Documentation
¶
Index ¶
- Variables
- type DialFunc
- type LookupFunc
- type Proxy
- func (proxy *Proxy) Addr() string
- func (proxy *Proxy) Authorize(executionID string, targets []Target) (string, error)
- func (proxy *Proxy) AuthorizeAll(executionID string) (string, error)
- func (proxy *Proxy) Close() error
- func (proxy *Proxy) Denial(executionID string) error
- func (proxy *Proxy) Release(executionID string)
- func (proxy *Proxy) Route() Route
- func (proxy *Proxy) ServeHTTP(writer http.ResponseWriter, request *http.Request)
- func (proxy *Proxy) URL(executionID, credential string) string
- type Route
- func (route Route) AddressGuarantee() bool
- func (route Route) DialTarget(ctx context.Context, target Target) (net.Conn, error)
- func (route Route) DialUpstream(ctx context.Context) (net.Conn, error)
- func (route Route) Fingerprint() string
- func (route Route) IsDirect() bool
- func (route Route) String() string
- func (route Route) TargetGuarantee() bool
- func (route Route) Upstream() *url.URL
- func (route Route) Validate() error
- func (route Route) WithDialer(lookup LookupFunc, dial DialFunc) Route
- type RouteResolver
- type Target
- type TargetDeniedError
Constants ¶
This section is empty.
Variables ¶
var ErrAddressDenied = errors.New("sandbox: resolved network address denied")
ErrAddressDenied reports that a target resolved to an address outside the public destination space a route is permitted to reach.
var ErrClosed = errors.New("sandbox: executor closed")
ErrClosed reports that a proxy refused an authorization because the executor that owns it is shutting down. It is the same sentinel the executor layer exposes as ErrExecutorClosed: one value, so errors.Is answers the same way whichever side of the boundary raised it.
var ErrRouteDenied = errors.New("sandbox: egress route denied")
var ErrTargetDenied = errors.New("sandbox: network target denied")
var UnparseableTarget = Target{/* contains filtered or unexported fields */}
UnparseableTarget is the placeholder recorded against an execution when a proxied request carried a target that could not be parsed at all. It is deliberately a value no real target can equal, so a denial is still audited without inventing a plausible-looking host.
Functions ¶
This section is empty.
Types ¶
type LookupFunc ¶
LookupFunc resolves a host to the addresses a route may connect to.
type Proxy ¶
type Proxy struct {
// contains filtered or unexported fields
}
func NewProxyWithListener ¶
NewProxyWithListener starts an authenticated enforcement proxy on an already-bound loopback TCP listener. The caller retains ownership when validation fails; after a successful return, Proxy.Close owns the listener.
This seam lets a platform reserve every permitted loopback port before sandbox construction and then make a one-way transition of exactly one reservation into the proxy endpoint. It never falls back to another port.
func (*Proxy) AuthorizeAll ¶
AuthorizeAll authorizes an execution for every target the route permits. It backs a profile whose network access is Allow, where the executor holds no per-target list to enumerate.
type Route ¶
type Route struct {
// contains filtered or unexported fields
}
Route is a validated, immutable route description. Secret upstream credentials are kept only in the private URL and excluded from identity.
func NewDirectRoute ¶
NewDirectRoute creates an explicit direct route with local DNS and address-class validation.
func NewUpstreamRoute ¶
NewUpstreamRoute creates an explicit HTTP or HTTPS organization proxy route. trustedAddressGuarantee is asserted only when the upstream contract guarantees resolved-address filtering.
func (Route) AddressGuarantee ¶
func (Route) DialTarget ¶
DialTarget resolves target through the route's resolver and connects to the first address that answers. Every resolved address must be a public destination: if any one of them is not, the whole dial fails with ErrAddressDenied rather than silently trying the remaining addresses, so a DNS answer that mixes public and private records cannot reach the private one.
func (Route) DialUpstream ¶
DialUpstream connects to the route's upstream proxy, wrapping the connection in TLS when the endpoint is https.
func (Route) Fingerprint ¶
func (Route) IsDirect ¶
IsDirect reports whether the route dials targets itself rather than handing them to an upstream proxy.
func (Route) TargetGuarantee ¶
func (Route) Upstream ¶
Upstream returns the upstream proxy endpoint, or nil for a direct route. The returned URL is the route's own; callers must not mutate it.
func (Route) WithDialer ¶
func (route Route) WithDialer(lookup LookupFunc, dial DialFunc) Route
WithDialer returns a copy of route that resolves and dials through the supplied collaborators; a nil argument leaves that collaborator unchanged.
This narrows nothing and widens nothing: DialTarget still rejects any resolved address outside the public destination space, so a substituted resolver cannot be used to reach loopback, link-local, or metadata addresses. The route's fingerprint is deliberately unchanged, because a fingerprint identifies the route's authority — its kind, endpoint, and guarantees — and not the machinery it uses to reach the network.
type RouteResolver ¶
type RouteResolver struct {
// contains filtered or unexported fields
}
RouteResolver confines a consumer selector to prevalidated routes.
func NewRouteResolver ¶
type Target ¶
type Target struct {
// contains filtered or unexported fields
}
Target is a normalized transport, hostname, and port tuple.
func ParseTarget ¶
ParseTarget accepts the v1 tcp:<host>:<port> grant target.
type TargetDeniedError ¶
type TargetDeniedError struct {
ExitCode int
ProcessError error
// contains filtered or unexported fields
}
TargetDeniedError preserves the completed process result while making an authenticated proxy denial the primary typed error.
func NewTargetDeniedError ¶
func NewTargetDeniedError(exitCode int, processErr, denial error) *TargetDeniedError
NewTargetDeniedError builds the typed error an executor returns when a spawn ran to completion but the proxy denied one of its network targets. The denial itself stays unexported so it can only be read through Error(), which keeps the denied host out of any caller that merely formats the wrapped sentinel.
func (*TargetDeniedError) Error ¶
func (err *TargetDeniedError) Error() string
func (*TargetDeniedError) Unwrap ¶
func (err *TargetDeniedError) Unwrap() error
Source Files