OpenSandbox 源码走读（四）：出口网络——NetworkPolicy、Egress Sidecar 与池化出口

1
2
3

def apply_egress_to_spec(..., network_policy, egress_image, ...):
    if not network_policy or not egress_image:
        return  # 两个条件缺一个，egress 根本不会出现

1
2
3
4
5
6

def build_security_context_for_sandbox_container(has_network_policy, ...):
    if not has_network_policy:
        ...
    return {
        "capabilities": {"drop": ["NET_ADMIN"]},
    }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

initialRules, _, err := policy.LoadInitialPolicyDetailed(...)
if err != nil {
    log.Fatalf("failed to load initial egress policy: %v", err)  // fail-closed
}
alwaysDeny, alwaysAllow, err := policy.LoadAlwaysRuleFiles()
...
proxy.Start(ctx)                          // DNS 代理先起，127.0.0.1:15353
...
if err := iptables.SetupRedirect(15353, exemptDst); err != nil {
    log.Fatalf("failed to install iptables redirect: %v", err)
}
setupNft(...)                             // dns+nft 模式下加载 nftables 链
...
policySrv, err := startPolicyServer(...)  // HTTP API :18080
mitm, err := startMitmproxyTransparentIfEnabled()  // 可选，实验特性

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

func normalizePolicy(p *NetworkPolicy) error {
    ...
    if ip, err := netip.ParseAddr(r.Target); err == nil {
        r.targetKind = targetIP      // 纯 IP
        r.ip = ip
        continue
    }
    if prefix, err := netip.ParsePrefix(r.Target); err == nil {
        r.targetKind = targetCIDR    // CIDR
        r.prefix = prefix
        continue
    }
    // 否则按域名处理

1
2
3
4

{"iptables", "-t", "nat", op, "OUTPUT", "-p", "udp", "--dport", "53",
    "-m", "mark", "--mark", constants.MarkHex, "-j", "RETURN"},   // ← 防自递归
{"iptables", "-t", "nat", op, "OUTPUT", "-p", "udp", "--dport", "53",
    "-j", "REDIRECT", "--to-port", targetPort},

1
2
3
4
5
6
7
8

if currentPolicy != nil && currentPolicy.Evaluate(domain) == policy.ActionDeny {
    telemetry.RecordDNSDenied()
    p.publishBlocked(domain)
    resp := new(dns.Msg)
    resp.SetRcode(r, dns.RcodeNameError)   // 被拒 = NXDOMAIN
    _ = w.WriteMsg(resp)
    return
}

1
2
3
4
5
6
7
8
9

ct state established,related accept      # 存量连接放行，策略变更不掐断
meta mark <MarkHex> accept               # 代理自身流量
oifname "lo" accept                      # 回环
ip daddr 127.0.0.1 udp/tcp dport 15353 accept
tcp/udp dport 853 drop                   # DoT 默认阻断，防 DNS 绕过
ip daddr @deny_v4/v6 drop                # 静态 deny 集
ip daddr @dyn_allow_v4/v6 accept         # 动态 allow 集（DNS 解析产物）
ip daddr @allow_v4/v6 accept             # 静态 allow 集
drop                                     # defaultAction: deny 兜底

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

const (
    dynSetTimeoutS = 360
    nftTTLSlackSec = 60   // 比 resolver 缓存多活 60s，减少竞态
    minTTLSec      = 60
    maxTTLSec      = 360  // max DNS TTL (300) + slack
)

func clampTTL(d time.Duration) time.Duration {
    sec := int(d.Seconds()) + nftTTLSlackSec
    sec = min(max(sec, minTTLSec), maxTTLSec)
    return time.Duration(sec) * time.Second
}

1
2

// maybeNotifyResolved calls onResolved before w.WriteMsg so dynamic nft allows are installed
// before the client receives the answer and may open a connection.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

- name: egress
  image: opensandbox/egress:v1.1.6
  securityContext:
    capabilities:
      add: ["NET_ADMIN"]        # 缺失则 sidecar 启动失败（fail-closed）
  env:
    - name: OPENSANDBOX_EGRESS_MODE
      value: "dns+nft"          # IP/CIDR 规则仅此模式生效
    - name: OPENSANDBOX_EGRESS_RULES
      value: '{"defaultAction":"deny","egress":[{"action":"allow","target":"api.github.com"}]}'
    - name: OPENSANDBOX_EGRESS_TOKEN
      value: "<token>"          # 不设则 18080 无认证，能连上就能改策略
  readinessProbe:
    httpGet: {path: /healthz, port: 18080}

1
2
3
4
5
6
7
8
9

# 平台组件 Service DNS
opensandbox-server.opensandbox.svc.cluster.local
opensandbox-ingress-gateway.opensandbox.svc.cluster.local
# 集群内部 CIDR：平台组件 + 沙箱间互访一刀切
10.244.0.0/16    # Pod CIDR
10.96.0.0/12     # Service CIDR
# 上层业务运行时
10.40.0.0/16
*.admin.corp

1
2
3
4
5
6
7
8
9

{
  "defaultAction": "deny",
  "egress": [
    {"action": "allow", "target": "api.openai.com"},
    {"action": "allow", "target": "*.pypi.org"},
    {"action": "allow", "target": "higress-gateway.corp.internal"},
    {"action": "allow", "target": "10.20.0.0/16"}
  ]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

沙箱应用容器
   │
   ▼
egress sidecar（dns+nft，defaultAction: deny）
   │  只放行：外部服务域名 + Higress 网关
   ├──────────────► 外部服务（LLM / GitHub / 包源）——域名直连
   │
   ▼
Higress 网关（L7：路径级 allow/deny、认证、限流）
   │
   ▼
内部服务（HTTP API / NodePort 服务）

1
2
3
4

osb egress get <sandbox-id> -o json   # 确认 mode=deny_all, enforcementMode=dns+nft
osb command run <sandbox-id> -o raw -- curl -I https://api.github.com   # 放行 → 200
osb command run <sandbox-id> -o raw -- curl -I https://blocked.corp     # 阻断 → NXDOMAIN
osb command run <sandbox-id> -o raw -- curl -I http://10.244.0.5        # 阻断 → 超时