Documentation
¶
Overview ¶
Package sandboxnet implements the sandbox network allowlist: entry parsing and matching, and the filtering HTTP proxy that sandboxed commands use.
Index ¶
Constants ¶
const ( ReasonNotAllowed = "host not in sandbox_allowed_domains" ReasonNonPublic = "host resolves to a loopback, link-local or private address" )
Denial reasons.
const ReasonLockdown = "host not in untrusted_content.lockdown.allowed_domains (the run has read untrusted content)"
ReasonLockdown is the denial reason for a host the proxy's rules allow but the untrusted-content lockdown allowlist doesn't (issue #171).
Variables ¶
This section is empty.
Functions ¶
func IsNonPublic ¶
IsNonPublic reports whether a is a loopback, private, link-local (cloud metadata), shared, multicast or unspecified address: one that is refused after resolution unless listed literally. The web_fetch tool shares it.
func NormalizeHost ¶
NormalizeHost lowercases h and strips a trailing dot and IPv6 brackets, the form Rule.Allows expects.
Types ¶
type Proxy ¶
type Proxy struct {
// Resolve and Dial default to the system resolver and a net.Dialer;
// tests replace them.
Resolve func(ctx context.Context, host string) ([]netip.Addr, error)
Dial func(ctx context.Context, network, addr string) (net.Conn, error)
// contains filtered or unexported fields
}
Proxy is an HTTP proxy (CONNECT for HTTPS, absolute-URI requests for plain HTTP) that forwards only to hosts its rules allow. It dials directly and never chains to an upstream proxy.
func NewLockdownProxy ¶ added in v0.9.0
NewLockdownProxy returns a proxy whose only allowlist is rules, the untrusted_content.lockdown.allowed_domains entries (issue #171). The lockdown starts it for a sandbox_network sandbox, whose commands lose their direct network at taint. It counts as narrowed from the start, and a refused host names untrusted_content.lockdown.allowed_domains rather than sandbox_allowed_domains.
func (*Proxy) Narrow ¶ added in v0.9.0
Narrow restricts the proxy for the rest of its life to hosts that match both its own rules and rules; an empty rules refuses everything. Every upstream connection opened before the call is closed, so a tunnel opened before the restriction can't outlive it. A connection that is being dialed while Narrow runs is checked again against the narrowed rules before it is used. Narrowing again replaces rules but never widens past the proxy's own rules.
func (*Proxy) TakeDenials ¶
TakeDenials returns the requests refused since the last call.
type Rule ¶
type Rule struct {
Host string // lowercase hostname, or the suffix after "*." when Wildcard
Wildcard bool // matches subdomains of Host only
Addr netip.Addr // set for IP literals
Port int // 0 means 80 and 443
}
Rule is one parsed sandbox_allowed_domains entry.
func ParseRule ¶
ParseRule parses an entry: a hostname, "*.example.com" (subdomains only) or an IP literal, with an optional ":port" (IPv6 as "[::1]:port").
func ParseRules ¶
ParseRules parses entries, naming the first invalid one.
Source Files