Documentation
¶
Overview ¶
Package netguard guards outbound HTTP requests whose target comes from outside the server (an end user's image URL, an MCP client metadata document) against server-side request forgery: connections to loopback, private, link-local, multicast or otherwise non-public addresses are refused. Direct connections are checked on the dialled IP, so DNS rebinding cannot bypass the check; requests routed through the environment's proxy are checked on the target host's resolved addresses before they are handed to the proxy.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrForbiddenAddress = errors.New("netguard: address not allowed")
ErrForbiddenAddress is returned when a target resolves to a non-public address.
Functions ¶
func CheckHost ¶
CheckHost resolves host and rejects it (ErrForbiddenAddress) unless every address is public. An IP literal is checked as is.
func NewTransport ¶
NewTransport returns a guarded transport. proxy selects the proxy for a request (http.ProxyFromEnvironment in production). Direct connections may only reach public addresses (enforced on the dialled IP); a request that proxy routes through a proxy is refused unless every resolved address of its target host is public. NewTransport performs no I/O.
Types ¶
This section is empty.
Source Files