paranoidhttp

README

Paranoidhttp

Paranoidhttp provides a pre-configured http.Client that protects you from harm.

Description

Paranoidhttp is a factory of http.Client that is paranoid againt attackers. This is useful when you craete a HTTP request using inputs from possibly malicious users.

The created http.Client protects you from connecting to internal IP ranges even though redirects or DNS tricks are used.

Synopsis

// use the default client for ease
res, err := paranoidhttp.DefaultClient.Get("http://www.hatena.ne.jp")

// or customize the client for yourself
client, transport, dialer := paranoidhttp.NewClient()
client.Timeout = 10 * time.Second
transport.DisableCompression = true
dialer.KeepAlive = 60 * time.Second

// Add an permitted ipnets with functional option
ipNet, _ := net.ParseCIDR("127.0.0.1/32")
client, _, _ := paranoidhttp.New(
    paranoidhttp.PermittedIPNets(ipNet))

Known Issues

• Supports only IPv4 (blocks IPv6).

Acknowledgement

I want to thank LWPx::ParanoidAgent.

License

MIT

Author

hakobe

Documentation

Index

• Variables
• func NewClient(opts ...Option) (*http.Client, *http.Transport, *net.Dialer)
• func NewDialer(dialer *net.Dialer, opts ...Option) func(ctx context.Context, network, addr string) (net.Conn, error)
• type Option
  • func ForbiddenHosts(hostRegs ...*regexp.Regexp) Option
  • func ForbiddenIPNets(ips ...*net.IPNet) Option
  • func PermittedIPNets(ips ...*net.IPNet) Option

Variables

var (
	DefaultClient *http.Client
)

DefaultClient is the default Client whose setting is the same as http.DefaultClient.

Functions

func NewClient

func NewClient(opts ...Option) (*http.Client, *http.Transport, *net.Dialer)

NewClient returns a new http.Client configured to be paranoid for attackers.

This also returns http.Tranport and net.Dialer so that you can customize those behavior.

func NewDialer

func NewDialer(dialer *net.Dialer, opts ...Option) func(ctx context.Context, network, addr string) (net.Conn, error)

NewDialer returns a dialer function which only accepts IPv4 connections.

This is used to create a new paranoid http.Client, because I'm not sure about a paranoid behavior for IPv6 connections :(

Types

type Option

type Option func(*config)

Option type of paranoidhttp

func ForbiddenHosts

func ForbiddenHosts(hostRegs ...*regexp.Regexp) Option

ForbiddenHosts set forbidden host rules by regexp

func ForbiddenIPNets

func ForbiddenIPNets(ips ...*net.IPNet) Option

ForbiddenIPNets sets forbidden IPNets

func PermittedIPNets

func PermittedIPNets(ips ...*net.IPNet) Option

PermittedIPNets sets permitted IPNets It takes priority over other forbidden rules.