Documentation
¶
Overview ¶
Package egress is a per-VM CONNECT proxy: default-deny, per-session allowlist, audit log. It is the only path out for session containers on the internal network (spec §8). The session is identified by its Proxy-Authorization header, either a literal Bearer token (the session id) or — the form a plain HTTP_PROXY/HTTPS_PROXY env var actually produces, since curl/wget have no way to set a literal header from an env var — HTTP Basic auth decoded from the proxy URL's userinfo (http://<session-id>:<ignored>@host:port), added for egress R4's env-var proxy flow (Task 13; see sessionFromProxyAuth). A CONNECT that carries no usable identity is answered with a 407 challenge rather than a refusal, because a client that waits to be asked (git does; curl does not) would otherwise never send the credential it already holds — see challengeRealm.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Option ¶ added in v0.0.10
type Option func(*Proxy)
Option configures a Proxy at construction. There is exactly one, and it exists because the guard it lifts is otherwise unconditional.
func AllowPrivateDestinations ¶ added in v0.0.10
func AllowPrivateDestinations() Option
AllowPrivateDestinations lets this proxy tunnel to loopback, RFC1918, link-local and the other non-public ranges vettedAddrs refuses.
It is for a proxy whose origins are FIXTURES — this package's own tests serve a git repository on localhost and allowlist "localhost" — and for a local fleet where the thing on the other side is a container on the same machine. It is not a production setting: egressd does not offer a flag for it, because on a runner the private addresses on the other side of that name are the metadata service, the other tenants' sandboxes, and the runner's own control plane.
Source Files