Add denyHosts flag to deny URLs for certain hosts

For example, when running in a Docker swarm cluster we dont want it to
have access to our internal services available under *.weave.local

Closes #85

imageproxy.go

@@ -49,6 +49,10 @@ type Proxy struct {
 	// Whitelist should no longer be used. Use "AllowHosts" instead.
 	Whitelist []string
 
+	// DenyHosts specifies a list of remote hosts that images cannot be
+	// proxied from.
+	DenyHosts []string
+
 	// Referrers, when given, requires that requests to the image
 	// proxy come from a referring host. An empty list means all
 	// hosts are allowed.
@@ -225,6 +229,10 @@ func (p *Proxy) allowed(r *Request) error {
 		return fmt.Errorf("request does not contain an allowed referrer: %v", r)
 	}
 
+	if validHost(p.DenyHosts, r.URL) {
+		return fmt.Errorf("request contains a denied host %v", r)
+	}
+
 	if len(p.AllowHosts) == 0 && len(p.SignatureKey) == 0 {
 		return nil // no allowed hosts or signature key, all requests accepted
 	}