Add --publish: the one ingress control
Everything else in the file gates egress, which left an everyday request unanswered: the agent starts a dev server inside the sandbox and a human wants to look at it. This puts a listener on the host that forwards into the container, so a browser, curl or an API tester reaches the server the sandboxed process runs. `--publish [ADDR:]HOST:CONTAINER`, config `publish` and AISB_PUBLISH, repeatable, with the cost named in the flag: it is ingress, so whatever that server serves is reachable from the address it binds. The default address is 127.0.0.1 because a bare podman -p binds every interface (measured) -- a port committed in a repo config must not quietly be a port on the LAN. publish_addr changes the default machine-wide; a spec with a non-loopback address warns on every run. The grammar is smaller than podman's on purpose: one port per entry, no ranges, no /udp, no `*` -- this list is reviewed line by line, and typing 0.0.0.0 is the whole warning. An address means three parts, so `127.0.0.1:8000` is refused rather than guessed. No -p alias: that flag belongs to the harness (claude -p prints). Fail closed, as elsewhere: --net none cannot forward a port and podman discards the mapping while starting the container anyway, so "it ran" would mean "nothing is listening"; a host port already in use is named before the container starts, not after a build; pick_port() will not hand the gate a port this run publishes. The container is labelled with the ports it was given, and doctor reports them. Inside, publish_rules() accepts tcp on the published ports in the input chain and never the output one. Measured (docs/networking.md): pasta delivers the connection over loopback, so that rule counts 0 packets on the reference host; it is there for a host or a bridge network that delivers on the interface, and so that `nft list table inet aisb` answers "what can reach this container". The ports are validated again inside the entrypoint, because a ruleset is not somewhere to splice an unvalidated string. And the measurement that makes a configured preview look broken: a server bound to 127.0.0.1 inside answers inside and refuses the published port outside, so dev servers must bind 0.0.0.0 -- both skills say so in the change that writes the port. Tests. Unit: the grammar and every port list that looks right and is not, config/env/flag precedence and dedup, the canonical spec in --print-policy, the `# ingress:` header, the flags reaching the invocation before the image, egress enforcement byte-identical with a port open, which chain the rule lands in and that a non-numeric port never reaches nft as code. e2e (tests/e2e/13_publish.sh): one real container with enforce=nft where the host gets its 200 and the same run still refuses a domain outside the allowlist at 403, the server runs as uid 1000 with no capabilities so it cannot widen its own port, and the host listener is gone when the container exits. LLM-Generated: true
This commit is contained in:
@@ -33,6 +33,43 @@ sb --allow; assert_rc 1 "--allow with no value"
|
||||
sb --allow-file /nope/missing; assert_rc 1 "--allow-file must exist"
|
||||
sb --mount /nope/missing --dry-run; assert_rc 1 "--mount path must exist"
|
||||
|
||||
t_name "publish takes a port, a pair, or an address and a pair"
|
||||
sb --dry-run $A --publish 8000; assert_rc 0 "a bare port parses"
|
||||
sb --dry-run $A --publish 18080:8000; assert_rc 0 "host:container parses"
|
||||
sb --dry-run $A --publish 0.0.0.0:8000:8000; assert_rc 0 "addr:host:container parses"
|
||||
sb --dry-run $A --publish '[::1]:8000:8000'; assert_rc 0 "bracketed ipv6 parses"
|
||||
sb --dry-run $A --publish=8000; assert_rc 0 "--publish= form parses"
|
||||
sb --strict-args --publish; assert_rc 1 "--publish is a known flag that needs a value"
|
||||
sb --strict-args --pub 8000 --dry-run $A; assert_contains "did you mean --publish" "a near miss suggests --publish"
|
||||
|
||||
# Every one of these is a port list that *looks* right and is not. Silently reading one as
|
||||
# something else is how a config ends up publishing a port nobody wrote.
|
||||
t_name "publish specs that are refused"
|
||||
for bad in 0 99999 abc 8000/udp 8000:8000:8000:8000 '::1:8000:8000' '8000:' ':8000' '8000::9000' '0.0.0.0:8000' '*:8000:8000' '0.0.0.0:8000:8000:8000'; do
|
||||
sb_timeout 15 --dry-run $A --publish "$bad"
|
||||
assert_rc 1 "refuses '$bad'"
|
||||
done
|
||||
# Three fields where the first is not an address: podman would get 'bind on 8000' and fail with an
|
||||
# error that names none of our words, so the address has to look like an address here.
|
||||
sb_timeout 15 --dry-run $A --publish 8000:8000:8000
|
||||
assert_rc 1 "refuses a port written where an address belongs"
|
||||
assert_contains "is not an address" "and says the three shapes that are valid"
|
||||
sb_timeout 15 --dry-run $A --publish all:8000:8000
|
||||
assert_rc 1 "refuses a word for an address"
|
||||
sb --dry-run $A --publish box.internal:8000:8000
|
||||
assert_contains "--publish box.internal:8000:8000" "a dotted host is taken as an address (and warned: not loopback)"
|
||||
assert_contains "anything that can route to this machine" " ... by the same warning an explicit IP gets"
|
||||
sb_timeout 15 --dry-run $A --publish 18080:8000 --publish 18080:9000
|
||||
assert_rc 1 "two container ports on one host port is refused"
|
||||
assert_contains "published twice" "and says which"
|
||||
sb_timeout 15 --dry-run --net none --publish 8000
|
||||
assert_rc 1 "--net none refuses to publish"
|
||||
assert_contains "cannot forward a port" "because podman would drop the mapping and run anyway"
|
||||
|
||||
# -p is the harness's flag (claude -p prints), so it must stay a pass-through.
|
||||
sb --dry-run $A -p 8000
|
||||
assert_contains "pi -p 8000" "-p belongs to the harness, not to the sandbox"
|
||||
|
||||
t_name "fail-closed network policy"
|
||||
sb --dry-run; assert_rc 1 "allow mode with no allowlist refuses to start"
|
||||
assert_contains "Refusing to start wide open" "explains that it refuses to be wide open"
|
||||
|
||||
@@ -91,6 +91,44 @@ for last in '# a trailing comment' '' ' '; do
|
||||
assert_contains "api.openai.com" "user target survives a file ending on [$last]"
|
||||
assert_contains "pypi.org" "repo target survives a file ending on [$last]"
|
||||
done
|
||||
|
||||
t_name "publish accumulates like the other list keys"
|
||||
cat > "$CFG/config" <<'EOF'
|
||||
publish = 8000
|
||||
EOF
|
||||
cat > "$REPO/.ai-sandbox/config" <<'EOF'
|
||||
publish = 18080:8000
|
||||
EOF
|
||||
sb --print-policy --net allow --allow example.com
|
||||
assert_contains "publish=127.0.0.1:8000:8000" "user config publishes"
|
||||
assert_contains "127.0.0.1:18080:8000" "repo config adds to it rather than replacing it"
|
||||
sb_env AISB_PUBLISH=9000,9100:80 --print-policy --net allow --allow example.com
|
||||
assert_contains "127.0.0.1:9000:9000" "AISB_PUBLISH is a comma list of the same shapes"
|
||||
assert_contains "127.0.0.1:9100:80" " ... including host:container"
|
||||
sb --print-policy --net allow --allow example.com --publish 9200
|
||||
assert_contains "127.0.0.1:9200:9200" "a flag adds to both files"
|
||||
sb --print-policy --net allow --allow example.com --publish 8000
|
||||
N="$(printf '%s' "$OUT" | grep -o '127.0.0.1:8000:8000' | wc -l | tr -d ' ')"
|
||||
assert_eq "1" "$N" "the same port from two sources collapses to one"
|
||||
|
||||
t_name "publish_addr is the default bind address, and only that"
|
||||
cat > "$CFG/config" <<'EOF'
|
||||
publish_addr = 127.0.0.2
|
||||
EOF
|
||||
rm -f "$REPO/.ai-sandbox/config"
|
||||
sb --print-policy --net allow --allow example.com --publish 8000
|
||||
assert_contains "publish=127.0.0.2:8000:8000" "config file sets the address a bare port binds"
|
||||
sb_env AISB_PUBLISH_ADDR=127.0.0.3 --print-policy --net allow --allow example.com --publish 8000
|
||||
assert_contains "127.0.0.3:8000:8000" "AISB_PUBLISH_ADDR beats the config file"
|
||||
sb_env AISB_PUBLISH_ADDR=localhost --print-policy --net allow --allow example.com --publish 8000
|
||||
assert_contains "publish=localhost:8000:8000" "a name is accepted where an address goes"
|
||||
printf '%s' "$OUT" | grep -qF 'route to this machine' \
|
||||
&& _bad "localhost warned about as if it were the LAN" || _ok "localhost counts as loopback: no LAN warning"
|
||||
sb --print-policy --net allow --allow example.com --publish 0.0.0.0:8000:8000
|
||||
assert_contains "publish=0.0.0.0:8000:8000" "an address written in the spec is the address used"
|
||||
printf '%s' "$OUT" | grep '^publish=' | grep -qF '127.0.0.2' \
|
||||
&& _bad "publish_addr overwrote an explicit address" || _ok "publish_addr only fills in a bare port"
|
||||
|
||||
# The fix must not trade one silence for another: with no target anywhere, the run still
|
||||
# refuses, and says why.
|
||||
printf '# nothing but a header here\n' > "$CFG/allow"
|
||||
|
||||
@@ -197,6 +197,43 @@ pos_cmd="$(printf '%s' "$line" | tr ' ' '\n' | grep -n -m1 '^hello$' | cut -d: -
|
||||
if [[ -n "$pos_img" && -n "$pos_lbl" && $pos_lbl -lt $pos_img ]]; then _ok "extra flags precede the image"; else _bad "extra flags precede the image" "img=$pos_img label=$pos_lbl"; fi
|
||||
if [[ -n "$pos_cmd" && -n "$pos_img" && $pos_img -lt $pos_cmd ]]; then _ok "the command follows the image"; else _bad "the command follows the image" "img=$pos_img cmd=$pos_cmd"; fi
|
||||
|
||||
t_name "published ports reach the invocation, bound to loopback"
|
||||
sb --dry-run $A --publish 8000
|
||||
assert_contains "--publish 127.0.0.1:8000:8000" "a bare port is bound to loopback on both ends"
|
||||
assert_contains "# ingress: publish=[127.0.0.1:8000:8000" "the dry run says what it will let in"
|
||||
assert_contains "--label aisb.publish=8000" "the container is labelled with the port it publishes"
|
||||
sb --dry-run $A --publish 18080:8000
|
||||
assert_contains "--publish 127.0.0.1:18080:8000" "host and container ports are separate"
|
||||
sb --dry-run $A --publish 8000 --publish 18080:9000
|
||||
assert_count 2 "--publish " "two entries, two flags"
|
||||
sb --dry-run $A --publish 0.0.0.0:18080:8000
|
||||
assert_contains "--publish 0.0.0.0:18080:8000" "an explicit address is passed through"
|
||||
assert_contains "anything that can route to this machine" "and said out loud as an open door"
|
||||
sb --dry-run $A --net full --publish 8000
|
||||
assert_contains "--publish 127.0.0.1:8000:8000" "--net full can publish too"
|
||||
|
||||
# The promise the flag has to keep: it is ingress only. Everything that gates egress must be
|
||||
# byte-identical with a port open, or "preview the app" would be a way to turn the policy off.
|
||||
t_name "publishing does not touch egress enforcement"
|
||||
sb --dry-run $A --publish 8000
|
||||
assert_contains "--network pasta:--map-host-loopback,100.64.0.1" "the gate address is still the only door"
|
||||
assert_contains "--cap-add=NET_ADMIN" "the entrypoint still gets NET_ADMIN to install the ruleset"
|
||||
assert_contains "--cap-drop=ALL" "and still drops everything else"
|
||||
assert_contains "HTTP_PROXY=http://100.64.0.1:18081" "the proxy env is still set"
|
||||
assert_contains "--security-opt no-new-privileges" "no-new-privileges survives"
|
||||
|
||||
# An ipv6 bind keeps its brackets: podman splits the spec on ':' too, and an address full of
|
||||
# them has to arrive as one field or the port lands inside the address.
|
||||
sb --dry-run $A --publish '[::1]:8000:8000'
|
||||
assert_contains '\[::1\]:8000:8000' "the ipv6 bind keeps its brackets in the invocation"
|
||||
|
||||
# --publish must precede the image like every other flag, or podman reads it as the command.
|
||||
sb --dry-run $A --publish 8000 -- echo hello
|
||||
line="$(printf '%s' "$OUT" | tail -1)"
|
||||
pos_img="$(printf '%s' "$line" | tr ' ' '\n' | grep -n -m1 'localhost/ai-sandbox' | cut -d: -f1)"
|
||||
pos_pub="$(printf '%s' "$line" | tr ' ' '\n' | grep -n -m1 -e '--publish' | cut -d: -f1)"
|
||||
if [[ -n "$pos_img" && -n "$pos_pub" && $pos_pub -lt $pos_img ]]; then _ok "--publish precedes the image"; else _bad "--publish precedes the image" "img=$pos_img publish=$pos_pub"; fi
|
||||
|
||||
t_name "dry run is side-effect free"
|
||||
sb --dry-run $A
|
||||
# Ask about the container *this* invocation would have created, not about every sandbox on
|
||||
|
||||
@@ -41,6 +41,21 @@ assert_rc 1 "non-numeric port rejected"
|
||||
sb --print-policy --net allow --allow api.openai.com:8443
|
||||
assert_contains "gate_domains=api.openai.com" "domain+port still routed through the gate"
|
||||
|
||||
t_name "publish is its own line, because it is a different direction"
|
||||
sb --print-policy --net allow --allow example.com
|
||||
assert_contains "publish=" "published ports are reported even when there are none"
|
||||
assert_eq "publish=" "$(printf '%s' "$OUT" | grep '^publish=')" " ... and the line is empty, not 'none'"
|
||||
sb --print-policy --net allow --allow example.com --publish 8000 --publish 18080:9000
|
||||
assert_contains "publish=127.0.0.1:8000:8000 127.0.0.1:18080:9000" "canonical specs: address, host port, container port"
|
||||
sb --print-policy --net allow --allow example.com --publish 0.0.0.0:8000
|
||||
assert_rc 1 "a two-part spec with an address is not guessed at"
|
||||
|
||||
# An allow entry and a published port are answers to different questions; a config that
|
||||
# reads like one must not quietly become the other.
|
||||
sb --print-policy --net allow --allow 100.64.0.1:5432 --publish 8000
|
||||
assert_contains "direct=100.64.0.1 5432" "the allow entry stayed an egress rule"
|
||||
assert_contains "publish=127.0.0.1:8000:8000" "and the published port stayed ingress"
|
||||
|
||||
t_name "mixed list"
|
||||
sb --print-policy --net allow --allow api.openai.com --allow 10.0.0.5:5432 --allow files.pythonhosted.org
|
||||
assert_contains "api.openai.com" "domain 1"
|
||||
|
||||
@@ -41,9 +41,21 @@ printf '::1 8080\n' > "$POL/direct6.list"
|
||||
|
||||
RULES="$AISB_STATE_DIR/rules.f"
|
||||
# Render the ruleset by extracting the generator and feeding it the policy above.
|
||||
# Render the ruleset the way the entrypoint would. publish_rules() is a function of its own
|
||||
# in there, so it comes along: extracting only gen_rules() would ask a half-program to run.
|
||||
render_rules() { # render_rules <AISB_PUBLISH_PORTS value> -> the ruleset on stdout
|
||||
local g="$WORK/render.$$.sh"
|
||||
{ awk '/^publish_rules\(\) \{/{f=1} f{print} f&&/^\}$/{exit}' "$EP"
|
||||
awk '/^gen_rules\(\) \{/{f=1} f{print} f&&/^\}$/{exit}' "$EP"
|
||||
printf 'POLICY_DIR=%q\nAISB_PROXY_IPS="100.64.0.1"\nAISB_PROXY_PORTS="18081"\nAISB_ALLOW_ICMP=1\nAISB_ALLOW_DNS=0\nAISB_PUBLISH_PORTS=%q\n' "$POL" "$1"
|
||||
printf 'gen_rules\n'; } > "$g"
|
||||
bash "$g" 2>"$WORK/render.err"
|
||||
}
|
||||
|
||||
GEN="$WORK/gen.sh"
|
||||
awk '/^gen_rules\(\) \{/{f=1} f{print} f&&/^\}$/{exit}' "$EP" > "$GEN"
|
||||
{ printf 'POLICY_DIR=%q\nAISB_PROXY_IPS="100.64.0.1"\nAISB_PROXY_PORTS="18081"\nAISB_ALLOW_ICMP=1\nAISB_ALLOW_DNS=0\n' "$POL"
|
||||
awk '/^publish_rules\(\) \{/{f=1} f{print} f&&/^\}$/{exit}' "$EP" > "$GEN"
|
||||
awk '/^gen_rules\(\) \{/{f=1} f{print} f&&/^\}$/{exit}' "$EP" >> "$GEN"
|
||||
{ printf 'POLICY_DIR=%q\nAISB_PROXY_IPS="100.64.0.1"\nAISB_PROXY_PORTS="18081"\nAISB_ALLOW_ICMP=1\nAISB_ALLOW_DNS=0\nAISB_PUBLISH_PORTS=""\n' "$POL"
|
||||
printf 'gen_rules\n'; } >> "$GEN"
|
||||
bash "$GEN" > "$RULES" 2>"$WORK/gen.err" && _ok "rules render" || _bad "rules render" "$(tail -3 "$WORK/gen.err")"
|
||||
|
||||
@@ -58,6 +70,29 @@ grep -q 'ip daddr 100.64.0.1 tcp dport 18081' "$RULES" && _ok "gate endpoi
|
||||
grep -q 'aisb-est' "$RULES" && _ok "established traffic accepted" || _bad "established rule"
|
||||
grep -c 'accept comment "aisb-direct"' "$RULES" | grep -qx 3 && _ok "exactly 3 direct rules" || _bad "direct rule count: $(grep -c 'aisb-direct' "$RULES")"
|
||||
|
||||
t_name "the published ports appear in the input chain, and nowhere else"
|
||||
# Nothing published means no ingress rule at all: the ruleset must not open a port that was
|
||||
# never asked for, and an empty set must not render an empty port list (nft refuses those).
|
||||
PUBRULES="$(render_rules "8000 18080 8000")"
|
||||
# Is a line matching <regex> present inside the named chain? An ingress rule in the output
|
||||
# chain would be an egress hole, which is the one thing this feature must never become.
|
||||
in_chain() { # in_chain <chain> <regex>
|
||||
awk -v c="chain $1 {" -v re="$2" 'index($0, c){inside=1; next} /^ }/{inside=0}
|
||||
inside && $0 ~ re {found=1} END{exit !found}' <<< "$PUBRULES"
|
||||
}
|
||||
printf '%s' "$PUBRULES" | grep -qF 'comment "aisb-publish"' && _ok "a rule names the published ports" || _bad "aisb-publish rule" "$(printf '%s' "$PUBRULES" | sed -n '/chain input/,/}/p')"
|
||||
printf '%s' "$PUBRULES" | grep -qF 'tcp dport { 8000,18080 }' && _ok "both ports, de-duplicated" || _bad "port set" "$(printf '%s' "$PUBRULES" | grep aisb-publish)"
|
||||
in_chain input 'aisb-publish' && _ok "the publish rule is in the input chain" || _bad "the publish rule is in the input chain"
|
||||
in_chain output 'aisb-publish' && _bad "the publish rule is also an egress hole" || _ok "publishing opens no egress path"
|
||||
in_chain input 'policy drop' && _ok "input still defaults to drop with a port open" || _bad "input policy drop survived"
|
||||
printf '%s' "$PUBRULES" | grep -qF 'aisb-default-drop' && _ok "the egress default-drop is untouched" || _bad "default-drop rule"
|
||||
# The policy file is host-written and mounted read-only, but a ruleset is not somewhere to
|
||||
# splice an unvalidated string: anything that is not a port is dropped on the floor.
|
||||
BADRULES="$(render_rules '8000 nft delete table inet aisb accept')"
|
||||
printf '%s' "$BADRULES" | grep -qF 'delete table' && _bad "a port value reached the ruleset as code" || _ok "a non-numeric port never reaches the ruleset"
|
||||
printf '%s' "$BADRULES" | grep -qF 'tcp dport { 8000 }' && _ok " ... and the valid port in it still lands" || _bad "valid port kept" "$(printf '%s' "$BADRULES" | grep aisb-publish)"
|
||||
render_rules '' | grep -qF 'aisb-publish' && _bad "a rule appeared with nothing published" || _ok "no publish rule when nothing is published"
|
||||
|
||||
t_name "no DNS hole when the gate is in front"
|
||||
grep -E 'th dport 53' "$RULES" >/dev/null && _bad "DNS is closed in gate mode" || _ok "DNS is closed in gate mode"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user