openmoat_proxy/lib.rs
1//! `openmoat-proxy`: the default-deny egress proxy behind `moat proxy` (ADR-020).
2//!
3//! It serves HTTP `CONNECT` tunnels and absolute-form plain-HTTP requests on a
4//! loopback port:
5//!
6//! - Hosts are decided by openmoat-core's [`CompiledPolicy`](openmoat_core::CompiledPolicy)
7//! as `moat guard` decides a fetch tool's URL: only an `allow` passes.
8//! - Cloud metadata and link-local addresses are refused whatever the policy
9//! says, by name and on every address the proxy resolves. Private and CGNAT
10//! addresses are refused unless an allow rule names the address.
11//! - A tunnel's TLS `ClientHello` must name the CONNECT host (SNI); nothing is
12//! decrypted.
13//! - A request that carries a brokered secret's placeholder or value to a host
14//! other than the secret's own is refused ([`Broker`]).
15//! - Every decision is recorded through a [`Recorder`]; a failed record is a
16//! refused connection.
17//!
18//! Plain `std::net` and one thread per connection, capped by [`Limits`]; the
19//! choice is explained in `docs/ARCHITECTURE.md` ยง12.
20
21#![warn(missing_docs)]
22// A library reports to its caller; only the `moat` binary prints.
23#![warn(clippy::print_stdout, clippy::print_stderr)]
24
25mod audit;
26mod broker;
27mod decide;
28mod request;
29mod server;
30mod sni;
31mod tunnel;
32mod upstream;
33
34pub use audit::{Connection, RecordError, Recorder};
35pub use broker::{Broker, BrokerError, Carried, Leak, RULE_SECRET};
36pub use decide::{
37 Forbidden, RULE_ADDRESS, RULE_AUDIT, RULE_REQUEST, RULE_SNI, RULE_UPSTREAM, address_policy,
38 forbidden, host as decide_host, named as address_named,
39};
40pub use request::{MAX_HEADERS, Request, RequestError, Target, parse as parse_request};
41pub use server::{Limits, Proxy};
42pub use sni::{Hello, HelloError, MAX_HELLO, server_name};
43pub use upstream::{Refusal, Resolve, SystemResolver, connect};