Documentation
¶
Overview ¶
Package netguard holds the shared loopback listen-address guard.
Extracted 2026-07-17 from cmd/local-agent (validateListenAddr) for fleet-serve; behavior identical. Both unauthenticated HTTP servers (local-agent's OpenAI shim and fleet-serve) refuse to bind beyond loopback unless the operator explicitly opts into a trusted network.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Validate ¶
Validate refuses any listen host that is not loopback. The servers using it are UNAUTHENTICATED by design, so binding beyond loopback exposes an RCE-class surface to the local network — a footgun for anyone publishing this repo.
Empty-host forms ("", ":18800") are treated as non-loopback: Go's net.Listen binds ALL interfaces when the host is empty, so they are exactly as exposed as "0.0.0.0" and must be refused too. Bracketed IPv6 ("[::1]") is handled by net.SplitHostPort, which strips the brackets; we also accept a bare "[::1]" host defensively in case brackets survive.
allowNonLocal (from --listen-trusted-network) overrides the refusal; the loud warning is the caller's responsibility, not the validator's — this stays a pure, side-effect-free function so it is trivial to test.
Types ¶
This section is empty.
Source Files