Documentation
¶
Overview ¶
Package netguard keeps the backend's own outgoing connections (to an administrator's sign-in providers and mail server) away from addresses that a typo or a hostile setting must not be able to reach: the cloud metadata services and the other addresses on a link, and, unless an administrator allows it, the private networks the server sits in. It takes nothing but the standard library, so both sides of the process boundary may use it.
The check runs when the connection is made, on the address the name resolved to, so a name that answers with a different address on each lookup (DNS rebinding) and a redirect to a private address get the same answer as a private address typed in.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrBlocked = errors.New("refusing to connect to that address")
ErrBlocked is returned for an address the guard refuses. The text names no address: it may reach a person who must not learn what is behind a name.
Functions ¶
func Check ¶
Check says whether a connection to ip may be made. Loopback is allowed: the sign-in provider rule lets a development server on http://localhost through, and the mail client accepts an unencrypted server on this machine, so both are already deliberate.
Types ¶
This section is empty.
Source Files