@namzu/sandbox 2.0.3 → 4.0.0

package/dist/egress/address.d.ts

@@ -0,0 +1,75 @@
+import type { LookupAddress } from 'node:dns';
+/**
+ * Why this address must not be reached, or `null` if it may be.
+ *
+ * Returns a reason rather than a boolean because the reason is what a
+ * denied operator needs: "link-local" and "private" are different mistakes
+ * with different fixes, and a bare `false` sends them to read this file.
+ */
+export declare function blockedAddressReason(address: string): string | null;
+/**
+ * Screen a target that is already an address rather than a name.
+ *
+ * A `lookup` hook cannot cover this case and it is not obvious why: the
+ * socket layer skips resolution entirely when the host is a valid IP
+ * literal, so the screening resolver is never called. The whole existing
+ * egress suite passed with the resolver in place *because* its upstream is
+ * `127.0.0.1` — a literal, never resolved, never screened. A green suite
+ * was the evidence the hole was still open.
+ *
+ * So the two cases need two checks: names are screened inside the resolver
+ * the socket calls, literals are screened here before it dials.
+ */
+export declare function blockedLiteralReason(host: string): string | null;
+export declare class EgressAddressDenied extends Error {
+    readonly host: string;
+    readonly address: string;
+    readonly reason: string;
+    constructor(host: string, address: string, reason: string);
+}
+export interface ScreeningLookupOptions {
+    /**
+     * Hosts permitted to resolve inward anyway, matched by the allowlist's
+     * own rules so `.internal.example` covers subdomains.
+     *
+     * Per host, never a global switch. An operator who genuinely proxies to
+     * one service on a private network needs that service exempted, and
+     * turning the screen off entirely to get it would hand every other
+     * allowlisted name the same reach.
+     */
+    readonly allowInwardFor?: readonly string[];
+    /** Injected in tests. Defaults to the platform resolver. */
+    readonly resolve?: AddressResolver;
+}
+/**
+ * The one shape this module asks a resolver for: every address, in the
+ * order the resolver returned them.
+ *
+ * Narrower than the platform signature on purpose. The screen has to see
+ * ALL the addresses to be worth anything, so a resolver that can be asked
+ * for one is a resolver this code could accidentally ask wrongly.
+ */
+export type AddressResolver = (hostname: string, options: {
+    readonly all: true;
+    readonly verbatim: true;
+}, callback: (err: NodeJS.ErrnoException | null, addresses: LookupAddress[]) => void) => void;
+type LookupCallback = (err: NodeJS.ErrnoException | null, address: string | LookupAddress[], family?: number) => void;
+/**
+ * A `lookup` implementation that screens before the socket uses the answer.
+ *
+ * This is deliberately not "resolve, check, then connect to the address we
+ * checked". That shape leaves the socket free to resolve again, and the
+ * second answer is the one that decides where the bytes go — so a name that
+ * alternates records walks straight through a check that passed a moment
+ * earlier. Screening inside the resolver the socket itself calls means there
+ * is one resolution, and the address that was screened is the address that
+ * gets connected to.
+ *
+ * Every returned address is screened, not just the one chosen. A record set
+ * mixing a public address with an inward one is the ordinary shape of this
+ * attack, and screening only the winner makes the outcome depend on which
+ * record the resolver happened to order first.
+ */
+export declare function createScreeningLookup(options?: ScreeningLookupOptions, isExempt?: (host: string, patterns: readonly string[]) => boolean): (hostname: string, opts: unknown, callback: LookupCallback) => void;
+export {};
+//# sourceMappingURL=address.d.ts.map

package/dist/egress/address.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.d.ts","sourceRoot":"","sources":["../../src/egress/address.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AA6H7C;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoCnE;AA6BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAahE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBAEX,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CASzD;AAED,MAAM,WAAW,sBAAsB;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,CAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,EACxD,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,IAAI,KAC7E,IAAI,CAAA;AAMT,KAAK,cAAc,GAAG,CACrB,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EACjC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,EACjC,MAAM,CAAC,EAAE,MAAM,KACX,IAAI,CAAA;AAET;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,OAAO,GAAE,sBAA2B,EACpC,QAAQ,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,KAAK,OAAqB,GAC5E,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,CAiErE"}

package/dist/egress/address.js

@@ -0,0 +1,289 @@
+import { lookup as dnsLookup } from 'node:dns';
+import { isIP } from 'node:net';
+const V4_RANGES = [
+    { reason: 'loopback', matches: (o) => o[0] === 127 },
+    { reason: 'this-host', matches: (o) => o[0] === 0 },
+    { reason: 'private', matches: (o) => o[0] === 10 },
+    { reason: 'private', matches: (o) => o[0] === 172 && (o[1] ?? 0) >= 16 && (o[1] ?? 0) <= 31 },
+    { reason: 'private', matches: (o) => o[0] === 192 && o[1] === 168 },
+    // 169.254.0.0/16. The metadata address every major host platform answers
+    // on lives here, which is why this range is the one that turns a name
+    // check into a credential leak.
+    { reason: 'link-local', matches: (o) => o[0] === 169 && o[1] === 254 },
+    {
+        reason: 'shared-address-space',
+        matches: (o) => o[0] === 100 && (o[1] ?? 0) >= 64 && (o[1] ?? 0) <= 127,
+    },
+    { reason: 'benchmarking', matches: (o) => o[0] === 198 && (o[1] === 18 || o[1] === 19) },
+    { reason: 'multicast', matches: (o) => (o[0] ?? 0) >= 224 && (o[0] ?? 0) <= 239 },
+    { reason: 'reserved', matches: (o) => (o[0] ?? 0) >= 240 },
+];
+function parseV4(address) {
+    const parts = address.split('.');
+    if (parts.length !== 4)
+        return null;
+    const octets = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const n = Number(part);
+        if (n > 255)
+            return null;
+        octets.push(n);
+    }
+    return octets;
+}
+/**
+ * Expand an IPv6 literal into its eight 16-bit groups, or `null`.
+ *
+ * Written out rather than pattern-matched on the text, because a prefix
+ * matched as a STRING is a different question from a prefix matched as a
+ * NUMBER, and the two disagree exactly where it hurts. `/^f[cd]/` was the
+ * first spelling of the unique-local check here, and `fd::1` matches it —
+ * but `fd::1` is `00fd:0:…`, an ordinary global address, so that check
+ * deleted a slice of the internet. `fe8::1` did the same against
+ * `/^fe[89ab]/`. Both are the `>=`-where-`>`-was-meant mistake wearing a
+ * regex.
+ *
+ * It fails the other way too. `0:0:0:0:0:ffff:169.254.169.254` is the
+ * metadata address written long, and no `^::`-anchored pattern sees it.
+ */
+function parseV6(address) {
+    // A zone id (`%eth0`) names an interface, not a different address.
+    const text = (address.toLowerCase().split('%')[0] ?? '').trim();
+    if (text.length === 0)
+        return null;
+    // A trailing dotted quad is the last two groups written in v4 notation.
+    let head = text;
+    let tail = [];
+    const lastColon = text.lastIndexOf(':');
+    const after = lastColon >= 0 ? text.slice(lastColon + 1) : '';
+    if (after.includes('.')) {
+        const quad = parseV4(after);
+        if (!quad)
+            return null;
+        const [a, b, c, d] = quad;
+        tail = [(a << 8) | b, (c << 8) | d];
+        head = text.slice(0, lastColon + 1);
+        if (head.endsWith(':') && !head.endsWith('::'))
+            head = head.slice(0, -1);
+    }
+    const halves = head.split('::');
+    if (halves.length > 2)
+        return null;
+    const toGroups = (part) => {
+        if (part.length === 0)
+            return [];
+        const out = [];
+        for (const piece of part.split(':')) {
+            if (!/^[0-9a-f]{1,4}$/.test(piece))
+                return null;
+            out.push(Number.parseInt(piece, 16));
+        }
+        return out;
+    };
+    if (halves.length === 1) {
+        const only = toGroups(halves[0] ?? '');
+        if (!only)
+            return null;
+        const groups = [...only, ...tail];
+        return groups.length === 8 ? groups : null;
+    }
+    const left = toGroups(halves[0] ?? '');
+    const right = toGroups(halves[1] ?? '');
+    if (!left || !right)
+        return null;
+    const known = left.length + right.length + tail.length;
+    if (known > 8)
+        return null;
+    return [...left, ...new Array(8 - known).fill(0), ...right, ...tail];
+}
+/** Whether the first `count` groups are all zero. */
+function zeroPrefix(groups, count) {
+    return groups.slice(0, count).every((g) => g === 0);
+}
+/**
+ * Why this address must not be reached, or `null` if it may be.
+ *
+ * Returns a reason rather than a boolean because the reason is what a
+ * denied operator needs: "link-local" and "private" are different mistakes
+ * with different fixes, and a bare `false` sends them to read this file.
+ */
+export function blockedAddressReason(address) {
+    const literal = unbracket(address);
+    const v4 = parseV4(literal);
+    if (v4) {
+        for (const range of V4_RANGES) {
+            if (range.matches(v4))
+                return range.reason;
+        }
+        return null;
+    }
+    const groups = parseV6(literal);
+    if (!groups)
+        return null;
+    // `::ffff:a.b.c.d` (v4-mapped) and the deprecated `::a.b.c.d`
+    // (v4-compatible) are both the v4 address wearing a v6 spelling, and both
+    // reach the v4 host. A screen that only understands dotted quads passes
+    // them, which is a documented way through this kind of filter rather than
+    // an oversight worth ignoring.
+    if (zeroPrefix(groups, 5) && groups[5] === 0xffff) {
+        return blockedAddressReason(v4FromGroups(groups));
+    }
+    if (zeroPrefix(groups, 6) && !(groups[6] === 0 && (groups[7] ?? 0) <= 1)) {
+        return blockedAddressReason(v4FromGroups(groups));
+    }
+    if (zeroPrefix(groups, 7)) {
+        if (groups[7] === 1)
+            return 'loopback';
+        if (groups[7] === 0)
+            return 'unspecified';
+    }
+    const first = groups[0] ?? 0;
+    // Masked, not prefix-matched: fc00::/7, fe80::/10, ff00::/8.
+    if ((first & 0xfe00) === 0xfc00)
+        return 'unique-local';
+    if ((first & 0xffc0) === 0xfe80)
+        return 'link-local';
+    if ((first & 0xff00) === 0xff00)
+        return 'multicast';
+    return null;
+}
+function v4FromGroups(groups) {
+    const high = groups[6] ?? 0;
+    const low = groups[7] ?? 0;
+    return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
+}
+/**
+ * An IPv6 literal arrives bracketed from one of the two paths.
+ *
+ * `new URL('http://[::1]/').hostname` is `[::1]`, brackets included, and
+ * `parseTarget` reads exactly that. The `Host`-header path hands the same
+ * address over bare, because `splitAuthority` strips the brackets itself —
+ * two spellings of one address, normalised here rather than at either call
+ * site.
+ *
+ * This is a layer, not a hole closed, and the difference was measured rather
+ * than assumed: Node does not read a bracketed string as an IP literal
+ * either, so without this the host falls through to `dns.lookup` and the
+ * screening resolver refuses it there. What this buys is that
+ * `blockedLiteralReason` stops answering `null` about an address it plainly
+ * recognises — a true-looking answer the next caller would build on.
+ */
+function unbracket(host) {
+    const trimmed = host.trim();
+    return trimmed.startsWith('[') && trimmed.endsWith(']') ? trimmed.slice(1, -1) : trimmed;
+}
+/**
+ * Screen a target that is already an address rather than a name.
+ *
+ * A `lookup` hook cannot cover this case and it is not obvious why: the
+ * socket layer skips resolution entirely when the host is a valid IP
+ * literal, so the screening resolver is never called. The whole existing
+ * egress suite passed with the resolver in place *because* its upstream is
+ * `127.0.0.1` — a literal, never resolved, never screened. A green suite
+ * was the evidence the hole was still open.
+ *
+ * So the two cases need two checks: names are screened inside the resolver
+ * the socket calls, literals are screened here before it dials.
+ */
+export function blockedLiteralReason(host) {
+    // The `isIP` guard states the contract: only an address is screened here.
+    //
+    // It is defence in depth rather than the thing that saves a hostname, and
+    // that was measured — removing it kills no test, because `parseV6` refuses
+    // `fdsomething.example` and `ff-cdn.example` on its own. It earns its place
+    // against the version of this file that does not: the first screen written
+    // here matched `/^f[cd]/` against the raw text, and under that screen this
+    // line was the only thing standing between an ordinary CDN hostname and a
+    // refusal. Keeping it means a future loosening of the parser cannot quietly
+    // turn an address screen back into a name filter.
+    if (isIP(unbracket(host)) === 0)
+        return null;
+    return blockedAddressReason(host);
+}
+export class EgressAddressDenied extends Error {
+    host;
+    address;
+    reason;
+    constructor(host, address, reason) {
+        super(`Egress denied: ${host} resolves to ${address}, which is a ${reason} address. The host is on the allowlist; the address it resolves to is not reachable from a sandbox.`);
+        this.name = 'EgressAddressDenied';
+        this.host = host;
+        this.address = address;
+        this.reason = reason;
+    }
+}
+const platformResolver = (hostname, options, callback) => {
+    dnsLookup(hostname, options, callback);
+};
+/**
+ * A `lookup` implementation that screens before the socket uses the answer.
+ *
+ * This is deliberately not "resolve, check, then connect to the address we
+ * checked". That shape leaves the socket free to resolve again, and the
+ * second answer is the one that decides where the bytes go — so a name that
+ * alternates records walks straight through a check that passed a moment
+ * earlier. Screening inside the resolver the socket itself calls means there
+ * is one resolution, and the address that was screened is the address that
+ * gets connected to.
+ *
+ * Every returned address is screened, not just the one chosen. A record set
+ * mixing a public address with an inward one is the ordinary shape of this
+ * attack, and screening only the winner makes the outcome depend on which
+ * record the resolver happened to order first.
+ */
+export function createScreeningLookup(options = {}, isExempt = () => false) {
+    const resolver = options.resolve ?? platformResolver;
+    const exemptions = options.allowInwardFor ?? [];
+    return (hostname, opts, callback) => {
+        const wantsAll = typeof opts === 'object' && opts !== null && opts.all === true;
+        const family = typeof opts === 'number'
+            ? opts
+            : typeof opts === 'object' && opts !== null
+                ? (opts.family ?? 0)
+                : 0;
+        resolver(hostname, { all: true, verbatim: true }, (err, addresses) => {
+            if (err) {
+                callback(err, '', 0);
+                return;
+            }
+            const found = addresses ?? [];
+            if (found.length === 0) {
+                const empty = new Error(`Egress denied: ${hostname} resolved to no addresses.`);
+                empty.code = 'ENOTFOUND';
+                callback(empty, '', 0);
+                return;
+            }
+            if (!(exemptions.length > 0 && isExempt(hostname, exemptions))) {
+                for (const candidate of found) {
+                    const reason = blockedAddressReason(candidate.address);
+                    if (reason) {
+                        callback(new EgressAddressDenied(hostname, candidate.address, reason), '', 0);
+                        return;
+                    }
+                }
+            }
+            const usable = family === 0 ? found : found.filter((a) => a.family === family);
+            if (usable.length === 0) {
+                const mismatch = new Error(`Egress denied: ${hostname} has no address in the requested family.`);
+                mismatch.code = 'ENOTFOUND';
+                callback(mismatch, '', 0);
+                return;
+            }
+            if (wantsAll) {
+                callback(null, usable);
+                return;
+            }
+            const first = usable[0];
+            if (!first) {
+                const none = new Error(`Egress denied: ${hostname} resolved to no usable address.`);
+                none.code = 'ENOTFOUND';
+                callback(none, '', 0);
+                return;
+            }
+            callback(null, first.address, first.family);
+        });
+    };
+}
+//# sourceMappingURL=address.js.map

package/dist/egress/address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.js","sourceRoot":"","sources":["../../src/egress/address.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,UAAU,CAAA;AAE9C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAyB/B,MAAM,SAAS,GAAqB;IACnC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;IACpD,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;IACnD,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE;IAClD,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;IAC7F,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;IACnE,yEAAyE;IACzE,sEAAsE;IACtE,gCAAgC;IAChC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE;IACtE;QACC,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG;KACvE;IACD,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE;IACxF,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,EAAE;IACjF,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,EAAE;CAC1D,CAAA;AAED,SAAS,OAAO,CAAC,OAAe;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACf,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,OAAO,CAAC,OAAe;IAC/B,mEAAmE;IACnE,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,wEAAwE;IACxE,IAAI,IAAI,GAAG,IAAI,CAAA;IACf,IAAI,IAAI,GAAa,EAAE,CAAA;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAwC,CAAA;QAC7D,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACnC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAA;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAmB,EAAE;QAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QAChC,MAAM,GAAG,GAAa,EAAE,CAAA;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC/C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;QACrC,CAAC;QACD,OAAO,GAAG,CAAA;IACX,CAAC,CAAA;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAA;QACjC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACvC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IACtD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1B,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,CAAA;AAC7E,CAAC;AAED,qDAAqD;AACrD,SAAS,UAAU,CAAC,MAAyB,EAAE,KAAa;IAC3D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IACnD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,EAAE,EAAE,CAAC;QACR,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAA;QAC3C,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,8DAA8D;IAC9D,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,+BAA+B;IAC/B,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACnD,OAAO,oBAAoB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IAClD,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,oBAAoB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IAClD,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,UAAU,CAAA;QACtC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,aAAa,CAAA;IAC1C,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC5B,6DAA6D;IAC7D,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,cAAc,CAAA;IACtD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,YAAY,CAAA;IACpD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,WAAW,CAAA;IACnD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,MAAyB;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC1B,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAA;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,SAAS,CAAC,IAAY;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AACzF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAChD,0EAA0E;IAC1E,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5C,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACpC,IAAI,CAAQ;IACZ,OAAO,CAAQ;IACf,MAAM,CAAQ;IAEvB,YAAY,IAAY,EAAE,OAAe,EAAE,MAAc;QACxD,KAAK,CACJ,kBAAkB,IAAI,gBAAgB,OAAO,gBAAgB,MAAM,qGAAqG,CACxK,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACrB,CAAC;CACD;AA+BD,MAAM,gBAAgB,GAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;IACzE,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AACvC,CAAC,CAAA;AAQD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACpC,UAAkC,EAAE,EACpC,WAAmE,GAAG,EAAE,CAAC,KAAK;IAE9E,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAA;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAA;IAE/C,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QACnC,MAAM,QAAQ,GACb,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAK,IAA0B,CAAC,GAAG,KAAK,IAAI,CAAA;QACtF,MAAM,MAAM,GACX,OAAO,IAAI,KAAK,QAAQ;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;gBAC1C,CAAC,CAAC,CAAE,IAA4B,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC7C,CAAC,CAAC,CAAC,CAAA;QAEN,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YACpE,IAAI,GAAG,EAAE,CAAC;gBACT,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;gBACpB,OAAM;YACP,CAAC;YACD,MAAM,KAAK,GAAG,SAAS,IAAI,EAAE,CAAA;YAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,KAAK,GAA0B,IAAI,KAAK,CAC7C,kBAAkB,QAAQ,4BAA4B,CACtD,CAAA;gBACD,KAAK,CAAC,IAAI,GAAG,WAAW,CAAA;gBACxB,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;gBACtB,OAAM;YACP,CAAC;YAED,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;gBAChE,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;oBAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;oBACtD,IAAI,MAAM,EAAE,CAAC;wBACZ,QAAQ,CAAC,IAAI,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;wBAC7E,OAAM;oBACP,CAAC;gBACF,CAAC;YACF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;YAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAA0B,IAAI,KAAK,CAChD,kBAAkB,QAAQ,0CAA0C,CACpE,CAAA;gBACD,QAAQ,CAAC,IAAI,GAAG,WAAW,CAAA;gBAC3B,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;gBACzB,OAAM;YACP,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;gBACtB,OAAM;YACP,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM,IAAI,GAA0B,IAAI,KAAK,CAC5C,kBAAkB,QAAQ,iCAAiC,CAC3D,CAAA;gBACD,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;gBACvB,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;gBACrB,OAAM;YACP,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;IACH,CAAC,CAAA;AACF,CAAC"}

package/dist/egress/index.d.ts

@@ -1,3 +1,5 @@
+export { blockedAddressReason, blockedLiteralReason, createScreeningLookup, EgressAddressDenied, } from './address.js';
+export type { AddressResolver, ScreeningLookupOptions } from './address.js';
 export { isHostAllowed, splitAuthority } from './allowlist.js';
 export { EgressProxy } from './proxy.js';
 export type { BrokeredCredential, EgressProxyOptions, RunningEgressProxy, } from './proxy.js';

package/dist/egress/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/egress/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,YAAY,EACX,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/egress/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,GACnB,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAC3E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,YAAY,EACX,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,YAAY,CAAA"}

package/dist/egress/index.js

@@ -1,3 +1,4 @@
+export { blockedAddressReason, blockedLiteralReason, createScreeningLookup, EgressAddressDenied, } from './address.js';
 export { isHostAllowed, splitAuthority } from './allowlist.js';
 export { EgressProxy } from './proxy.js';
 //# sourceMappingURL=index.js.map

package/dist/egress/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/egress/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/egress/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,GACnB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}

package/dist/egress/proxy.d.ts

@@ -1,3 +1,4 @@
+import type { ScreeningLookupOptions } from './address.js';
 /**
  * The network boundary a sandbox's egress policy is enforced at.
  *
@@ -49,6 +50,18 @@ export interface EgressProxyOptions {
      */
     readonly upgradeToHttps?: boolean;
     readonly onDenied?: (host: string, reason: string) => void;
+    /**
+     * Allowlisted hosts permitted to resolve to an inward address anyway.
+     *
+     * Matched by the allowlist's own rules, so `.internal.example` covers
+     * subdomains. Per host on purpose: an operator who genuinely proxies to
+     * one service on a private network needs that one exempted, and a global
+     * switch to get it would hand every other allowlisted name the same
+     * reach — which is the hole this screen exists to close.
+     */
+    readonly allowInwardFor?: readonly string[];
+    /** Injected in tests. Defaults to the platform resolver. */
+    readonly resolveAddresses?: ScreeningLookupOptions['resolve'];
 }
 export interface RunningEgressProxy {
     readonly port: number;
@@ -65,10 +78,26 @@ export declare class EgressProxy {
     private readonly onDenied;
     /** See the loop guard in `listen`. */
     private selfPort;
+    /**
+     * The resolver both paths connect through.
+     *
+     * Held once rather than built per request so there is exactly one place
+     * the address screen can be bypassed, and it is visible from here.
+     */
+    private readonly lookup;
+    private readonly inwardAllowed;
     constructor(options: EgressProxyOptions);
     listen(port?: number): Promise<RunningEgressProxy>;
     private allowed;
     private deny;
+    /**
+     * Why this target may not be dialled as written, or `null`.
+     *
+     * Covers the literal-address case only; a name is screened inside
+     * `this.lookup`, which the socket calls. Both are needed — see
+     * `blockedLiteralReason` for why one cannot cover the other.
+     */
+    private literalDenial;
     /** Plain HTTP. The only path where a credential can be stamped on. */
     private handleRequest;
     /**
@@ -81,6 +110,18 @@ export declare class EgressProxy {
      * agent sends anywhere, a strictly larger risk than the one being
      * mitigated. A workload that needs brokering speaks plain HTTP to the
      * proxy and lets it upgrade upstream.
+     *
+     * **And the allowlist here is a check on the name in the CONNECT line,
+     * which is the only thing about this tunnel that is ever in clear text.**
+     * The address screen makes it a check on where that name goes, which is a
+     * real bound — a permitted name can no longer be a route to the host's own
+     * network. It is not a check on what travels afterwards. Inside the tunnel
+     * the bytes are the caller's, and the name the caller puts in its own TLS
+     * handshake or `Host` header is not visible to this process, so against a
+     * determined caller running inside the sandbox this path bounds the
+     * DESTINATION and nothing else. Say so plainly rather than let a reader
+     * infer that a tunnel to an allowlisted host carries only allowlisted
+     * traffic.
      */
     private handleConnect;
     /** Whether a target names this proxy. See the loop guard in `listen`. */

package/dist/egress/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/egress/proxy.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;GAgBG;AAEH,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACpD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;CAC1D;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,eAAe,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GAAG,IAAI,CAAA;IAChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACtB;AAID,qBAAa,WAAW;IACvB,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsD;IAC/E,sCAAsC;IACtC,OAAO,CAAC,QAAQ,CAAoB;gBAExB,OAAO,EAAE,kBAAkB;IAOjC,MAAM,CAAC,IAAI,SAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAyCrC,OAAO;IAWrB,OAAO,CAAC,IAAI;IAIZ,sEAAsE;YACxD,aAAa;IA8D3B;;;;;;;;;;OAUG;YACW,aAAa;IA2B3B,yEAAyE;IACzE,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,aAAa;CAGrB"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/egress/proxy.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAG1D;;;;;;;;;;;;;;;;GAgBG;AAEH,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACpD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1D;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,4DAA4D;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,eAAe,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GAAG,IAAI,CAAA;IAChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACtB;AAID,qBAAa,WAAW;IACvB,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsD;IAC/E,sCAAsC;IACtC,OAAO,CAAC,QAAQ,CAAoB;IACpC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmB;gBAErC,OAAO,EAAE,kBAAkB;IAejC,MAAM,CAAC,IAAI,SAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAyCrC,OAAO;IAWrB,OAAO,CAAC,IAAI;IAIZ;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAKrB,sEAAsE;YACxD,aAAa;IA4F3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,aAAa;IA+C3B,yEAAyE;IACzE,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,aAAa;CAGrB"}

package/dist/egress/proxy.js

@@ -1,6 +1,7 @@
 import { createServer, request as httpRequest } from 'node:http';
 import { request as httpsRequest } from 'node:https';
 import { connect as netConnect } from 'node:net';
+import { EgressAddressDenied, blockedLiteralReason, createScreeningLookup } from './address.js';
 import { isHostAllowed, splitAuthority } from './allowlist.js';
 const DENIED_STATUS = 403;
 export class EgressProxy {
@@ -10,11 +11,24 @@ export class EgressProxy {
     onDenied;
     /** See the loop guard in `listen`. */
     selfPort;
+    /**
+     * The resolver both paths connect through.
+     *
+     * Held once rather than built per request so there is exactly one place
+     * the address screen can be bypassed, and it is visible from here.
+     */
+    lookup;
+    inwardAllowed;
     constructor(options) {
         this.resolveAllowed = options.allowedHosts;
         this.credentials = options.credentials ?? [];
         this.upgradeToHttps = options.upgradeToHttps ?? true;
         this.onDenied = options.onDenied;
+        this.inwardAllowed = options.allowInwardFor ?? [];
+        this.lookup = createScreeningLookup({
+            ...(options.allowInwardFor ? { allowInwardFor: options.allowInwardFor } : {}),
+            ...(options.resolveAddresses ? { resolve: options.resolveAddresses } : {}),
+        }, isHostAllowed);
     }
     async listen(port = 0) {
         const server = createServer((req, res) => {
@@ -67,6 +81,18 @@ export class EgressProxy {
     deny(host, reason) {
         this.onDenied?.(host, reason);
     }
+    /**
+     * Why this target may not be dialled as written, or `null`.
+     *
+     * Covers the literal-address case only; a name is screened inside
+     * `this.lookup`, which the socket calls. Both are needed — see
+     * `blockedLiteralReason` for why one cannot cover the other.
+     */
+    literalDenial(host) {
+        if (this.inwardAllowed.length > 0 && isHostAllowed(host, this.inwardAllowed))
+            return null;
+        return blockedLiteralReason(host);
+    }
     /** Plain HTTP. The only path where a credential can be stamped on. */
     async handleRequest(req, res) {
         const target = parseTarget(req);
@@ -89,6 +115,17 @@ export class EgressProxy {
             res.end(`Egress denied: ${target.host} is not on this sandbox's allowlist.\n`);
             return;
         }
+        const literal = this.literalDenial(target.host);
+        if (literal) {
+            this.deny(target.host, `is a ${literal} address`);
+            res.writeHead(DENIED_STATUS, { 'content-type': 'text/plain' });
+            // Refused BEFORE the credential is looked up, let alone stamped.
+            // The ordering is the point: on this path the token goes on the
+            // headers a few lines below, so a check that ran after it would be
+            // deciding whether to send a request that already carried it.
+            res.end(`Egress denied: ${target.host} is a ${literal} address, which is not reachable from a sandbox.\n`);
+            return;
+        }
         const headers = { ...req.headers };
         // The proxy re-issues the request, so hop-by-hop headers about the
         // hop that just ended must not be forwarded.
@@ -108,11 +145,28 @@ export class EgressProxy {
             method: req.method,
             path: target.path,
             headers,
+            // `host` stays the NAME so SNI and certificate validation still
+            // check the name the allowlist approved; only the address the
+            // socket dials is screened. Swapping in the address here would
+            // break TLS verification, which is the wrong way to fix this.
+            lookup: this.lookup,
         }, (response) => {
             res.writeHead(response.statusCode ?? 502, response.headers);
             response.pipe(res);
         });
         upstream.on('error', (err) => {
+            // An address denial is a policy refusal, not a network fault, and
+            // telling them apart is the difference between an agent that stops
+            // and one that retries a forbidden host forever. The credential is
+            // already on `headers` at this point and has still not left the
+            // process: the socket never connected, so nothing was written.
+            if (err instanceof EgressAddressDenied) {
+                this.deny(err.host, `resolves to a ${err.reason} address`);
+                if (!res.headersSent)
+                    res.writeHead(DENIED_STATUS, { 'content-type': 'text/plain' });
+                res.end(`${err.message}\n`);
+                return;
+            }
             if (!res.headersSent)
                 res.writeHead(502, { 'content-type': 'text/plain' });
             res.end(`Upstream request failed: ${err.message}\n`);
@@ -129,6 +183,18 @@ export class EgressProxy {
      * agent sends anywhere, a strictly larger risk than the one being
      * mitigated. A workload that needs brokering speaks plain HTTP to the
      * proxy and lets it upgrade upstream.
+     *
+     * **And the allowlist here is a check on the name in the CONNECT line,
+     * which is the only thing about this tunnel that is ever in clear text.**
+     * The address screen makes it a check on where that name goes, which is a
+     * real bound — a permitted name can no longer be a route to the host's own
+     * network. It is not a check on what travels afterwards. Inside the tunnel
+     * the bytes are the caller's, and the name the caller puts in its own TLS
+     * handshake or `Host` header is not visible to this process, so against a
+     * determined caller running inside the sandbox this path bounds the
+     * DESTINATION and nothing else. Say so plainly rather than let a reader
+     * infer that a tunnel to an allowlisted host carries only allowlisted
+     * traffic.
      */
     async handleConnect(req, socket, head) {
         const { host, port } = splitAuthority(req.url ?? '');
@@ -138,14 +204,29 @@ export class EgressProxy {
             socket.end();
             return;
         }
-        const upstream = netConnect(port ?? 443, host, () => {
+        const literal = this.literalDenial(host);
+        if (literal) {
+            this.deny(host, `is a ${literal} address`);
+            socket.write(`HTTP/1.1 ${DENIED_STATUS} Forbidden\r\nContent-Type: text/plain\r\n\r\nEgress denied: ${host} is a ${literal} address, which is not reachable from a sandbox.\n`);
+            socket.end();
+            return;
+        }
+        // Same screened resolver as the plain path. The tunnel carries no
+        // brokered credential, so the loss here is reach rather than a token —
+        // but an allowlisted name pointing inward still turns this proxy into
+        // a route to the host's own network, which is what a sandbox is for.
+        const upstream = netConnect({ port: port ?? 443, host, lookup: this.lookup }, () => {
             socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
             if (head.length > 0)
                 upstream.write(head);
             upstream.pipe(socket);
             socket.pipe(upstream);
         });
-        upstream.on('error', () => {
+        upstream.on('error', (err) => {
+            if (err instanceof EgressAddressDenied) {
+                this.deny(err.host, `resolves to a ${err.reason} address`);
+                socket.write(`HTTP/1.1 ${DENIED_STATUS} Forbidden\r\nContent-Type: text/plain\r\n\r\n${err.message}\n`);
+            }
             socket.end();
         });
         socket.on('error', () => {