Documentation
¶
Overview ¶
Package reachability checks which listening ports a host serves locally and, only when the operator opts in, which of them the internet can reach.
Index ¶
Constants ¶
const ( DialbackTimeout = 8 * time.Second DialbackMaxResponseBytes = 64 << 10 DialbackMaxPorts = 16 LocalDialTimeout = 1500 * time.Millisecond )
Limits for the optional dial-back request.
const ( ExternalNotChecked = "not_checked" ExternalReachable = "reachable" ExternalUnreachable = "unreachable" ExternalUnknown = "unknown" )
Verdicts for one port seen from outside.
Variables ¶
var ErrDialbackURL = errors.New("dial-back url refused")
ErrDialbackURL is returned for a dial-back URL that must not be contacted.
Functions ¶
func ApplyDialback ¶
func ApplyDialback(rs []PortReport, res DialbackResult)
ApplyDialback folds a dial-back answer into the per-port reports.
func ExposablePorts ¶
func ExposablePorts(rs []PortReport) []int
ExposablePorts lists the ports worth asking a dial-back service about.
Types ¶
type DialbackOptions ¶
type DialbackOptions struct {
AllowPrivate bool
Client *http.Client
Resolve func(ctx context.Context, host string) ([]netip.Addr, error)
}
DialbackOptions tunes a dial-back call. Client nil builds the SSRF-safe default.
type DialbackResult ¶
type DialbackResult struct {
Reachable []int `json:"reachable"`
Unreachable []int `json:"unreachable"`
}
DialbackResult is the service answer.
func Dialback ¶
func Dialback(ctx context.Context, rawURL string, ports []int, opt DialbackOptions) (DialbackResult, error)
Dialback POSTs {ports:[...]} to rawURL. An empty URL contacts nothing.
type Dialer ¶
type Dialer interface {
DialContext(ctx context.Context, network, address string) (net.Conn, error)
}
Dialer is the seam for local port probes.
type PortReport ¶
type PortReport struct {
Target
Listening bool `json:"listening"`
Probes []Probe `json:"probes"`
External string `json:"external"`
Advice string `json:"advice,omitempty"`
}
PortReport is the result for one target.
func ProbeLocal ¶
ProbeLocal dials 127.0.0.1 and the primary interface address (when known) for each target.
func (PortReport) Exposable ¶
func (p PortReport) Exposable() bool
Exposable reports whether the port should be reachable from outside the host.
Source Files