camo

Documentation

Overview

Package camo provides an HTTP proxy server with content type restrictions as well as regex host allow list support.

Package camo provides an HTTP proxy server with content type restrictions as well as regex host allow list support.

Package camo provides an HTTP proxy server with content type restrictions as well as regex host allow list support.

Package camo provides an HTTP proxy server with content type restrictions as well as regex host allow list support.

Index

• Constants
• Variables
• type Config
• type FilterFunc
• type LimitReadCloser
  • func NewLimitReadCloser(r io.ReadCloser, n int64) *LimitReadCloser
  • func (l *LimitReadCloser) Read(p []byte) (int, error)
• type Proxy
  • func New(pc Config) (*Proxy, error)
  • func NewWithFilters(pc Config, filters []FilterFunc) (*Proxy, error)
  • func (p *Proxy) ServeHTTP(w http.ResponseWriter, req *http.Request)

Constants

const (
	MetricNamespace = "camo"
	MetricSubsystem = "proxy"
)

Namespace used for Prometheus metrics.

Variables

var (
	ErrRedirect        = errors.New("bad redirect")
	ErrDenyList        = errors.New("denylist host failure")
	ErrRejectIP        = errors.New("ip rejection")
	ErrInvalidHostPort = errors.New("invalid host/port")
	ErrInvalidNetType  = errors.New("invalid network type")
)

var ValidReqHeaders = map[string]bool{
	"Accept":         true,
	"Accept-Charset": true,

	"Accept-Encoding":   false,
	"Accept-Language":   true,
	"Cache-Control":     true,
	"If-None-Match":     true,
	"If-Modified-Since": true,

	"X-Forwarded-For": false,

	"Range": true,
}

ValidReqHeaders are http request headers that are acceptable to pass from the client to the remote server. Only those present and true, are forwarded. Empty implies no filtering.

var ValidRespHeaders = map[string]bool{

	"Accept-Ranges":  true,
	"Content-Length": true,
	"Content-Range":  true,

	"Cache-Control":    true,
	"Content-Encoding": true,
	"Content-Type":     true,
	"Etag":             true,
	"Expires":          true,
	"Last-Modified":    true,

	"Server":            false,
	"Transfer-Encoding": true,
}

ValidRespHeaders are http response headers that are acceptable to pass from the remote server to the client. Only those present and true, are forwarded. Empty implies no filtering.

Types

type Config

type Config struct {
	// Server name used in Headers and Via checks
	ServerName string
	// HMACKey is a byte slice to be used as the hmac key
	HMACKey []byte
	// MaxSize is the maximum valid image size response (in bytes).
	MaxSize int64
	// MaxSizeRedirect is the URL to redirect when MaxSize is exceeded.
	MaxSizeRedirect string
	// MaxRedirects is the maximum number of redirects to follow.
	MaxRedirects int
	// Request timeout is a timeout for fetching upstream data.
	RequestTimeout time.Duration
	// IdleTimeout is the maximum amount of time to wait for the next request when keep-alive is enabled
	IdleTimeout time.Duration
	// Maximum duration for reading the entire request, including the body.
	ReadTimeout time.Duration
	// Keepalive enable/disable
	DisableKeepAlivesFE bool
	DisableKeepAlivesBE bool
	// x-forwarded-for enable/disable
	EnableXFwdFor bool
	// additional content types to allow
	AllowContentVideo bool
	AllowContentAudio bool
	// allow URLs to contain user/pass credentials
	AllowCredentialURLs bool
	// Whether to call/increment metrics
	CollectMetrics bool
	// contains filtered or unexported fields
}

Config holds configuration data used when creating a Proxy with New.

type FilterFunc

type FilterFunc func(*url.URL) (bool, error)

The FilterFunc type is a function that validates a *url.URL A true value approves the url. A false value rejects the url.

type LimitReadCloser

type LimitReadCloser struct {
	io.ReadCloser
	io.Reader
}

func NewLimitReadCloser

func NewLimitReadCloser(r io.ReadCloser, n int64) *LimitReadCloser

func (*LimitReadCloser) Read

func (l *LimitReadCloser) Read(p []byte) (int, error)

type Proxy

type Proxy struct {
	// contains filtered or unexported fields
}

A Proxy is a Camo like HTTP proxy, that provides content type restrictions as well as regex host allow list support.

func New

func New(pc Config) (*Proxy, error)

New returns a new Proxy. Returns an error if Proxy could not be constructed.

func NewWithFilters

func NewWithFilters(pc Config, filters []FilterFunc) (*Proxy, error)

NewWithFilters returns a new Proxy that utilises the passed in proxy filters. filters are evaluated in order, and the first false response from a filter function halts further evaluation and fails the request.

func (*Proxy) ServeHTTP

func (p *Proxy) ServeHTTP(w http.ResponseWriter, req *http.Request)

ServerHTTP handles the client request, validates the request is validly HMAC signed, filters based on the Allow list, and then proxies valid requests to the desired endpoint. Responses are filtered for proper image content types.