openmoat_proxy/lib.rs
1//! `openmoat-proxy`: the default-deny egress proxy behind `moat proxy` (ADR-020).
2//!
3//! It serves HTTP `CONNECT` tunnels and absolute-form plain-HTTP requests on a
4//! loopback port:
5//!
6//! - Hosts are decided by openmoat-core's [`CompiledPolicy`](openmoat_core::CompiledPolicy)
7//! as `moat guard` decides a fetch tool's URL: only an `allow` passes.
8//! - Cloud metadata and link-local addresses are refused whatever the policy
9//! says, by name and on every address the proxy resolves. Private and CGNAT
10//! addresses are refused unless an allow rule names the address.
11//! - A tunnel's TLS `ClientHello` must name the CONNECT host (SNI); nothing is
12//! decrypted.
13//! - A request that carries a brokered secret's placeholder or value to a host
14//! other than the secret's own is refused ([`Broker`]).
15//! - Every decision is recorded through a [`Recorder`]; a failed record is a
16//! refused connection.
17//!
18//! Plain `std::net` and one thread per connection, capped by [`Limits`]; the
19//! choice is explained in `docs/notes/proxy-evaluation.md`.
20
21#![warn(missing_docs)]
22
23mod audit;
24mod broker;
25mod decide;
26mod request;
27mod server;
28mod sni;
29mod tunnel;
30mod upstream;
31
32pub use audit::{Connection, RecordError, Recorder};
33pub use broker::{Broker, BrokerError, Carried, Leak, RULE_SECRET};
34pub use decide::{
35 Forbidden, RULE_ADDRESS, RULE_AUDIT, RULE_REQUEST, RULE_SNI, RULE_UPSTREAM, address_policy,
36 forbidden, host as decide_host, named as address_named,
37};
38pub use request::{MAX_HEADERS, Request, RequestError, Target, parse as parse_request};
39pub use server::{Limits, Proxy};
40pub use sni::{Hello, HelloError, MAX_HELLO, server_name};
41pub use upstream::{Refusal, Resolve, SystemResolver, connect};