Documentation
¶
Overview ¶
Package egresspolicy holds what the VM has been told about the egress policy its session runs under.
The policy itself lives outside the VM: a session's allowlist is enforced by Kernel's egress proxy, which is the only component that knows which destinations are allowed. The VM is told one thing — that an allowlist exists — because some of what it can be asked to do would route traffic around that proxy, and it cannot refuse those requests without knowing the session is filtered at all.
Index ¶
Constants ¶
const DefaultStatePath = "/run/kernel/egress-policy.json"
DefaultStatePath is where the policy is kept so it survives a restart of the API process, which supervisord does automatically. Alongside the fork identity, since both are per-boot state the control plane hands the VM.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type State ¶
type State struct {
// contains filtered or unexported fields
}
State is the session's egress policy as the control plane last reported it.
It is held on disk as well as in memory. The API process is restarted automatically if it dies, and a restart that came back unfiltered would drop the refusal silently while the session's allowlist was still being enforced at the proxy — the gap would be invisible from outside the VM.
func Load ¶
Load reads the policy left by a previous run of the process. A session that has never been told anything is unfiltered, which is how every session behaved before the policy existed.
A file that exists but cannot be read is treated as filtered. It should not happen — the file is written atomically — but the alternative is to resolve an unreadable security control in the direction that switches it off.
func (*State) Filtered ¶
Filtered reports whether the session's egress is restricted to an allowlist. It is read on the CDP proxy's forwarding path, ahead of the message it is deciding about, so it is a lock-free load.
func (*State) SetFiltered ¶
SetFiltered records the policy the control plane applied, and does not take effect unless it was persisted: a caller that is told the policy is applied must be able to rely on it surviving a restart.
It is called when the session is set up and again whenever an allowlist is added to or removed from a running session, so it is safe to call repeatedly with the same value.
Source Files