Package org.microproxy.starlark


package org.microproxy.starlark
  • Class
    Description
    A fixed-width protobuf value in a script: what protobuf.decode gives for a field with wire type fixed32 or fixed64 (without a schema it could be an integer or a float), and what protobuf.fixed32(x) and protobuf.fixed64(x) make.
    A protobuf group (proto2's deprecated wire types 3 and 4) in a script: what protobuf.decode gives for one, and what protobuf.group(fields) makes.
    A client's TLS ClientHello, as on_client_hello and ctx.client_hello see it: a read-only view of a ClientHello.
    Per-request context: who the client is, vars, a dict that lives as long as the request so on_request can leave notes for on_response, timings, a snapshot of the exchange's timings taken when it is read, client_hello, the TLS ClientHello that started the client's intercepted session (None before it is read, and for plain HTTP), forwarded_via, the session's server that the request is forwarded through as the client's proxy (host:port: an intercepted HTTPS proxy, or an HTTP proxy whose session is plain HTTP), or None, socks_version, the SOCKS version the client reached the proxy with (5, or 4 for SOCKS4 and 4a), or None for an HTTP client, transparent_quic, whether the client's QUIC came to the transparent QUIC listener, and script_stats, what the calls into scripts for the exchange added up to so far (calls, time, interpreter steps and bytes of values created; see ScriptUsageValue), early_data, whether the HTTP/3 request arrived as 0-RTT early data, which may be a replay: a hook may answer it 425 (Too Early) for its client to send again after the handshake, protocol, the protocol the client speaks to the proxy ("http1", "http2" or "http3", whose protocol policy applies), or None where the hook gets no flow.
    Drives the proxy from a Starlark script.
    Options for ScriptedProxy.
    A Starlark script failed to parse, compile or run its top-level statements.
    Why the proxy has to answer a request itself, as on_failure sees it: a read-only view of a ProxyFailure.
    A WebSocket frame as on_websocket_frame sees it.
    Where a frame on_frame sees travels: the protocol, the client connection and stream, the client and the server.
    The headers of a request or response, or the header block of an HTTP/2 or HTTP/3 frame.
    An HTTP/2 or HTTP/3 frame as on_frame sees it, or as h2.data(...) and the like make it.
    An intercepted QUIC connection, or one of its streams, as on_quic_start, on_quic_stream_data, on_quic_message, on_quic_datagram and on_quic_end see it: the client, the server (host, port, server, and address, where the proxy connected to), the sni and alpn both sides use, whether the QUIC came inside a CONNECT-UDP flow (masque), vars, a dict that lives as long as the connection (its streams share it), and error, why the connection failed (None until then, and for one that ended normally).
    Bytes of an intercepted QUIC connection, as on_quic_stream_data (bytes read from one side of a stream), on_quic_message (one whole message of a framed stream, without its length prefix or delimiter) and on_quic_datagram (one datagram) see them: data, text (None when the bytes are not valid UTF-8, as a character split between two reads is not), from_client, stream_id (on the client's connection; None for a datagram) and timestamp (seconds since the epoch).
    A request as scripts see it.
    A response as scripts see it: from the server in on_response, or made by response().
    The stats module: a script's own metrics, kept in the proxy's StatsRegistry as script.<name> next to the proxy's (and shown wherever they are: Prometheus, statsd).
    A counter of a script.
    A gauge of a script.
    A histogram of a script.
    A raw TCP tunnel, as on_tcp_start, on_tcp_message and on_tcp_end see it: the client, the target, whether the proxy decrypted the client's TLS (tls) with its sni and alpn, vars, a dict that lives as long as the tunnel, and error, why the tunnel failed (None until then, and for one that ended normally).
    Bytes read from one side of a raw TCP tunnel, as on_tcp_message sees them: data, text (None when the bytes are not valid UTF-8, as a character split between two messages is not), from_client and timestamp (seconds since the epoch).
    ctx.timings: a read-only snapshot of the exchange's FlowTimings, in milliseconds as floats, each None when that phase has not happened (yet) or did not happen at all.
    The trace module: the distributed trace of the exchange a hook runs for (see microproxy-otel), whose span a script can add attributes and events to: trace.set_attribute("tenant", "acme"), trace.add_event("rule.matched", {"rule": "r1"}).
    A UDP flow (CONNECT-UDP), as on_udp_start, on_udp_message and on_udp_end see it: the client, the target (host, port, server, and address, what its name resolved to), and vars, a dict that lives as long as the flow.
    One datagram of a UDP flow (CONNECT-UDP), as on_udp_message sees it: data, text (None when the payload is not valid UTF-8), from_client and timestamp (seconds since the epoch).
    ctx.script_stats: what the calls into scripts for the exchange added up to before the call reading it (FlowContext.scriptStats()), read when it is: calls, time_ms (a float), steps and alloc_bytes (an estimate of the bytes of values the calls created, not of what stayed in memory).
    A whole WebSocket message as on_websocket_message sees it, or one a script made with websocket_message(...).
    Adds --script to the command line when this module is on the class path.
    A compiled Starlark file whose top-level statements have run.
    Bounds on each call into a script (and on running its top level).