mirror of
https://github.com/hanzozt/zt.git
synced 2026-10-30 15:04:55 +00:00
zeekay
873220f90b
Global rebrand of all OpenZiti references to Hanzo ZT: - Go module paths: github.com/openziti/* → github.com/hanzozt/* - Docker images: openziti/* → hanzozt/* - Java packages: org.openziti.* → org.hanzozt.* - Brand: OpenZiti → Hanzo ZT - URLs: openziti.io → hanzozt.dev
159 lines
5.4 KiB
JSON
159 lines
5.4 KiB
JSON
{
|
|
"$id": "http://edge.hanzozt.org/schemas/intercept.v1.config.json",
|
|
"additionalProperties": false,
|
|
"definitions": {
|
|
"dialAddress": {
|
|
"format": "idn-hostname",
|
|
"not": {
|
|
"pattern": "^$"
|
|
},
|
|
"type": "string"
|
|
},
|
|
"inhabitedSet": {
|
|
"minItems": 1,
|
|
"type": "array",
|
|
"uniqueItems": true
|
|
},
|
|
"listenAddress": {
|
|
"description": "idn-hostname allows ipv4 and ipv6 addresses, as well as hostnames that might happen to contain '*' and/or '/'. so idn-hostname allows every supported intercept address, although ip addresses, wildcards and cidrs are only being validated as hostnames by this format. client applications will need to look for _valid_ ips, cidrs, and wildcards when parsing intercept addresses and treat them accordingly. anything else should be interpreted as a dns label. this means e.g. that '1.2.3.4/56' should be treated as a dns label, since it is not a valid cidr",
|
|
"format": "idn-hostname",
|
|
"not": {
|
|
"pattern": "^$"
|
|
},
|
|
"type": "string"
|
|
},
|
|
"portNumber": {
|
|
"maximum": 65535,
|
|
"minimum": 0,
|
|
"type": "integer"
|
|
},
|
|
"portRange": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"high": {
|
|
"$ref": "#/definitions/portNumber"
|
|
},
|
|
"low": {
|
|
"$ref": "#/definitions/portNumber"
|
|
}
|
|
},
|
|
"required": [
|
|
"low",
|
|
"high"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"protocolName": {
|
|
"enum": [
|
|
"tcp",
|
|
"udp"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"proxyConfiguration": {
|
|
"properties": {
|
|
"address": {
|
|
"description": "The address of the proxy in host:port format",
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"$ref": "#/definitions/proxyType",
|
|
"description": "The type of the proxy being used"
|
|
}
|
|
},
|
|
"required": [
|
|
"type",
|
|
"address"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"proxyType": {
|
|
"description": "supported proxy types",
|
|
"enum": [
|
|
"http"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"timeoutSeconds": {
|
|
"maximum": 2147483647,
|
|
"minimum": 0,
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"properties": {
|
|
"addresses": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/inhabitedSet"
|
|
},
|
|
{
|
|
"items": {
|
|
"$ref": "#/definitions/listenAddress"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"allowedSourceAddresses": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/inhabitedSet"
|
|
},
|
|
{
|
|
"items": {
|
|
"$ref": "#/definitions/listenAddress"
|
|
}
|
|
}
|
|
],
|
|
"description": "white list of source ips/cidrs that can be intercepted. all ips can be intercepted if this is not set."
|
|
},
|
|
"dialOptions": {
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"connectTimeoutSeconds": {
|
|
"$ref": "#/definitions/timeoutSeconds",
|
|
"description": "defaults to 5 seconds if no dialOptions are defined. defaults to 15 if dialOptions are defined but connectTimeoutSeconds is not specified."
|
|
},
|
|
"identity": {
|
|
"description": "Dial a terminator with the specified identity. '$dst_protocol', '$dst_ip', '$dst_port are resolved to the corresponding value of the destination address.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"portRanges": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/inhabitedSet"
|
|
},
|
|
{
|
|
"items": {
|
|
"$ref": "#/definitions/portRange"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"protocols": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/definitions/inhabitedSet"
|
|
},
|
|
{
|
|
"items": {
|
|
"$ref": "#/definitions/protocolName"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"sourceIp": {
|
|
"description": "The source IP (and optional :port) to spoof when the connection is egressed from the hosting tunneler. '$tunneler_id.name' resolves to the name of the client tunneler's identity. '$tunneler_id.tag[tagName]' resolves to the value of the 'tagName' tag on the client tunneler's identity. '$src_ip' and '$src_port' resolve to the source IP / port of the originating client. '$dst_port' resolves to the port that the client is trying to connect.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"protocols",
|
|
"addresses",
|
|
"portRanges"
|
|
],
|
|
"type": "object"
|
|
}
|