Documentation
¶
Overview ¶
Package netguard builds HTTP clients for user-configured outbound URLs (alert and deploy notification webhooks) that refuse to connect to loopback, private, link-local, or otherwise internal addresses.
Index ¶
Constants ¶
const AllowPrivateEnv = "APP_NOTIFY_ALLOW_PRIVATE_NETWORKS"
AllowPrivateEnv names the env var that, when true, lets outbound notification requests reach internal addresses (for example a self-hosted chat server on a private IP).
Variables ¶
var ErrBlockedAddress = errors.New("netguard: destination address is internal and not allowed")
ErrBlockedAddress is returned when a dial targets an internal address while AllowPrivateEnv is not enabled.
var ErrInvalidURL = errors.New("netguard: not an absolute http or https URL")
ErrInvalidURL is returned by ValidateURL for a URL that is not an absolute http(s) URL with a host.
Functions ¶
func AllowPrivate ¶
func AllowPrivate() bool
AllowPrivate reports whether AllowPrivateEnv is set to a true value.
func IsBlocked ¶
IsBlocked reports whether addr is an address an outbound notification must not reach unless AllowPrivateEnv is enabled.
func NewClient ¶
NewClient returns an HTTP client whose every connection, including redirects, is refused when it targets an internal address. It ignores HTTP(S)_PROXY, since a proxy would dial the destination on our behalf and bypass the check.
func NewClientAllowing ¶
NewClientAllowing is NewClient with its own opt-in env vars, so one feature can allow private addresses without relaxing the others. The first name is the one shown in the refusal message.
func ValidateURL ¶
ValidateURL rejects, at configuration time, a URL every later send would refuse: a non-http(s) URL, a loopback or private IP literal, localhost, or a hostname whose every resolved address is internal. A hostname that does not resolve here is accepted, since resolution can differ at send time.
Types ¶
This section is empty.
Source Files