Documentation
¶
Overview ¶
Package peer checks who is on the other end of a local Unix socket. The kernel reports the peer's user, so a process cannot claim to be someone else the way it could with a token or a header.
Index ¶
- func ConnContext(ctx context.Context, c net.Conn) context.Context
- func Require(policy Policy, log *slog.Logger, next http.Handler) http.Handler
- func RequireRoutes(policy Policy, log *slog.Logger, mux *http.ServeMux) http.Handler
- func WithPeer(ctx context.Context, p Peer) context.Context
- type Peer
- type Policy
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ConnContext ¶
ConnContext is meant for http.Server.ConnContext. It records the peer when a connection is accepted. If the credentials cannot be read no peer is stored, and every request on that connection is refused.
func RequireRoutes ¶ added in v0.7.0
RequireRoutes is Require for a mux, and lets the users of Policy.Routes through to their own routes.
Types ¶
type Policy ¶
type Policy struct {
UIDs []uint32
// Routes holds users that may use some routes only, by the pattern the
// route was registered with, such as "GET /v1/host". A user in UIDs may
// use every route, whatever is listed here.
Routes map[uint32][]string
}
Policy lists the users allowed in. Root is always allowed.
Source Files
Click to show internal directories.
Click to hide internal directories.