Documentation
¶
Overview ¶
Package netclient builds HTTP clients and proxy resolvers that share fairpeer's user-facing proxy settings. web_fetch reuses the resolver while keeping its own dial-time SSRF guard.
Index ¶
- Constants
- Variables
- func BlockedFetchIP(ip net.IP) bool
- func NewHTTPClient(spec ProxySpec, opts TransportOptions) (*http.Client, error)
- func NewTransport(spec ProxySpec, opts TransportOptions) (*http.Transport, error)
- func NormalizeMode(mode string) string
- func ProxyFunc(spec ProxySpec) (func(*http.Request) (*url.URL, error), error)
- func ProxyURLFor(spec ProxySpec, req *http.Request) (string, error)
- func Summary(spec ProxySpec) string
- func Validate(spec ProxySpec) error
- type ProxySpec
- type TransportOptions
Constants ¶
const ( ModeAuto = "auto" ModeEnv = "env" ModeCustom = "custom" ModeOff = "off" )
Variables ¶
var CGNATRange = mustCIDR("100.64.0.0/10")
CGNATRange is RFC 6598 shared address space (100.64.0.0/10). Go's IsPrivate doesn't cover it, yet some clouds host instance metadata there (Alibaba Cloud at 100.100.100.200), so it's an SSRF target.
Functions ¶
func BlockedFetchIP ¶
BlockedFetchIP reports whether ip is an address that outbound fetches must not reach. Covers RFC1918, link-local, unspecified, and CGNAT ranges.
func NewHTTPClient ¶
func NewHTTPClient(spec ProxySpec, opts TransportOptions) (*http.Client, error)
NewHTTPClient returns an HTTP client with fairpeer proxy settings applied.
func NewTransport ¶
func NewTransport(spec ProxySpec, opts TransportOptions) (*http.Transport, error)
NewTransport clones net/http's default transport and overlays the requested proxy and timeout knobs. Cloning preserves defaults such as HTTP/2 support, connection pooling, and environment-proxy behavior for auto/env modes.
func NormalizeMode ¶
NormalizeMode maps empty and unknown modes to auto, preserving a fail-open default for older configs.
func ProxyURLFor ¶
ProxyURLFor resolves the proxy URL string for a given request under spec. Returns "" when no proxy applies. This is a convenience wrapper around ProxyFunc for callers that only need the URL string.
Types ¶
type ProxySpec ¶
type ProxySpec struct {
Mode string
URL string
NoProxy string
Type string
Server string
Port int
Username string
Password string
DirectHosts []string
}
ProxySpec is the resolved proxy configuration used by network clients. URL is an advanced override; otherwise Type/Server/Port/Credentials are composed into a proxy URL. NoProxy is honored for custom proxies. DirectHosts always bypass the proxy in every mode (the caller derives them, e.g. from no_proxy providers).
Source Files