Documentation
¶
Overview ¶
Package netguard restricts the network destinations the cloud-backup subsystem is allowed to connect to, mitigating server-side request forgery (SSRF). Backup destinations (S3 endpoint, WebDAV base URL, SFTP host) are fully user-controlled, so without a guard an authenticated user could point a destination at cloud metadata (169.254.169.254), loopback, or other internal services and use the connection result to probe the internal network.
The guard is applied as a net.Dialer Control hook, which runs against the concrete IP that will actually be dialed *after* DNS resolution. That closes the DNS-rebinding hole where a hostname resolves to a public address during validation and a private one at connect time.
Index ¶
- Constants
- type Guard
- func (g *Guard) Allowed(ip net.IP) bool
- func (g *Guard) Control(network, address string, _ syscall.RawConn) error
- func (g *Guard) DialContext(ctx context.Context, network, addr string) (net.Conn, error)
- func (g *Guard) Dialer(timeout time.Duration) *net.Dialer
- func (g *Guard) HTTPClient(timeout time.Duration) *http.Client
- func (g *Guard) HTTPTransport() *http.Transport
Constants ¶
const AllowPrivateNetworksEnv = "BACKUP_ALLOW_PRIVATE_NETWORKS"
AllowPrivateNetworksEnv, when set to "true", permits connections to RFC-1918 / unique-local / CGNAT ranges. This is the opt-in switch for self-hosted deployments that legitimately back up to a NAS on the local network. Loopback, link-local (including cloud metadata), unspecified, and multicast addresses are always blocked regardless of this setting.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Guard ¶
type Guard struct {
// contains filtered or unexported fields
}
Guard decides whether a connection to a resolved IP is permitted.
func FromEnv ¶
func FromEnv() *Guard
FromEnv builds a Guard from AllowPrivateNetworksEnv. Private networks are blocked unless the variable is explicitly set to "true".
func New ¶
New returns a Guard. When allowPrivate is true, private/ULA/CGNAT ranges are permitted (loopback, link-local, unspecified, and multicast are always blocked).
func (*Guard) Control ¶
Control is a net.Dialer Control hook. It rejects the connection if the resolved address is a blocked destination. address is "ip:port".
func (*Guard) DialContext ¶
DialContext is a guarded dial function suitable for SFTP and any other caller that dials directly.
func (*Guard) HTTPClient ¶
HTTPClient returns an *http.Client using a guarded transport and the given overall timeout.
func (*Guard) HTTPTransport ¶
HTTPTransport returns an *http.Transport whose connections are guarded. It is used by the S3 and WebDAV providers.
Source Files