proxy

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 21, 2026 License: Apache-2.0 Imports: 25 Imported by: 0

Documentation

Overview

proxy/mtls.go

Index

Constants

View Source 
const (
	EnvProxyTLSKey  = "VIBEPIT_PROXY_TLS_KEY"
	EnvProxyTLSCert = "VIBEPIT_PROXY_TLS_CERT"
	EnvProxyCACert  = "VIBEPIT_PROXY_CA_CERT"
)
View Source 
const (
	DefaultUpstreamDNS = "9.9.9.9:53"
	DefaultDNSPort     = 53
	LogBufferCapacity  = 10000
)
View Source 
const SSHForwardPort = 2222

SSHForwardPort is the port the SSH forwarder listens on inside the proxy container.

Variables

This section is empty.

Functions

func LoadServerTLSConfigFromEnv 

func LoadServerTLSConfigFromEnv() (*tls.Config, error)

LoadServerTLSConfigFromEnv reads PEM-encoded TLS material from environment variables and returns a tls.Config for the control API. Returns an error if any of the required env vars are missing — the control API must not start without mTLS.

func ValidateDNSEntries 

func ValidateDNSEntries(entries []string) error

ValidateDNSEntries validates all allow-dns entries and returns the first error.

func ValidateDNSEntry 

func ValidateDNSEntry(entry string) error

ValidateDNSEntry validates a single allow-dns entry. Entry format is a domain pattern without port.

func ValidateHTTPEntries 

func ValidateHTTPEntries(entries []string) error

ValidateHTTPEntries validates all entries and returns the first error.

func ValidateHTTPEntry 

func ValidateHTTPEntry(entry string) error

ValidateHTTPEntry validates a single allow-http entry. Entry format is "domain:port" where port is an exact number or '*'.

Types

type Action 

type Action string
const (
	ActionAllow Action = "allow"
	ActionBlock Action = "block"
)

type CIDRBlocker 

type CIDRBlocker struct {
	// contains filtered or unexported fields
}

func NewCIDRBlocker 

func NewCIDRBlocker(block, allow []string) *CIDRBlocker

func (*CIDRBlocker) IsAllowed added in v0.3.0 

func (b *CIDRBlocker) IsAllowed(ip net.IP) bool

func (*CIDRBlocker) IsBlocked 

func (b *CIDRBlocker) IsBlocked(ip net.IP) bool

type ControlAPI 

type ControlAPI struct {
	// contains filtered or unexported fields
}

ControlAPI serves proxy status and configuration over HTTP.

func NewControlAPI 

func NewControlAPI(log *LogBuffer, config any, httpAllowlist *HTTPAllowlist, dnsAllowlist *DNSAllowlist) *ControlAPI

func (*ControlAPI) ServeHTTP 

func (a *ControlAPI) ServeHTTP(w http.ResponseWriter, r *http.Request)

type DNSAllowlist 

type DNSAllowlist struct {
	// contains filtered or unexported fields
}

DNSAllowlist holds parsed DNS allow rules. Safe for concurrent use.

func NewDNSAllowlist 

func NewDNSAllowlist(entries []string) (*DNSAllowlist, error)

NewDNSAllowlist parses allow-dns entries (bare domains, no ports).

func (*DNSAllowlist) Add 

func (al *DNSAllowlist) Add(entries []string) error

Add parses new DNS entries and appends them atomically.

func (*DNSAllowlist) Allows 

func (al *DNSAllowlist) Allows(host string) bool

Allows checks whether a domain is permitted for DNS resolution.

type DNSRule 

type DNSRule struct {
	Domain domainPattern
}

DNSRule represents a parsed allow-dns entry with a domain pattern.

type DNSServer 

type DNSServer struct {
	// contains filtered or unexported fields
}

DNSServer is a filtering DNS server that checks queries against an allowlist and verifies resolved IPs against a CIDR blocklist.

func NewDNSServer 

func NewDNSServer(allowlist *DNSAllowlist, cidr *CIDRBlocker, log *LogBuffer, upstream string) *DNSServer

func (*DNSServer) ListenAndServe 

func (s *DNSServer) ListenAndServe(addr string) error

ListenAndServe starts the DNS server on the given address (e.g. ":53").

func (*DNSServer) ListenAndServeTest 

func (s *DNSServer) ListenAndServeTest() (string, func())

ListenAndServeTest starts a UDP DNS server on a random port for testing. Returns the address and a cleanup function.

func (*DNSServer) SetProxyIP 

func (s *DNSServer) SetProxyIP(ip net.IP)

SetProxyIP sets the IP address that host.vibepit will resolve to.

type DomainStats 

type DomainStats struct {
	Allowed int `json:"allowed"`
	Blocked int `json:"blocked"`
}

type HTTPAllowlist 

type HTTPAllowlist struct {
	// contains filtered or unexported fields
}

HTTPAllowlist holds parsed HTTP allow rules. Safe for concurrent use.

func NewHTTPAllowlist 

func NewHTTPAllowlist(entries []string) (*HTTPAllowlist, error)

NewHTTPAllowlist parses allow-http entries into an HTTPAllowlist. Each entry must be "domain:port" (e.g. "github.com:443", "*.example.com:*").

func (*HTTPAllowlist) Add 

func (al *HTTPAllowlist) Add(entries []string) error

Add parses new entries and appends them atomically.

func (*HTTPAllowlist) Allows 

func (al *HTTPAllowlist) Allows(host, port string) bool

Allows checks whether a host:port pair is permitted.

type HTTPProxy 

type HTTPProxy struct {
	// contains filtered or unexported fields
}

HTTPProxy is a filtering HTTP/HTTPS proxy that uses an allowlist and CIDR blocker to decide whether to forward or reject each request.

func NewHTTPProxy 

func NewHTTPProxy(allowlist *HTTPAllowlist, cidr *CIDRBlocker, log *LogBuffer, upstream string) *HTTPProxy

func (*HTTPProxy) Handler 

func (p *HTTPProxy) Handler() http.Handler

func (*HTTPProxy) SetHostVibepit 

func (p *HTTPProxy) SetHostVibepit(gateway string, allowedPorts []int)

SetHostVibepit configures the proxy to rewrite host.vibepit requests to the given gateway address. If allowedPorts is non-nil, only those ports are auto-allowed without requiring an explicit allowlist entry.

type HTTPRule 

type HTTPRule struct {
	Domain domainPattern
	Port   string
}

HTTPRule represents a parsed allow-http entry with a domain pattern and port.

type LogBuffer 

type LogBuffer struct {
	// contains filtered or unexported fields
}

func NewLogBuffer 

func NewLogBuffer(capacity int) *LogBuffer

func (*LogBuffer) Add 

func (b *LogBuffer) Add(entry LogEntry)

func (*LogBuffer) Entries 

func (b *LogBuffer) Entries() []LogEntry

func (*LogBuffer) EntriesAfter 

func (b *LogBuffer) EntriesAfter(afterID uint64) []LogEntry

EntriesAfter returns entries with ID > afterID in chronological order. When afterID is 0, it returns at most the last 25 entries.

func (*LogBuffer) Stats 

func (b *LogBuffer) Stats() map[string]DomainStats

type LogEntry 

type LogEntry struct {
	ID     uint64    `json:"id"`
	Time   time.Time `json:"time"`
	Domain string    `json:"domain"`
	Port   string    `json:"port,omitempty"`
	Action Action    `json:"action"`
	Source Source    `json:"source"`
	Reason string    `json:"reason,omitempty"`
}

type MTLSCredentials 

type MTLSCredentials struct {
	CACert *x509.Certificate

	ServerCert *x509.Certificate

	ClientCert *x509.Certificate
	// contains filtered or unexported fields
}

MTLSCredentials holds the ephemeral CA, server, and client certificates generated for a single vibepit session. The CA private key is not stored after signing — only the public cert is retained for verification.

func GenerateMTLSCredentials 

func GenerateMTLSCredentials(lifetime time.Duration) (*MTLSCredentials, error)

GenerateMTLSCredentials creates an ephemeral CA and signs a server cert (SAN: 127.0.0.1, EKU: serverAuth) and a client cert (EKU: clientAuth). The CA private key is discarded after signing.

func (*MTLSCredentials) CACertPEM 

func (c *MTLSCredentials) CACertPEM() []byte

func (*MTLSCredentials) ClientCertPEM 

func (c *MTLSCredentials) ClientCertPEM() []byte

func (*MTLSCredentials) ClientKeyPEM 

func (c *MTLSCredentials) ClientKeyPEM() []byte

func (*MTLSCredentials) ClientTLSConfig 

func (c *MTLSCredentials) ClientTLSConfig() (*tls.Config, error)

ClientTLSConfig returns a tls.Config for CLI commands calling the control API. It pins the ephemeral CA as the only trusted root and presents the client cert.

func (*MTLSCredentials) ServerCertPEM 

func (c *MTLSCredentials) ServerCertPEM() []byte

func (*MTLSCredentials) ServerKeyPEM 

func (c *MTLSCredentials) ServerKeyPEM() []byte

func (*MTLSCredentials) ServerTLSConfig 

func (c *MTLSCredentials) ServerTLSConfig() (*tls.Config, error)

ServerTLSConfig returns a tls.Config for the proxy control API server. It requires TLS 1.3 and verifies client certificates against the ephemeral CA.

type Preset 

type Preset struct {
	Name        string   `yaml:"name"`
	Group       string   `yaml:"group"`
	Description string   `yaml:"description"`
	Domains     []string `yaml:"domains"`
	Matchers    []string `yaml:"matchers"` // file glob patterns for project auto-detection
	Includes    []string `yaml:"includes"` // other preset names (meta-presets)
}

Preset defines a network allowlist preset with optional auto-detection matchers and the ability to include other presets.

type PresetRegistry 

type PresetRegistry struct {
	// contains filtered or unexported fields
}

PresetRegistry holds all built-in presets in definition order.

func NewPresetRegistry 

func NewPresetRegistry() *PresetRegistry

NewPresetRegistry returns the built-in preset registry.

func (*PresetRegistry) All 

func (r *PresetRegistry) All() []Preset

All returns all presets in definition order.

func (*PresetRegistry) Expand 

func (r *PresetRegistry) Expand(names []string) []string

Expand resolves a list of preset names into a deduplicated flat list of domains, recursively expanding Includes with cycle detection.

func (*PresetRegistry) Get 

func (r *PresetRegistry) Get(name string) (Preset, bool)

Get returns a preset by name.

type ProxyConfig 

type ProxyConfig struct {
	AllowHTTP      []string `json:"allow-http"`
	AllowDNS       []string `json:"allow-dns"`
	BlockCIDR      []string `json:"block-cidr"`
	AllowCIDR      []string `json:"allow-cidr"`
	UpstreamDNS    string   `json:"upstream-dns"`
	AllowHostPorts []int    `json:"allow-host-ports"`
	ProxyIP        string   `json:"proxy-ip"`
	HostGateway    string   `json:"host-gateway"`
	ProxyPort      int      `json:"proxy-port"`
	ControlAPIPort int      `json:"control-api-port"`
	DNSPort        int      `json:"dns-port"`
	SSHForwardAddr string   `json:"ssh-forward-addr,omitempty"`
}

ProxyConfig is the JSON config file passed to the proxy container.

type Server 

type Server struct {
	// contains filtered or unexported fields
}

Server runs the HTTP proxy, DNS server, and control API.

func NewServer 

func NewServer(configPath string) (*Server, error)

func (*Server) Run 

func (s *Server) Run(ctx context.Context) error

type Source 

type Source string
const (
	SourceProxy Source = "proxy"
	SourceDNS   Source = "dns"
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.