Package org.microproxy.starlark
package org.microproxy.starlark
-
ClassDescriptionA fixed-width protobuf value in a script: what
protobuf.decodegives for a field with wire type fixed32 or fixed64 (without a schema it could be an integer or a float), and whatprotobuf.fixed32(x)andprotobuf.fixed64(x)make.A protobuf group (proto2's deprecated wire types 3 and 4) in a script: whatprotobuf.decodegives for one, and whatprotobuf.group(fields)makes.A client's TLSClientHello, ason_client_helloandctx.client_hellosee it: a read-only view of aClientHello.Per-request context: who the client is,vars, a dict that lives as long as the request soon_requestcan leave notes foron_response,timings, a snapshot of the exchange's timings taken when it is read,client_hello, the TLS ClientHello that started the client's intercepted session (Nonebefore it is read, and for plain HTTP),forwarded_via, the session's server that the request is forwarded through as the client's proxy (host:port: an intercepted HTTPS proxy, or an HTTP proxy whose session is plain HTTP), orNone,socks_version, the SOCKS version the client reached the proxy with (5, or4for SOCKS4 and 4a), orNonefor an HTTP client,transparent_quic, whether the client's QUIC came to the transparent QUIC listener, andscript_stats, what the calls into scripts for the exchange added up to so far (calls, time, interpreter steps and bytes of values created; seeScriptUsageValue),early_data, whether the HTTP/3 request arrived as 0-RTT early data, which may be a replay: a hook may answer it425(Too Early) for its client to send again after the handshake,protocol, the protocol the client speaks to the proxy ("http1","http2"or"http3", whose protocol policy applies), orNonewhere the hook gets no flow.Drives the proxy from a Starlark script.Options forScriptedProxy.A Starlark script failed to parse, compile or run its top-level statements.Why the proxy has to answer a request itself, ason_failuresees it: a read-only view of aProxyFailure.A WebSocket frame ason_websocket_framesees it.Where a frameon_framesees travels: the protocol, the client connection and stream, the client and the server.The headers of a request or response, or the header block of an HTTP/2 or HTTP/3 frame.An HTTP/2 or HTTP/3 frame ason_framesees it, or ash2.data(...)and the like make it.An intercepted QUIC connection, or one of its streams, ason_quic_start,on_quic_stream_data,on_quic_message,on_quic_datagramandon_quic_endsee it: the client, the server (host,port,server, andaddress, where the proxy connected to), thesniandalpnboth sides use, whether the QUIC came inside a CONNECT-UDP flow (masque),vars, a dict that lives as long as the connection (its streams share it), anderror, why the connection failed (Noneuntil then, and for one that ended normally).Bytes of an intercepted QUIC connection, ason_quic_stream_data(bytes read from one side of a stream),on_quic_message(one whole message of a framed stream, without its length prefix or delimiter) andon_quic_datagram(one datagram) see them:data,text(Nonewhen the bytes are not valid UTF-8, as a character split between two reads is not),from_client,stream_id(on the client's connection;Nonefor a datagram) andtimestamp(seconds since the epoch).A request as scripts see it.A response as scripts see it: from the server inon_response, or made byresponse().Thestatsmodule: a script's own metrics, kept in the proxy'sStatsRegistryasscript.<name>next to the proxy's (and shown wherever they are: Prometheus, statsd).A counter of a script.A gauge of a script.A histogram of a script.A raw TCP tunnel, ason_tcp_start,on_tcp_messageandon_tcp_endsee it: the client, the target, whether the proxy decrypted the client's TLS (tls) with itssniandalpn,vars, a dict that lives as long as the tunnel, anderror, why the tunnel failed (Noneuntil then, and for one that ended normally).Bytes read from one side of a raw TCP tunnel, ason_tcp_messagesees them:data,text(Nonewhen the bytes are not valid UTF-8, as a character split between two messages is not),from_clientandtimestamp(seconds since the epoch).ctx.timings: a read-only snapshot of the exchange'sFlowTimings, in milliseconds as floats, eachNonewhen that phase has not happened (yet) or did not happen at all.Thetracemodule: the distributed trace of the exchange a hook runs for (seemicroproxy-otel), whose span a script can add attributes and events to:trace.set_attribute("tenant", "acme"),trace.add_event("rule.matched", {"rule": "r1"}).A UDP flow (CONNECT-UDP), ason_udp_start,on_udp_messageandon_udp_endsee it: the client, the target (host,port,server, andaddress, what its name resolved to), andvars, a dict that lives as long as the flow.One datagram of a UDP flow (CONNECT-UDP), ason_udp_messagesees it:data,text(Nonewhen the payload is not valid UTF-8),from_clientandtimestamp(seconds since the epoch).ctx.script_stats: what the calls into scripts for the exchange added up to before the call reading it (FlowContext.scriptStats()), read when it is:calls,time_ms(a float),stepsandalloc_bytes(an estimate of the bytes of values the calls created, not of what stayed in memory).A whole WebSocket message ason_websocket_messagesees it, or one a script made withwebsocket_message(...).Adds--scriptto the command line when this module is on the class path.A compiled Starlark file whose top-level statements have run.Bounds on each call into a script (and on running its top level).