Documentation
¶
Overview ¶
Package egresspolicy evaluates an Actor's EgressPolicy against a destination. ateapi validates patterns and CIDRs with the same parsers the gateway matches with, so the two cannot drift.
The package is pure: no I/O, no logging.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Decision ¶
type Decision struct {
// Allowed reports whether some rule authorized the destination.
Allowed bool
// RuleIndex is the index of the first matching rule in the policy, or -1
// when nothing matched.
RuleIndex int
// Effects are the effects of the matching rule, when it is a hostname
// rule that declares any. Nil otherwise.
Effects *ateapipb.EgressRuleEffects
// ByName reports that a hostname rule matched: the destination was
// authorized on its name, so the name is what to dial.
ByName bool
}
Decision is the outcome of evaluating a policy against a Destination.
type Destination ¶
type Destination struct {
// Hostname is the normalized DNS name: lowercase ASCII, no trailing dot.
// Empty when the destination was not named by a hostname.
Hostname string
// IP is the address that will be dialed, when known. Zero when unknown.
IP netip.Addr
// Port is the destination port, when known. Zero when unknown.
Port uint16
}
Destination is what a request or connection is going to, as far as the leg evaluating it can tell. A request the gateway can read has the Hostname it named, when that is a DNS name, and the IP the actor dialed, when the leg knows it; a connection has only IP and Port. A rule that needs a field the leg cannot supply never matches there.
func NormalizeAuthority ¶
func NormalizeAuthority(authority string) (Destination, error)
NormalizeAuthority turns an :authority or Host value into a Destination: port split off, IP literal to IP, DNS name lowercased with one trailing dot removed and checked as a DNS-1123 subdomain. Anything else is an error, and the caller should deny.
type HostnamePattern ¶
type HostnamePattern struct {
// contains filtered or unexported fields
}
HostnamePattern is one parsed HostnameRule pattern: an exact name, or a wildcard standing in for the whole leftmost label.
func ParseHostnamePattern ¶
func ParseHostnamePattern(raw string) (HostnamePattern, error)
ParseHostnamePattern parses a HostnameRule pattern. A pattern is a lowercase DNS-1123 subdomain, optionally prefixed with "*." to match exactly one non-empty leftmost label. IP literals, ports, URLs, trailing dots, and any other placement of "*" are rejected.
func (HostnamePattern) Matches ¶
func (p HostnamePattern) Matches(hostname string) bool
Matches reports whether hostname, already normalized as by NormalizeAuthority, matches the pattern. "*.example.com" matches "api.example.com" but neither "example.com" nor "a.b.example.com".
func (HostnamePattern) String ¶
func (p HostnamePattern) String() string
String returns the pattern in the form it was written.
type Policy ¶
type Policy struct {
// contains filtered or unexported fields
}
Policy is an EgressPolicy with its patterns and CIDRs parsed once, ready to be evaluated many times.
func Compile ¶
func Compile(policy *ateapipb.EgressPolicy) (*Policy, []error)
Compile parses every pattern and CIDR in policy. ateapi validates with the same parsers, so nothing should fail here; an entry that does (an older ateapi accepted it) is dropped and reported, which fails closed because it only narrows an allow rule. The Policy is always usable.
func (*Policy) Evaluate ¶
func (p *Policy) Evaluate(dest Destination) Decision
Evaluate walks the rules in order and returns the first that matches dest. Only that rule's effects apply; a request is denied when no rule matches.
func (*Policy) HasHostnameRules ¶
HasHostnameRules reports whether any rule can match a hostname. A decision point that sees only an address needs this before refusing a connection whose requests might still be allowed by name.
Source Files