iohex/cybergym
1
0
Fork 0
mirror of https://github.com/sunblaze-ucb/cybergym.git synced 2026-10-12 08:42:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow ports and rename

Browse Source
This commit is contained in:
zhun
2026-04-15 08:22:23 +00:00
parent 5228282bcc
commit 112647114b
2 changed files with 15 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/cybergym/firewall/__init__.py
View File

@@ -1,3 +1,7 @@
from cybergym.firewall.proxy import DEFAULT_ALLOWLIST_PATH, ProxyManager, load_allowlist from cybergym.firewall.proxy import (
DEFAULT_ALLOWLIST_PATH,
FirewallProxyManager,
load_allowlist,
)
__all__ = ["DEFAULT_ALLOWLIST_PATH", "ProxyManager", "load_allowlist"] __all__ = ["DEFAULT_ALLOWLIST_PATH", "FirewallProxyManager", "load_allowlist"]

14
src/cybergym/firewall/proxy.py
View File

@@ -13,9 +13,9 @@ Architecture
Usage Usage
----- -----
from cybergym.firewall import ProxyManager, load_allowlist from cybergym.firewall import FirewallProxyManager, load_allowlist
proxy = ProxyManager( proxy = FirewallProxyManager(
allowed_domains=load_allowlist("allowlist.txt"), allowed_domains=load_allowlist("allowlist.txt"),
) )
proxy.start() proxy.start()
@@ -64,7 +64,7 @@ IP_ALLOWLIST_CONTAINER_PATH = "/etc/squid/allowed_ips.txt"
SQUID_CONF_TEMPLATE = """\ SQUID_CONF_TEMPLATE = """\
# --- CyberGym domain-allowlist proxy --- # --- CyberGym domain-allowlist proxy ---
acl SSL_ports port 443 acl SSL_ports port 443 {extra_ports}
acl Safe_ports port 80 443 {extra_ports} acl Safe_ports port 80 443 {extra_ports}
acl CONNECT method CONNECT acl CONNECT method CONNECT
@@ -76,6 +76,7 @@ acl allowed_domains dstdomain "{domain_allowlist_path}"
http_access deny !Safe_ports http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports http_access deny CONNECT !SSL_ports
http_access allow CONNECT allowed_domains http_access allow CONNECT allowed_domains
{ip_connect_rule}
http_access allow allowed_domains http_access allow allowed_domains
{ip_rule} {ip_rule}
http_access deny all http_access deny all
@@ -112,7 +113,7 @@ def load_allowlist(path: str | Path) -> list[str]:
return domains return domains
class ProxyManager: class FirewallProxyManager:
"""Manages a Squid proxy container with network-level enforcement.""" """Manages a Squid proxy container with network-level enforcement."""
def __init__( def __init__(
@@ -390,9 +391,11 @@ class ProxyManager:
def _generate_squid_conf(self) -> str: def _generate_squid_conf(self) -> str:
ip_acl = "" ip_acl = ""
ip_rule = "" ip_rule = ""
ip_connect_rule = ""
if self._has_ips(): if self._has_ips():
ip_acl = f'acl allowed_ips dst "{IP_ALLOWLIST_CONTAINER_PATH}"' ip_acl = f'acl allowed_ips dst "{IP_ALLOWLIST_CONTAINER_PATH}"'
ip_rule = "http_access allow allowed_ips" ip_rule = "http_access allow allowed_ips"
ip_connect_rule = "http_access allow CONNECT allowed_ips"
# Allow any port for IP-based destinations # Allow any port for IP-based destinations
extra_ports = "1-65535" if self._has_ips() else "" extra_ports = "1-65535" if self._has_ips() else ""
@@ -401,6 +404,7 @@ class ProxyManager:
domain_allowlist_path=DOMAIN_ALLOWLIST_CONTAINER_PATH, domain_allowlist_path=DOMAIN_ALLOWLIST_CONTAINER_PATH,
ip_acl=ip_acl, ip_acl=ip_acl,
ip_rule=ip_rule, ip_rule=ip_rule,
ip_connect_rule=ip_connect_rule,
extra_ports=extra_ports, extra_ports=extra_ports,
port=self.proxy_port, port=self.proxy_port,
) )
@@ -451,7 +455,7 @@ def main():
if getattr(args, "ip", None): if getattr(args, "ip", None):
kwargs["extra_ips"] = args.ip kwargs["extra_ips"] = args.ip
mgr = ProxyManager(**kwargs) mgr = FirewallProxyManager(**kwargs)
match args.action: match args.action:
case "start": case "start":