Documentation
¶
Index ¶
- Constants
- Variables
- func AddressStringToCIDR(addressString string) string
- func AddressStringsToCIDRs(addressStrings []string) []string
- func DefaultHostResolver(ctx context.Context, host string) ([]net.IP, error)
- func IsIPDevAllowedAsProxyEndpoint(ip net.IP) bool
- func IsIPInDeniedSandboxCIDRs(ip net.IP) bool
- func IsIPOrCIDR(s string) bool
- func IsSpecifiedIPOrCIDR(s string) bool
- func IsValidWildcardDomainPattern(pattern string) bool
- func MatchDomainPattern(hostname, pattern string) bool
- func ParseAddressesAndDomains(entries []string) (addresses []string, domains []string)
- type EgressProxyConfig
- type HostResolver
Constants ¶
const ( AllInternetTrafficCIDR = "0.0.0.0/0" DefaultNameserver = "8.8.8.8" )
Variables ¶
var DeniedSandboxCIDRs = []string{
"10.0.0.0/8",
"100.64.0.0/10",
"127.0.0.0/8",
"169.254.0.0/16",
"172.16.0.0/12",
"192.168.0.0/16",
"::1/128",
"fc00::/7",
"fe80::/10",
}
var DeniedSandboxSetData = utils.Must(set.AddressStringsToSetData(DeniedSandboxCIDRs))
var DevAllowedProxyEndpointCIDRs = func() []string { if !env.IsDevelopment() { return nil } return parseCIDRsEnv("BYOP_DEV_ALLOWED_PROXY_CIDRS") }()
DevAllowedProxyEndpointCIDRs is a dev-only allowlist that overrides DeniedSandboxCIDRs at BYOP validation time. Populated from BYOP_DEV_ALLOWED_PROXY_CIDRS (comma-separated CIDRs) only when running in a development build; ignored in production so a stray env var cannot widen the BYOP endpoint allowlist.
var ErrEgressProxyInternalEndpoint = errors.New("egress proxy endpoint resolves to an internal / denied IP range")
ErrEgressProxyInternalEndpoint is returned when a configured BYOP endpoint resolves to an IP in DeniedSandboxCIDRs.
Functions ¶
func AddressStringToCIDR ¶
AddressStringToCIDR converts a string address to the CIDR format. Supports only IPv4 addresses.
func AddressStringsToCIDRs ¶
AddressStringsToCIDRs converts a list of string addresses to the CIDR format. Supports only IPv4 addresses.
func DefaultHostResolver ¶
DefaultHostResolver uses net.DefaultResolver.LookupIPAddr and honors ctx.
func IsIPDevAllowedAsProxyEndpoint ¶
IsIPDevAllowedAsProxyEndpoint reports whether ip falls into any CIDR in DevAllowedProxyEndpointCIDRs.
func IsIPInDeniedSandboxCIDRs ¶
IsIPInDeniedSandboxCIDRs reports whether ip must be denied as a BYOP egress proxy endpoint: the unspecified addresses, "this network" block (0.0.0.0/8) or any IP in DeniedSandboxCIDRs. 0.0.0.0/8 is checked here because it cannot be encoded into the kernel nftables denylist.
func IsIPOrCIDR ¶
IsIPOrCIDR checks if a string is a valid IP address or CIDR notation.
func IsSpecifiedIPOrCIDR ¶
IsSpecifiedIPOrCIDR checks if a string is a valid IP address or CIDR notation with a specified (non-zero) IP. It rejects unspecified addresses like 0.0.0.0 or :: (which cause errors in nftables), but allows 0.0.0.0/0 as a special case.
func IsValidWildcardDomainPattern ¶
IsValidWildcardDomainPattern reports whether pattern contains exactly one leading wildcard label followed by a DNS-1123 subdomain.
func MatchDomainPattern ¶
MatchDomainPattern reports whether hostname matches an exact domain, the all-domains wildcard, or a leading-label wildcard such as *.example.com.
func ParseAddressesAndDomains ¶
ParseAddressesAndDomains separates a list of strings into IP addresses/CIDRs and domain names.
Types ¶
type EgressProxyConfig ¶
EgressProxyConfig is a transport-agnostic view of a BYOP SOCKS5 proxy configuration. Mirrors EgressProxy{Address,Username,Password} on db/pkg/types.SandboxNetworkEgressConfig.
func ValidateEgressProxy ¶
func ValidateEgressProxy(ctx context.Context, cfg *EgressProxyConfig, resolve HostResolver) (*EgressProxyConfig, error)
ValidateEgressProxy checks a BYOP SOCKS5 config and rejects configurations that would expose E2B infrastructure or are malformed. On success it returns a canonical copy (host lower-cased, whitespace trimmed); the input is not mutated. cfg == nil returns (nil, nil). resolve defaults to DefaultHostResolver.
Rules:
- Address must parse as "host:port" with a non-zero port.
- Host must be an IP literal or resolve via the provided resolver.
- Every resolved A/AAAA record must NOT be in DeniedSandboxCIDRs.
- If Username == "" then Password must also be "" (no orphan password).
- Username and Password are each capped at 255 bytes (RFC 1929).
Source Files