#687
Pull Requests/containers/gvisor-tap-vsock/#687

Allow filtering of outgoing connectins

Openevidolobwants to merge intofrom
10 commits46 files changed+10156-259

This PR based on https://github.com/containers/gvisor-tap-vsock/pull/609 And its REST API is based on https://github.com/containers/gvisor-tap-vsock/issues/630

Activity

16
C
feat: add blockAllOutbound option to block guest-initiated connections
72b43e8
C
feat: add outbound allowlist for domain-based traffic filtering
09d5d2b
C
feat: harden SNI filtering proxy against known bypass attacks
9f3e130
C
feat: allow ECH/GREASE through SNI proxy per RFC 9849
d6da515
Y
add performance test for vfkit and qemu
b24f53c
Y
feat: add filter observer package for connection tracking and REST API
37c8c1e
Y
feat: wire filter observer into forwarders and DNS handler
2865177
Y
test: add integration tests for filter API and domain blocking
3d1627c
Y
docs: add filter API docs, VM scripts, and move scripts to scripts/
e686197
openshift-ci[bot]4mo ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: evidolob

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

evidolob4mo ago

Here performance test comparison:

Performance Impact: 100 Domain Blocklist Entries

Environment: macOS Darwin 25.5.0, arm64, Fedora CoreOS VM Branch: filter-outgoing-connection Test: test-perf-qemu (21/21 pass), test-perf-mac (21/21 pass)

QEMU

MetricBaseline+100 BlocklistDelta
TCP VM→Host2867.51 Mbps2769.20 Mbps-3.4%
TCP Host→VM2037.93 Mbps2027.57 Mbps-0.5%
TCP fwd Host→VM1905.79 Mbps2067.15 Mbps+8.5%
TCP fwd VM→Host2976.71 Mbps2779.36 Mbps-6.6%
TCP 1 stream2840.45 Mbps2807.80 Mbps-1.1%
TCP 4 streams2791.13 Mbps2753.43 Mbps-1.4%
TCP 8 streams2819.41 Mbps2775.95 Mbps-1.5%
UDP VM→Host1.05 Mbps1.05 Mbps0.0%
UDP Host→VM1.05 Mbps1.05 Mbps0.0%
Ping gateway avg0.661 ms0.590 ms-10.7%
Ping external avg8.343 ms8.968 ms+7.5%
DNS internal avg0.0 ms0.0 ms—
DNS internal p950 ms0 ms—
DNS external avg1.1 ms1.5 ms+36.4%
DNS external max2 ms7 ms+250%
HTTP req/sec2086.11958.3-6.1%
HTTP avg latency0.48 ms0.51 ms+6.3%
Expose avg161 µs121 µs-24.8%
Unexpose avg115 µs98 µs-14.8%

vfkit

MetricBaseline+100 BlocklistDelta
TCP VM→Host3154.36 Mbps3284.18 Mbps+4.1%
TCP Host→VM1471.18 Mbps1522.41 Mbps+3.5%
TCP fwd Host→VM1476.93 Mbps1539.93 Mbps+4.3%
TCP fwd VM→Host3113.83 Mbps3275.83 Mbps+5.2%
TCP 1 stream3090.61 Mbps3285.70 Mbps+6.3%
TCP 4 streams3010.52 Mbps3554.11 Mbps+18.1%
TCP 8 streams2830.14 Mbps2944.97 Mbps+4.1%
UDP VM→Host1.05 Mbps1.05 Mbps0.0%
UDP Host→VM1.05 Mbps1.05 Mbps0.0%
Ping gateway avg0.390 ms0.429 ms+10.0%
Ping external avg8.720 ms8.831 ms+1.3%
DNS internal avg0.0 ms0.2 ms—
DNS internal p950 ms1 ms—
DNS external avg0.4 ms1.2 ms+200%
DNS external max1 ms2 ms+100%
HTTP req/sec2881.02850.1-1.1%
HTTP avg latency0.35 ms0.35 ms0.0%
Expose avg47 µs65 µs+38.3%
Unexpose avg44 µs54 µs+22.7%

Conclusion

  • Throughput: No measurable impact. All TCP/UDP variations are within normal run-to-run noise (±5-8%).
  • DNS latency: Small increase on external resolution (~0.4-0.8 ms avg), negligible vs upstream RTT. Internal DNS stays sub-millisecond.
  • HTTP request rate: Within noise (-1% to -6%).
  • Port forwarding ops: Within noise; direction differs between QEMU and vfkit.
evidolob4mo ago

cc @benoitf

Y
fix: lint
d0ee147
AkihiroSuda3mo ago

DCO seems missing and GPG seems invalid (https://github.com/containers/gvisor-tap-vsock/pull/687/commits says Unverified).

This PR also seems contain lots of files that do not directly relate to filtering.

openshift-ci[bot]2mo ago

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

AkihiroSuda1mo ago

What's the current status?