feat: Stop emitting iptables errors on dual-stack hosts; add IPv6 sandbox support#10
Open
machado144 wants to merge 3 commits into
Open
feat: Stop emitting iptables errors on dual-stack hosts; add IPv6 sandbox support#10machado144 wants to merge 3 commits into
machado144 wants to merge 3 commits into
Conversation
Hosts with both v4 and v6 nameservers in resolv.conf (Fedora 43 + IPv6 routers being a common case) caused the sandbox startup script to run `iptables -A OUTPUT -d <v6-addr>`, which iptables rejects with "host/network not found". Sandbox still worked (v4 path was unaffected), but two error lines printed at every launch. Split the resolv.conf nameserver list by address family and only feed the v4 entries to iptables. v6 entries are logged but otherwise dropped — the sandbox is IPv4-only by design (slirp4netns IPv4 NAT only, iptables-only rules), so those nameservers were never reachable from inside the sandbox anyway. This is the symptom fix. Adding actual IPv6 sandbox support is the follow-up commit on this branch. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Extends the network-filtered sandbox to also filter IPv6 egress on hosts
that support it. The v4 path is unchanged; v6 is enabled when both
conditions hold:
- kernel v6 is enabled (/proc/sys/net/ipv6/conf/all/disable_ipv6 == 0)
- ip6tables is on PATH
Either missing → sandbox stays v4-only (status quo). A partial v6 filter
would leave the sandbox with v6 connectivity and no egress rules, which
is worse than no v6 at all.
Changes:
- slirp4netns invoked with --enable-ipv6 when supported (both the
unshare-orchestration shell path and the bwrap+exec.Command path)
- resolv.conf inside sandbox gets `nameserver fd00::3` (slirp4netns v6
forwarder) alongside 10.0.2.3 when v6 is on
- parallel ip6tables ruleset mirroring iptables: loopback, DNS port 53,
allowed v6 nameservers, AAAA-resolved AllowNet hosts (via getent
ahostsv6), final REJECT with icmp6-adm-prohibited
- doctor reports ip6tables and surfaces the chosen v6/v4-only mode
- sandbox script prelude (tap0 wait, resolv.conf bind) extracted to
shared helpers to cut duplication between the unshare and bwrap paths
Manually verified on Fedora 42 (host has v4+v6 nameservers in resolv.conf,
which was the issue #8 repro shape): startup is silent, ip6tables OUTPUT
chain ends with REJECT, iptables OUTPUT chain ends with REJECT.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
StructLint — All checks passed78 rules validated against
|
machado144
changed the title
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #8.
What
iptables; closes the noise from ipv6 error with nftables #8.slirp4netns --enable-ipv6+ parallelip6tableschain (loopback, DNS, allowed v6 nameservers, AAAA-resolvedallow_net, final REJECT).ip6tables.Safety
ip6tablesis on PATH. Either missing → v4-only (status quo).allow_net.Verified
iptablesandip6tablesOUTPUT chains end with REJECT.dupehound: clones 122 → 118, no new prod dead code.🤖 Generated with Claude Code