Documentation
¶
Overview ¶
Package protected wraps listeners with best-effort peer-owner checks.
A protected listener accepts only connections whose peer owner matches at least one configured rule. Connections that do not match, or whose owner cannot be resolved, are closed internally and the listener continues waiting for the next connection.
The owner lookup is performed by sockowner pkg. That lookup is intentionally best-effort and race-prone: sockets can close, be reused, or be shared by multiple processes while ownership information is being resolved.
Username rules are resolved twice. Each username is resolved once when the protected listener is created, and again for every accepted connection. A username rule matches only when both resolutions return the same UID and the connection owner has that UID.
Index ¶
- func Listen(network, address string, rules Rules) (net.Listener, error)
- func ListenCtx(ctx context.Context, network, address string, rules Rules) (net.Listener, error)
- func NewListener(l net.Listener, rules Rules) (net.Listener, error)
- func NewTCPListener(l gonnect.TCPListener, rules Rules) (gonnect.TCPListener, error)
- type Listener
- type Rules
- type TCPListener
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Listen ¶
Listen announces on the local network address and returns a protected listener. Its network and address arguments match net.Listen.
func ListenCtx ¶
ListenCtx announces on the local network address and returns a protected listener. Its network and address arguments match net.Listen.
func NewListener ¶
NewListener wraps l with owner-based connection filtering.
func NewTCPListener ¶
func NewTCPListener( l gonnect.TCPListener, rules Rules, ) (gonnect.TCPListener, error)
NewTCPListener wraps l with owner-based TCP connection filtering.
Types ¶
type Listener ¶
Listener is a protected net.Listener wrapper.
func (*Listener) Accept ¶
Accept accepts the next connection whose owner matches the listener rules.
func (*Listener) GetWrapped ¶
GetWrapped returns the wrapped listener.
type Rules ¶
Rules controls which peer owners may connect to a protected listener.
A connection is accepted when at least one UID, GID, or username rule matches its resolved owner. Empty rules match nothing.
type TCPListener ¶
type TCPListener struct {
gonnect.TCPListener
// contains filtered or unexported fields
}
TCPListener is a protected gonnect.TCPListener wrapper.
func (*TCPListener) Accept ¶
func (l *TCPListener) Accept() (net.Conn, error)
Accept accepts the next TCP connection as a net.Conn.
func (*TCPListener) AcceptTCP ¶
func (l *TCPListener) AcceptTCP() (gonnect.TCPConn, error)
AcceptTCP accepts the next TCP connection whose owner matches the listener rules.
func (*TCPListener) GetWrapped ¶
func (l *TCPListener) GetWrapped() any
GetWrapped returns the wrapped TCP listener.
func (*TCPListener) SetDeadline ¶
func (l *TCPListener) SetDeadline(t time.Time) error
SetDeadline sets the deadline associated with the wrapped listener.
Source Files