feat(linux-sandbox): route DNS through managed proxy

codex-rs/Cargo.toml

@@ -388,6 +388,7 @@ rustls = { version = "0.23", default-features = false, features = [
 ] }
 rustls-native-certs = "0.8.3"
 rustls-pki-types = "1.14.0"
+rustix = { version = "1.1.4", features = ["thread"] }
 schemars = "0.8.22"
 seccompiler = "0.5.0"
 semver = "1.0"

codex-rs/config/src/permissions_toml.rs

@@ -341,6 +341,7 @@ pub struct NetworkToml {
     pub enable_socks5: Option<bool>,
     pub socks_url: Option<String>,
     pub enable_socks5_udp: Option<bool>,
+    pub enable_dns: Option<bool>,
     pub allow_upstream_proxy: Option<bool>,
     pub dangerously_allow_non_loopback_proxy: Option<bool>,
     pub dangerously_allow_all_unix_sockets: Option<bool>,
@@ -515,6 +516,9 @@ impl NetworkToml {
         if let Some(enable_socks5_udp) = self.enable_socks5_udp {
             config.enable_socks5_udp = enable_socks5_udp;
         }
+        if let Some(enable_dns) = self.enable_dns {
+            config.enable_dns = enable_dns;
+        }
         if let Some(allow_upstream_proxy) = self.allow_upstream_proxy {
             config.allow_upstream_proxy = allow_upstream_proxy;
         }

codex-rs/core/config.schema.json

@@ -1932,6 +1932,9 @@
           },
           "type": "object"
         },
+        "enable_dns": {
+          "type": "boolean"
+        },
         "enable_socks5": {
           "type": "boolean"
         },
@@ -1998,6 +2001,9 @@
         "domains": {
           "$ref": "#/definitions/NetworkDomainPermissionsToml"
         },
+        "enable_dns": {
+          "type": "boolean"
+        },
         "enable_socks5": {
           "type": "boolean"
         },

codex-rs/core/src/config/config_tests.rs

@@ -1065,6 +1065,7 @@ strip_request_headers = ["authorization"]
                         enable_socks5: Some(false),
                         socks_url: None,
                         enable_socks5_udp: None,
+                        enable_dns: None,
                         allow_upstream_proxy: Some(false),
                         dangerously_allow_non_loopback_proxy: None,
                         dangerously_allow_all_unix_sockets: None,

codex-rs/core/src/config/permissions.rs

@@ -141,6 +141,7 @@ pub(crate) fn apply_network_proxy_feature_config(
         enable_socks5: feature_config.enable_socks5,
         socks_url: feature_config.socks_url.clone(),
         enable_socks5_udp: feature_config.enable_socks5_udp,
+        enable_dns: feature_config.enable_dns,
         allow_upstream_proxy: feature_config.allow_upstream_proxy,
         dangerously_allow_non_loopback_proxy: feature_config.dangerously_allow_non_loopback_proxy,
         dangerously_allow_all_unix_sockets: feature_config.dangerously_allow_all_unix_sockets,

codex-rs/features/src/feature_configs.rs

@@ -203,6 +203,8 @@ pub struct NetworkProxyConfigToml {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub enable_socks5_udp: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub enable_dns: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub allow_upstream_proxy: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub dangerously_allow_non_loopback_proxy: Option<bool>,

codex-rs/linux-sandbox/Cargo.toml

@@ -31,10 +31,12 @@ seccompiler = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 sha2 = { workspace = true }
+rustix = { workspace = true }
 url = { workspace = true }
 
 [target.'cfg(target_os = "linux")'.dev-dependencies]
 codex-core = { workspace = true }
+hickory-proto = { workspace = true }
 pretty_assertions = { workspace = true }
 tempfile = { workspace = true }
 tokio = { workspace = true, features = [

codex-rs/linux-sandbox/src/dns_routing.rs

@@ -0,0 +1,175 @@
+use codex_network_proxy::DNS_PROXY_ENV_KEY;
+use codex_network_proxy::DNS_PROXY_SESSION_PREFACE;
+use std::io;
+use std::io::Read;
+use std::io::Write;
+use std::net::Ipv4Addr;
+use std::net::SocketAddr;
+use std::net::TcpListener;
+use std::net::TcpStream;
+use std::net::UdpSocket;
+use std::time::Duration;
+use url::Url;
+
+const SANDBOX_DNS_LISTEN_ADDR: (Ipv4Addr, u16) = (Ipv4Addr::LOCALHOST, 53);
+const DNS_IO_TIMEOUT: Duration = Duration::from_secs(3);
+const MAX_DNS_MESSAGE_BYTES: usize = u16::MAX as usize;
+
+pub(crate) struct BoundDnsStub {
+    udp_socket: UdpSocket,
+    tcp_listener: TcpListener,
+}
+
+pub(crate) fn bind_netns_dns_stub() -> io::Result<BoundDnsStub> {
+    let udp_socket = UdpSocket::bind(SANDBOX_DNS_LISTEN_ADDR)?;
+    let tcp_listener = TcpListener::bind(SANDBOX_DNS_LISTEN_ADDR)?;
+    Ok(BoundDnsStub {
+        udp_socket,
+        tcp_listener,
+    })
+}
+
+pub(crate) fn spawn_netns_dns_stub(bound: BoundDnsStub) -> io::Result<()> {
+    let endpoint = take_dns_proxy_endpoint_from_env()?.ok_or_else(|| {
+        io::Error::new(
+            io::ErrorKind::NotFound,
+            "DNS bridge expected a proxy endpoint",
+        )
+    })?;
+    let pid = unsafe { libc::fork() };
+    if pid < 0 {
+        return Err(io::Error::last_os_error());
+    }
+    if pid == 0 {
+        let status = i32::from(
+            crate::proxy_routing::harden_bridge_process()
+                .and_then(|_| run_netns_dns_stub(bound, endpoint))
+                .is_err(),
+        );
+        unsafe { libc::_exit(status) };
+    }
+    Ok(())
+}
+
+fn take_dns_proxy_endpoint_from_env() -> io::Result<Option<SocketAddr>> {
+    let Some(value) = std::env::var_os(DNS_PROXY_ENV_KEY) else {
+        return Ok(None);
+    };
+    // SAFETY: the helper process is single-threaded at this point, before execing
+    // the user command.
+    unsafe { std::env::remove_var(DNS_PROXY_ENV_KEY) };
+    let value = value
+        .into_string()
+        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "DNS proxy URL is not UTF-8"))?;
+    parse_dns_proxy_endpoint(value.as_str()).map(Some)
+}
+
+fn parse_dns_proxy_endpoint(value: &str) -> io::Result<SocketAddr> {
+    let parsed = Url::parse(value).map_err(|err| {
+        io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!("invalid DNS proxy URL: {err}"),
+        )
+    })?;
+    if parsed.scheme() != "tcp" {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "DNS proxy URL must use tcp scheme",
+        ));
+    }
+    let Some(host) = parsed.host_str() else {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "DNS proxy URL is missing host",
+        ));
+    };
+    if host != "127.0.0.1" {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "DNS proxy URL must point at 127.0.0.1",
+        ));
+    }
+    let Some(port) = parsed.port() else {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "DNS proxy URL is missing port",
+        ));
+    };
+    Ok(SocketAddr::from((Ipv4Addr::LOCALHOST, port)))
+}
+
+fn run_netns_dns_stub(bound: BoundDnsStub, endpoint: SocketAddr) -> io::Result<()> {
+    let udp_endpoint = endpoint;
+    std::thread::Builder::new().spawn(move || netns_udp_loop(bound.udp_socket, udp_endpoint))?;
+    netns_tcp_loop(bound.tcp_listener, endpoint)
+}
+
+fn netns_udp_loop(socket: UdpSocket, endpoint: SocketAddr) -> io::Result<()> {
+    let mut query = vec![0; MAX_DNS_MESSAGE_BYTES];
+    loop {
+        let (len, peer) = socket.recv_from(&mut query)?;
+        let Ok(response) = resolve_through_proxy(endpoint, &query[..len]) else {
+            continue;
+        };
+        socket.send_to(&response, peer)?;
+    }
+}
+
+fn netns_tcp_loop(listener: TcpListener, endpoint: SocketAddr) -> io::Result<()> {
+    loop {
+        let (mut client, _) = listener.accept()?;
+        client.set_read_timeout(Some(DNS_IO_TIMEOUT))?;
+        client.set_write_timeout(Some(DNS_IO_TIMEOUT))?;
+        std::thread::spawn(move || {
+            let _ = serve_tcp_client(&mut client, endpoint);
+        });
+    }
+}
+
+fn serve_tcp_client(client: &mut TcpStream, endpoint: SocketAddr) -> io::Result<()> {
+    while let Ok(query) = read_frame(client) {
+        let response = resolve_through_proxy(endpoint, &query)?;
+        write_frame(client, &response)?;
+    }
+    Ok(())
+}
+
+fn resolve_through_proxy(endpoint: SocketAddr, query: &[u8]) -> io::Result<Vec<u8>> {
+    let mut stream = TcpStream::connect(endpoint)?;
+    stream.set_read_timeout(Some(DNS_IO_TIMEOUT))?;
+    stream.set_write_timeout(Some(DNS_IO_TIMEOUT))?;
+    stream.write_all(DNS_PROXY_SESSION_PREFACE)?;
+    let mut ack = [0_u8; DNS_PROXY_SESSION_PREFACE.len()];
+    stream.read_exact(&mut ack)?;
+    if &ack != DNS_PROXY_SESSION_PREFACE {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            "DNS proxy rejected session preface",
+        ));
+    }
+    write_frame(&mut stream, query)?;
+    read_frame(&mut stream)
+}
+
+fn write_frame(writer: &mut impl Write, payload: &[u8]) -> io::Result<()> {
+    let len = u16::try_from(payload.len()).map_err(|_| {
+        io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "DNS message exceeds maximum wire length",
+        )
+    })?;
+    writer.write_all(&len.to_be_bytes())?;
+    writer.write_all(payload)
+}
+
+fn read_frame(reader: &mut impl Read) -> io::Result<Vec<u8>> {
+    let mut len = [0; 2];
+    reader.read_exact(&mut len)?;
+    let mut payload = vec![0; usize::from(u16::from_be_bytes(len))];
+    reader.read_exact(&mut payload)?;
+    Ok(payload)
+}
+
+#[cfg(test)]
+#[path = "dns_routing_tests.rs"]
+mod tests;

codex-rs/linux-sandbox/src/dns_routing_tests.rs

@@ -0,0 +1,111 @@
+use super::*;
+use pretty_assertions::assert_eq;
+use std::net::TcpListener;
+use std::net::UdpSocket;
+use std::sync::mpsc;
+use std::time::Duration;
+
+#[test]
+fn parses_loopback_dns_proxy_endpoint() {
+    assert_eq!(
+        parse_dns_proxy_endpoint("tcp://127.0.0.1:43128").expect("endpoint"),
+        SocketAddr::from((Ipv4Addr::LOCALHOST, 43128))
+    );
+}
+
+#[test]
+fn rejects_non_loopback_dns_proxy_endpoint() {
+    let err =
+        parse_dns_proxy_endpoint("tcp://192.0.2.10:43128").expect_err("non-loopback endpoint");
+    assert_eq!(err.kind(), io::ErrorKind::InvalidInput);
+}
+
+#[test]
+fn forwards_dns_query_to_private_proxy_session() {
+    let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).expect("bind DNS proxy fixture");
+    let endpoint = listener.local_addr().expect("fixture local addr");
+    let (received_tx, received_rx) = mpsc::channel();
+    let expected_response = b"dns-response".to_vec();
+    let response = expected_response.clone();
+    std::thread::spawn(move || {
+        let (mut stream, _) = listener.accept().expect("accept DNS proxy session");
+        let mut preface = [0_u8; DNS_PROXY_SESSION_PREFACE.len()];
+        stream.read_exact(&mut preface).expect("read preface");
+        assert_eq!(&preface, DNS_PROXY_SESSION_PREFACE);
+        stream
+            .write_all(DNS_PROXY_SESSION_PREFACE)
+            .expect("write preface ack");
+        let query = read_frame(&mut stream).expect("read query");
+        received_tx.send(query).expect("send query");
+        write_frame(&mut stream, &response).expect("write response");
+    });
+
+    let response = resolve_through_proxy(endpoint, b"dns-query").expect("proxy response");
+
+    assert_eq!(received_rx.recv().expect("query"), b"dns-query");
+    assert_eq!(response, expected_response);
+}
+
+#[test]
+fn udp_loop_continues_after_proxy_error() {
+    let dns_socket = UdpSocket::bind((Ipv4Addr::LOCALHOST, 0)).expect("bind UDP DNS stub");
+    dns_socket
+        .set_read_timeout(Some(Duration::from_millis(500)))
+        .expect("set DNS stub idle timeout");
+    let dns_addr = dns_socket.local_addr().expect("DNS stub address");
+
+    let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).expect("bind DNS proxy fixture");
+    let endpoint = listener.local_addr().expect("fixture local addr");
+    let (received_tx, received_rx) = mpsc::channel();
+    let (failed_session_tx, failed_session_rx) = mpsc::channel();
+    let expected_response = b"dns-response".to_vec();
+    let response = expected_response.clone();
+    std::thread::spawn(move || {
+        let (mut stream, _) = listener.accept().expect("accept failing DNS proxy session");
+        stream
+            .write_all(&[0; DNS_PROXY_SESSION_PREFACE.len()])
+            .expect("write invalid preface ack");
+        failed_session_tx
+            .send(())
+            .expect("send failing session signal");
+
+        let (mut stream, _) = listener.accept().expect("accept DNS proxy session");
+        let mut preface = [0_u8; DNS_PROXY_SESSION_PREFACE.len()];
+        stream.read_exact(&mut preface).expect("read preface");
+        assert_eq!(&preface, DNS_PROXY_SESSION_PREFACE);
+        stream
+            .write_all(DNS_PROXY_SESSION_PREFACE)
+            .expect("write preface ack");
+        let query = read_frame(&mut stream).expect("read query");
+        received_tx.send(query).expect("send query");
+        write_frame(&mut stream, &response).expect("write response");
+    });
+    std::thread::spawn(move || {
+        let _ = netns_udp_loop(dns_socket, endpoint);
+    });
+
+    let client = UdpSocket::bind((Ipv4Addr::LOCALHOST, 0)).expect("bind UDP client");
+    client
+        .set_read_timeout(Some(Duration::from_millis(500)))
+        .expect("set UDP client timeout");
+    client
+        .send_to(b"first-query", dns_addr)
+        .expect("send first query");
+    failed_session_rx
+        .recv_timeout(Duration::from_secs(1))
+        .expect("failing session");
+    let mut buffer = [0; 64];
+
+    client
+        .send_to(b"second-query", dns_addr)
+        .expect("send second query");
+    let (len, _) = client.recv_from(&mut buffer).expect("receive DNS response");
+
+    assert_eq!(
+        received_rx
+            .recv_timeout(Duration::from_secs(1))
+            .expect("query"),
+        b"second-query"
+    );
+    assert_eq!(&buffer[..len], expected_response);
+}