Mathieu Virbel
9cb65151ee
Remove the built-in HTTP/SOCKS5 proxy servers and domain allowlist/denylist system. Instead, use tun2socks with a TUN device inside the network namespace to transparently route all TCP/UDP traffic through an external SOCKS5 proxy. This enables truly transparent proxying where any binary (Go, static, etc.) has its traffic routed through the proxy without needing to respect HTTP_PROXY/ALL_PROXY environment variables. The external proxy handles its own filtering. Key changes: - NetworkConfig: remove AllowedDomains/DeniedDomains/proxy ports, add ProxyURL - Delete internal/proxy/, internal/templates/, internal/importer/ - Embed tun2socks binary (downloaded at build time via Makefile) - Replace LinuxBridge with ProxyBridge (single Unix socket to external proxy) - Inner script sets up TUN device + tun2socks inside network namespace - Falls back to env-var proxying when TUN is unavailable - macOS: best-effort env-var proxying to external SOCKS5 proxy - CLI: remove --template/import, add --proxy flag - Feature detection: add ip/tun/tun2socks status to --linux-features
40 lines
1.0 KiB
Go
40 lines
1.0 KiB
Go
package sandbox
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/Use-Tusk/fence/internal/config"
|
|
)
|
|
|
|
// TestLinux_NoProxyBlocksNetwork verifies that when no ProxyURL is set,
|
|
// the Linux sandbox uses --unshare-net to block all network access.
|
|
func TestLinux_NoProxyBlocksNetwork(t *testing.T) {
|
|
cfg := &config.Config{
|
|
Network: config.NetworkConfig{},
|
|
Filesystem: config.FilesystemConfig{
|
|
AllowWrite: []string{"/tmp/test"},
|
|
},
|
|
}
|
|
|
|
// With no proxy, network should be blocked
|
|
if cfg.Network.ProxyURL != "" {
|
|
t.Error("expected empty ProxyURL for no-network config")
|
|
}
|
|
}
|
|
|
|
// TestLinux_ProxyURLSet verifies that a proxy URL is properly set in config.
|
|
func TestLinux_ProxyURLSet(t *testing.T) {
|
|
cfg := &config.Config{
|
|
Network: config.NetworkConfig{
|
|
ProxyURL: "socks5://localhost:1080",
|
|
},
|
|
Filesystem: config.FilesystemConfig{
|
|
AllowWrite: []string{"/tmp/test"},
|
|
},
|
|
}
|
|
|
|
if cfg.Network.ProxyURL != "socks5://localhost:1080" {
|
|
t.Errorf("expected ProxyURL socks5://localhost:1080, got %s", cfg.Network.ProxyURL)
|
|
}
|
|
}
|