Documentation
¶
Overview ¶
Package providerproxy holds the security-critical request/response filtering shared by Orka's provider-facing HTTP proxies: the standalone orka-provider-auth-proxy binary and the ACP supervisor's per-session provider proxy. Both proxies sit between untrusted callers and provider credentials, so the header allow/deny decisions, path-traversal checks, upstream target construction, and response byte bounds live here exactly once — a hardening fix in this package reaches every proxy.
Index ¶
- Variables
- func CopyRequestHeaders(destination, source http.Header)
- func CopyResponseHeaders(destination, source http.Header)
- func HasDisallowedContentEncoding(header http.Header) bool
- func HasUnsafePathSegment(path string) bool
- func ReleaseSlot(slots chan struct{})
- func StreamBoundedResponse(destination io.Writer, source io.Reader, limit int64, flusher http.Flusher) error
- func Target(base *url.URL, requestPath, rawQuery string) *url.URL
- func TryAcquireSlot(slots chan struct{}) bool
- func WriteError(w http.ResponseWriter, status int, message string)
Constants ¶
This section is empty.
Variables ¶
var ErrDestinationWrite = errors.New("provider proxy destination write failed")
ErrDestinationWrite wraps a failure to deliver upstream bytes to the downstream client (it closed its side of the connection). The upstream stream itself was healthy up to that point, so callers that account upstream outcomes must not treat it as an upstream failure.
var ErrResponseTooLarge = errors.New("provider upstream response exceeds limit")
ErrResponseTooLarge reports an upstream response body that exceeds the proxy's configured byte limit.
Functions ¶
func CopyRequestHeaders ¶
CopyRequestHeaders copies caller request headers onto the upstream request, dropping hop-by-hop headers, headers nominated by Connection, and headers that could leak caller credentials, identity, or routing metadata to the provider. Header values are never logged or printed here.
func CopyResponseHeaders ¶
CopyResponseHeaders copies upstream response headers back to the caller, dropping hop-by-hop headers, headers nominated by Connection, and headers that could leak provider credentials or redirect the caller elsewhere.
func HasDisallowedContentEncoding ¶
HasDisallowedContentEncoding reports whether the header declares a Content-Encoding other than identity. The proxies refuse compressed bodies in both directions so byte limits apply to the true payload size.
func HasUnsafePathSegment ¶
HasUnsafePathSegment reports whether a proxied URL path must be rejected before it is joined onto the upstream base URL. It applies the strictest union of the checks the two provider proxies previously implemented independently — every path either proxy rejected before is still rejected:
- any "." or ".." path segment, checked on both the raw path and its percent-decoded form, so percent-encoded traversal ("%2e%2e") cannot survive a later decode upstream;
- any backslash or NUL byte, again in both raw and decoded forms, so Windows-style separators and string-truncation tricks cannot smuggle traversal past the segment check;
- malformed percent-encoding, which is rejected outright because it cannot be normalized safely.
func ReleaseSlot ¶
func ReleaseSlot(slots chan struct{})
ReleaseSlot returns a request slot taken with TryAcquireSlot.
func StreamBoundedResponse ¶
func StreamBoundedResponse(destination io.Writer, source io.Reader, limit int64, flusher http.Flusher) error
StreamBoundedResponse copies the upstream response body to the caller, enforcing the byte limit as it streams. It never writes more than limit bytes: the read that would cross the limit returns ErrResponseTooLarge without forwarding the offending chunk, and reads never run more than one byte past the limit. When flusher is non-nil it is flushed after every write so streamed (for example server-sent event) responses propagate promptly; pass nil to keep the destination's default buffering.
func Target ¶
Target joins a proxied request path and raw query onto the upstream base URL. Callers must reject unsafe paths with HasUnsafePathSegment first.
func TryAcquireSlot ¶
func TryAcquireSlot(slots chan struct{}) bool
TryAcquireSlot attempts to take one request slot without blocking.
func WriteError ¶
func WriteError(w http.ResponseWriter, status int, message string)
WriteError writes a plain-text, non-cacheable proxy error response. The message must never contain credential material.
Types ¶
This section is empty.
Source Files