Documentation
¶
Overview ¶
The DNS cache is pure Go and shared between the Sentry-side UDP forwarder (writer) and the Sentry-side TCP forwarder (reader). It has no gvisor dependencies — leave it without a //go:build constraint so cross-platform unit tests in apoxy-cloud//clrk can exercise it.
Index ¶
Constants ¶
const InitStrEnv = sandboxsentrystack.InitStrEnv
InitStrEnv is the env var carrying the per-sandbox InitStr to PreInit.
Variables ¶
var DecodeInitStr = sandboxsentrystack.DecodeInitStr
DecodeInitStr parses an encoded InitStr. Re-exported from the core.
var ErrNonDNSUDPDenied = errors.New("non-DNS UDP egress denied (no UDP policy plumbing yet)")
ErrNonDNSUDPDenied is returned by routedUDPDialer.DialUDP when an agent attempts UDP egress to anything other than :53. Worker-side UDP policy is not wired yet; until it is, non-DNS UDP fails closed so an agent can't bypass SandboxPolicy / Envoy MITM by switching protocols. Stable error value — cross-module tests rely on it.
var Singleton = sandboxsentrystack.Singleton
Singleton returns the registered PluginStack. Re-exported from the core so cmd/worker's runsc dispatch keeps its existing call site.
Functions ¶
func DNSCacheCapForTest ¶
func DNSCacheCapForTest() int
DNSCacheCapForTest returns the LRU capacity. Tests rely on it to drive eviction without hardcoding the constant on the call site.
func DialTCPThroughStackForTest ¶
DialTCPThroughStackForTest opens a TCP connection from inside s to dst, routed through the in-Sentry TCP forwarder that the egress installer registered. Returns the sandbox-side net.Conn — read/write bytes through it to exercise the splice loop. Caller closes the conn.
Drives the same code path a Sentry-attached process would: gonet builds an endpoint on the stack, Connect emits a SYN, the loopether LinkEndpoint loops it back to DeliverNetworkPacket, the forwarder catches it (no listening endpoint matches), and req.CreateEndpoint completes the handshake.
func DialUDPThroughStackForTest ¶
DialUDPThroughStackForTest opens a UDP socket on s pointed at dst. The first datagram written through the returned conn flows out via the sandbox-side eth0 (loopether), gets caught by the installed UDP forwarder, and is dialed upstream by routedUDPDialer.DialUDP — i.e. the test drives runUDPFlow + copyUDPPackets through their full happy path.
Types ¶
type DNSCache ¶
type DNSCache = dnsCache
DNSCache aliases the unexported dnsCache so tests in apoxy-cloud//clrk/sentrystack/ can reference the type by name. The methods (Bind, Lookup, IngestResponse) are already uppercase on the underlying type, so callers just invoke them directly.
func NewDNSCacheForTest ¶
NewDNSCacheForTest builds a fresh dnsCache and overrides its clock with `now`. Used by tests that pin time deterministically to assert TTL clamping and expiry-driven eviction without sleeping.
type InitStr ¶
type InitStr = sandboxsentrystack.InitStr
InitStr is the sentrystack init envelope. Aliased from the core.
type RoutedTCPDialer ¶
type RoutedTCPDialer = routedDialer
RoutedTCPDialer aliases the unexported routedDialer so tests can name the value type without the package exposing routedDialer to production callers.
func NewRoutedTCPDialerForTest ¶
func NewRoutedTCPDialerForTest(init *InitStr, dnsCache *DNSCache) *RoutedTCPDialer
NewRoutedTCPDialerForTest constructs a routedDialer the same way the egress forwarder install does — see newRoutedTCPDialer in forwarder.go. dnsCache may be nil to disable DstName lookup.
func (*RoutedTCPDialer) DialTCPForTest ¶
func (d *RoutedTCPDialer) DialTCPForTest(ctx context.Context, src, dst netip.AddrPort) (net.Conn, error)
DialTCPForTest invokes (*routedDialer).DialTCP directly.
func (*RoutedTCPDialer) IMDSTargetsForTest ¶
func (d *RoutedTCPDialer) IMDSTargetsForTest() []netip.AddrPort
IMDSTargetsForTest returns the parsed IMDS target set so a test can assert newRoutedTCPDialer correctly handled malformed IMDSV4/V6 without poking into the unexported field.
type RoutedUDPDialer ¶
type RoutedUDPDialer = routedUDPDialer
RoutedUDPDialer aliases routedUDPDialer for the test target.
func NewRoutedUDPDialerForTest ¶
func NewRoutedUDPDialerForTest(init *InitStr) *RoutedUDPDialer
NewRoutedUDPDialerForTest constructs a routedUDPDialer the same way the egress forwarder install does (see newRoutedUDPDialer in udp_linux.go).
func (*RoutedUDPDialer) DialUDPForTest ¶
func (d *RoutedUDPDialer) DialUDPForTest(ctx context.Context, src, dst netip.AddrPort) (net.Conn, error)
DialUDPForTest invokes (*routedUDPDialer).DialUDP directly.
func (*RoutedUDPDialer) ResolversForTest ¶
func (d *RoutedUDPDialer) ResolversForTest() []netip.AddrPort
ResolversForTest returns the parsed resolver list so a test can assert newRoutedUDPDialer skips unparseable entries.
type Stack ¶
type Stack = sandboxsentrystack.Stack
Stack is the sentrystack PluginStack. Aliased from the neutral core; the egress forwarder install (installEgressForwarders) and the test seams in this package operate on the same type via this alias.
Source Files