Documentation
¶
Index ¶
- func MatchAll(legs []Leg, legFunc LegFunc) bool
- func MatchAllCIDR(legs []Leg, n ...net.IPNet) bool
- func MatchAny(legs []Leg, legFunc LegFunc) bool
- func MatchAnyCIDR(legs []Leg, n ...net.IPNet) bool
- func TrustLast(leg *Leg, distance int) bool
- func TrustXRealIP(leg *Leg, distance int) bool
- type Leg
- func Parse(req *http.Request) []Leg
- func ParseLocal(req *http.Request) (legs []Leg, err error)
- func ParseRFC7239(hdr http.Header) (legs []Leg, err error)
- func ParseXForwardedFor(hdr http.Header) (legs []Leg, err error)
- func ParseXRealIP(hdr http.Header) (legs []Leg, err error)
- func TrustedLegs(legs []Leg, trustLegFunc LegFunc) []Leg
- type LegFrom
- type LegFunc
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MatchAllCIDR ¶
Returns true if all of the source IPs of all of the legs match one of given prefixes.
Since ALL legs must match, this can be useful for whitelisting, e.g. to ensure a request originates from within your network.
func MatchAnyCIDR ¶
Returns true if any of the source IPs of any of the legs match one of the given prefixes.
Since this examines untrusted legs, this should be used for blacklisting and never whitelisting. i.e. it allows clients to volunteer to be blacklisted, e.g. by ISP transparent proxies. But it should never result in *increased* access.
Types ¶
type Leg ¶
type Leg struct {
SourceIP net.IP // nil if unknown
SourcePort uint16 // 0 if unknown
DestinationIP net.IP // nil if unknown
DestinationPort uint16 // 0 if unknown
Scheme string // "" (unknown) or "http" or "https"
Host string // HTTP host
From LegFrom // information source ("X-Forwarded-For" or "X-Real-IP" or "Forwarded" or "local")
}
A leg represents a leg of a request. A leg has source and destination IPs and ports and uses either HTTP or HTTPS.
func ParseLocal ¶
Return the local request leg.
func ParseRFC7239 ¶
Parse the RFC 7239 "Forwarded" header and returns the legs described in the header.
func ParseXForwardedFor ¶
Parse the "X-Forwarded-For" header.
func ParseXRealIP ¶
Parse the "X-Real-IP"/"X-Real-Protocol"/"X-Local-IP" header.
func TrustedLegs ¶
Returns a slice of the given slice which is the span of trusted legs.
A leg is trusted if trustLegFunc returns true. By definition, all trusted legs are contiguously at the end of the slice, because these represent legs closer to this machine. For example:
Trusted Trusted
_________ _________
{Client Machine} <- Leg -> {ISP Transparent Proxy} <- Leg -> {Load Balancer} <- Leg -> {This Machine}
The information provided by machines you do not control, such as the ISP Transparent Proxy, is untrusted. The information provided by your load balancer, and the local information on the 'physical' connection to this machine are trusted.
In general, you want to trust the first trusted leg. Thus you inspect TrustedLegs(...)[0].
type LegFunc ¶
Predicate function type for leg trust decisions. Returns true iff a leg is trusted.
distance is the number of legs between the leg specified and the local (physical connection) leg. The local leg has a distance of 0, the preceding leg has a distance of 1, etc.
The predicates defined in this package currently do not use distance.
func TrustForwardedN ¶
Trust any Forwarded headers which have a distance of at most d.
Source Files