proxy

package
v0.4.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 21, 2026 License: Apache-2.0 Imports: 47 Imported by: 0

Documentation

Overview

Package proxy provides proxy functionality for CheeseWAF.

Index

Constants

This section is empty.

Variables

View Source 
var ErrNoUpstream = errors.New("no upstream available")

Functions

func HTTP3AltSvcValue 

func HTTP3AltSvcValue(addr string) (string, error)

func HTTP3ListenAddr 

func HTTP3ListenAddr(cfg config.ServerConfig) string

func HasCertificate 

func HasCertificate(cfg config.TLSConfig) bool

func IsWebSocketUpgrade 

func IsWebSocketUpgrade(r *http.Request) bool

func ListenAndServe 

func ListenAndServe(ctx context.Context, srv *http.Server) error

func ListenAndServeHTTP3 

func ListenAndServeHTTP3(ctx context.Context, srv *http3.Server) error

func NewReverseProxy 

func NewReverseProxy(target *url.URL, timeout time.Duration) *httputil.ReverseProxy

func NewReverseProxyForClient 

func NewReverseProxyForClient(target *url.URL, timeout time.Duration, clientIP string) *httputil.ReverseProxy

NewReverseProxyForClient rebuilds upstream forwarding headers from the client identity already validated by the proxy trust policy.

func NewReverseProxyForSite added in v0.4.5 

func NewReverseProxyForSite(target *url.URL, timeout time.Duration, clientIP string, originScheme string, passHost bool, hostHeader string) *httputil.ReverseProxy

NewReverseProxyForSite applies the site's origin transport and Host policy. Site configuration is kept separate from the request-facing forwarding identity so a saved per-site origin setting cannot be silently ignored.

func TLSConfig 

func TLSConfig(cfg config.TLSConfig) (*tls.Config, error)

Types

type HealthChecker 

type HealthChecker struct {
	// contains filtered or unexported fields
}

func NewHealthChecker 

func NewHealthChecker(sites []config.SiteConfig, registry *HealthRegistry) *HealthChecker

func (*HealthChecker) Start 

func (h *HealthChecker) Start(ctx context.Context)

func (*HealthChecker) UpdateSites 

func (h *HealthChecker) UpdateSites(sites []config.SiteConfig)

UpdateSites replaces the checker generation after the previous loops exit.

type HealthRegistry 

type HealthRegistry struct {
	// contains filtered or unexported fields
}

func NewHealthRegistry 

func NewHealthRegistry(sites []config.SiteConfig) *HealthRegistry

func (*HealthRegistry) Healthy 

func (r *HealthRegistry) Healthy(address string) bool

func (*HealthRegistry) HealthyForSite added in v0.4.5 

func (r *HealthRegistry) HealthyForSite(siteID, address string) bool

func (*HealthRegistry) Set 

func (r *HealthRegistry) Set(address string, healthy bool)

func (*HealthRegistry) SetForSite added in v0.4.5 

func (r *HealthRegistry) SetForSite(siteID, address string, healthy bool)

func (*HealthRegistry) Snapshot 

func (r *HealthRegistry) Snapshot() map[string]bool

func (*HealthRegistry) UpdateSites 

func (r *HealthRegistry) UpdateSites(sites []config.SiteConfig)

UpdateSites updates the registry in place so users retain one source of truth.

type LoadBalancer 

type LoadBalancer struct {
	// contains filtered or unexported fields
}

func NewLoadBalancer 

func NewLoadBalancer(sites []config.SiteConfig) *LoadBalancer

func (*LoadBalancer) Next 

func (lb *LoadBalancer) Next(site config.SiteConfig, clientIP string) (*url.URL, error)

func (*LoadBalancer) SiteForHost 

func (lb *LoadBalancer) SiteForHost(host string) config.SiteConfig

SiteForHost returns the enabled site whose Domains contain host (port stripped). When no site matches, it returns an empty SiteConfig (ID == "") so callers can reject the request instead of falling back to another tenant's site.

func (*LoadBalancer) Track 

func (lb *LoadBalancer) Track(target *url.URL) func()

Track records one in-flight request for least_conn. The returned function must be called exactly once when the attempt finishes.

func (*LoadBalancer) UpdateSites 

func (lb *LoadBalancer) UpdateSites(sites []config.SiteConfig, health *HealthRegistry)

func (*LoadBalancer) WithHealth 

func (lb *LoadBalancer) WithHealth(health *HealthRegistry) *LoadBalancer

type ReviewQueue 

type ReviewQueue interface {
	Enqueue(ctx context.Context, item *storage.ReviewItem)
}

ReviewQueue receives detections that were not blocked, and level-5 blocks that still need a model verdict.

type RewriteRule 

type RewriteRule struct {
	ID           string
	Pattern      *regexp.Regexp
	Replacement  string
	RedirectCode int
}

type Rewriter 

type Rewriter struct {
	// contains filtered or unexported fields
}

func NewRewriter 

func NewRewriter(items []config.RewriteRuleConfig) (*Rewriter, error)

func (*Rewriter) Apply 

func (r *Rewriter) Apply(req *http.Request) (redirect bool, code int)

type Server 

type Server struct {
	// contains filtered or unexported fields
}

func NewServer 

func NewServer(cfg *config.Config, pipeline *engine.Pipeline, sink storage.LogSink) (*Server, error)

func NewServerWithClock 

func NewServerWithClock(cfg *config.Config, pipeline *engine.Pipeline, sink storage.LogSink, clock timekeeper.Clock) (*Server, error)

func (*Server) Close 

func (s *Server) Close() error

Close releases runtime resources after in-flight requests have exited.

func (*Server) HTTP3Server 

func (s *Server) HTTP3Server() (*http3.Server, string, error)

func (*Server) HTTPServer 

func (s *Server) HTTPServer() *http.Server

func (*Server) Handler 

func (s *Server) Handler() http.Handler

func (*Server) HealthRegistry 

func (s *Server) HealthRegistry() *HealthRegistry

func (*Server) SetPromoteStore 

func (s *Server) SetPromoteStore(store storage.Store)

func (*Server) SetReviewQueue 

func (s *Server) SetReviewQueue(queue ReviewQueue)

func (*Server) TLSServer 

func (s *Server) TLSServer(altSvc string) (*http.Server, error)

func (*Server) UpdateAPISec 

func (s *Server) UpdateAPISec(apiSec config.APISecConfig) error

func (*Server) UpdateBlockPage 

func (s *Server) UpdateBlockPage(page config.BlockPageConfig) error

func (*Server) UpdateCAPTCHAProviders added in v0.4.5 

func (s *Server) UpdateCAPTCHAProviders(providers config.CAPTCHAProvidersConfig) error

func (*Server) UpdateEdge 

func (s *Server) UpdateEdge(cfg config.EdgeConfig) error

UpdateEdge atomically replaces all request-time Edge components.

func (*Server) UpdatePipeline 

func (s *Server) UpdatePipeline(pipeline *engine.Pipeline)

func (*Server) UpdateProtection 

func (s *Server) UpdateProtection(protection config.ProtectionConfig) error

func (*Server) UpdateSites 

func (s *Server) UpdateSites(sites []config.SiteConfig) error

UpdateSites refreshes site routing and certificates. Certificate load errors are returned so callers can roll back instead of reporting success with a stale cert.

type SiteCertificateStore 

type SiteCertificateStore struct {
	// contains filtered or unexported fields
}

func NewSiteCertificateStore 

func NewSiteCertificateStore(cfg *config.Config) (*SiteCertificateStore, error)

func (*SiteCertificateStore) GetCertificate 

func (s *SiteCertificateStore) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)

func (*SiteCertificateStore) HasCertificate 

func (s *SiteCertificateStore) HasCertificate() bool

func (*SiteCertificateStore) TLSConfig 

func (s *SiteCertificateStore) TLSConfig(cfg config.TLSConfig) *tls.Config

func (*SiteCertificateStore) Update 

func (s *SiteCertificateStore) Update(cfg *config.Config) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.