connectivity

package
v0.6.6 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 23, 2026 License: MIT Imports: 27 Imported by: 0

Documentation

Index

Constants

View Source
const (
	DefaultGrantTTL = time.Minute
	MaxGrantTTL     = 5 * time.Minute
)
View Source
const (
	DefaultMaxNetworkRequestBytes  = 1 << 20
	DefaultMaxNetworkResponseBytes = 1 << 20
	DefaultHTTPStreamChunkBytes    = 32 << 10
	DefaultNetworkTimeout          = 10 * time.Second
	DefaultUDPRateLimitRoundTrips  = 120
	DefaultUDPRateLimitWindow      = time.Second
)

Variables

View Source
var (
	ErrInvalidConnector      = errors.New("network connector is invalid")
	ErrTargetDenied          = errors.New("network target denied")
	ErrConnectorDenied       = errors.New("network connector denied")
	ErrResourceScopeMismatch = errors.New("network resource scope mismatch")
	ErrGrantExpired          = errors.New("network grant expired")
	ErrRequestTooLarge       = errors.New("network request too large")
	ErrResponseTooLarge      = errors.New("network response too large")
	ErrRateLimited           = errors.New("network rate limited")
	ErrConnectionClosed      = errors.New("network connection closed")
	ErrWebSocketFailed       = errors.New("websocket handshake failed")
)

Functions

func ValidTransport

func ValidTransport(transport Transport) bool

Types

type Broker

type Broker interface {
	InstallPolicy(ctx context.Context, policy PolicySet) error
	RemovePolicy(ctx context.Context, pluginInstanceID string) error
	MintConnectionGrant(ctx context.Context, req GrantRequest) (ConnectionGrant, error)
}

type Classifier

type Classifier struct {
	// contains filtered or unexported fields
}

func DefaultClassifier

func DefaultClassifier() Classifier

func (Classifier) Evaluate

func (c Classifier) Evaluate(destination Destination) error

func (Classifier) EvaluateResolvedAddress

func (c Classifier) EvaluateResolvedAddress(destination Destination, addr netip.Addr) error

type CompileRequest

type CompileRequest struct {
	PluginInstanceID   string
	PluginID           string
	ActiveFingerprint  string
	PolicyRevision     uint64
	ManagementRevision uint64
	RevokeEpoch        uint64
	Manifest           manifest.Manifest
}

type ConnectionGrant

type ConnectionGrant struct {
	GrantID                 string                   `json:"grant_id"`
	PluginInstanceID        string                   `json:"plugin_instance_id"`
	ActiveFingerprint       string                   `json:"active_fingerprint"`
	ResourceScope           sessionctx.ResourceScope `json:"resource_scope"`
	PolicyRevision          uint64                   `json:"policy_revision"`
	ManagementRevision      uint64                   `json:"management_revision"`
	RevokeEpoch             uint64                   `json:"revoke_epoch"`
	ConnectorID             string                   `json:"connector_id"`
	Transport               Transport                `json:"transport"`
	Destination             Destination              `json:"destination"`
	RuntimeGenerationID     string                   `json:"runtime_generation_id,omitempty"`
	TargetClassifierVersion string                   `json:"target_classifier_version"`
	ExpiresAt               time.Time                `json:"expires_at"`
}

func MintConnectionGrant

func MintConnectionGrant(ctx context.Context, policy PolicySet, req GrantRequest) (ConnectionGrant, error)

type ConnectorPolicy

type ConnectorPolicy struct {
	ConnectorID  string        `json:"connector_id"`
	Transport    Transport     `json:"transport"`
	Scope        Scope         `json:"scope"`
	Destinations []Destination `json:"destinations"`
	SecretRef    string        `json:"secret_ref,omitempty"`
}

type Destination

type Destination struct {
	Transport Transport `json:"transport"`
	Scheme    string    `json:"scheme,omitempty"`
	Host      string    `json:"host"`
	Port      int       `json:"port"`
}

func ParseDestination

func ParseDestination(transport Transport, raw string) (Destination, error)

func (Destination) Canonical

func (d Destination) Canonical() string

type Executor

type Executor struct {
	// contains filtered or unexported fields
}

func NewExecutor

func NewExecutor(options ExecutorOptions) *Executor

func (*Executor) Close added in v0.5.0

func (e *Executor) Close(ctx context.Context) error

Close rejects new requests, closes idle HTTP connections, and waits for in-flight responses to release their pools.

func (*Executor) DoHTTP

func (e *Executor) DoHTTP(ctx context.Context, req HTTPRequest) (HTTPResponse, error)

func (*Executor) StreamHTTP

func (e *Executor) StreamHTTP(ctx context.Context, req HTTPRequest, onChunk func(HTTPResponseChunk) error) (HTTPStreamResponse, error)

func (*Executor) TCPRoundTrip

func (*Executor) UDPRoundTrip

func (*Executor) WebSocketRoundTrip

type ExecutorOptions

type ExecutorOptions struct {
	Dialer           *net.Dialer
	LookupIPAddr     func(ctx context.Context, host string) ([]net.IPAddr, error)
	UDPRateLimiter   UDPRateLimiter
	MaxRequestBytes  int64
	MaxResponseBytes int64
	DefaultTimeout   time.Duration
	Now              func() time.Time
}

type GrantRequest

type GrantRequest struct {
	PluginInstanceID    string
	ActiveFingerprint   string
	ResourceScope       sessionctx.ResourceScope
	PolicyRevision      uint64
	ManagementRevision  uint64
	RevokeEpoch         uint64
	ConnectorID         string
	Transport           Transport
	Destination         string
	RuntimeGenerationID string
	Now                 time.Time `json:"-"`
	TTL                 time.Duration
}

type HTTPRequest

type HTTPRequest struct {
	Grant            ConnectionGrant `json:"grant"`
	Method           string          `json:"method"`
	Path             string          `json:"path,omitempty"`
	Query            url.Values      `json:"query,omitempty"`
	Headers          http.Header     `json:"headers,omitempty"`
	Body             []byte          `json:"-"`
	MaxRequestBytes  int64           `json:"max_request_bytes,omitempty"`
	MaxResponseBytes int64           `json:"max_response_bytes,omitempty"`
	MaxChunkBytes    int64           `json:"max_chunk_bytes,omitempty"`
	Timeout          time.Duration   `json:"timeout,omitempty"`
	Now              time.Time       `json:"-"`
}

type HTTPResponse

type HTTPResponse struct {
	StatusCode int         `json:"status_code"`
	Headers    http.Header `json:"headers,omitempty"`
	Body       []byte      `json:"-"`
}

type HTTPResponseChunk

type HTTPResponseChunk struct {
	Index int    `json:"index"`
	Data  []byte `json:"-"`
}

type HTTPStreamResponse

type HTTPStreamResponse struct {
	StatusCode int         `json:"status_code"`
	Headers    http.Header `json:"headers,omitempty"`
	BytesRead  int64       `json:"bytes_read"`
	ChunkCount int         `json:"chunk_count"`
}

type MemoryBroker

type MemoryBroker struct {
	// contains filtered or unexported fields
}

func NewMemoryBroker

func NewMemoryBroker() *MemoryBroker

func (*MemoryBroker) InstallPolicy

func (b *MemoryBroker) InstallPolicy(ctx context.Context, policy PolicySet) error

func (*MemoryBroker) MintConnectionGrant

func (b *MemoryBroker) MintConnectionGrant(ctx context.Context, req GrantRequest) (ConnectionGrant, error)

func (*MemoryBroker) RemovePolicy

func (b *MemoryBroker) RemovePolicy(ctx context.Context, pluginInstanceID string) error

type MemoryUDPRateLimiter

type MemoryUDPRateLimiter struct {
	// contains filtered or unexported fields
}

func NewMemoryUDPRateLimiter

func NewMemoryUDPRateLimiter(limit UDPRateLimit) *MemoryUDPRateLimiter

func (*MemoryUDPRateLimiter) AllowUDPRoundTrip

func (l *MemoryUDPRateLimiter) AllowUDPRoundTrip(now time.Time, key UDPRateLimitKey) bool

type NetworkExecutor

type NetworkExecutor interface {
	DoHTTP(ctx context.Context, req HTTPRequest) (HTTPResponse, error)
	StreamHTTP(ctx context.Context, req HTTPRequest, onChunk func(HTTPResponseChunk) error) (HTTPStreamResponse, error)
	WebSocketRoundTrip(ctx context.Context, req WebSocketRoundTripRequest) (WebSocketRoundTripResponse, error)
	TCPRoundTrip(ctx context.Context, req TCPRoundTripRequest) (TCPRoundTripResponse, error)
	UDPRoundTrip(ctx context.Context, req UDPRoundTripRequest) (UDPRoundTripResponse, error)
}

type PolicySet

type PolicySet struct {
	PluginInstanceID        string            `json:"plugin_instance_id"`
	PluginID                string            `json:"plugin_id"`
	ActiveFingerprint       string            `json:"active_fingerprint"`
	PolicyRevision          uint64            `json:"policy_revision"`
	ManagementRevision      uint64            `json:"management_revision"`
	RevokeEpoch             uint64            `json:"revoke_epoch"`
	TargetClassifierVersion string            `json:"target_classifier_version"`
	Connectors              []ConnectorPolicy `json:"connectors"`
}

func CompilePolicy

func CompilePolicy(req CompileRequest) (PolicySet, error)

type Scope

type Scope string
const (
	ScopeUser        Scope = "user"
	ScopeEnvironment Scope = "environment"
)

type TCPRoundTripRequest

type TCPRoundTripRequest struct {
	Grant           ConnectionGrant `json:"grant"`
	Payload         []byte          `json:"-"`
	MaxRequestBytes int64           `json:"max_request_bytes,omitempty"`
	MaxReadBytes    int64           `json:"max_read_bytes,omitempty"`
	Timeout         time.Duration   `json:"timeout,omitempty"`
	Now             time.Time       `json:"-"`
}

type TCPRoundTripResponse

type TCPRoundTripResponse struct {
	Payload []byte `json:"-"`
}

type Transport

type Transport string
const (
	TransportHTTP      Transport = "http"
	TransportWebSocket Transport = "websocket"
	TransportTCP       Transport = "tcp"
	TransportUDP       Transport = "udp"
)

type UDPRateLimit

type UDPRateLimit struct {
	MaxRoundTrips int
	Window        time.Duration
}

type UDPRateLimitKey

type UDPRateLimitKey struct {
	PluginInstanceID  string      `json:"plugin_instance_id"`
	ActiveFingerprint string      `json:"active_fingerprint"`
	ConnectorID       string      `json:"connector_id"`
	GrantID           string      `json:"grant_id"`
	Destination       Destination `json:"destination"`
}

type UDPRateLimiter

type UDPRateLimiter interface {
	AllowUDPRoundTrip(now time.Time, key UDPRateLimitKey) bool
}

type UDPRateLimiterFunc

type UDPRateLimiterFunc func(now time.Time, key UDPRateLimitKey) bool

func (UDPRateLimiterFunc) AllowUDPRoundTrip

func (f UDPRateLimiterFunc) AllowUDPRoundTrip(now time.Time, key UDPRateLimitKey) bool

type UDPRoundTripRequest

type UDPRoundTripRequest struct {
	Grant        ConnectionGrant `json:"grant"`
	Payload      []byte          `json:"-"`
	MaxReadBytes int64           `json:"max_read_bytes,omitempty"`
	Timeout      time.Duration   `json:"timeout,omitempty"`
	Now          time.Time       `json:"-"`
}

type UDPRoundTripResponse

type UDPRoundTripResponse struct {
	Payload []byte `json:"-"`
}

type WebSocketMessageType

type WebSocketMessageType string
const (
	WebSocketMessageText   WebSocketMessageType = "text"
	WebSocketMessageBinary WebSocketMessageType = "binary"
)

type WebSocketRoundTripRequest

type WebSocketRoundTripRequest struct {
	Grant            ConnectionGrant      `json:"grant"`
	Path             string               `json:"path,omitempty"`
	Headers          http.Header          `json:"headers,omitempty"`
	MessageType      WebSocketMessageType `json:"message_type,omitempty"`
	Payload          []byte               `json:"-"`
	MaxRequestBytes  int64                `json:"max_request_bytes,omitempty"`
	MaxResponseBytes int64                `json:"max_response_bytes,omitempty"`
	Timeout          time.Duration        `json:"timeout,omitempty"`
	Now              time.Time            `json:"-"`
}

type WebSocketRoundTripResponse

type WebSocketRoundTripResponse struct {
	MessageType WebSocketMessageType `json:"message_type"`
	Payload     []byte               `json:"-"`
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL