Documentation
¶
Index ¶
- func AcquireDeadPeerTimeout(ctx context.Context, timeout time.Duration) (func(), error)
- func ClearReadDeadline(ctx context.Context)
- func DefaultLookupIP(ctx context.Context, host string) ([]net.IP, error)
- func GetClientBaseURL(origin, forwardedHost, forwardedProto, host, appURL string) string
- func GetIntQueryParam(r *http.Request, name string, required bool) (int, error)
- func IsWebSocketUpgradeRequest(r *http.Request) bool
- func NewHTTPClient() *http.Client
- func NewHTTPClientWithTimeout(timeout time.Duration) *http.Client
- func NewSafeOutboundHTTPClient(base *http.Client, lookupIP LookupIPFunc) (*http.Client, error)
- func NormalizeBaseURL(rawURL string) (string, error)
- func SetJSONStreamHeaders(headers HeaderSetter)
- func ValidateOutboundHTTPURL(rawURL string) (*url.URL, error)
- func ValidateSafeRemoteURL(ctx context.Context, rawURL string, lookupIP LookupIPFunc) (*url.URL, error)
- func ValidateWebSocketOrigin(appURL string) func(r *http.Request) bool
- func WithConn(ctx context.Context, conn net.Conn) context.Context
- type HeaderSetter
- type LookupIPFunc
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AcquireDeadPeerTimeout ¶ added in v2.6.0
AcquireDeadPeerTimeout bounds how long data written to the request's connection may stay unacknowledged before the kernel tears it down, and returns a release function restoring the system default once every caller sharing the connection has released it.
Long-lived streams need this because they write on their own schedule into a connection the client may have silently abandoned: left to the defaults the kernel retransmits until tcp_retries2 is exhausted, roughly eleven minutes. TCP keepalive does not cover the case, since probes only fire while a connection is idle and a stream with an unacknowledged write in flight never is.
It is deliberately scoped to one connection rather than the listener: the same listener carries edge tunnel gRPC streams, which tolerate up to edge.TunnelStaleTimeout of silence and would be reset by a shared timeout.
The release function is always safe to call, including when acquisition failed or the request never passed through WithConn.
func ClearReadDeadline ¶ added in v2.8.1
ClearReadDeadline clears any read deadline left armed on the request's underlying connection. Safe to call from any request handler, including when the request never passed through WithConn; only the first call per connection issues the syscall.
It exists because go1.26.6 (the CVE-2026-56853 backport) arms ReadHeaderTimeout on the raw connection before sniffing the h2c preface and hands the connection to the HTTP/2 server without clearing it. The HTTP/2 server tracks liveness with timers, never read deadlines, so the stale absolute deadline survives and tears the connection down — with every stream on it — exactly ReadHeaderTimeout after accept. By the time a handler runs the headers are already parsed, so clearing the deadline does not weaken the slowloris protection the timeout is for.
func GetClientBaseURL ¶
GetClientBaseURL determines the client's base URL from request headers. It checks Origin, X-Forwarded-Host/Proto, and Host headers. If none provide a valid URL, it falls back to the configured appURL.
func GetIntQueryParam ¶
GetIntQueryParam reads and parses an integer query parameter from the request URL. If `required` is true and the parameter is missing, or if parsing fails, an error is returned.
func IsWebSocketUpgradeRequest ¶ added in v2.7.0
IsWebSocketUpgradeRequest reports whether r is a WebSocket handshake: the Connection header contains "upgrade" (it can be a list, e.g. Firefox sends "keep-alive, Upgrade") and Upgrade is "websocket".
func NewHTTPClient ¶
func NormalizeBaseURL ¶ added in v2.8.0
NormalizeBaseURL validates an outbound HTTP URL and strips endpoint-specific components.
func SetJSONStreamHeaders ¶
func SetJSONStreamHeaders(headers HeaderSetter)
func ValidateOutboundHTTPURL ¶
ValidateOutboundHTTPURL parses and validates an outbound HTTP(S) target URL. It intentionally performs syntactic hardening (scheme/host/credentials) without restricting private network ranges, because environment agents may be deployed on trusted private subnets.
func ValidateSafeRemoteURL ¶
func ValidateWebSocketOrigin ¶
ValidateWebSocketOrigin validates the Origin header for WebSocket connections to prevent CSRF attacks. It checks: 1. Same-origin requests (Origin matches Host) 2. Allowed origins from appURL 3. Handles empty Origin headers (some clients don't send it)
Source Files