Documentation
¶
Overview ¶
Package egressproxy provides an exact-target forward proxy for trust-scoped workloads.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsPublicAddress ¶
IsPublicAddress reports whether an IP is globally routable under the proxy's reviewed special-use denylist. It is shared by sandbox command egress authorization; callers still must resolve and pin each connection themselves.
Types ¶
type Config ¶
type Config struct {
// AllowedTargets is the finite exact host/port allowlist.
AllowedTargets []Target
// DialContext establishes one already-authorized target connection. Nil uses a standard dialer.
DialContext func(context.Context, string, string) (net.Conn, error)
// Resolve resolves a declared DNS host before dialing. Nil uses the system resolver.
Resolve func(context.Context, string) ([]net.IPAddr, error)
}
Config declares the complete egress authority for one proxy process.
type Proxy ¶
type Proxy struct {
// contains filtered or unexported fields
}
Proxy is a validated HTTP proxy with no ambient target authority.
func (Proxy) ActiveTunnelCount ¶
ActiveTunnelCount reports the number of hijacked CONNECT tunnels that have not yet drained. It is intended for process shutdown accounting.
func (Proxy) CloseActiveTunnels ¶
CloseActiveTunnels force-closes each active CONNECT tunnel and returns the number of tunnel pairs that received the shutdown signal.
func (Proxy) ServeHTTP ¶
func (proxy Proxy) ServeHTTP(writer http.ResponseWriter, request *http.Request)
ServeHTTP handles absolute-form HTTP and HTTPS CONNECT proxy requests only to allowlisted targets.
type Target ¶
type Target struct {
// Host is an exact public DNS name without wildcards.
Host string
// Port is the exact permitted TCP port.
Port int
}
Target is one exact DNS host and TCP port allowed through the proxy.
func ParseTargets ¶
ParseTargets validates a finite exact-target inventory for composition roots.
Source Files