tegwick
d477c3b5d9
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
39 lines
2.4 KiB
Markdown
39 lines
2.4 KiB
Markdown
# Bwrap HTTPS egress
|
|
|
|
Owner extension config can set `allowed_egress: [api.anthropic.com:443]`.
|
|
A profile must declare a subset in `network.egress`, with `default: deny`.
|
|
Defaults remain empty. Only exact lowercase DNS names ending in `:443`
|
|
are accepted; no wildcards, IP literals, URLs or other ports.
|
|
|
|
Each opted-in sandbox gets a separate host-side Unix CONNECT proxy. Only that
|
|
socket is mounted into the sandbox; an in-namespace loopback bridge provides
|
|
HTTPS_PROXY/https_proxy to child processes. The namespace retains only lo,
|
|
without a host interface or direct DNS/network access. The owner proxy resolves
|
|
the declared hostname, rejects any non-global result, and connects to a checked
|
|
numeric address without a second lookup. TLS stays between client and provider;
|
|
system CA certificates are mounted read-only. No TLS interception or body logging.
|
|
|
|
This enforces connection destinations, not HTTP paths, provider account identity,
|
|
or TLS SNI on shared hosting. A client can send arbitrary bytes to an allowed
|
|
server. It is not an application firewall or a defense against an allowed
|
|
provider's own forwarding features. A future stronger policy needs separate
|
|
application enforcement. DNS resolution uses the trusted host resolver.
|
|
|
|
Up to 16 concurrent tunnels per sandbox, 8 KiB CONNECT headers, 10-second
|
|
socket operations, 30-second idle and 900-second tunnel lifetime. Unsupported
|
|
methods, hosts, ports and request framing close without upstream dialing.
|
|
Teardown kills the dedicated proxy process and removes its socket directory.
|
|
The current host owner must remain trusted; no caller-selected proxy config.
|
|
|
|
Validation: `scripts/smoke-bwrap-egress.py` made a credential-free TLS GET to
|
|
api.anthropic.com from sandbox e290e788 and received HTTP 404. Undeclared
|
|
example.com and direct 1.1.1.1:443 were denied, only lo existed, and proxy plus
|
|
workspace teardown passed. This is transport evidence, not model authentication.
|
|
Unit tests cover invalid destinations, private and mapped-loopback DNS,
|
|
checked-address dialing, CONNECT framing and owner/profile allowlist separation.
|
|
|
|
Claude documents HTTPS_PROXY at https://code.claude.com/docs/en/network-config.
|
|
The pinned Claude executable must still pass its own proxy/startup compatibility
|
|
proof. The existing production profiles are unchanged. CCR-2026-0016 custody is
|
|
complete at version 2, but owner machine authentication and protected credential
|
|
delivery remain outstanding under SAND-WP-0015-T04 and GLAS-WP-0012-T02.
|