Documentation
¶
Overview ¶
Package egresswire is the pure wire framing shared by the two ends of the compute egress data path: the in-Sentry forwarder (pkg/sandbox/sentrystack/ egressfwd) writes the preamble, and the host egress bridge (pkg/workerd/host) reads it. It is a leaf package with NO build tag and NO init() side effect, so importing it to encode/decode a preamble never arms the forwarder — that stays an explicit opt-in via a blank import of egressfwd. Keeping the codec here (not in egressfwd) is what preserves that opt-in contract: the host bridge needs the reader, not the installer.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ReadEgressPreamble ¶
ReadEgressPreamble reads and parses the announcement written by WriteEgressPreamble. On success r is positioned at the first byte after the newline, so the caller can splice the remainder as the raw stream. dstName is "" when the forwarder emitted no hostname (literal-IP flow or DNS-cache miss).
func ReadEgressVerdict ¶
ReadEgressVerdict reads the verdict written by WriteEgressVerdict. On an allow verdict r is positioned at the first upstream byte, so the caller can splice the remainder as the raw stream. Any error — including a short read from a bridge that closed without answering — must be treated as a deny by the caller (fail closed).
func WriteEgressPreamble ¶
WriteEgressPreamble writes the one-line (src, dst[, dstName]) announcement onto w. Both addresses are the sandbox-visible tuple verbatim, so a v4 dst carries a v4 src and a v6 dst a v6 src. dstName is the hostname the worker resolved dst from (from the Sentry DNS-answer cache), or "" when unknown.
Both src and dst are validated: an invalid AddrPort stringifies to "invalid AddrPort" (which contains a space), so emitting it would produce a preamble line that ReadEgressPreamble rejects as malformed for a reason unrelated to the real bug. Failing here surfaces the malformed address at the forwarder's dial with a clear error instead. dstName is likewise rejected if it contains whitespace, since the line is whitespace-delimited.
func WriteEgressVerdict ¶
WriteEgressVerdict writes the bridge's one-byte policy verdict for the flow announced by the preceding preamble. The forwarder reads it before completing the guest's TCP handshake: deny (or any read failure, which fails closed) refuses the SYN with an RST without allocating a netstack endpoint.
Types ¶
This section is empty.
Source Files