chainlesschain 0.166.77 → 0.166.79

package/src/lib/sandbox-egress-proxy.js

@@ -18,6 +18,8 @@
 import http from "node:http";
 import net from "node:net";
 import dns from "node:dns";
+import fs from "node:fs";
+import path from "node:path";
 import {
   evaluateNetworkAccess,
   isPrivateHost,
@@ -132,15 +134,83 @@ export function proxyEnv(port, host = "127.0.0.1") {
 /**
  * Create (but do not yet listen on) an egress-filtering proxy for a policy.
  * @param {object} policy  { allowedDomains?, deniedDomains?, allowPrivate? }
- * @param {object} [opts]  { onDecision?(info), bindHost? }
- * @returns {{ listen():Promise<{port,env,server}>, close():Promise<void>,
- *             server:import('http').Server, blocked:number, allowed:number }}
+ * @param {object} [opts]  { onDecision?(info), bindHost?, socketPath? }
+ * @returns {{ listen():Promise<{port?,socketPath?,env?,server}>, close():Promise<void>,
+ *             updatePolicy(nextPolicy:object, expectedRevision:number):number,
+ *             server:import('http').Server, blocked:number, allowed:number,
+ *             revision:number }}
  */
 export function createEgressProxy(policy = {}, opts = {}) {
   const bindHost = opts.bindHost || "127.0.0.1";
+  const socketPath = opts.socketPath || null;
+  if (socketPath) {
+    if (
+      process.platform !== "linux" ||
+      !path.isAbsolute(socketPath) ||
+      Buffer.byteLength(socketPath) > 107
+    ) {
+      throw new Error(
+        "A short Linux absolute path is required for the egress broker socket",
+      );
+    }
+    const parent = path.dirname(socketPath);
+    const stat = fs.lstatSync(parent);
+    if (
+      !stat.isDirectory() ||
+      stat.mode & 0o077 ||
+      stat.uid !== process.getuid()
+    ) {
+      throw new Error(
+        "The egress broker socket requires an owner-only directory",
+      );
+    }
+  }
   const state = { blocked: 0, allowed: 0 };
+  const snapshot = (value) => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new TypeError("Egress policy must be an object");
+    }
+    for (const key of ["allowedDomains", "deniedDomains"]) {
+      if (
+        value[key] !== undefined &&
+        (!Array.isArray(value[key]) ||
+          value[key].some((item) => typeof item !== "string"))
+      ) {
+        throw new TypeError(`${key} must be an array of strings`);
+      }
+    }
+    if (
+      value.allowPrivate !== undefined &&
+      typeof value.allowPrivate !== "boolean"
+    ) {
+      throw new TypeError("allowPrivate must be a boolean");
+    }
+    return Object.freeze({
+      allowedDomains: Object.freeze([...(value.allowedDomains || [])]),
+      deniedDomains: Object.freeze([...(value.deniedDomains || [])]),
+      allowPrivate: value.allowPrivate === true,
+    });
+  };
+  let currentPolicy = snapshot(policy);
+  let revision = 0;
+  let closed = false;
+  const active = new Set();
+  const connections = new Set();
+  const register = (client) => {
+    const lease = { revision, client, upstream: null, cancelled: false };
+    active.add(lease);
+    return lease;
+  };
+  const revoke = (lease) => {
+    lease.cancelled = true;
+    lease.upstream?.destroy();
+    lease.client.destroy();
+    active.delete(lease);
+  };
+  const live = (lease) =>
+    !closed && !lease.cancelled && lease.revision === revision;
   const decide = (target, kind) => {
-    const verdict = evaluateNetworkAccess(target, policy);
+    const verdict = evaluateNetworkAccess(target, currentPolicy);
     if (verdict.allowed) state.allowed += 1;
     else state.blocked += 1;
     if (typeof opts.onDecision === "function") {
@@ -162,11 +232,11 @@ export function createEgressProxy(policy = {}, opts = {}) {
   // exact address to pin the connection to (null → connect by the original
   // name). When the resolved IP is private the name-based allow is overturned:
   // fix the counters and re-notify observers with the block reason.
-  const guard = async (verdict, kind) => {
+  const guard = async (verdict, kind, policySnapshot) => {
     if (!verdict.allowed || verdict.specific || !rebindGuard) {
       return { verdict, ip: null };
     }
-    const res = await guardResolvedTarget(verdict.host, policy, lookup);
+    const res = await guardResolvedTarget(verdict.host, policySnapshot, lookup);
     if (res.ok) return { verdict, ip: res.ip };
     state.allowed -= 1;
     state.blocked += 1;
@@ -182,9 +252,20 @@ export function createEgressProxy(policy = {}, opts = {}) {
   };
 
   const server = http.createServer(async (req, res) => {
+    const lease = register(res);
+    res.once("close", () => {
+      active.delete(lease);
+      if (!res.writableEnded) lease.upstream?.destroy();
+    });
     try {
       // A forward-proxy request carries the absolute URL in the request line.
-      const { verdict, ip } = await guard(decide(req.url, "http"), "http");
+      const policySnapshot = currentPolicy;
+      const { verdict, ip } = await guard(
+        decide(req.url, "http"),
+        "http",
+        policySnapshot,
+      );
+      if (!live(lease)) return;
       if (!verdict.allowed) {
         res.writeHead(403, { "content-type": "text/plain" });
         res.end(`egress blocked: ${verdict.host} — ${verdict.reason}\n`);
@@ -198,26 +279,40 @@ export function createEgressProxy(policy = {}, opts = {}) {
         res.end("bad request target\n");
         return;
       }
+      if (u.protocol !== "http:" || u.username || u.password) {
+        res.writeHead(400, { "content-type": "text/plain" });
+        res.end("unsupported proxy target\n");
+        return;
+      }
       const upstream = http.request(
         {
           hostname: ip || u.hostname, // pin to the validated IP when re-checked
           port: u.port || 80,
           path: `${u.pathname}${u.search}`,
           method: req.method,
-          headers: req.headers, // preserves the original Host header
+          // The URL is the policy authority. Do not forward a conflicting
+          // client Host header to a different virtual host on the allowed IP.
+          headers: { ...req.headers, host: u.host },
         },
         (upRes) => {
+          if (!live(lease)) {
+            upRes.destroy();
+            return;
+          }
           res.writeHead(upRes.statusCode || 502, upRes.headers);
           upRes.pipe(res);
         },
       );
+      lease.upstream = upstream;
       upstream.on("error", () => {
+        if (!live(lease)) return;
         if (!res.headersSent)
           res.writeHead(502, { "content-type": "text/plain" });
         res.end("upstream error\n");
       });
       req.pipe(upstream);
     } catch {
+      if (!live(lease)) return;
       if (!res.headersSent)
         res.writeHead(502, { "content-type": "text/plain" });
       res.end("proxy error\n");
@@ -226,11 +321,19 @@ export function createEgressProxy(policy = {}, opts = {}) {
 
   // HTTPS (and any TLS) goes through CONNECT — tunnel only allowed hosts.
   server.on("connect", async (req, clientSocket, head) => {
+    const lease = register(clientSocket);
+    clientSocket.once("close", () => {
+      active.delete(lease);
+      lease.upstream?.destroy();
+    });
     try {
+      const policySnapshot = currentPolicy;
       const { verdict, ip } = await guard(
         decide(req.url, "connect"),
         "connect",
+        policySnapshot,
       ); // req.url = "host:port"
+      if (!live(lease)) return;
       if (!verdict.allowed) {
         clientSocket.write(
           "HTTP/1.1 403 Forbidden\r\n" +
@@ -245,11 +348,16 @@ export function createEgressProxy(policy = {}, opts = {}) {
       // Connect to the pinned validated IP so a rebind at connect time can't
       // swap in a private address between our check and the socket.
       const upstream = net.connect(port, ip || host, () => {
+        if (!live(lease)) {
+          upstream.destroy();
+          return;
+        }
         clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
         if (head && head.length) upstream.write(head);
         upstream.pipe(clientSocket);
         clientSocket.pipe(upstream);
       });
+      lease.upstream = upstream;
       upstream.on("error", () => {
         try {
           clientSocket.end();
@@ -265,6 +373,7 @@ export function createEgressProxy(policy = {}, opts = {}) {
         }
       });
     } catch {
+      if (!live(lease)) return;
       try {
         clientSocket.end();
       } catch {
@@ -273,6 +382,16 @@ export function createEgressProxy(policy = {}, opts = {}) {
     }
   });
 
+  // Raw HTTP Upgrade is not a governed tunnel. WebSocket clients may use a
+  // CONNECT tunnel, which remains registered above for revision revocation.
+  server.on("upgrade", (_req, socket) => {
+    socket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+  });
+  server.on("connection", (socket) => {
+    connections.add(socket);
+    socket.once("close", () => connections.delete(socket));
+  });
+
   return {
     server,
     get blocked() {
@@ -281,17 +400,55 @@ export function createEgressProxy(policy = {}, opts = {}) {
     get allowed() {
       return state.allowed;
     },
+    get revision() {
+      return revision;
+    },
+    updatePolicy(nextPolicy, expectedRevision) {
+      if (closed || expectedRevision !== revision) {
+        const error = new Error("Stale or closed egress policy revision");
+        error.code = "ERR_EGRESS_POLICY_REVISION";
+        throw error;
+      }
+      const next = snapshot(nextPolicy);
+      currentPolicy = next;
+      revision += 1;
+      // A new revision has no inherited connection authority. Closing every
+      // existing lease also covers in-flight DNS and HTTP connect callbacks.
+      for (const lease of active) revoke(lease);
+      return revision;
+    },
     listen() {
       return new Promise((resolve, reject) => {
+        if (closed) {
+          reject(new Error("Egress proxy is closed"));
+          return;
+        }
         server.once("error", reject);
-        server.listen(0, bindHost, () => {
+        const onListening = () => {
           server.removeListener("error", reject);
+          if (socketPath) {
+            try {
+              fs.chmodSync(socketPath, 0o600);
+            } catch (error) {
+              server.close();
+              reject(error);
+              return;
+            }
+            resolve({ socketPath, server });
+            return;
+          }
           const port = server.address().port;
           resolve({ port, env: proxyEnv(port), server });
-        });
+        };
+        if (socketPath) server.listen(socketPath, onListening);
+        else server.listen(0, bindHost, onListening);
       });
     },
     close() {
+      closed = true;
+      for (const lease of active) revoke(lease);
+      for (const socket of connections) socket.destroy();
+      if (!server.listening) return Promise.resolve();
       return new Promise((resolve) => server.close(() => resolve()));
     },
   };

package/src/lib/sandbox-egress-worker-thread.js

@@ -0,0 +1,38 @@
+import { parentPort, workerData } from "node:worker_threads";
+import { createEgressProxy } from "./sandbox-egress-proxy.js";
+
+let proxy;
+try {
+  proxy = createEgressProxy(workerData.policy, {
+    bindHost: workerData.bindHost,
+    socketPath: workerData.socketPath,
+  });
+  const { port, socketPath } = await proxy.listen();
+  parentPort.postMessage({ type: "ready", port, socketPath });
+  parentPort.on("message", async (message) => {
+    if (!Number.isSafeInteger(message?.id) || message.id < 1) return;
+    try {
+      if (message.type === "update") {
+        const revision = proxy.updatePolicy(
+          message.policy,
+          message.expectedRevision,
+        );
+        parentPort.postMessage({ id: message.id, revision });
+      } else if (message.type === "close") {
+        await proxy.close();
+        parentPort.postMessage({ id: message.id, closed: true });
+      }
+    } catch (error) {
+      parentPort.postMessage({
+        id: message.id,
+        errorCode:
+          error?.code === "ERR_EGRESS_POLICY_REVISION"
+            ? error.code
+            : "ERR_EGRESS_WORKER_REQUEST",
+      });
+    }
+  });
+} catch {
+  parentPort.postMessage({ type: "startup-failed" });
+  parentPort.close();
+}

package/src/lib/sandbox-egress-worker.js

@@ -0,0 +1,196 @@
+/** Run the policy proxy on a separate event loop so a synchronous shell wait
+ * cannot stall HTTP/CONNECT decisions. This is a host-side building block;
+ * callers still need a kernel-enforced network route before allowing a
+ * domain-restricted sandbox command to start.
+ */
+import { Worker } from "node:worker_threads";
+import path from "node:path";
+
+const RESPONSE_TIMEOUT_MS = 10_000;
+
+function workerError(code) {
+  const error = new Error(code);
+  error.code = code;
+  return error;
+}
+
+export async function startEgressProxyWorker(policy, options = {}) {
+  const bindHost = options.bindHost || "127.0.0.1";
+  const socketPath = options.socketPath || null;
+  if (socketPath) {
+    if (process.platform !== "linux" || !path.isAbsolute(socketPath)) {
+      throw workerError("ERR_EGRESS_WORKER_SOCKET_PATH");
+    }
+  } else if (bindHost !== "127.0.0.1" && bindHost !== "::1") {
+    throw workerError("ERR_EGRESS_WORKER_BIND_HOST");
+  }
+  const timeoutMs = options.timeoutMs || RESPONSE_TIMEOUT_MS;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
+    throw workerError("ERR_EGRESS_WORKER_TIMEOUT");
+  }
+  const worker = new Worker(
+    new URL("./sandbox-egress-worker-thread.js", import.meta.url),
+    { workerData: { policy, bindHost, socketPath } },
+  );
+  const pending = new Map();
+  let nextId = 1;
+  let revision = 0;
+  let closed = false;
+  let terminalError = null;
+  let expectedTermination = false;
+  let terminationPromise = null;
+  let shutdownPromise = null;
+  let resolveReady;
+  let rejectReady;
+  const ready = new Promise((resolve, reject) => {
+    resolveReady = resolve;
+    rejectReady = reject;
+  });
+  const startupTimer = setTimeout(() => {
+    fail(workerError("ERR_EGRESS_WORKER_START_TIMEOUT"));
+    void terminateWorker();
+  }, timeoutMs);
+
+  function terminateWorker() {
+    if (!terminationPromise) {
+      expectedTermination = true;
+      terminationPromise = worker.terminate();
+    }
+    return terminationPromise;
+  }
+
+  function fail(error) {
+    if (terminalError) return;
+    terminalError = error;
+    clearTimeout(startupTimer);
+    rejectReady(error);
+    for (const entry of pending.values()) {
+      clearTimeout(entry.timer);
+      entry.reject(error);
+    }
+    pending.clear();
+    if (!closed) {
+      try {
+        options.onFailure?.(error);
+      } catch {
+        // A diagnostic observer cannot keep a failed proxy alive.
+      }
+    }
+  }
+
+  worker.on("message", (message) => {
+    if (message?.type === "startup-failed") {
+      fail(workerError("ERR_EGRESS_WORKER_START_FAILED"));
+      return;
+    }
+    if (message?.type === "ready") {
+      const validEndpoint = socketPath
+        ? message.socketPath === socketPath && message.port === undefined
+        : Number.isSafeInteger(message.port) &&
+          message.port >= 1 &&
+          message.port <= 65535;
+      if (!validEndpoint) {
+        fail(workerError("ERR_EGRESS_WORKER_PROTOCOL"));
+        void terminateWorker();
+        return;
+      }
+      clearTimeout(startupTimer);
+      resolveReady(socketPath ? socketPath : message.port);
+      return;
+    }
+    const entry = pending.get(message?.id);
+    if (!entry) return;
+    pending.delete(message.id);
+    clearTimeout(entry.timer);
+    if (message.errorCode) {
+      entry.reject(
+        workerError(
+          message.errorCode === "ERR_EGRESS_POLICY_REVISION"
+            ? message.errorCode
+            : "ERR_EGRESS_WORKER_REQUEST",
+        ),
+      );
+      return;
+    }
+    entry.resolve(message);
+  });
+  worker.on("error", () => fail(workerError("ERR_EGRESS_WORKER_FAILURE")));
+  worker.on("exit", () => {
+    if (!expectedTermination) fail(workerError("ERR_EGRESS_WORKER_EXIT"));
+  });
+
+  function request(type, fields = {}) {
+    if (terminalError) return Promise.reject(terminalError);
+    if (closed && type !== "close") {
+      return Promise.reject(workerError("ERR_EGRESS_WORKER_CLOSED"));
+    }
+    const id = nextId++;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        const error = workerError("ERR_EGRESS_WORKER_RESPONSE_TIMEOUT");
+        fail(error);
+        void terminateWorker();
+      }, timeoutMs);
+      pending.set(id, { resolve, reject, timer });
+      try {
+        worker.postMessage({ id, type, ...fields });
+      } catch {
+        clearTimeout(timer);
+        pending.delete(id);
+        reject(workerError("ERR_EGRESS_WORKER_REQUEST"));
+      }
+    });
+  }
+
+  let endpoint;
+  try {
+    endpoint = await ready;
+  } catch (error) {
+    await terminateWorker();
+    throw error;
+  }
+  return {
+    port: socketPath ? null : endpoint,
+    socketPath: socketPath ? endpoint : null,
+    get revision() {
+      return revision;
+    },
+    async updatePolicy(nextPolicy, expectedRevision) {
+      const response = await request("update", {
+        policy: nextPolicy,
+        expectedRevision,
+      });
+      if (!Number.isSafeInteger(response.revision)) {
+        fail(workerError("ERR_EGRESS_WORKER_PROTOCOL"));
+        void terminateWorker();
+        throw terminalError;
+      }
+      revision = response.revision;
+      return revision;
+    },
+    close() {
+      if (!shutdownPromise) {
+        closed = true;
+        shutdownPromise = (async () => {
+          try {
+            if (!terminalError) await request("close");
+          } finally {
+            await terminateWorker();
+          }
+        })();
+      }
+      return shutdownPromise;
+    },
+    abort() {
+      if (!shutdownPromise) {
+        fail(workerError("ERR_EGRESS_WORKER_ABORTED"));
+        closed = true;
+        shutdownPromise = terminateWorker().then(() => {});
+      } else if (!expectedTermination) {
+        fail(workerError("ERR_EGRESS_WORKER_ABORTED"));
+        void terminateWorker();
+      }
+      return shutdownPromise;
+    },
+  };
+}