codex/codex-cli/scripts/init_firewall.sh at main · hencjo/codex · GitHub

History

115 lines (99 loc) · 3.81 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

#!/bin/bash

set -euo pipefail # Exit on error, undefined vars, and pipeline failures

IFS=$'\n\t' # Stricter word splitting

# Read allowed domains from file

ALLOWED_DOMAINS_FILE="/etc/codex/allowed_domains.txt"

if [ -f "$ALLOWED_DOMAINS_FILE" ]; then

ALLOWED_DOMAINS=()

while IFS= read -r domain; do

ALLOWED_DOMAINS+=("$domain")

done < "$ALLOWED_DOMAINS_FILE"

echo "Using domains from file: ${ALLOWED_DOMAINS[*]}"

else

# Fallback to default domains

ALLOWED_DOMAINS=("api.openai.com")

echo "Domains file not found, using default: ${ALLOWED_DOMAINS[*]}"

# Ensure we have at least one domain

if [ ${#ALLOWED_DOMAINS[@]} -eq 0 ]; then

echo "ERROR: No allowed domains specified"

exit 1

# Flush existing rules and delete existing ipsets

iptables -F

iptables -X

iptables -t nat -F

iptables -t nat -X

iptables -t mangle -F

iptables -t mangle -X

ipset destroy allowed-domains 2>/dev/null || true

# First allow DNS and localhost before any restrictions

# Allow outbound DNS

iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

# Allow inbound DNS responses

iptables -A INPUT -p udp --sport 53 -j ACCEPT

# Allow localhost

iptables -A INPUT -i lo -j ACCEPT

iptables -A OUTPUT -o lo -j ACCEPT

# Create ipset with CIDR support

ipset create allowed-domains hash:net

# Resolve and add other allowed domains

for domain in "${ALLOWED_DOMAINS[@]}"; do

echo "Resolving $domain..."

ips=$(dig +short A "$domain")

if [ -z "$ips" ]; then

echo "ERROR: Failed to resolve $domain"

exit 1

while read -r ip; do

if [[ ! "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then

echo "ERROR: Invalid IP from DNS for $domain: $ip"

exit 1

echo "Adding $ip for $domain"

ipset add allowed-domains "$ip"

done < <(echo "$ips")

done

# Get host IP from default route

HOST_IP=$(ip route | grep default | cut -d" " -f3)

if [ -z "$HOST_IP" ]; then

echo "ERROR: Failed to detect host IP"

exit 1

HOST_NETWORK=$(echo "$HOST_IP" | sed "s/\.[0-9]*$/.0\/24/")

echo "Host network detected as: $HOST_NETWORK"

# Set up remaining iptables rules

iptables -A INPUT -s "$HOST_NETWORK" -j ACCEPT

iptables -A OUTPUT -d "$HOST_NETWORK" -j ACCEPT

# Set default policies to DROP first

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT DROP

# First allow established connections for already approved traffic

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Then allow only specific outbound traffic to allowed domains

iptables -A OUTPUT -m set --match-set allowed-domains dst -j ACCEPT

# Append final REJECT rules for immediate error responses

# For TCP traffic, send a TCP reset; for UDP, send ICMP port unreachable.

iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset

iptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable

iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset

iptables -A OUTPUT -p udp -j REJECT --reject-with icmp-port-unreachable

iptables -A FORWARD -p tcp -j REJECT --reject-with tcp-reset

iptables -A FORWARD -p udp -j REJECT --reject-with icmp-port-unreachable

echo "Firewall configuration complete"

echo "Verifying firewall rules..."

if curl --connect-timeout 5 https://example.com >/dev/null 2>&1; then

echo "ERROR: Firewall verification failed - was able to reach https://example.com"

exit 1

else

echo "Firewall verification passed - unable to reach https://example.com as expected"

# Always verify OpenAI API access is working

if ! curl --connect-timeout 5 https://api.openai.com >/dev/null 2>&1; then

echo "ERROR: Firewall verification failed - unable to reach https://api.openai.com"

exit 1

else

echo "Firewall verification passed - able to reach https://api.openai.com as expected"

codex/codex-cli/scripts/init_firewall.sh at main · hencjo/codex · GitHub

Expand file tree

Breadcrumbs

init_firewall.sh

Latest commit

History

Breadcrumbs

init_firewall.sh

File metadata and controls