[PR #186] [MERGED] fix(network): tighten sandbox host isolation and egress handling #236

New issue

Closed

opened 2026-10-29 14:21:20 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:21:20 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/AgentENV/pull/186
Author: @LSX-s-Software
Created: 8/18/2026
Status: ✅ Merged
Merged: 8/19/2026
Merged by: @yingdi-shan

Base: main ← Head: fix/network-policy

📝 Commits (2)

a74ec38 perf(network): skip empty egress programming on clean slots
925d12e fix(network): tighten sandbox egress chain and gateway ingress chain

📊 Changes

3 files changed (+135 additions, -28 deletions)

View changed files

📝 src/sandbox/network/manager.rs (+38 -6)
📝 src/sandbox/network/policy.rs (+44 -13)
📝 src/sandbox/network/slot.rs (+53 -9)

📄 Description

What

Tighten host iptables rules so sandbox traffic is accepted only on AgentENV veth interfaces and unsolicited guest-to-host traffic is rejected.
Narrow the namespace egress baseline to established reply traffic and DNS over TCP/UDP port 53 instead of allowing all traffic to host-side addresses.
Track whether a warm network slot contains user egress rules and skip no-op policy cleanup for slots known to be clean.

Why

The previous host and namespace rules were broader than required for sandbox operation. A sandbox could reach host-side addresses through the baseline egress allow rules, and the global host forwarding rules matched the full host-interaction CIDR without constraining the AgentENV interface. In addition, every sandbox without runtime egress rules still entered its network namespace and reprogrammed an empty user chain, including clean warm-pool slots.

This change reduces the reachable host surface while preserving host-initiated proxy/envd reply traffic and avoids unnecessary namespace/iptables work on the common no-policy path.

N/A - no linked issue was provided.

Scope and non-goals

Included:

Host INPUT and FORWARD rules for AgentENV sandbox veth interfaces.
Static namespace egress allow/deny ordering.
Warm-slot bookkeeping for user egress rules, including failure-state handling.
Focused unit coverage for rule construction and clean/dirty slot transitions.

Not included:

Public network-policy API or schema changes.
New egress policy capabilities or TCP proxy support.
Changes to network address allocation, NAT layout, DNS selection, or warm-pool sizing.
Changes outside the Rust sandbox network subsystem.

Design and behavior changes

Global host INPUT rules first accept ESTABLISHED,RELATED replies from AgentENV veth interfaces, then reject other guest-to-host traffic from the host-interaction CIDR.
Global FORWARD rules now match the AgentENV ingress or egress veth interface in addition to the host-interaction CIDR.
The namespace static egress chain allows established host-initiated replies and DNS to the configured guest DNS server on TCP/UDP port 53 before internal-network rejects. It no longer grants an unrestricted allow to the host-side veth address.
Slot records whether user egress rules were successfully installed. Empty policy updates return immediately for known-clean slots; failed apply or cleanup attempts preserve the prior state so a later reuse does not incorrectly skip cleanup.

Compatibility and operations

Public API or generated protocol: N/A - no API schema or generated code changes.
Configuration or defaults: N/A - existing network configuration and defaults are unchanged.
Snapshot manifest, artifact layout, or storage format: N/A - no persistence format changes.
Upgrade and rollback: Revised host rules take effect when the network manager installs them during process startup. Normal shutdown removes the matching rules.
Host requirements, permissions, ports, or dependencies: No new requirements. The existing iptables and conntrack capabilities used by sandbox networking remain required.

Validation

make fmt
make clippy
make test-unit
Relevant Rust integration tests
make -C services test (required when services/ changes)
Generated clients/server regenerated with the documented make target
Documentation updated
Benchmarks or performance comparison completed

Commands and results:

Unit test suite: passed (run by the author before PR creation)
Rust integration test suite: passed (run by the author before PR creation)

The exact command lines were not provided with the PR creation request.

Skipped checks and reasons:

make -C services test: skipped because services/ is unchanged.
Code generation: not required because no source schema or generated code changed.
Documentation: not required because the public API and configuration are unchanged.
Benchmarks: not run; the optimization removes a no-op namespace/iptables update, and this PR does not claim a measured performance improvement.

Risks and reviewer notes

Correctness depends on iptables ordering: established replies and DNS must remain ahead of internal-network rejects, while the host INPUT reject must remain after the established-reply accept.
The warm-slot flag is deliberately updated only after successful policy programming. Review the failure paths in src/sandbox/network/slot.rs together with warm-pool reuse.
The most security-sensitive changes are the host rules in src/sandbox/network/manager.rs and the namespace baseline rules in src/sandbox/network/policy.rs.

Checklist

The PR contains one coherent change and no unrelated formatting or refactoring.
New behavior is covered by tests, or I explained why testing is impractical.
Logs and examples contain no credentials, tokens, or private registry information.
I did not manually edit generated code without updating its source and regenerating it.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/AgentENV/pull/186 **Author:** [@LSX-s-Software](https://github.com/LSX-s-Software) **Created:** 8/18/2026 **Status:** ✅ Merged **Merged:** 8/19/2026 **Merged by:** [@yingdi-shan](https://github.com/yingdi-shan) **Base:** `main` ← **Head:** `fix/network-policy` --- ### 📝 Commits (2) - [`a74ec38`](https://github.com/kvcache-ai/AgentENV/commit/a74ec38a9122ca6a0bff11b76fee381754a9286d) perf(network): skip empty egress programming on clean slots - [`925d12e`](https://github.com/kvcache-ai/AgentENV/commit/925d12ec3706f5d5fa7e969bf2b779e9c4260556) fix(network): tighten sandbox egress chain and gateway ingress chain ### 📊 Changes **3 files changed** (+135 additions, -28 deletions) <details> <summary>View changed files</summary> 📝 `src/sandbox/network/manager.rs` (+38 -6) 📝 `src/sandbox/network/policy.rs` (+44 -13) 📝 `src/sandbox/network/slot.rs` (+53 -9) </details> ### 📄 Description ## What - Tighten host iptables rules so sandbox traffic is accepted only on AgentENV veth interfaces and unsolicited guest-to-host traffic is rejected. - Narrow the namespace egress baseline to established reply traffic and DNS over TCP/UDP port 53 instead of allowing all traffic to host-side addresses. - Track whether a warm network slot contains user egress rules and skip no-op policy cleanup for slots known to be clean. ## Why The previous host and namespace rules were broader than required for sandbox operation. A sandbox could reach host-side addresses through the baseline egress allow rules, and the global host forwarding rules matched the full host-interaction CIDR without constraining the AgentENV interface. In addition, every sandbox without runtime egress rules still entered its network namespace and reprogrammed an empty user chain, including clean warm-pool slots. This change reduces the reachable host surface while preserving host-initiated proxy/envd reply traffic and avoids unnecessary namespace/iptables work on the common no-policy path. ## Related issue N/A - no linked issue was provided. ## Scope and non-goals Included: - Host INPUT and FORWARD rules for AgentENV sandbox veth interfaces. - Static namespace egress allow/deny ordering. - Warm-slot bookkeeping for user egress rules, including failure-state handling. - Focused unit coverage for rule construction and clean/dirty slot transitions. Not included: - Public network-policy API or schema changes. - New egress policy capabilities or TCP proxy support. - Changes to network address allocation, NAT layout, DNS selection, or warm-pool sizing. - Changes outside the Rust sandbox network subsystem. ## Design and behavior changes - Global host INPUT rules first accept `ESTABLISHED,RELATED` replies from AgentENV veth interfaces, then reject other guest-to-host traffic from the host-interaction CIDR. - Global FORWARD rules now match the AgentENV ingress or egress veth interface in addition to the host-interaction CIDR. - The namespace static egress chain allows established host-initiated replies and DNS to the configured guest DNS server on TCP/UDP port 53 before internal-network rejects. It no longer grants an unrestricted allow to the host-side veth address. - `Slot` records whether user egress rules were successfully installed. Empty policy updates return immediately for known-clean slots; failed apply or cleanup attempts preserve the prior state so a later reuse does not incorrectly skip cleanup. ## Compatibility and operations - Public API or generated protocol: N/A - no API schema or generated code changes. - Configuration or defaults: N/A - existing network configuration and defaults are unchanged. - Snapshot manifest, artifact layout, or storage format: N/A - no persistence format changes. - Upgrade and rollback: Revised host rules take effect when the network manager installs them during process startup. Normal shutdown removes the matching rules. - Host requirements, permissions, ports, or dependencies: No new requirements. The existing iptables and conntrack capabilities used by sandbox networking remain required. ## Validation - [x] `make fmt` - [x] `make clippy` - [x] `make test-unit` - [x] Relevant Rust integration tests - [ ] `make -C services test` (required when `services/` changes) - [ ] Generated clients/server regenerated with the documented `make` target - [ ] Documentation updated - [ ] Benchmarks or performance comparison completed Commands and results: ```text Unit test suite: passed (run by the author before PR creation) Rust integration test suite: passed (run by the author before PR creation) ``` The exact command lines were not provided with the PR creation request. Skipped checks and reasons: - `make -C services test`: skipped because `services/` is unchanged. - Code generation: not required because no source schema or generated code changed. - Documentation: not required because the public API and configuration are unchanged. - Benchmarks: not run; the optimization removes a no-op namespace/iptables update, and this PR does not claim a measured performance improvement. ## Risks and reviewer notes - Correctness depends on iptables ordering: established replies and DNS must remain ahead of internal-network rejects, while the host INPUT reject must remain after the established-reply accept. - The warm-slot flag is deliberately updated only after successful policy programming. Review the failure paths in `src/sandbox/network/slot.rs` together with warm-pool reuse. - The most security-sensitive changes are the host rules in `src/sandbox/network/manager.rs` and the namespace baseline rules in `src/sandbox/network/policy.rs`. ## Checklist - [x] The PR contains one coherent change and no unrelated formatting or refactoring. - [x] New behavior is covered by tests, or I explained why testing is impractical. - [x] Logs and examples contain no credentials, tokens, or private registry information. - [x] I did not manually edit generated code without updating its source and regenerating it. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-29 14:21:20 +00:00