Skip to content

Let microsandbox domain allows pass HTTPS #894

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SaladDay merged 1 commit into from
Oct 27, 2026
Merged

Let microsandbox domain allows pass HTTPS #894

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion services/core/tools/microsandbox-provider/network.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,10 @@ const resolveTimeout = 5 * time.Second
// and rebind protection already refuse private ones
// 7. public addresses, when Public
//
// Strict hostname enforcement is off: it accepts a domain allow over TLS only
// with TLS interception, so the domain allows of rule 6 would never pass HTTPS.
// They match by the guest's DNS answer and the TLS server name instead.
//
// Core and PrivateDomains names are resolved together under one deadline. A
// PrivateDomains name that does not resolve gets no address rule and is
// reported to report.
Expand Down Expand Up @@ -95,7 +99,7 @@ func egressNetwork(ctx context.Context, coreURL string, egress sandbox.Egress, r
slices.Sort(private)
private = slices.Compact(private)

n := &sdk.NetworkConfig{DefaultEgress: sdk.PolicyActionDeny, DefaultIngress: sdk.PolicyActionDeny}
n := &sdk.NetworkConfig{DefaultEgress: sdk.PolicyActionDeny, DefaultIngress: sdk.PolicyActionDeny, DisableStrict: true}
allow := func(destination, protocol, port string) {
n.Rules = append(n.Rules, sdk.PolicyRule{Action: sdk.PolicyActionAllow, Direction: sdk.PolicyDirectionEgress, Destination: destination, Protocol: sdk.PolicyProtocol(protocol), Port: port})
}
Expand Down
2 changes: 1 addition & 1 deletion services/core/tools/microsandbox-provider/network_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ func rules(t *testing.T, egress sandbox.Egress, dns map[string][]string) (string
if err != nil {
t.Fatal(err)
}
if n.DefaultEgress != "deny" || n.DefaultIngress != "deny" || n.DNS != nil {
if n.DefaultEgress != "deny" || n.DefaultIngress != "deny" || !n.DisableStrict || n.DNS != nil {
t.Fatalf("defaults or DNS options changed: %+v", n)
}
var lines []string
Expand Down
Loading