outbound

func GuardOperatorTargetBinding ¶ added in v0.2.3

func GuardOperatorTargetBinding(baseRaw, targetRaw string) error

GuardOperatorTargetBinding requires target to stay on the exact origin and below the secret-bearing base path selected for this invocation. It does not replace GuardOperatorURL's DNS and address checks; the broker applies both.

func GuardOperatorURL ¶ added in v0.2.3

func GuardOperatorURL(raw string) error

GuardOperatorURL validates an operator-selected API endpoint. Unlike GuardURL it deliberately permits private and loopback HTTPS destinations; cleartext HTTP is restricted to loopback. Secret-bearing endpoints must keep credentials out of authority/query/fragment and use a non-root path.

func GuardURL ¶

func GuardURL(raw string) error

GuardURL rejects outbound HTTP(S) targets that point at local, private, link-local, multicast, unspecified, or cloud metadata addresses.

func NewClient ¶

func NewClient(timeout time.Duration) *http.Client

NewClient returns an HTTP client for operator-configured outbound webhooks. It validates both the requested URL and the actual dial target so DNS rebinding and redirects cannot turn an allowed hostname into an internal-address request.

func NewOperatorClient ¶ added in v0.2.3

func NewOperatorClient(timeout time.Duration) *http.Client

NewOperatorClient permits an explicitly operator-selected private service target while preserving scheme, URL-shape, redirect, DNS, and dial checks. It is intentionally separate from NewClient: callers need a stronger, system-only capability to use it.

func NewOperatorTransport ¶ added in v0.2.3

func NewOperatorTransport() http.RoundTripper

NewOperatorTransport allows private and loopback HTTPS destinations, and loopback-only HTTP, while still rejecting the unspecified address, every link-local and multicast class, the broadcast address, and the cloud metadata address at both URL validation and dial time.

It does NOT apply blockedSpecialUsePrefixes, and that is deliberate rather than an oversight: this client exists to reach an endpoint an operator named on purpose, and 100.64.0.0/10 is a real address range for a service behind carrier NAT. The documentation and benchmarking ranges in that list are not blocked here either, because nothing sensitive answers on them - blocking them would only cost a confusing failure for someone testing against TEST-NET. The confinement that matters for this client is elsewhere: the caller needs a system-only capability, and the target must sit under a base URL bound to the invocation (see GuardOperatorTargetBinding).

func NewTransport ¶

func NewTransport() http.RoundTripper

NewTransport returns a guarded transport with proxy support disabled. Letting arbitrary environment proxies handle webhook traffic would let a proxy reach networks the local guard intentionally blocks.

func ResolveAllowed ¶ added in v0.2.3

func ResolveAllowed(ctx context.Context, host, port string) ([]string, error)

ResolveAllowed resolves host to the host:port addresses a raw dial may use, refusing the same address classes GuardURL refuses (loopback, private, link-local, multicast, the metadata endpoint). It is the policy for any server-side dial that is not an HTTP request through NewClient.