kz-proxy 0.3.0

MITM proxy and subprocess sandbox for blind secret injection
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

//! kz-proxy: run a subprocess with masked secrets and an HTTP proxy that rewrites tokens.
//!
//! The main type is [`Sandbox`]: build it from a [`SandboxConfig`] (with optional [`SecretMapping`]s,
//! [`StringMapping`]s, and connection allow/deny rules), then call [`Sandbox::run`] to execute a shell
//! command with masked env vars and proxied HTTP that rewrites tokens to real secrets.
//!
//! The proxy is implemented with the [hyper](https://github.com/hyperium/hyper) stack so that
//! HTTP parsing, Content-Length, chunked encoding, and CONNECT tunneling follow RFC 7230/9110.

mod enforce;
pub use enforce::ESSENTIAL_VARS;
#[cfg(target_os = "linux")]
mod enforce_linux;
mod mitm;
pub(crate) mod proxy;
pub(crate) mod rewrite;
pub(crate) mod types;

pub use types::{
    ConnectionPolicy, HostPattern, Sandbox, SandboxConfig, SecretMapping, StringMapping,
};