Repository navigation
fix(sandbox): resolve host-gateway aliases from proxy /etc/hosts - #2479
Closed
zanetworker wants to merge 3 commits into
Closed
zanetworker wants to merge 3 commits into
zanetworker wants to merge 3 commits into
Conversation
The SSRF engine in 0.0.91 blocks host.openshell.internal because DNS
resolution fails for this synthetic hostname. The sandbox process runs
in a separate mount namespace whose /etc/hosts does not contain the
driver-injected entry, and the system DNS resolver cannot resolve
proxy-internal names.
Add resolve_from_proxy_hosts() as a fallback in the DNS resolution
chain for host-gateway aliases. When the sandbox's /etc/hosts and
system DNS both fail, the proxy reads its own /etc/hosts (the
container-level file populated by the compute driver's --add-host
flag) to resolve the hostname. The resolved IP then flows through
the normal SSRF validation pipeline (allowed_ips or
exact_declared_endpoint_host path) without weakening SSRF guards.
Resolution order is now:
1. IP literal
2. Sandbox /etc/hosts (via /proc/{pid}/root/etc/hosts)
3. Proxy /etc/hosts (host-gateway aliases only)
4. System DNS
Fixes NVIDIA#2478
Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>
zanetworker
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
July 25, 2026 15:57
- Convert resolve_from_proxy_hosts to async with tokio::fs, matching the resolve_from_sandbox_hosts I/O pattern - Extract path-parameterized resolve_from_hosts_file helper so the file-reading path is unit-testable with a temp hosts file - Log read failures at debug level instead of silently falling through to DNS - Drop redundant lowercase allocation at the alias guard call site - Replace parser-only duplicate tests with temp-file tests covering alias resolution, missing alias, and unreadable file Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>
Collaborator
|
/ok to test 91efad6 |
krishicks
reviewed
Aug 4, 2026
Comment on lines
+23
to
+24
| #[cfg(any(target_os = "linux", test))] | ||
| use std::path::Path; |
Collaborator
There was a problem hiding this comment.
Based on the linter failures I think you can remove both these lines.
Contributor
Author
There was a problem hiding this comment.
Actually the import is needed — it's used by resolve_from_proxy_hosts (line 2846) and resolve_from_hosts_file (line 2856), both behind the same #[cfg(any(target_os = "linux", test))] guard.
The linter failure is the inverse: lines 9900 and 10036 used fully-qualified std::path::Path::new(...) while the import already exists, triggering unnecessary_qualification. Fixed by dropping the std::path:: prefix on those two call sites.
Drop redundant std::path:: prefix on two test-only Path::new() calls that Clippy flagged as unnecessary_qualification since the cfg-guarded import already brings Path into scope. Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>
|
This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity. |
github-actions
Bot
added
the
state:stale
Collaborator
|
Closing this in light of new topo for 0.1.0. If it's a bug still let's re-open it with repro and analysis under the new 0.1.0 topo. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
host.openshell.internalin 0.0.91 by adding a DNS resolution fallback that reads the proxy's own/etc/hostsfor host-gateway aliases./etc/hostsdoes not contain the driver-injected entry, and the system DNS resolver cannot resolve proxy-internal names. The proxy's/etc/hosts(populated by the compute driver's--add-hostflag) is the correct source of truth.Related Issue
Fixes #2478
Changes
crates/openshell-supervisor-network/src/proxy.rsresolve_from_proxy_hosts()(async) backed by a path-parameterizedresolve_from_hosts_file()helper — reads the proxy's own/etc/hostsviatokio::fs(matches the siblingresolve_from_sandbox_hostsI/O pattern) using the existingparse_hosts_file_for_hostparser. Scoped to Linux + test. Read failures log atdebug!and returnNone(fall through to DNS) rather than failing silently.resolve_socket_addrs()with a new resolution step between sandbox/etc/hostsand system DNS: for host-gateway aliases only, try the proxy's/etc/hostsas a fallback.None, unreadable file →None.Resolution order is now:
/etc/hosts(via/proc/{pid}/root/etc/hosts)/etc/hosts(host-gateway aliases only) ← newSecurity properties preserved:
allowed_ipsorexact_declared_endpoint_hostpath)HOST_GATEWAY_ALIASESTesting
cargo test -p openshell-supervisor-network)cargo clippy --workspace --all-targets -- -D warnings)cargo fmt --all -- --check)sandbox_reaches_host_openshell_internal_via_host_gateway_alias— PASS (podman, macOS arm64, applehv, bridge network gateway_ip=10.89.0.1)sandbox_inference_local_routes_to_host_openshell_internal— PASSinference_set_supports_no_verify_for_unreachable_endpoint— PASSallowed_ipspolicy reached host server; sandbox without policy correctly denied; non-alias hostname correctly deniedChecklist