monadical/greywall
Archived
14
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat: native allowedDomains/deniedDomains network filtering #1

Closed
jose wants to merge 4 commits from feat/domain-filtering-proxy into main
pull from: feat/domain-filtering-proxy
merge into: monadical:main
Conversation 1 Commits 4 Files Changed 14 +6 -5
2 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 1300cbacc9 - Show all commits

2
.gitea/workflows/main.yml
View File

@@ -43,7 +43,7 @@ jobs:
run: go mod download run: go mod download
- name: Lint - name: Lint
uses: golangci/golangci-lint-action@v6 uses: golangci/golangci-lint-action@v7
with: with:
install-mode: binary install-mode: binary
version: v2.1.6 version: v2.1.6

9
internal/sandbox/linux.go
View File

@@ -637,14 +637,15 @@ func WrapCommandLinuxWithOptions(cfg *config.Config, command string, proxyBridge
// Always use --unshare-net when available (network namespace isolation) // Always use --unshare-net when available (network namespace isolation)
// Inside the namespace, tun2socks will provide transparent proxy access. // Inside the namespace, tun2socks will provide transparent proxy access.
// Skip network namespace when domain filtering with wildcard allow is active // Skip network namespace when domain filtering proxy is active — the proxy
// (the filtering proxy handles domain enforcement via env vars). // listens on the host's 127.0.0.1 and uses env-var-based proxying, which
skipUnshareNet := filterProxy != nil && cfg != nil && cfg.Network.IsWildcardAllow() // requires the sandboxed process to reach the host network.
skipUnshareNet := filterProxy != nil
if features.CanUnshareNet && !skipUnshareNet { if features.CanUnshareNet && !skipUnshareNet {
bwrapArgs = append(bwrapArgs, "--unshare-net") // Network namespace isolation bwrapArgs = append(bwrapArgs, "--unshare-net") // Network namespace isolation
} else if opts.Debug { } else if opts.Debug {
if skipUnshareNet { if skipUnshareNet {
fmt.Fprintf(os.Stderr, "[greywall:linux] Skipping --unshare-net (wildcard allow with domain filtering)\n") fmt.Fprintf(os.Stderr, "[greywall:linux] Skipping --unshare-net (domain filtering proxy active)\n")
} else { } else {
fmt.Fprintf(os.Stderr, "[greywall:linux] Skipping --unshare-net (network namespace unavailable in this environment)\n") fmt.Fprintf(os.Stderr, "[greywall:linux] Skipping --unshare-net (network namespace unavailable in this environment)\n")
} }