openmoat_proxy/
lib.rs

1//! `openmoat-proxy`: the default-deny egress proxy behind `moat proxy` (ADR-020).
2//!
3//! It serves HTTP `CONNECT` tunnels and absolute-form plain-HTTP requests on a
4//! loopback port:
5//!
6//! - Hosts are decided by openmoat-core's [`CompiledPolicy`](openmoat_core::CompiledPolicy)
7//!   as `moat guard` decides a fetch tool's URL: only an `allow` passes. A host
8//!   is reached on 443 and 80 unless a rule names `host:port` ([`port_policy`]).
9//! - Cloud metadata and link-local addresses are refused whatever the policy
10//!   says, by name and on every address the proxy resolves. Private and CGNAT
11//!   addresses are refused unless an allow rule names the address.
12//! - A tunnel's TLS `ClientHello` must name the CONNECT host (SNI); nothing is
13//!   decrypted.
14//! - A request that carries a brokered secret's placeholder or value to a host
15//!   other than the secret's own is refused ([`Broker`]).
16//! - Every decision is recorded through a [`Recorder`]; a failed record is a
17//!   refused connection.
18//! - In session mode ([`Sessions`], ADR-027) every request must carry its
19//!   session's credential. The session's audit id goes on each row, a
20//!   session that read secret material reaches only that secret's host, and
21//!   no session holds more than half the connections.
22//! - A connection that starts with a [`LocalService`]'s prefix goes to that
23//!   service of the proxy's own process (ADR-028), not upstream.
24//!
25//! Plain `std::net` and one thread per connection, capped by [`Limits`]; the
26//! choice is explained in `docs/ARCHITECTURE.md` §12.
27
28#![warn(missing_docs)]
29// A library reports to its caller; only the `moat` binary prints.
30#![warn(clippy::print_stdout, clippy::print_stderr)]
31
32mod audit;
33mod body;
34mod broker;
35mod decide;
36mod local;
37mod request;
38mod server;
39mod session;
40mod slots;
41mod sni;
42mod tunnel;
43mod upstream;
44
45pub use audit::{Connection, RecordError, Recorder};
46pub use broker::{Broker, BrokerError, Carried, Leak, RULE_SECRET};
47pub use decide::{
48    DEFAULT_PORTS, Forbidden, RULE_ADDRESS, RULE_AUDIT, RULE_PORT, RULE_REQUEST, RULE_SNI,
49    RULE_UPSTREAM, address_policy, denied as address_denied, forbidden, host as decide_host,
50    host_port as decide_host_port, named as address_named, named_on as address_named_on,
51    port_policy, tainted as decide_tainted,
52};
53pub use local::LocalService;
54pub use request::{
55    MAX_HEADERS, ProxyCredential, Request, RequestError, Target, parse as parse_request,
56};
57pub use server::{Limits, Proxy, RULE_CAPACITY};
58pub use session::{
59    AuthError, Credential, CredentialError, MIN_TOKEN_LEN, RULE_SESSION, Sessions, TaintLookup,
60    constant_time_eq,
61};
62pub use sni::{Hello, HelloError, MAX_HELLO, server_name};
63pub use upstream::{Refusal, Resolve, SystemResolver, connect};
openmoat_proxy/lib.rs

openmoat_proxy/
lib.rs
