Documentation
¶
Overview ¶
Package egresspolicy evaluates an Actor's EgressPolicy against a destination. ateapi validates patterns with the same parser the gateway matches with, so the two cannot drift.
Requests are decided here; TLS connections are decided by the dataplane against SNIRules.
The package is pure: no I/O, no logging.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Decision ¶
type Decision struct {
// Allowed reports whether some rule authorized the destination.
Allowed bool
// RuleIndex is the index of the deciding rule in the policy, or -1 when
// nothing matched.
RuleIndex int
// Effects are the effects of the deciding rule, when it declares any.
// Nil otherwise.
Effects *ateapipb.HttpRuleEffects
}
Decision is the outcome of evaluating a policy against a Destination.
type Destination ¶
type Destination struct {
// Hostname is the normalized DNS name: lowercase ASCII, no trailing dot.
// Empty when the destination was not named by a hostname.
Hostname string
// IP is the address named instead of a hostname, when it was. Only the
// "*" pattern matches it.
IP netip.Addr
// Port is the port the actor dialed, when the leg knows it. Zero when it
// does not, in which case a rule's ports are not enforced. A port in a
// request's authority is not this.
Port uint16
}
Destination is what a request is going to, as far as the leg evaluating it can tell: the Hostname it named, or the IP when it named a literal, and the port the actor dialed.
func NormalizeAuthority ¶
func NormalizeAuthority(authority string) (Destination, error)
NormalizeAuthority turns an :authority or Host value into a Destination: port split off, IP literal to IP, DNS name lowercased with one trailing dot removed and checked as a DNS-1123 subdomain. Anything else is an error, and the caller should deny.
type HostnamePattern ¶
type HostnamePattern struct {
// contains filtered or unexported fields
}
HostnamePattern is one parsed host or SNI pattern: an exact name, a wildcard standing in for the whole leftmost label, or "*" for every name and every address.
func ParseHostnamePattern ¶
func ParseHostnamePattern(raw string) (HostnamePattern, error)
ParseHostnamePattern parses a host or SNI pattern. A pattern is a lowercase DNS-1123 subdomain, optionally prefixed with "*." to match exactly one non-empty leftmost label, or "*" alone to match every name. IP literals, ports, URLs, trailing dots, and any other placement of "*" are rejected.
func (HostnamePattern) Matches ¶
func (p HostnamePattern) Matches(hostname string) bool
Matches reports whether hostname, already normalized as by NormalizeAuthority, matches the pattern. "*.example.com" matches "api.example.com" but neither "example.com" nor "a.b.example.com"; "*" matches every name.
func (HostnamePattern) String ¶
func (p HostnamePattern) String() string
String returns the pattern in the form it was written.
type Policy ¶
type Policy struct {
// contains filtered or unexported fields
}
Policy is an EgressPolicy with its patterns and ports parsed once, ready to be evaluated many times.
func Compile ¶
func Compile(policy *ateapipb.EgressPolicy) (*Policy, []error)
Compile parses every pattern and port in policy. ateapi validates the same way, so nothing should fail here; an entry that does (an older ateapi accepted it) is dropped and reported, which fails closed because it only narrows an allow rule. The Policy is always usable.
func (*Policy) EvaluateRequest ¶ added in v0.3.0
func (p *Policy) EvaluateRequest(dest Destination, decrypted bool) Decision
EvaluateRequest decides one request the gateway can read, on the name or address in its authority and the port the actor dialed. decrypted selects the https rules, for a request the gateway terminated TLS for; otherwise the http rules apply. A tls_passthrough rule never decides a request.
Source Files