coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: reject multicast and reserved egress addresses
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-05 22:10:59 +02:00
parent d477c3b5d9
commit e45e3e6401
2 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/sandboxer/extensions/egress.py
View file

@ -25,7 +25,8 @@ def destinations(entries: list[str]) -> frozenset[str]:
def connect_public(host: str) -> socket.socket:
addresses = socket.getaddrinfo(host, 443, type=socket.SOCK_STREAM)
if not addresses or any(not ipaddress.ip_address(a[4][0]).is_global for a in addresses):
ips = [ipaddress.ip_address(a[4][0]) for a in addresses]
if not ips or any(not ip.is_global or ip.is_multicast or ip.is_reserved for ip in ips):
raise ValueError("non-public destination")
# Connect to the already checked numeric address; never resolve a second time.
for family, kind, proto, _, address in addresses: