Ilker ManapandClaude Opus 5.5
a56ad8e4c4
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
42 lines
1.3 KiB
Go
42 lines
1.3 KiB
Go
package mirror
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"net/netip"
|
|
"net/url"
|
|
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/safedial"
|
|
)
|
|
|
|
// errPrivateSource is a fetch refused because it would reach this machine or
|
|
// the network behind it rather than the internet.
|
|
var errPrivateSource = safedial.ErrBlocked
|
|
|
|
// fetchClient downloads sources for the management API.
|
|
//
|
|
// The API fetches whatever URL it is given and the file server then hands the
|
|
// result to anyone. Without this, "fetch http://169.254.169.254/..." was a way
|
|
// to read a cloud's instance metadata — or anything else on the network the
|
|
// mirror sits in — through the mirror. No overall timeout: a model is tens of
|
|
// gigabytes, and after the first byte a stall is the context's to end.
|
|
func fetchClient(allowPrivate bool) *http.Client {
|
|
if allowPrivate {
|
|
return safedial.Client(safedial.Policy{Private: true, Loopback: true, LinkLocal: true}, 0)
|
|
}
|
|
return safedial.Client(safedial.Policy{}, 0)
|
|
}
|
|
|
|
func blockedAddr(a netip.Addr) bool { return safedial.Blocked(a, safedial.Policy{}) }
|
|
|
|
func checkScheme(u *url.URL) error { return safedial.CheckScheme(u) }
|
|
|
|
// validSource checks a source before a download is started for it.
|
|
func validSource(source string) error {
|
|
u, err := url.Parse(source)
|
|
if err != nil || u.Host == "" {
|
|
return fmt.Errorf("%q is not a URL", source)
|
|
}
|
|
return checkScheme(u)
|
|
}
|