Documentation
¶
Overview ¶
Package netguard contains the shared SSRF protection used when Fider makes outbound HTTP requests to user-configurable URLs (webhooks, custom OAuth token/profile URLs).
There are two layers:
- validate.WebhookURL performs a friendly preflight check (it resolves the hostname and rejects private targets with a readable message).
- The client returned by NewClient enforces the same IsBlockedIP check at dial time, on the exact IP address being connected to. This is the real enforcement: it cannot be bypassed by DNS rebinding (a hostname that resolves to a public IP during validation and to a private IP when the request is made).
Index ¶
Constants ¶
This section is empty.
Variables ¶
var Client = NewClient()
Client is a shared guarded client, safe for concurrent use.
var ErrBlockedAddress = errors.New("connection to a private or internal network address is not allowed")
ErrBlockedAddress is returned when a connection to a private/internal network address is attempted through a guarded client.
Functions ¶
func ClientFor ¶
ClientFor returns the HTTP client to use for an outbound request. When blockPrivateNetworkTargets is true it returns the guarded Client, unless the instance opted out via ALLOW_PRIVATE_NETWORK_TARGETS=true, in which case (and when blockPrivateNetworkTargets is false) it returns http.DefaultClient. This is the single place where the escape hatch is applied.
func IsBlockedIP ¶
IsBlockedIP reports whether ip belongs to a private, internal, or otherwise non-public range that outbound requests to user-configured URLs must not reach. IPv6 transition addresses (NAT64, 6to4, Teredo, IPv4-compatible, SIIT) are unwrapped and the embedded IPv4 address is checked as well. A nil/invalid IP is treated as blocked.
func NewClient ¶
NewClient returns an http.Client that refuses to connect to any address for which IsBlockedIP returns true. It mirrors Fider's default client settings: 30s timeout and redirects are not followed.
Proxies are intentionally disabled (Proxy: nil, i.e. HTTP(S)_PROXY is ignored). With a proxy, the dial would go to the proxy rather than to the target, so the dial-time check would inspect the proxy's address and either block every request (proxy on a private network) or protect nothing (the proxy resolves and connects to the target itself). Guarded requests are therefore always sent directly. Installs that can only reach the internet through a proxy can set ALLOW_PRIVATE_NETWORK_TARGETS=true, which makes ClientFor fall back to http.DefaultClient (and so honour HTTP(S)_PROXY).
Types ¶
This section is empty.
Source Files