chpolicy

package

v1.35.0 Latest Latest Go to latest Published: Oct 20, 2026 License: MIT Imports: 8 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/rudderlabs/sqlconnect-go

Links

Open Source Insights

Documentation ¶

Overview ¶

Package chpolicy stores the process-wide ClickHouse dial policy that clickhousequery.SetDialPolicy installs and the driver's dialer reads.

Index ¶

func Install(p Policy) error
func ResetForTest()
func Validate(p Policy) error
type Policy
- func Current() (Policy, bool)
- func (p Policy) RefusedReason(ip net.IP) string

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Install ¶

func Install(p Policy) error

Install validates p and makes it the process policy. It fails when a policy is already installed.

func ResetForTest ¶

func ResetForTest()

ResetForTest clears the installed policy, so the install-once check holds under go test -count=N. It panics outside a test binary, so production code can never clear the dial policy.

func Validate ¶

func Validate(p Policy) error

Validate refuses an invalid prefix, a prefix with host bits set, and an IPv4-mapped prefix. Answers are checked in their IPv4 form, so a mapped prefix would never match and the operator entry would do nothing.

Types ¶

type Policy ¶

type Policy struct {
	Blocked []netip.Prefix
	// AllowLoopback admits loopback answers. Test builds only.
	AllowLoopback bool
	// AllowPlainHTTP admits secure=false. Test builds only.
	AllowPlainHTTP bool
}

Policy holds the operator block list and two relaxations for test builds only. Production code never sets AllowLoopback or AllowPlainHTTP.

func Current ¶

func Current() (Policy, bool)

Current returns a copy of the installed policy and whether one is installed.

func (Policy) RefusedReason ¶

func (p Policy) RefusedReason(ip net.IP) string

RefusedReason returns "" when the policy admits ip. The operator list runs first, so AllowLoopback never admits a listed address. Each embedded IPv4 address is checked against the list in its IPv4 form.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL