Documentation
¶
Index ¶
Constants ¶
const ( // ProxyPort is the port the forward proxy listens on. // It serves both HTTP forward proxy requests and HTTP CONNECT tunnels. // Transparent iptables-redirected connections (port 80/443) are also accepted here. ProxyPort = 3128 )
const SidecarUID = 0
SidecarUID is the UID the network-filter sidecar container runs as. filter OUTPUT rules accept all traffic from this UID unconditionally so the sidecar can reach real upstreams without being self-blocked.
Variables ¶
This section is empty.
Functions ¶
func PeekSNI ¶
PeekSNI reads a TLS ClientHello from r and returns the SNI hostname. It does not consume bytes beyond what it reads; use a bufio.Reader or bytes.Buffer so the caller can replay the bytes to the upstream connection. Returns an error if the record is not a valid TLS ClientHello or has no SNI.
func SetupIPTables ¶
func SetupIPTables() error
SetupIPTables configures iptables rules to enforce network isolation for the session Pod, following the same strategy as NemoClaw / NVIDIA OpenShell:
- All outbound TCP is REJECT-ed by default.
- Traffic from the network-filter sidecar (UID 0) is exempted so it can reach real upstreams without looping back through itself.
- The proxy port (127.0.0.1:3128) is explicitly allowed for the main container to reach the sidecar.
- Established / related packets (TCP replies, ICMP unreachables) are let through so the proxy's upstream connections work normally.
- UDP is left unrestricted to avoid breaking DNS and other infrastructure; add explicit UDP rules here if stricter UDP isolation is required.
Primary mechanism: HTTP_PROXY / HTTPS_PROXY environment variables (injected by the session manager) make proxy-aware clients (curl, Go http.Client, npm, pip, etc.) use CONNECT tunnels for ALL ports, not just 80/443. The REJECT rules below ensure non-proxy-aware direct TCP connections are also blocked.
Must be called with CAP_NET_ADMIN — from the network-filter-setup init container.
Types ¶
type Filter ¶
type Filter struct {
// contains filtered or unexported fields
}
Filter decides whether a given host should be blocked. In allowlist mode (created via NewAllowlistFilter), only listed domains pass; an empty allowlist blocks everything. In denylist mode (created via NewFilter), listed domains are blocked; an empty denylist allows everything. bypassDomains are always allowed regardless of mode.
func NewAllowlistFilter ¶ added in v1.414.0
NewAllowlistFilter creates an allowlist filter: only listed domains are permitted. An empty allowedDomains list blocks all traffic (nothing is allowed).
func (*Filter) Check ¶ added in v1.414.0
func (f *Filter) Check(host string) FilterResult
Check returns the FilterResult for the given host. host may include a port suffix (host:port); it is stripped before matching.
type FilterResult ¶ added in v1.414.0
type FilterResult int
FilterResult describes the outcome of a filter check.
const ( FilterResultAllowed FilterResult = iota // passed allowlist/denylist check FilterResultBypassed // always-allow bypass domain FilterResultBlocked // denied by allowlist or denylist )
func (FilterResult) String ¶ added in v1.414.0
func (r FilterResult) String() string
type Proxy ¶
type Proxy struct {
// contains filtered or unexported fields
}
Proxy is a forward proxy that enforces a domain deny-list. It handles three types of incoming connections on a single port:
- HTTP CONNECT tunnels — sent by proxy-aware HTTPS clients (via HTTP_PROXY env var)
- HTTP forward requests — sent by proxy-aware HTTP clients (via HTTP_PROXY env var)
- Transparent TCP — redirected by iptables from port 80/443 - port 80: parsed as an HTTP request (Host header) - port 443: TLS ClientHello SNI peek
Source Files