Documentation
¶
Index ¶
- func MarkSocket(raw syscall.RawConn, marker Marker) error
- type Guard
- type HostConn
- func (h *HostConn) Addr() string
- func (h *HostConn) Close() error
- func (h *HostConn) Drain(ctx context.Context)
- func (h *HostConn) Read(b []byte) (int, error)
- func (h *HostConn) RemoteAddr() string
- func (h *HostConn) SetReadDeadline(t time.Time) error
- func (h *HostConn) SetWriteDeadline(t time.Time) error
- func (h *HostConn) Type() socket.SocketType
- func (h *HostConn) Write(b []byte) (int, error)
- type HostConnOpts
- type HostDialer
- type Marker
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Guard ¶
Guard is the network policy decision a dialer applies to the address the operating system is about to connect to. It is the last gate in front of connect: returning an error from it means no packet is sent.
type HostConn ¶
type HostConn struct {
// contains filtered or unexported fields
}
func NewConnection ¶
func NewConnection(ctx context.Context, pc ratelimit.PacketCount, id uuid.UUID, conn net.Conn, opts HostConnOpts) (_ *HostConn, err error)
NewConnection consumes conn. On failure it closes the attached wrapper (if available), otherwise the original connection. On success HostConn owns it. A failed close is attached with cleanup.Join, so cleanup.Released separates connection release failure from attach/limit failure without exposing a new guest ABI or conflating execution and cleanup.
func (*HostConn) RemoteAddr ¶
func (*HostConn) SetReadDeadline ¶ added in v0.3.0
func (*HostConn) SetWriteDeadline ¶ added in v0.3.0
func (*HostConn) Type ¶
func (h *HostConn) Type() socket.SocketType
type HostConnOpts ¶
type HostDialer ¶
type HostDialer struct {
// contains filtered or unexported fields
}
HostDialer dials a guest's connection under a Guard. It holds no policy of its own: everything it refuses, it refuses because the guard did.
func NewDialer ¶
func NewDialer(guard Guard, marker Marker) (*HostDialer, error)
NewDialer returns a dialer that consults guard for every socket it opens and marks every admitted socket with marker before it is connected. A nil marker, including a nil tagger converted to a Marker, means no marking.
func (*HostDialer) Control ¶
func (hd *HostDialer) Control(network, address string, raw syscall.RawConn) error
Control is the net.Dialer control hook. The operating system calls it with the resolved address after the socket exists and before it is connected, so a refusal here is a destination that was never contacted, and a mark set here covers the socket's first packet. A socket that cannot be marked is not connected.
Source Files