netguard

Documentation

Overview

Package netguard provides safe outbound HTTP primitives for server-side fetches to user-controlled URLs.

Index

• func HTTPClient(allowInternal bool, timeout time.Duration) *http.Client
• func IsDisallowedAddress(ip net.IP) bool
• func SafeDialContext(allowInternal bool) func(context.Context, string, string) (net.Conn, error)

Functions

func HTTPClient

func HTTPClient(allowInternal bool, timeout time.Duration) *http.Client

HTTPClient builds an outbound client that re-validates every resolved address on every redirect hop. Redirects are capped to avoid redirect-loop resource exhaustion while still supporting normal public push services.

func IsDisallowedAddress

func IsDisallowedAddress(ip net.IP) bool

IsDisallowedAddress rejects loopback, private, link-local, multicast, unspecified, and reserved addresses, including IPv4-mapped IPv6 forms.

func SafeDialContext

func SafeDialContext(allowInternal bool) func(context.Context, string, string) (net.Conn, error)

SafeDialContext resolves all candidates itself, validates each resolution, and dials the selected IP directly. This closes DNS rebinding gaps between an initial hostname check and the actual socket connection.