Documentation
¶
Overview ¶
Package netguard keeps HTTP requests to addresses chosen by users (webhook URLs, ntfy servers) away from the server's own machine and network. Any member can add a destination, so without it a URL such as http://169.254.169.254/ would let them read cloud credentials through Exhale (server-side request forgery).
The rules: http and https only; loopback, link-local and cloud-metadata addresses are never reachable; private networks only when the owner allows them. The check runs when a connection is opened, on the address actually dialed, so a DNS name that changes its answer or a redirect cannot get around it.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrBlocked = errors.New("destination not allowed")
ErrBlocked marks a destination refused by the rules (as opposed to one that could not be reached).
Functions ¶
Types ¶
type Guard ¶
type Guard struct {
// AllowPrivate reports whether private-network addresses (10/8,
// 192.168/16, fc00::/7…) may be reached right now. Nil means no.
AllowPrivate func(ctx context.Context) bool
// Resolver defaults to net.DefaultResolver.
Resolver Resolver
// Dial opens the connection to an address that already passed the
// rules. It defaults to a net.Dialer; tests replace it.
Dial func(ctx context.Context, network, addr string) (net.Conn, error)
}
Guard applies the rules. The zero value refuses private networks and uses the system resolver.
func (*Guard) CheckURL ¶
CheckURL validates an address a user typed: a well-formed http or https URL whose host passes the rules today. It returns the parsed URL.
func (*Guard) Client ¶
Client returns an HTTP client for user-chosen addresses. It does not follow redirects: the response of the address the user gave is the answer.
func (*Guard) DialContext ¶
DialContext resolves the host itself, checks every address and connects to the checked address (never back to the name).
Source Files