internal

Documentation

Index

• Variables
• func ClampIP(addr netip.Addr) (netip.Prefix, bool)
• func CustomRealIPHeader(customRealIPHeaderValue string, next http.Handler) http.Handler
• func FastHash(text string) string
• func GetFilteredHTTPLogger() *log.Logger
• func GetHealth(svc string) (healthv1.HealthCheckResponse_ServingStatus, bool)
• func GetRequestLogger(base *slog.Logger, r *http.Request) *slog.Logger
• func GzipMiddleware(level int, next http.Handler) http.Handler
• func InitSlog(level string, sink io.Writer) *slog.Logger
• func JA4H(next http.Handler) http.Handler
• func NoBrowsing(next http.Handler) http.Handler
• func NoStoreCache(next http.Handler) http.Handler
• func RealIP(r *http.Request) (netip.Addr, bool)
• func RemoteXRealIP(useRemoteAddress bool, bindNetwork string, next http.Handler) http.Handler
• func SHA256sum(text string) string
• func SetHealth(svc string, status healthv1.HealthCheckResponse_ServingStatus)
• func UnbreakDocker()
• func UnchangingCache(next http.Handler) http.Handler
• func XForwardedForToXRealIP(next http.Handler) http.Handler
• func XForwardedForUpdate(stripPrivate bool, next http.Handler) http.Handler
• type ErrorLogFilter
  • func (elf *ErrorLogFilter) Write(p []byte) (n int, err error)
• type ListOr
  • func (lo *ListOr[T]) UnmarshalJSON(data []byte) error
• type XFFComputePreferences

Variables

var (
	ErrCantSplitHostParse = errors.New("internal: unable to net.SplitHostParse")
	ErrCantParseRemoteIP  = errors.New("internal: unable to parse remote IP")
)

var CGNat = netip.MustParsePrefix("100.64.0.0/10")

var HealthSrv = health.NewServer()

Functions

func ClampIP

func ClampIP(addr netip.Addr) (netip.Prefix, bool)

func CustomRealIPHeader

func CustomRealIPHeader(customRealIPHeaderValue string, next http.Handler) http.Handler

CustomXRealIPHeader sets the X-Real-IP header to the value of a different header. Used in environments where the upstream proxy sets the request's origin IP in a custom header.

func FastHash

func FastHash(text string) string

FastHash is a high-performance non-cryptographic hash function suitable for internal caching, policy rule identification, and other performance-critical use cases where cryptographic security is not required.

func GetFilteredHTTPLogger

func GetFilteredHTTPLogger() *log.Logger

func GetHealth

func GetHealth(svc string) (healthv1.HealthCheckResponse_ServingStatus, bool)

func GetRequestLogger

func GetRequestLogger(base *slog.Logger, r *http.Request) *slog.Logger

func GzipMiddleware

func GzipMiddleware(level int, next http.Handler) http.Handler

func InitSlog

func InitSlog(level string, sink io.Writer) *slog.Logger

func JA4H

func JA4H(next http.Handler) http.Handler

func NoBrowsing

func NoBrowsing(next http.Handler) http.Handler

NoBrowsing prevents directory browsing by returning a 404 for any request that ends with a "/".

func NoStoreCache

func NoStoreCache(next http.Handler) http.Handler

NoStoreCache sets the Cache-Control header to no-store for the response.

func RealIP

func RealIP(r *http.Request) (netip.Addr, bool)

func RemoteXRealIP

func RemoteXRealIP(useRemoteAddress bool, bindNetwork string, next http.Handler) http.Handler

RemoteXRealIP sets the X-Real-Ip header to the request's real IP if the setting is enabled by the user.

func SHA256sum

func SHA256sum(text string) string

SHA256sum computes a cryptographic hash. Still used for proof-of-work challenges where we need the security properties of a cryptographic hash function.

func SetHealth

func SetHealth(svc string, status healthv1.HealthCheckResponse_ServingStatus)

func UnbreakDocker

func UnbreakDocker()

func UnchangingCache

func UnchangingCache(next http.Handler) http.Handler

UnchangingCache sets the Cache-Control header to cache a response for 1 year if and only if the application is compiled in "release" mode by Docker.

func XForwardedForToXRealIP

func XForwardedForToXRealIP(next http.Handler) http.Handler

XForwardedForToXRealIP sets the X-Real-Ip header based on the contents of the X-Forwarded-For header.

func XForwardedForUpdate

func XForwardedForUpdate(stripPrivate bool, next http.Handler) http.Handler

XForwardedForUpdate sets or updates the X-Forwarded-For header, adding the known remote address to an existing chain if present

Types

type ErrorLogFilter

type ErrorLogFilter struct {
	Unwrap *log.Logger
}

ErrorLogFilter is used to suppress "context canceled" logs from the http server when a request is canceled (e.g., when a client disconnects).

func (*ErrorLogFilter) Write

func (elf *ErrorLogFilter) Write(p []byte) (n int, err error)

type ListOr

type ListOr[T any] []T

ListOr[T any] is a slice that can contain either a single T or multiple T values. During JSON unmarshaling, it checks if the first character is '[' to determine whether to treat the JSON as an array or a single value.

func (*ListOr[T]) UnmarshalJSON

func (lo *ListOr[T]) UnmarshalJSON(data []byte) error

type XFFComputePreferences

type XFFComputePreferences struct {
	StripPrivate  bool
	StripLoopback bool
	StripCGNAT    bool
	StripLLU      bool
	Flatten       bool
}

TODO: move into config