WIP: POC: Add network and DNS filtering with approval UI

# Build gvproxy
make

# Run with secure mode + services endpoint
./bin/gvproxy --listen unix:///tmp/gvproxy.sock \
  --listen-vfkit unixgram:///tmp/vfkit.sock \
  --secure-mode \
  --services "unix:///tmp/gvproxy-services.sock"

All outbound connections from the VM will be blocked and held pending for 30 seconds.

2. Policy file mode (static ACL rules)

Create a policy.yaml:

defaultAction: deny
rules:
  - action: allow
    cidr: "0.0.0.0/0"
    ports: [443, 80]
    protocol: tcp
  - action: deny
    cidr: "10.0.0.0/8"
dns:
  defaultAction: deny
  allowedDomains:
    - "*.github.com"
    - "*.googleapis.com"
    - "registry.fedoraproject.org"
  blockedDomains:
    - "*.malware.example"

./bin/gvproxy --listen unix:///tmp/gvproxy.sock \
  --listen-vfkit unixgram:///tmp/vfkit.sock \
  --network-policy policy.yaml \
  --services "unix:///tmp/gvproxy-services.sock"

3. Query the HTTP API

# List pending/denied connections
curl --unix-socket /tmp/gvproxy-services.sock http://localhost/network/pending

# List denied DNS queries
curl --unix-socket /tmp/gvproxy-services.sock http://localhost/dns/denied

# Approve a connection (interactive mode)
curl --unix-socket /tmp/gvproxy-services.sock -X POST http://localhost/network/allow \
  -d '{"protocol":"tcp","ip":"142.250.80.46","port":443}'

# Allow a DNS domain dynamically
curl --unix-socket /tmp/gvproxy-services.sock -X POST http://localhost/dns/allow \
  -d '{"domain":"example.com"}'

# Stream events (SSE)
curl --unix-socket /tmp/gvproxy-services.sock http://localhost/network/events

4. Run the approval UI

cd approval
npm install
npm run dev

The Svelte UI connects to the SSE event stream and shows pending connections/DNS queries with approve/deny buttons.

5. Run unit tests

go test ./pkg/services/forwarder/ -run TestFilter -v
go test ./pkg/services/dns/ -run TestFilter -v

Limitations (POC)

- No persistence — approved rules are lost on restart
- No authentication on the HTTP API
- The approval UI assumes the services socket is reachable (needs proxy for unix sockets)
- Interactive approval timeout is fixed at 30s (configurable via approvalTimeout in policy YAML)