Documentation
¶
Overview ¶
Package egress is the outbound op-dial policy seam. When an op does EXEC "http(s)://...", the chassis dials it through one shared HTTP transport. A Guard is consulted at the dial step — after DNS resolution, with the concrete IP about to be connected — so an op cannot use the chassis to reach addresses it should not (loopback, private networks, link-local cloud-metadata, etc.).
The default backend ("open") allows everything, so local development and testing are unaffected. The map in factory.go is the extension seam: an additional backend in a separate package registers itself the same way as the built-ins, with no change to callers.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DialControl ¶
DialControl adapts a Guard to a net.Dialer.Control function. Control runs once per resolved candidate address, before the socket connects, so checking here inspects the IP actually being dialed and defeats DNS-rebinding.
func Register ¶
func Register(name string, c Constructor)
Register adds a backend constructor. Called from a backend package's init(); the chassis activates a backend with a blank import.
func Transport ¶ added in v0.2.46
Transport is the HTTP transport for outbound requests the guard polices: a clone of http.DefaultTransport whose dials go through g, and which never uses a proxy.
The default transport takes its proxy from the environment (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY). Through a proxy the dial is to the proxy, so the guard would check the proxy's address instead of the destination's, and a request could reach anything the proxy can. No deployment sets those variables today; this keeps it that way for every guarded client. Callers tune the pool on the copy they get.
Types ¶
type Config ¶
type Config struct {
// DenyCIDRs are extra CIDRs the policy also blocks (deployment-
// specific internal ranges).
DenyCIDRs []string
// AllowCIDRs are CIDRs allowed even if otherwise blocked — an
// explicit escape hatch. Allow wins over deny.
AllowCIDRs []string
}
Config carries backend-selecting options resolved from chassis config. The "private" backend uses DenyCIDRs/AllowCIDRs to extend/override its built-in private-range set. Additional backends may extend this struct with their own fields; existing backends and callers are unaffected by added fields.
type Constructor ¶
Constructor builds a Guard from resolved config.
type Guard ¶
type Guard interface {
// CheckAddr is called after DNS resolution with the concrete network
// ("tcp4"/"tcp6"/...) and the resolved "ip:port" about to be dialed.
// A non-nil error blocks the connection. Implementations must be
// pure in-memory (no DNS/FS/DB): the dial's DNS lookup has already
// happened and this runs on the request hot path.
CheckAddr(network, address string) error
// Name is the backend identity (for logs).
Name() string
}
Guard decides whether an outbound op dial may proceed.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package open registers the "open" egress policy: it allows every outbound op dial.
|
Package open registers the "open" egress policy: it allows every outbound op dial. |
|
Package private registers the "private" egress policy: it blocks outbound op dials whose resolved IP falls in loopback, private, link-local (incl.
|
Package private registers the "private" egress policy: it blocks outbound op dials whose resolved IP falls in loopback, private, link-local (incl. |
|
Package wgtunnel brings up a WireGuard tunnel inside the chassis process — userspace, no kernel interface, no root — so an outbound dial can leave through a peer on a private network the host itself is not on.
|
Package wgtunnel brings up a WireGuard tunnel inside the chassis process — userspace, no kernel interface, no root — so an outbound dial can leave through a peer on a private network the host itself is not on. |