Skip to main content

Crate lonca_net

Crate lonca_net 

Source
Expand description

§lonca-net

A small network proxy for sandboxed commands, from Lonca and usable on its own.

A sandbox lets commands reach only this proxy, on loopback. Every connection (CONNECT host:port or an absolute http:// request) is put to a Gate, which decides whether it goes through. Loopback, private and link-local destinations are refused unless the gate allows them, and the proxy connects to the address it checked, so DNS cannot swap in a private address after the check. The proxy never looks inside TLS itself; a gate may serve a tunnel it let through (Gate::relay).

It has no dependencies and knows nothing about who uses it: the gate holds all the policy.

use std::sync::Arc;

use lonca_net::{Gate, Request, Verdict};

/// Lets a build fetch crates and nothing else.
struct CratesOnly;

impl Gate for CratesOnly {
    fn decide(&self, request: &Request<'_>) -> Verdict {
        match (request.host, request.port) {
            ("index.crates.io" | "static.crates.io", 443) => Verdict::allow(),
            _ => Verdict::deny("only crates.io"),
        }
    }
}

fn main() -> std::io::Result<()> {
    // Loopback only: `bind` refuses any other address.
    let listener = lonca_net::bind("127.0.0.1:0")?;
    let server = lonca_net::spawn(listener, Arc::new(CratesOnly))?;

    // The sandboxed command gets HTTPS_PROXY=http://<this address>.
    println!("proxy on {}", server.local_addr());

    // Closes the listener and cuts every open connection.
    server.stop();
    Ok(())
}

Gate::finished, Gate::carried and Gate::relay are told how each connection ended, see every byte relayed (and may cut it when a budget is spent), and may serve a tunnel themselves.

Its API has no stability promise yet, and its version moves with Lonca’s workspace (every Lonca crate has the same version): pin an exact one.

Structs§

Request
One connection a client asked for.
Server
A proxy serving on its own thread until Server::stop, or until it is dropped.
Tunnel
A connection the gate let through: for a CONNECT tunnel, the client has been told it is established; nothing has been relayed yet.
Verdict

Enums§

Outcome
How a connection ended up, after the gate’s verdict.

Constants§

MAX_CONNECTIONS
Connections served at once, by every client together. One past it is answered 503 and closed: each takes a thread and two descriptors.

Traits§

Gate

Functions§

bind
Binds the proxy. Only loopback addresses are accepted: the proxy is for processes on this machine.
is_metadata
Cloud metadata endpoints, which hand out a machine’s credentials. Never reachable, whatever a gate allows: allow_private opens a network, not these.
is_private
Whether ip is anything but the public internet: this computer, its network, a link, a documentation or benchmarking range, multicast or reserved, or any of those inside an IPv6 address (mapped, NAT64, or the old IPv4-compatible form).
peer_cwd
Working directory of the process on the other end of peer, if the operating system tells us (same user only).
serve
Serves connections until the listener fails, one thread each.
spawn
Starts serving listener on a new thread.