Documentation
¶
Overview ¶
Package sslbypass is the SSL-inspection bypass matcher: a runtime-managed list of host patterns (FQDN globs via hostutil.MatchFQDN semantics, or "~"-prefixed regexes) that must always bypass SSL inspection regardless of what the PBAC policy says, with pre-compiled matching and JSON file persistence. Extracted from package main's policy.go per ADR-0002 (policy.go decomposition Phase B).
package main keeps the surfaces: the `sslBypass` singleton, the /api/ssl-bypass handlers, the inspection-rules startup slice, cluster sync, and config-version rollback — all through aliases. Matches sits on the per-CONNECT hot path (resolveSSLAction).
Index ¶
- type Matcher
- func (m *Matcher) Add(p string) error
- func (m *Matcher) List() []string
- func (m *Matcher) Load(path string) error
- func (m *Matcher) Matches(host string) bool
- func (m *Matcher) Path() string
- func (m *Matcher) Remove(p string) bool
- func (m *Matcher) Save()
- func (m *Matcher) Set(patterns []string) error
- func (m *Matcher) SetPathForTest(path string)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Matcher ¶
type Matcher struct {
// contains filtered or unexported fields
}
Matcher holds a list of host patterns that must always bypass SSL inspection, regardless of what the PBAC policy says. Patterns are managed at runtime via /api/ssl-bypass and persisted to a JSON file so they survive restarts without modifying config.yaml. The zero value is a valid empty matcher.
func (*Matcher) Load ¶
Load reads bypass patterns from a JSON file (array of strings). A missing file is treated as an empty list (not an error). Sets the persistence path so subsequent Save() calls write to this file.
func (*Matcher) Matches ¶
Matches reports whether host matches any configured bypass pattern. Glob patterns follow hostutil.MatchFQDN semantics ("*.co.il" matches "www.co.il"). Regex patterns (prefix "~") are matched against the lower-cased bare host.
func (*Matcher) Save ¶
func (m *Matcher) Save()
Save atomically persists the current patterns to the configured JSON file. A temporary file + rename ensures a crash mid-write never corrupts the list.
func (*Matcher) SetPathForTest ¶
SetPathForTest points persistence at path without loading.
Source Files