From 6b201de72db9c677c38e2255e6797c5828455bfb Mon Sep 17 00:00:00 2001 From: SaladDay <1203511142@qq.com> Date: Tue, 27 Oct 2026 19:45:09 +0000 Subject: [PATCH] Let microsandbox domain allows pass HTTPS microsandbox's strict hostname mode, on by default, accepts a domain allow over TLS only with TLS interception. Every domain rule of a not-public egress (the model endpoint, restricted domains, public domains of the cap) therefore reset at the TLS handshake. Turn it off so these rules match by the guest's DNS answer and the TLS server name. --- services/core/tools/microsandbox-provider/network.go | 6 +++++- services/core/tools/microsandbox-provider/network_test.go | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/services/core/tools/microsandbox-provider/network.go b/services/core/tools/microsandbox-provider/network.go index 5c8c05e63..3b8b5a4f2 100644 --- a/services/core/tools/microsandbox-provider/network.go +++ b/services/core/tools/microsandbox-provider/network.go @@ -46,6 +46,10 @@ const resolveTimeout = 5 * time.Second // and rebind protection already refuse private ones // 7. public addresses, when Public // +// Strict hostname enforcement is off: it accepts a domain allow over TLS only +// with TLS interception, so the domain allows of rule 6 would never pass HTTPS. +// They match by the guest's DNS answer and the TLS server name instead. +// // Core and PrivateDomains names are resolved together under one deadline. A // PrivateDomains name that does not resolve gets no address rule and is // reported to report. @@ -95,7 +99,7 @@ func egressNetwork(ctx context.Context, coreURL string, egress sandbox.Egress, r slices.Sort(private) private = slices.Compact(private) - n := &sdk.NetworkConfig{DefaultEgress: sdk.PolicyActionDeny, DefaultIngress: sdk.PolicyActionDeny} + n := &sdk.NetworkConfig{DefaultEgress: sdk.PolicyActionDeny, DefaultIngress: sdk.PolicyActionDeny, DisableStrict: true} allow := func(destination, protocol, port string) { n.Rules = append(n.Rules, sdk.PolicyRule{Action: sdk.PolicyActionAllow, Direction: sdk.PolicyDirectionEgress, Destination: destination, Protocol: sdk.PolicyProtocol(protocol), Port: port}) } diff --git a/services/core/tools/microsandbox-provider/network_test.go b/services/core/tools/microsandbox-provider/network_test.go index 16984ce24..e4fa496bc 100644 --- a/services/core/tools/microsandbox-provider/network_test.go +++ b/services/core/tools/microsandbox-provider/network_test.go @@ -33,7 +33,7 @@ func rules(t *testing.T, egress sandbox.Egress, dns map[string][]string) (string if err != nil { t.Fatal(err) } - if n.DefaultEgress != "deny" || n.DefaultIngress != "deny" || n.DNS != nil { + if n.DefaultEgress != "deny" || n.DefaultIngress != "deny" || !n.DisableStrict || n.DNS != nil { t.Fatalf("defaults or DNS options changed: %+v", n) } var lines []string