fix: prevent DNS exfiltration in strong jails

.github/workflows/tests.yml

@@ -6,6 +6,7 @@ on:
  - main
  pull_request:
  workflow_call:
+ workflow_dispatch:
 
 env:
  CARGO_TERM_COLOR: always

Cargo.toml

@@ -38,6 +38,7 @@ filetime = "0.2"
 ctrlc = "3.4"
 url = "2.5"
 v8 = "129"
+simple-dns = "0.7"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 libc = "0.2"

README.md

@@ -20,6 +20,7 @@ Or download a pre-built binary from the [releases page](https://github.com/coder
 
 - 🔒 **Process-level network isolation** - Isolate processes in restricted network environments
 - 🌐 **HTTP/HTTPS interception** - Transparent proxy with TLS certificate injection
+- 🛡️ **DNS exfiltration protection** - Prevents data leakage through DNS queries
 - 🔧 **Script-based evaluation** - Custom request evaluation logic via external scripts
 - 🚀 **JavaScript evaluation** - Fast, secure request filtering using V8 JavaScript engine
 - 📝 **Request logging** - Monitor and log all HTTP/HTTPS requests
@@ -70,7 +71,7 @@ httpjail creates an isolated network environment for the target process, interce
 ├─────────────────────────────────────────────────┤
 │ 1. Create network namespace │
 │ 2. Setup nftables rules │
-│ 3. Start embedded proxy  │
+│ 3. Start embedded proxy + DNS server │
 │ 4. Export CA trust env vars │
 │ 5. Execute target process in namespace │
 └─────────────────────────────────────────────────┘
@@ -79,6 +80,7 @@ httpjail creates an isolated network environment for the target process, interce
 │ Target Process │
 │ • Isolated in network namespace │
 │ • All HTTP/HTTPS → local proxy │
+│ • All DNS queries → dummy resolver (6.6.6.6) │
 │ • CA cert trusted via env vars │
 └─────────────────────────────────────────────────┘
 ```
@@ -114,6 +116,50 @@ httpjail creates an isolated network environment for the target process, interce
 | Sudo required | ⚠️ Yes | ✅ No | 🚧 |
 | Force all traffic | ✅ Yes | ❌ No (apps must cooperate) | 🚧 |
 
+## DNS Exfiltration Protection
+
+httpjail includes built-in protection against DNS exfiltration attacks. In isolated environments (Linux strong mode), all DNS queries are intercepted and answered with a dummy response (6.6.6.6), preventing data leakage through DNS subdomain encoding.
+
+**Attack Prevention**: Without this protection, malicious code could exfiltrate sensitive data (environment variables, secrets, etc.) by encoding it in DNS queries like `secret-data.attacker.com`. Our dummy DNS server ensures:
+
+1. All DNS queries receive the same response (6.6.6.6)
+2. External DNS servers (1.1.1.1, 8.8.8.8) cannot be reached
+3. HTTP/HTTPS traffic still works as it's redirected through our proxy
+4. No actual DNS resolution occurs, preventing data leakage
+
+This approach blocks DNS tunneling while maintaining full HTTP/HTTPS functionality through transparent proxy redirection.
+
+```mermaid
+sequenceDiagram
+ participant J as Jailed Process
+ participant S as Jail Server
+ participant D as Public DNS Resolvers
+
+ Note over J,D: DNS Exfiltration Attempt
+ J->>S: DNS Query: secret-data.attacker.com
+ S-->>J: Response: 6.6.6.6 (dummy)
+ Note over S,D: ❌ Query never reaches public resolvers
+
+ Note over J,D: Blocked HTTP Flow
+ J->>S: HTTP GET http://blocked.com
+ Note over S: Rule evaluation: denied
+ S-->>J: 403 Forbidden
+ Note over S,D: ❌ No DNS resolution needed
+
+ Note over J,D: Allowed HTTP Flow
+ J->>S: HTTP GET http://example.com
+ Note over S: Rule evaluation: allowed
+ S->>D: DNS Query: example.com (only if needed)
+ D-->>S: Real IP address
+ S->>S: Forward to upstream server
+ S-->>J: HTTP response
+```
+
+The diagram illustrates three key scenarios:
+1. **DNS Exfiltration Prevention**: All DNS queries from the jailed process receive a dummy response (6.6.6.6), never reaching public resolvers
+2. **Blocked HTTP Traffic**: Requests to denied domains are rejected without any DNS resolution
+3. **Allowed HTTP Traffic**: Only when rules permit, the server performs actual DNS resolution and forwards the request
+
 ## Prerequisites
 
 ### Linux

src/jail/linux/dns.rs

@@ -0,0 +1,184 @@
+use anyhow::{Context, Result};
+use simple_dns::rdata::RData;
+use simple_dns::{CLASS, Packet, PacketFlag, ResourceRecord};
+use std::net::{Ipv4Addr, UdpSocket};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::Duration;
+use tracing::{debug, error, info, warn};
+
+const DUMMY_IPV4: Ipv4Addr = Ipv4Addr::new(6, 6, 6, 6);
+const MAX_DNS_PACKET_SIZE: usize = 512;
+
+pub struct DummyDnsServer {
+ socket: Option<UdpSocket>,
+ shutdown: Arc<AtomicBool>,
+ thread_handle: Option<thread::JoinHandle<()>>,
+}
+
+impl DummyDnsServer {
+ pub fn new() -> Self {
+ Self {
+ socket: None,
+ shutdown: Arc::new(AtomicBool::new(false)),
+ thread_handle: None,
+ }
+ }
+
+ pub fn start(&mut self, bind_addr: &str) -> Result<()> {
+ let socket = UdpSocket::bind(bind_addr)
+ .with_context(|| format!("Failed to bind DNS server to {}", bind_addr))?;
+
+ socket.set_read_timeout(Some(Duration::from_millis(100)))?;
+
+ info!("Starting dummy DNS server on {}", bind_addr);
+
+ let socket_clone = socket.try_clone()?;
+ let shutdown_clone = self.shutdown.clone();
+
+ let thread_handle = thread::spawn(move || {
+ if let Err(e) = run_dns_server(socket_clone, shutdown_clone) {
+ error!("DNS server error: {}", e);
+ }
+ });
+
+ self.socket = Some(socket);
+ self.thread_handle = Some(thread_handle);
+
+ Ok(())
+ }
+
+ pub fn stop(&mut self) {
+ debug!("Stopping dummy DNS server");
+ self.shutdown.store(true, Ordering::Relaxed);
+
+ if let Some(handle) = self.thread_handle.take() {
+ let _ = handle.join();
+ }
+
+ self.socket = None;
+ }
+}
+
+impl Drop for DummyDnsServer {
+ fn drop(&mut self) {
+ self.stop();
+ }
+}
+
+fn run_dns_server(socket: UdpSocket, shutdown: Arc<AtomicBool>) -> Result<()> {
+ let mut buf = [0u8; MAX_DNS_PACKET_SIZE];
+
+ while !shutdown.load(Ordering::Relaxed) {
+ match socket.recv_from(&mut buf) {
+ Ok((size, src)) => {
+ debug!("Received DNS query from {}: {} bytes", src, size);
+
+ // Parse the DNS query using simple-dns
+ match Packet::parse(&buf[..size]) {
+ Ok(query) => {
+ if let Ok(response) = build_dummy_response(query) {
+ if let Err(e) = socket.send_to(&response, src) {
+ warn!("Failed to send DNS response to {}: {}", src, e);
+ } else {
+ debug!("Sent dummy DNS response to {}", src);
+ }
+ }
+ }
+ Err(e) => {
+ debug!("Failed to parse DNS query: {}", e);
+ }
+ }
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {
+ continue;
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::TimedOut => {
+ continue;
+ }
+ Err(e) => {
+ if !shutdown.load(Ordering::Relaxed) {
+ error!("DNS server receive error: {}", e);
+ }
+ break;
+ }
+ }
+ }
+
+ Ok(())
+}
+
+fn build_dummy_response(query: Packet<'_>) -> Result<Vec<u8>> {
+ // Create a response packet based on the query
+ let mut response = Packet::new_reply(query.id());
+
+ // Set standard response flags
+ response.set_flags(PacketFlag::RESPONSE | PacketFlag::RECURSION_AVAILABLE);
+
+ // Copy all questions from the query to the response
+ for question in &query.questions {
+ response.questions.push(question.clone());
+ }
+
+ // For each question, add a dummy A record response
+ for question in &query.questions {
+ // Only respond to A record queries (TYPE 1)
+ // But we'll respond to all queries with an A record anyway
+ // to prevent any DNS exfiltration attempts
+ let answer = ResourceRecord::new(
+ question.qname.clone(),
+ CLASS::IN,
+ 60, // TTL in seconds
+ RData::A(DUMMY_IPV4.into()),
+ );
+ response.answers.push(answer);
+ }
+
+ // Build the response packet into bytes
+ response
+ .build_bytes_vec()
+ .map_err(|e| anyhow::anyhow!("Failed to build DNS response: {}", e))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use simple_dns::{Name, Question, TYPE};
+
+ #[test]
+ fn test_dns_response_builder() {
+ // Create a test query using simple-dns
+ let mut query = Packet::new_query(0x1234);
+ let qname = Name::new("google.com").unwrap();
+ query.questions.push(Question::new(
+ qname.clone(),
+ TYPE::A.into(),
+ CLASS::IN.into(),
+ false,
+ ));
+
+ // Build the response
+ let response_packet = build_dummy_response(query.clone()).unwrap();
+
+ // Parse the response back
+ let response = Packet::parse(&response_packet).unwrap();
+
+ // Verify the response
+ assert_eq!(response.id(), 0x1234);
+ assert!(response.has_flags(PacketFlag::RESPONSE));
+ assert_eq!(response.questions.len(), 1);
+ assert_eq!(response.answers.len(), 1);
+
+ // Check that the answer contains our dummy IP
+ if let Some(answer) = response.answers.first() {
+ if let RData::A(ip) = &answer.rdata {
+ assert_eq!(Ipv4Addr::from(ip.address), DUMMY_IPV4);
+ } else {
+ panic!("Expected A record in response");
+ }
+ } else {
+ panic!("No answer in response");
+ }
+ }
+}

src/jail/linux/docker.rs

@@ -284,6 +284,7 @@ impl DockerLinux {
  &["-e", "-v", "-p", "--name", "--entrypoint", "-w", "--user"];
 
  /// Build the docker command with isolated network
+ #[allow(clippy::collapsible_if)]
  fn build_docker_command(
  &self,
  docker_args: &[String],

.github/workflows/tests.yml

@@ -6,6 +6,7 @@ on:
  - main
  pull_request:
  workflow_call:
+ workflow_dispatch:
 
 env:
  CARGO_TERM_COLOR: always

Cargo.toml

@@ -38,6 +38,7 @@ filetime = "0.2"
 ctrlc = "3.4"
 url = "2.5"
 v8 = "129"
+simple-dns = "0.7"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 libc = "0.2"

README.md

@@ -20,6 +20,7 @@ Or download a pre-built binary from the [releases page](https://github.com/coder
 
 - 🔒 **Process-level network isolation** - Isolate processes in restricted network environments
 - 🌐 **HTTP/HTTPS interception** - Transparent proxy with TLS certificate injection
+- 🛡️ **DNS exfiltration protection** - Prevents data leakage through DNS queries
 - 🔧 **Script-based evaluation** - Custom request evaluation logic via external scripts
 - 🚀 **JavaScript evaluation** - Fast, secure request filtering using V8 JavaScript engine
 - 📝 **Request logging** - Monitor and log all HTTP/HTTPS requests
@@ -70,7 +71,7 @@ httpjail creates an isolated network environment for the target process, interce
 ├─────────────────────────────────────────────────┤
 │ 1. Create network namespace │
 │ 2. Setup nftables rules │
-│ 3. Start embedded proxy  │
+│ 3. Start embedded proxy + DNS server │
 │ 4. Export CA trust env vars │
 │ 5. Execute target process in namespace │
 └─────────────────────────────────────────────────┘
@@ -79,6 +80,7 @@ httpjail creates an isolated network environment for the target process, interce
 │ Target Process │
 │ • Isolated in network namespace │
 │ • All HTTP/HTTPS → local proxy │
+│ • All DNS queries → dummy resolver (6.6.6.6) │
 │ • CA cert trusted via env vars │
 └─────────────────────────────────────────────────┘
 ```
@@ -114,6 +116,50 @@ httpjail creates an isolated network environment for the target process, interce
 | Sudo required | ⚠️ Yes | ✅ No | 🚧 |
 | Force all traffic | ✅ Yes | ❌ No (apps must cooperate) | 🚧 |
 
+## DNS Exfiltration Protection
+
+httpjail includes built-in protection against DNS exfiltration attacks. In isolated environments (Linux strong mode), all DNS queries are intercepted and answered with a dummy response (6.6.6.6), preventing data leakage through DNS subdomain encoding.
+
+**Attack Prevention**: Without this protection, malicious code could exfiltrate sensitive data (environment variables, secrets, etc.) by encoding it in DNS queries like `secret-data.attacker.com`. Our dummy DNS server ensures:
+
+1. All DNS queries receive the same response (6.6.6.6)
+2. External DNS servers (1.1.1.1, 8.8.8.8) cannot be reached
+3. HTTP/HTTPS traffic still works as it's redirected through our proxy
+4. No actual DNS resolution occurs, preventing data leakage
+
+This approach blocks DNS tunneling while maintaining full HTTP/HTTPS functionality through transparent proxy redirection.
+
+```mermaid
+sequenceDiagram
+ participant J as Jailed Process
+ participant S as Jail Server
+ participant D as Public DNS Resolvers
+
+ Note over J,D: DNS Exfiltration Attempt
+ J->>S: DNS Query: secret-data.attacker.com
+ S-->>J: Response: 6.6.6.6 (dummy)
+ Note over S,D: ❌ Query never reaches public resolvers
+
+ Note over J,D: Blocked HTTP Flow
+ J->>S: HTTP GET http://blocked.com
+ Note over S: Rule evaluation: denied
+ S-->>J: 403 Forbidden
+ Note over S,D: ❌ No DNS resolution needed
+
+ Note over J,D: Allowed HTTP Flow
+ J->>S: HTTP GET http://example.com
+ Note over S: Rule evaluation: allowed
+ S->>D: DNS Query: example.com (only if needed)
+ D-->>S: Real IP address
+ S->>S: Forward to upstream server
+ S-->>J: HTTP response
+```
+
+The diagram illustrates three key scenarios:
+1. **DNS Exfiltration Prevention**: All DNS queries from the jailed process receive a dummy response (6.6.6.6), never reaching public resolvers
+2. **Blocked HTTP Traffic**: Requests to denied domains are rejected without any DNS resolution
+3. **Allowed HTTP Traffic**: Only when rules permit, the server performs actual DNS resolution and forwards the request
+
 ## Prerequisites
 
 ### Linux

src/jail/linux/dns.rs

@@ -0,0 +1,184 @@
+use anyhow::{Context, Result};
+use simple_dns::rdata::RData;
+use simple_dns::{CLASS, Packet, PacketFlag, ResourceRecord};
+use std::net::{Ipv4Addr, UdpSocket};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::Duration;
+use tracing::{debug, error, info, warn};
+
+const DUMMY_IPV4: Ipv4Addr = Ipv4Addr::new(6, 6, 6, 6);
+const MAX_DNS_PACKET_SIZE: usize = 512;
+
+pub struct DummyDnsServer {
+ socket: Option<UdpSocket>,
+ shutdown: Arc<AtomicBool>,
+ thread_handle: Option<thread::JoinHandle<()>>,
+}
+
+impl DummyDnsServer {
+ pub fn new() -> Self {
+ Self {
+ socket: None,
+ shutdown: Arc::new(AtomicBool::new(false)),
+ thread_handle: None,
+ }
+ }
+
+ pub fn start(&mut self, bind_addr: &str) -> Result<()> {
+ let socket = UdpSocket::bind(bind_addr)
+ .with_context(|| format!("Failed to bind DNS server to {}", bind_addr))?;
+
+ socket.set_read_timeout(Some(Duration::from_millis(100)))?;
+
+ info!("Starting dummy DNS server on {}", bind_addr);
+
+ let socket_clone = socket.try_clone()?;
+ let shutdown_clone = self.shutdown.clone();
+
+ let thread_handle = thread::spawn(move || {
+ if let Err(e) = run_dns_server(socket_clone, shutdown_clone) {
+ error!("DNS server error: {}", e);
+ }
+ });
+
+ self.socket = Some(socket);
+ self.thread_handle = Some(thread_handle);
+
+ Ok(())
+ }
+
+ pub fn stop(&mut self) {
+ debug!("Stopping dummy DNS server");
+ self.shutdown.store(true, Ordering::Relaxed);
+
+ if let Some(handle) = self.thread_handle.take() {
+ let _ = handle.join();
+ }
+
+ self.socket = None;
+ }
+}
+
+impl Drop for DummyDnsServer {
+ fn drop(&mut self) {
+ self.stop();
+ }
+}
+
+fn run_dns_server(socket: UdpSocket, shutdown: Arc<AtomicBool>) -> Result<()> {
+ let mut buf = [0u8; MAX_DNS_PACKET_SIZE];
+
+ while !shutdown.load(Ordering::Relaxed) {
+ match socket.recv_from(&mut buf) {
+ Ok((size, src)) => {
+ debug!("Received DNS query from {}: {} bytes", src, size);
+
+ // Parse the DNS query using simple-dns
+ match Packet::parse(&buf[..size]) {
+ Ok(query) => {
+ if let Ok(response) = build_dummy_response(query) {
+ if let Err(e) = socket.send_to(&response, src) {
+ warn!("Failed to send DNS response to {}: {}", src, e);
+ } else {
+ debug!("Sent dummy DNS response to {}", src);
+ }
+ }
+ }
+ Err(e) => {
+ debug!("Failed to parse DNS query: {}", e);
+ }
+ }
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {
+ continue;
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::TimedOut => {
+ continue;
+ }
+ Err(e) => {
+ if !shutdown.load(Ordering::Relaxed) {
+ error!("DNS server receive error: {}", e);
+ }
+ break;
+ }
+ }
+ }
+
+ Ok(())
+}
+
+fn build_dummy_response(query: Packet<'_>) -> Result<Vec<u8>> {
+ // Create a response packet based on the query
+ let mut response = Packet::new_reply(query.id());
+
+ // Set standard response flags
+ response.set_flags(PacketFlag::RESPONSE | PacketFlag::RECURSION_AVAILABLE);
+
+ // Copy all questions from the query to the response
+ for question in &query.questions {
+ response.questions.push(question.clone());
+ }
+
+ // For each question, add a dummy A record response
+ for question in &query.questions {
+ // Only respond to A record queries (TYPE 1)
+ // But we'll respond to all queries with an A record anyway
+ // to prevent any DNS exfiltration attempts
+ let answer = ResourceRecord::new(
+ question.qname.clone(),
+ CLASS::IN,
+ 60, // TTL in seconds
+ RData::A(DUMMY_IPV4.into()),
+ );
+ response.answers.push(answer);
+ }
+
+ // Build the response packet into bytes
+ response
+ .build_bytes_vec()
+ .map_err(|e| anyhow::anyhow!("Failed to build DNS response: {}", e))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use simple_dns::{Name, Question, TYPE};
+
+ #[test]
+ fn test_dns_response_builder() {
+ // Create a test query using simple-dns
+ let mut query = Packet::new_query(0x1234);
+ let qname = Name::new("google.com").unwrap();
+ query.questions.push(Question::new(
+ qname.clone(),
+ TYPE::A.into(),
+ CLASS::IN.into(),
+ false,
+ ));
+
+ // Build the response
+ let response_packet = build_dummy_response(query.clone()).unwrap();
+
+ // Parse the response back
+ let response = Packet::parse(&response_packet).unwrap();
+
+ // Verify the response
+ assert_eq!(response.id(), 0x1234);
+ assert!(response.has_flags(PacketFlag::RESPONSE));
+ assert_eq!(response.questions.len(), 1);
+ assert_eq!(response.answers.len(), 1);
+
+ // Check that the answer contains our dummy IP
+ if let Some(answer) = response.answers.first() {
+ if let RData::A(ip) = &answer.rdata {
+ assert_eq!(Ipv4Addr::from(ip.address), DUMMY_IPV4);
+ } else {
+ panic!("Expected A record in response");
+ }
+ } else {
+ panic!("No answer in response");
+ }
+ }
+}

src/jail/linux/docker.rs

@@ -284,6 +284,7 @@ impl DockerLinux {
  &["-e", "-v", "-p", "--name", "--entrypoint", "-w", "--user"];
 
  /// Build the docker command with isolated network
+ #[allow(clippy::collapsible_if)]
  fn build_docker_command(
  &self,
  docker_args: &[String],

.github/workflows/tests.yml

@@ -6,6 +6,7 @@ on:
  - main
  pull_request:
  workflow_call:
+ workflow_dispatch:
 
 env:
  CARGO_TERM_COLOR: always

Cargo.toml

@@ -38,6 +38,7 @@ filetime = "0.2"
 ctrlc = "3.4"
 url = "2.5"
 v8 = "129"
+simple-dns = "0.7"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 libc = "0.2"

README.md

@@ -20,6 +20,7 @@ Or download a pre-built binary from the [releases page](https://github.com/coder
 
 - 🔒 **Process-level network isolation** - Isolate processes in restricted network environments
 - 🌐 **HTTP/HTTPS interception** - Transparent proxy with TLS certificate injection
+- 🛡️ **DNS exfiltration protection** - Prevents data leakage through DNS queries
 - 🔧 **Script-based evaluation** - Custom request evaluation logic via external scripts
 - 🚀 **JavaScript evaluation** - Fast, secure request filtering using V8 JavaScript engine
 - 📝 **Request logging** - Monitor and log all HTTP/HTTPS requests
@@ -70,7 +71,7 @@ httpjail creates an isolated network environment for the target process, interce
 ├─────────────────────────────────────────────────┤
 │ 1. Create network namespace │
 │ 2. Setup nftables rules │
-│ 3. Start embedded proxy  │
+│ 3. Start embedded proxy + DNS server │
 │ 4. Export CA trust env vars │
 │ 5. Execute target process in namespace │
 └─────────────────────────────────────────────────┘
@@ -79,6 +80,7 @@ httpjail creates an isolated network environment for the target process, interce
 │ Target Process │
 │ • Isolated in network namespace │
 │ • All HTTP/HTTPS → local proxy │
+│ • All DNS queries → dummy resolver (6.6.6.6) │
 │ • CA cert trusted via env vars │
 └─────────────────────────────────────────────────┘
 ```
@@ -114,6 +116,50 @@ httpjail creates an isolated network environment for the target process, interce
 | Sudo required | ⚠️ Yes | ✅ No | 🚧 |
 | Force all traffic | ✅ Yes | ❌ No (apps must cooperate) | 🚧 |
 
+## DNS Exfiltration Protection
+
+httpjail includes built-in protection against DNS exfiltration attacks. In isolated environments (Linux strong mode), all DNS queries are intercepted and answered with a dummy response (6.6.6.6), preventing data leakage through DNS subdomain encoding.
+
+**Attack Prevention**: Without this protection, malicious code could exfiltrate sensitive data (environment variables, secrets, etc.) by encoding it in DNS queries like `secret-data.attacker.com`. Our dummy DNS server ensures:
+
+1. All DNS queries receive the same response (6.6.6.6)
+2. External DNS servers (1.1.1.1, 8.8.8.8) cannot be reached
+3. HTTP/HTTPS traffic still works as it's redirected through our proxy
+4. No actual DNS resolution occurs, preventing data leakage
+
+This approach blocks DNS tunneling while maintaining full HTTP/HTTPS functionality through transparent proxy redirection.
+
+```mermaid
+sequenceDiagram
+ participant J as Jailed Process
+ participant S as Jail Server
+ participant D as Public DNS Resolvers
+
+ Note over J,D: DNS Exfiltration Attempt
+ J->>S: DNS Query: secret-data.attacker.com
+ S-->>J: Response: 6.6.6.6 (dummy)
+ Note over S,D: ❌ Query never reaches public resolvers
+
+ Note over J,D: Blocked HTTP Flow
+ J->>S: HTTP GET http://blocked.com
+ Note over S: Rule evaluation: denied
+ S-->>J: 403 Forbidden
+ Note over S,D: ❌ No DNS resolution needed
+
+ Note over J,D: Allowed HTTP Flow
+ J->>S: HTTP GET http://example.com
+ Note over S: Rule evaluation: allowed
+ S->>D: DNS Query: example.com (only if needed)
+ D-->>S: Real IP address
+ S->>S: Forward to upstream server
+ S-->>J: HTTP response
+```
+
+The diagram illustrates three key scenarios:
+1. **DNS Exfiltration Prevention**: All DNS queries from the jailed process receive a dummy response (6.6.6.6), never reaching public resolvers
+2. **Blocked HTTP Traffic**: Requests to denied domains are rejected without any DNS resolution
+3. **Allowed HTTP Traffic**: Only when rules permit, the server performs actual DNS resolution and forwards the request
+
 ## Prerequisites
 
 ### Linux

src/jail/linux/dns.rs

@@ -0,0 +1,184 @@
+use anyhow::{Context, Result};
+use simple_dns::rdata::RData;
+use simple_dns::{CLASS, Packet, PacketFlag, ResourceRecord};
+use std::net::{Ipv4Addr, UdpSocket};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::Duration;
+use tracing::{debug, error, info, warn};
+
+const DUMMY_IPV4: Ipv4Addr = Ipv4Addr::new(6, 6, 6, 6);
+const MAX_DNS_PACKET_SIZE: usize = 512;
+
+pub struct DummyDnsServer {
+ socket: Option<UdpSocket>,
+ shutdown: Arc<AtomicBool>,
+ thread_handle: Option<thread::JoinHandle<()>>,
+}
+
+impl DummyDnsServer {
+ pub fn new() -> Self {
+ Self {
+ socket: None,
+ shutdown: Arc::new(AtomicBool::new(false)),
+ thread_handle: None,
+ }
+ }
+
+ pub fn start(&mut self, bind_addr: &str) -> Result<()> {
+ let socket = UdpSocket::bind(bind_addr)
+ .with_context(|| format!("Failed to bind DNS server to {}", bind_addr))?;
+
+ socket.set_read_timeout(Some(Duration::from_millis(100)))?;
+
+ info!("Starting dummy DNS server on {}", bind_addr);
+
+ let socket_clone = socket.try_clone()?;
+ let shutdown_clone = self.shutdown.clone();
+
+ let thread_handle = thread::spawn(move || {
+ if let Err(e) = run_dns_server(socket_clone, shutdown_clone) {
+ error!("DNS server error: {}", e);
+ }
+ });
+
+ self.socket = Some(socket);
+ self.thread_handle = Some(thread_handle);
+
+ Ok(())
+ }
+
+ pub fn stop(&mut self) {
+ debug!("Stopping dummy DNS server");
+ self.shutdown.store(true, Ordering::Relaxed);
+
+ if let Some(handle) = self.thread_handle.take() {
+ let _ = handle.join();
+ }
+
+ self.socket = None;
+ }
+}
+
+impl Drop for DummyDnsServer {
+ fn drop(&mut self) {
+ self.stop();
+ }
+}
+
+fn run_dns_server(socket: UdpSocket, shutdown: Arc<AtomicBool>) -> Result<()> {
+ let mut buf = [0u8; MAX_DNS_PACKET_SIZE];
+
+ while !shutdown.load(Ordering::Relaxed) {
+ match socket.recv_from(&mut buf) {
+ Ok((size, src)) => {
+ debug!("Received DNS query from {}: {} bytes", src, size);
+
+ // Parse the DNS query using simple-dns
+ match Packet::parse(&buf[..size]) {
+ Ok(query) => {
+ if let Ok(response) = build_dummy_response(query) {
+ if let Err(e) = socket.send_to(&response, src) {
+ warn!("Failed to send DNS response to {}: {}", src, e);
+ } else {
+ debug!("Sent dummy DNS response to {}", src);
+ }
+ }
+ }
+ Err(e) => {
+ debug!("Failed to parse DNS query: {}", e);
+ }
+ }
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {
+ continue;
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::TimedOut => {
+ continue;
+ }
+ Err(e) => {
+ if !shutdown.load(Ordering::Relaxed) {
+ error!("DNS server receive error: {}", e);
+ }
+ break;
+ }
+ }
+ }
+
+ Ok(())
+}
+
+fn build_dummy_response(query: Packet<'_>) -> Result<Vec<u8>> {
+ // Create a response packet based on the query
+ let mut response = Packet::new_reply(query.id());
+
+ // Set standard response flags
+ response.set_flags(PacketFlag::RESPONSE | PacketFlag::RECURSION_AVAILABLE);
+
+ // Copy all questions from the query to the response
+ for question in &query.questions {
+ response.questions.push(question.clone());
+ }
+
+ // For each question, add a dummy A record response
+ for question in &query.questions {
+ // Only respond to A record queries (TYPE 1)
+ // But we'll respond to all queries with an A record anyway
+ // to prevent any DNS exfiltration attempts
+ let answer = ResourceRecord::new(
+ question.qname.clone(),
+ CLASS::IN,
+ 60, // TTL in seconds
+ RData::A(DUMMY_IPV4.into()),
+ );
+ response.answers.push(answer);
+ }
+
+ // Build the response packet into bytes
+ response
+ .build_bytes_vec()
+ .map_err(|e| anyhow::anyhow!("Failed to build DNS response: {}", e))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use simple_dns::{Name, Question, TYPE};
+
+ #[test]
+ fn test_dns_response_builder() {
+ // Create a test query using simple-dns
+ let mut query = Packet::new_query(0x1234);
+ let qname = Name::new("google.com").unwrap();
+ query.questions.push(Question::new(
+ qname.clone(),
+ TYPE::A.into(),
+ CLASS::IN.into(),
+ false,
+ ));
+
+ // Build the response
+ let response_packet = build_dummy_response(query.clone()).unwrap();
+
+ // Parse the response back
+ let response = Packet::parse(&response_packet).unwrap();
+
+ // Verify the response
+ assert_eq!(response.id(), 0x1234);
+ assert!(response.has_flags(PacketFlag::RESPONSE));
+ assert_eq!(response.questions.len(), 1);
+ assert_eq!(response.answers.len(), 1);
+
+ // Check that the answer contains our dummy IP
+ if let Some(answer) = response.answers.first() {
+ if let RData::A(ip) = &answer.rdata {
+ assert_eq!(Ipv4Addr::from(ip.address), DUMMY_IPV4);
+ } else {
+ panic!("Expected A record in response");
+ }
+ } else {
+ panic!("No answer in response");
+ }
+ }
+}

src/jail/linux/docker.rs

@@ -284,6 +284,7 @@ impl DockerLinux {
  &["-e", "-v", "-p", "--name", "--entrypoint", "-w", "--user"];
 
  /// Build the docker command with isolated network
+ #[allow(clippy::collapsible_if)]
  fn build_docker_command(
  &self,
  docker_args: &[String],

.github/workflows/tests.yml

@@ -6,6 +6,7 @@ on:
  - main
  pull_request:
  workflow_call:
+ workflow_dispatch:
 
 env:
  CARGO_TERM_COLOR: always

Cargo.toml

@@ -38,6 +38,7 @@ filetime = "0.2"
 ctrlc = "3.4"
 url = "2.5"
 v8 = "129"
+simple-dns = "0.7"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 libc = "0.2"

README.md

@@ -20,6 +20,7 @@ Or download a pre-built binary from the [releases page](https://github.com/coder
 
 - 🔒 **Process-level network isolation** - Isolate processes in restricted network environments
 - 🌐 **HTTP/HTTPS interception** - Transparent proxy with TLS certificate injection
+- 🛡️ **DNS exfiltration protection** - Prevents data leakage through DNS queries
 - 🔧 **Script-based evaluation** - Custom request evaluation logic via external scripts
 - 🚀 **JavaScript evaluation** - Fast, secure request filtering using V8 JavaScript engine
 - 📝 **Request logging** - Monitor and log all HTTP/HTTPS requests
@@ -70,7 +71,7 @@ httpjail creates an isolated network environment for the target process, interce
 ├─────────────────────────────────────────────────┤
 │ 1. Create network namespace │
 │ 2. Setup nftables rules │
-│ 3. Start embedded proxy  │
+│ 3. Start embedded proxy + DNS server │
 │ 4. Export CA trust env vars │
 │ 5. Execute target process in namespace │
 └─────────────────────────────────────────────────┘
@@ -79,6 +80,7 @@ httpjail creates an isolated network environment for the target process, interce
 │ Target Process │
 │ • Isolated in network namespace │
 │ • All HTTP/HTTPS → local proxy │
+│ • All DNS queries → dummy resolver (6.6.6.6) │
 │ • CA cert trusted via env vars │
 └─────────────────────────────────────────────────┘
 ```
@@ -114,6 +116,50 @@ httpjail creates an isolated network environment for the target process, interce
 | Sudo required | ⚠️ Yes | ✅ No | 🚧 |
 | Force all traffic | ✅ Yes | ❌ No (apps must cooperate) | 🚧 |
 
+## DNS Exfiltration Protection
+
+httpjail includes built-in protection against DNS exfiltration attacks. In isolated environments (Linux strong mode), all DNS queries are intercepted and answered with a dummy response (6.6.6.6), preventing data leakage through DNS subdomain encoding.
+
+**Attack Prevention**: Without this protection, malicious code could exfiltrate sensitive data (environment variables, secrets, etc.) by encoding it in DNS queries like `secret-data.attacker.com`. Our dummy DNS server ensures:
+
+1. All DNS queries receive the same response (6.6.6.6)
+2. External DNS servers (1.1.1.1, 8.8.8.8) cannot be reached
+3. HTTP/HTTPS traffic still works as it's redirected through our proxy
+4. No actual DNS resolution occurs, preventing data leakage
+
+This approach blocks DNS tunneling while maintaining full HTTP/HTTPS functionality through transparent proxy redirection.
+
+```mermaid
+sequenceDiagram
+ participant J as Jailed Process
+ participant S as Jail Server
+ participant D as Public DNS Resolvers
+
+ Note over J,D: DNS Exfiltration Attempt
+ J->>S: DNS Query: secret-data.attacker.com
+ S-->>J: Response: 6.6.6.6 (dummy)
+ Note over S,D: ❌ Query never reaches public resolvers
+
+ Note over J,D: Blocked HTTP Flow
+ J->>S: HTTP GET http://blocked.com
+ Note over S: Rule evaluation: denied
+ S-->>J: 403 Forbidden
+ Note over S,D: ❌ No DNS resolution needed
+
+ Note over J,D: Allowed HTTP Flow
+ J->>S: HTTP GET http://example.com
+ Note over S: Rule evaluation: allowed
+ S->>D: DNS Query: example.com (only if needed)
+ D-->>S: Real IP address
+ S->>S: Forward to upstream server
+ S-->>J: HTTP response
+```
+
+The diagram illustrates three key scenarios:
+1. **DNS Exfiltration Prevention**: All DNS queries from the jailed process receive a dummy response (6.6.6.6), never reaching public resolvers
+2. **Blocked HTTP Traffic**: Requests to denied domains are rejected without any DNS resolution
+3. **Allowed HTTP Traffic**: Only when rules permit, the server performs actual DNS resolution and forwards the request
+
 ## Prerequisites
 
 ### Linux

src/jail/linux/dns.rs

@@ -0,0 +1,184 @@
+use anyhow::{Context, Result};
+use simple_dns::rdata::RData;
+use simple_dns::{CLASS, Packet, PacketFlag, ResourceRecord};
+use std::net::{Ipv4Addr, UdpSocket};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::Duration;
+use tracing::{debug, error, info, warn};
+
+const DUMMY_IPV4: Ipv4Addr = Ipv4Addr::new(6, 6, 6, 6);
+const MAX_DNS_PACKET_SIZE: usize = 512;
+
+pub struct DummyDnsServer {
+ socket: Option<UdpSocket>,
+ shutdown: Arc<AtomicBool>,
+ thread_handle: Option<thread::JoinHandle<()>>,
+}
+
+impl DummyDnsServer {
+ pub fn new() -> Self {
+ Self {
+ socket: None,
+ shutdown: Arc::new(AtomicBool::new(false)),
+ thread_handle: None,
+ }
+ }
+
+ pub fn start(&mut self, bind_addr: &str) -> Result<()> {
+ let socket = UdpSocket::bind(bind_addr)
+ .with_context(|| format!("Failed to bind DNS server to {}", bind_addr))?;
+
+ socket.set_read_timeout(Some(Duration::from_millis(100)))?;
+
+ info!("Starting dummy DNS server on {}", bind_addr);
+
+ let socket_clone = socket.try_clone()?;
+ let shutdown_clone = self.shutdown.clone();
+
+ let thread_handle = thread::spawn(move || {
+ if let Err(e) = run_dns_server(socket_clone, shutdown_clone) {
+ error!("DNS server error: {}", e);
+ }
+ });
+
+ self.socket = Some(socket);
+ self.thread_handle = Some(thread_handle);
+
+ Ok(())
+ }
+
+ pub fn stop(&mut self) {
+ debug!("Stopping dummy DNS server");
+ self.shutdown.store(true, Ordering::Relaxed);
+
+ if let Some(handle) = self.thread_handle.take() {
+ let _ = handle.join();
+ }
+
+ self.socket = None;
+ }
+}
+
+impl Drop for DummyDnsServer {
+ fn drop(&mut self) {
+ self.stop();
+ }
+}
+
+fn run_dns_server(socket: UdpSocket, shutdown: Arc<AtomicBool>) -> Result<()> {
+ let mut buf = [0u8; MAX_DNS_PACKET_SIZE];
+
+ while !shutdown.load(Ordering::Relaxed) {
+ match socket.recv_from(&mut buf) {
+ Ok((size, src)) => {
+ debug!("Received DNS query from {}: {} bytes", src, size);
+
+ // Parse the DNS query using simple-dns
+ match Packet::parse(&buf[..size]) {
+ Ok(query) => {
+ if let Ok(response) = build_dummy_response(query) {
+ if let Err(e) = socket.send_to(&response, src) {
+ warn!("Failed to send DNS response to {}: {}", src, e);
+ } else {
+ debug!("Sent dummy DNS response to {}", src);
+ }
+ }
+ }
+ Err(e) => {
+ debug!("Failed to parse DNS query: {}", e);
+ }
+ }
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {
+ continue;
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::TimedOut => {
+ continue;
+ }
+ Err(e) => {
+ if !shutdown.load(Ordering::Relaxed) {
+ error!("DNS server receive error: {}", e);
+ }
+ break;
+ }
+ }
+ }
+
+ Ok(())
+}
+
+fn build_dummy_response(query: Packet<'_>) -> Result<Vec<u8>> {
+ // Create a response packet based on the query
+ let mut response = Packet::new_reply(query.id());
+
+ // Set standard response flags
+ response.set_flags(PacketFlag::RESPONSE | PacketFlag::RECURSION_AVAILABLE);
+
+ // Copy all questions from the query to the response
+ for question in &query.questions {
+ response.questions.push(question.clone());
+ }
+
+ // For each question, add a dummy A record response
+ for question in &query.questions {
+ // Only respond to A record queries (TYPE 1)
+ // But we'll respond to all queries with an A record anyway
+ // to prevent any DNS exfiltration attempts
+ let answer = ResourceRecord::new(
+ question.qname.clone(),
+ CLASS::IN,
+ 60, // TTL in seconds
+ RData::A(DUMMY_IPV4.into()),
+ );
+ response.answers.push(answer);
+ }
+
+ // Build the response packet into bytes
+ response
+ .build_bytes_vec()
+ .map_err(|e| anyhow::anyhow!("Failed to build DNS response: {}", e))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use simple_dns::{Name, Question, TYPE};
+
+ #[test]
+ fn test_dns_response_builder() {
+ // Create a test query using simple-dns
+ let mut query = Packet::new_query(0x1234);
+ let qname = Name::new("google.com").unwrap();
+ query.questions.push(Question::new(
+ qname.clone(),
+ TYPE::A.into(),
+ CLASS::IN.into(),
+ false,
+ ));
+
+ // Build the response
+ let response_packet = build_dummy_response(query.clone()).unwrap();
+
+ // Parse the response back
+ let response = Packet::parse(&response_packet).unwrap();
+
+ // Verify the response
+ assert_eq!(response.id(), 0x1234);
+ assert!(response.has_flags(PacketFlag::RESPONSE));
+ assert_eq!(response.questions.len(), 1);
+ assert_eq!(response.answers.len(), 1);
+
+ // Check that the answer contains our dummy IP
+ if let Some(answer) = response.answers.first() {
+ if let RData::A(ip) = &answer.rdata {
+ assert_eq!(Ipv4Addr::from(ip.address), DUMMY_IPV4);
+ } else {
+ panic!("Expected A record in response");
+ }
+ } else {
+ panic!("No answer in response");
+ }
+ }
+}

src/jail/linux/docker.rs

@@ -284,6 +284,7 @@ impl DockerLinux {
  &["-e", "-v", "-p", "--name", "--entrypoint", "-w", "--user"];
 
  /// Build the docker command with isolated network
+ #[allow(clippy::collapsible_if)]
  fn build_docker_command(
  &self,
  docker_args: &[String],

.github/workflows/tests.yml

@@ -6,6 +6,7 @@ on:
  - main
  pull_request:
  workflow_call:
+ workflow_dispatch:
 
 env:
  CARGO_TERM_COLOR: always

Cargo.toml

@@ -38,6 +38,7 @@ filetime = "0.2"
 ctrlc = "3.4"
 url = "2.5"
 v8 = "129"
+simple-dns = "0.7"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 libc = "0.2"

README.md

@@ -20,6 +20,7 @@ Or download a pre-built binary from the [releases page](https://github.com/coder
 
 - 🔒 **Process-level network isolation** - Isolate processes in restricted network environments
 - 🌐 **HTTP/HTTPS interception** - Transparent proxy with TLS certificate injection
+- 🛡️ **DNS exfiltration protection** - Prevents data leakage through DNS queries
 - 🔧 **Script-based evaluation** - Custom request evaluation logic via external scripts
 - 🚀 **JavaScript evaluation** - Fast, secure request filtering using V8 JavaScript engine
 - 📝 **Request logging** - Monitor and log all HTTP/HTTPS requests
@@ -70,7 +71,7 @@ httpjail creates an isolated network environment for the target process, interce
 ├─────────────────────────────────────────────────┤
 │ 1. Create network namespace │
 │ 2. Setup nftables rules │
-│ 3. Start embedded proxy  │
+│ 3. Start embedded proxy + DNS server │
 │ 4. Export CA trust env vars │
 │ 5. Execute target process in namespace │
 └─────────────────────────────────────────────────┘
@@ -79,6 +80,7 @@ httpjail creates an isolated network environment for the target process, interce
 │ Target Process │
 │ • Isolated in network namespace │
 │ • All HTTP/HTTPS → local proxy │
+│ • All DNS queries → dummy resolver (6.6.6.6) │
 │ • CA cert trusted via env vars │
 └─────────────────────────────────────────────────┘
 ```
@@ -114,6 +116,50 @@ httpjail creates an isolated network environment for the target process, interce
 | Sudo required | ⚠️ Yes | ✅ No | 🚧 |
 | Force all traffic | ✅ Yes | ❌ No (apps must cooperate) | 🚧 |
 
+## DNS Exfiltration Protection
+
+httpjail includes built-in protection against DNS exfiltration attacks. In isolated environments (Linux strong mode), all DNS queries are intercepted and answered with a dummy response (6.6.6.6), preventing data leakage through DNS subdomain encoding.
+
+**Attack Prevention**: Without this protection, malicious code could exfiltrate sensitive data (environment variables, secrets, etc.) by encoding it in DNS queries like `secret-data.attacker.com`. Our dummy DNS server ensures:
+
+1. All DNS queries receive the same response (6.6.6.6)
+2. External DNS servers (1.1.1.1, 8.8.8.8) cannot be reached
+3. HTTP/HTTPS traffic still works as it's redirected through our proxy
+4. No actual DNS resolution occurs, preventing data leakage
+
+This approach blocks DNS tunneling while maintaining full HTTP/HTTPS functionality through transparent proxy redirection.
+
+```mermaid
+sequenceDiagram
+ participant J as Jailed Process
+ participant S as Jail Server
+ participant D as Public DNS Resolvers
+
+ Note over J,D: DNS Exfiltration Attempt
+ J->>S: DNS Query: secret-data.attacker.com
+ S-->>J: Response: 6.6.6.6 (dummy)
+ Note over S,D: ❌ Query never reaches public resolvers
+
+ Note over J,D: Blocked HTTP Flow
+ J->>S: HTTP GET http://blocked.com
+ Note over S: Rule evaluation: denied
+ S-->>J: 403 Forbidden
+ Note over S,D: ❌ No DNS resolution needed
+
+ Note over J,D: Allowed HTTP Flow
+ J->>S: HTTP GET http://example.com
+ Note over S: Rule evaluation: allowed
+ S->>D: DNS Query: example.com (only if needed)
+ D-->>S: Real IP address
+ S->>S: Forward to upstream server
+ S-->>J: HTTP response
+```
+
+The diagram illustrates three key scenarios:
+1. **DNS Exfiltration Prevention**: All DNS queries from the jailed process receive a dummy response (6.6.6.6), never reaching public resolvers
+2. **Blocked HTTP Traffic**: Requests to denied domains are rejected without any DNS resolution
+3. **Allowed HTTP Traffic**: Only when rules permit, the server performs actual DNS resolution and forwards the request
+
 ## Prerequisites
 
 ### Linux

src/jail/linux/dns.rs

@@ -0,0 +1,184 @@
+use anyhow::{Context, Result};
+use simple_dns::rdata::RData;
+use simple_dns::{CLASS, Packet, PacketFlag, ResourceRecord};
+use std::net::{Ipv4Addr, UdpSocket};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::Duration;
+use tracing::{debug, error, info, warn};
+
+const DUMMY_IPV4: Ipv4Addr = Ipv4Addr::new(6, 6, 6, 6);
+const MAX_DNS_PACKET_SIZE: usize = 512;
+
+pub struct DummyDnsServer {
+ socket: Option<UdpSocket>,
+ shutdown: Arc<AtomicBool>,
+ thread_handle: Option<thread::JoinHandle<()>>,
+}
+
+impl DummyDnsServer {
+ pub fn new() -> Self {
+ Self {
+ socket: None,
+ shutdown: Arc::new(AtomicBool::new(false)),
+ thread_handle: None,
+ }
+ }
+
+ pub fn start(&mut self, bind_addr: &str) -> Result<()> {
+ let socket = UdpSocket::bind(bind_addr)
+ .with_context(|| format!("Failed to bind DNS server to {}", bind_addr))?;
+
+ socket.set_read_timeout(Some(Duration::from_millis(100)))?;
+
+ info!("Starting dummy DNS server on {}", bind_addr);
+
+ let socket_clone = socket.try_clone()?;
+ let shutdown_clone = self.shutdown.clone();
+
+ let thread_handle = thread::spawn(move || {
+ if let Err(e) = run_dns_server(socket_clone, shutdown_clone) {
+ error!("DNS server error: {}", e);
+ }
+ });
+
+ self.socket = Some(socket);
+ self.thread_handle = Some(thread_handle);
+
+ Ok(())
+ }
+
+ pub fn stop(&mut self) {
+ debug!("Stopping dummy DNS server");
+ self.shutdown.store(true, Ordering::Relaxed);
+
+ if let Some(handle) = self.thread_handle.take() {
+ let _ = handle.join();
+ }
+
+ self.socket = None;
+ }
+}
+
+impl Drop for DummyDnsServer {
+ fn drop(&mut self) {
+ self.stop();
+ }
+}
+
+fn run_dns_server(socket: UdpSocket, shutdown: Arc<AtomicBool>) -> Result<()> {
+ let mut buf = [0u8; MAX_DNS_PACKET_SIZE];
+
+ while !shutdown.load(Ordering::Relaxed) {
+ match socket.recv_from(&mut buf) {
+ Ok((size, src)) => {
+ debug!("Received DNS query from {}: {} bytes", src, size);
+
+ // Parse the DNS query using simple-dns
+ match Packet::parse(&buf[..size]) {
+ Ok(query) => {
+ if let Ok(response) = build_dummy_response(query) {
+ if let Err(e) = socket.send_to(&response, src) {
+ warn!("Failed to send DNS response to {}: {}", src, e);
+ } else {
+ debug!("Sent dummy DNS response to {}", src);
+ }
+ }
+ }
+ Err(e) => {
+ debug!("Failed to parse DNS query: {}", e);
+ }
+ }
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {
+ continue;
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::TimedOut => {
+ continue;
+ }
+ Err(e) => {
+ if !shutdown.load(Ordering::Relaxed) {
+ error!("DNS server receive error: {}", e);
+ }
+ break;
+ }
+ }
+ }
+
+ Ok(())
+}
+
+fn build_dummy_response(query: Packet<'_>) -> Result<Vec<u8>> {
+ // Create a response packet based on the query
+ let mut response = Packet::new_reply(query.id());
+
+ // Set standard response flags
+ response.set_flags(PacketFlag::RESPONSE | PacketFlag::RECURSION_AVAILABLE);
+
+ // Copy all questions from the query to the response
+ for question in &query.questions {
+ response.questions.push(question.clone());
+ }
+
+ // For each question, add a dummy A record response
+ for question in &query.questions {
+ // Only respond to A record queries (TYPE 1)
+ // But we'll respond to all queries with an A record anyway
+ // to prevent any DNS exfiltration attempts
+ let answer = ResourceRecord::new(
+ question.qname.clone(),
+ CLASS::IN,
+ 60, // TTL in seconds
+ RData::A(DUMMY_IPV4.into()),
+ );
+ response.answers.push(answer);
+ }
+
+ // Build the response packet into bytes
+ response
+ .build_bytes_vec()
+ .map_err(|e| anyhow::anyhow!("Failed to build DNS response: {}", e))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use simple_dns::{Name, Question, TYPE};
+
+ #[test]
+ fn test_dns_response_builder() {
+ // Create a test query using simple-dns
+ let mut query = Packet::new_query(0x1234);
+ let qname = Name::new("google.com").unwrap();
+ query.questions.push(Question::new(
+ qname.clone(),
+ TYPE::A.into(),
+ CLASS::IN.into(),
+ false,
+ ));
+
+ // Build the response
+ let response_packet = build_dummy_response(query.clone()).unwrap();
+
+ // Parse the response back
+ let response = Packet::parse(&response_packet).unwrap();
+
+ // Verify the response
+ assert_eq!(response.id(), 0x1234);
+ assert!(response.has_flags(PacketFlag::RESPONSE));
+ assert_eq!(response.questions.len(), 1);
+ assert_eq!(response.answers.len(), 1);
+
+ // Check that the answer contains our dummy IP
+ if let Some(answer) = response.answers.first() {
+ if let RData::A(ip) = &answer.rdata {
+ assert_eq!(Ipv4Addr::from(ip.address), DUMMY_IPV4);
+ } else {
+ panic!("Expected A record in response");
+ }
+ } else {
+ panic!("No answer in response");
+ }
+ }
+}

src/jail/linux/docker.rs

@@ -284,6 +284,7 @@ impl DockerLinux {
  &["-e", "-v", "-p", "--name", "--entrypoint", "-w", "--user"];
 
  /// Build the docker command with isolated network
+ #[allow(clippy::collapsible_if)]
  fn build_docker_command(
  &self,
  docker_args: &[String],

.github/workflows/tests.yml

@@ -6,6 +6,7 @@ on:
  - main
  pull_request:
  workflow_call:
+ workflow_dispatch:
 
 env:
  CARGO_TERM_COLOR: always

Cargo.toml

@@ -38,6 +38,7 @@ filetime = "0.2"
 ctrlc = "3.4"
 url = "2.5"
 v8 = "129"
+simple-dns = "0.7"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 libc = "0.2"

README.md

@@ -20,6 +20,7 @@ Or download a pre-built binary from the [releases page](https://github.com/coder
 
 - 🔒 **Process-level network isolation** - Isolate processes in restricted network environments
 - 🌐 **HTTP/HTTPS interception** - Transparent proxy with TLS certificate injection
+- 🛡️ **DNS exfiltration protection** - Prevents data leakage through DNS queries
 - 🔧 **Script-based evaluation** - Custom request evaluation logic via external scripts
 - 🚀 **JavaScript evaluation** - Fast, secure request filtering using V8 JavaScript engine
 - 📝 **Request logging** - Monitor and log all HTTP/HTTPS requests
@@ -70,7 +71,7 @@ httpjail creates an isolated network environment for the target process, interce
 ├─────────────────────────────────────────────────┤
 │ 1. Create network namespace │
 │ 2. Setup nftables rules │
-│ 3. Start embedded proxy  │
+│ 3. Start embedded proxy + DNS server │
 │ 4. Export CA trust env vars │
 │ 5. Execute target process in namespace │
 └─────────────────────────────────────────────────┘
@@ -79,6 +80,7 @@ httpjail creates an isolated network environment for the target process, interce
 │ Target Process │
 │ • Isolated in network namespace │
 │ • All HTTP/HTTPS → local proxy │
+│ • All DNS queries → dummy resolver (6.6.6.6) │
 │ • CA cert trusted via env vars │
 └─────────────────────────────────────────────────┘
 ```
@@ -114,6 +116,50 @@ httpjail creates an isolated network environment for the target process, interce
 | Sudo required | ⚠️ Yes | ✅ No | 🚧 |
 | Force all traffic | ✅ Yes | ❌ No (apps must cooperate) | 🚧 |
 
+## DNS Exfiltration Protection
+
+httpjail includes built-in protection against DNS exfiltration attacks. In isolated environments (Linux strong mode), all DNS queries are intercepted and answered with a dummy response (6.6.6.6), preventing data leakage through DNS subdomain encoding.
+
+**Attack Prevention**: Without this protection, malicious code could exfiltrate sensitive data (environment variables, secrets, etc.) by encoding it in DNS queries like `secret-data.attacker.com`. Our dummy DNS server ensures:
+
+1. All DNS queries receive the same response (6.6.6.6)
+2. External DNS servers (1.1.1.1, 8.8.8.8) cannot be reached
+3. HTTP/HTTPS traffic still works as it's redirected through our proxy
+4. No actual DNS resolution occurs, preventing data leakage
+
+This approach blocks DNS tunneling while maintaining full HTTP/HTTPS functionality through transparent proxy redirection.
+
+```mermaid
+sequenceDiagram
+ participant J as Jailed Process
+ participant S as Jail Server
+ participant D as Public DNS Resolvers
+
+ Note over J,D: DNS Exfiltration Attempt
+ J->>S: DNS Query: secret-data.attacker.com
+ S-->>J: Response: 6.6.6.6 (dummy)
+ Note over S,D: ❌ Query never reaches public resolvers
+
+ Note over J,D: Blocked HTTP Flow
+ J->>S: HTTP GET http://blocked.com
+ Note over S: Rule evaluation: denied
+ S-->>J: 403 Forbidden
+ Note over S,D: ❌ No DNS resolution needed
+
+ Note over J,D: Allowed HTTP Flow
+ J->>S: HTTP GET http://example.com
+ Note over S: Rule evaluation: allowed
+ S->>D: DNS Query: example.com (only if needed)
+ D-->>S: Real IP address
+ S->>S: Forward to upstream server
+ S-->>J: HTTP response
+```
+
+The diagram illustrates three key scenarios:
+1. **DNS Exfiltration Prevention**: All DNS queries from the jailed process receive a dummy response (6.6.6.6), never reaching public resolvers
+2. **Blocked HTTP Traffic**: Requests to denied domains are rejected without any DNS resolution
+3. **Allowed HTTP Traffic**: Only when rules permit, the server performs actual DNS resolution and forwards the request
+
 ## Prerequisites
 
 ### Linux

src/jail/linux/dns.rs

@@ -0,0 +1,184 @@
+use anyhow::{Context, Result};
+use simple_dns::rdata::RData;
+use simple_dns::{CLASS, Packet, PacketFlag, ResourceRecord};
+use std::net::{Ipv4Addr, UdpSocket};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::Duration;
+use tracing::{debug, error, info, warn};
+
+const DUMMY_IPV4: Ipv4Addr = Ipv4Addr::new(6, 6, 6, 6);
+const MAX_DNS_PACKET_SIZE: usize = 512;
+
+pub struct DummyDnsServer {
+ socket: Option<UdpSocket>,
+ shutdown: Arc<AtomicBool>,
+ thread_handle: Option<thread::JoinHandle<()>>,
+}
+
+impl DummyDnsServer {
+ pub fn new() -> Self {
+ Self {
+ socket: None,
+ shutdown: Arc::new(AtomicBool::new(false)),
+ thread_handle: None,
+ }
+ }
+
+ pub fn start(&mut self, bind_addr: &str) -> Result<()> {
+ let socket = UdpSocket::bind(bind_addr)
+ .with_context(|| format!("Failed to bind DNS server to {}", bind_addr))?;
+
+ socket.set_read_timeout(Some(Duration::from_millis(100)))?;
+
+ info!("Starting dummy DNS server on {}", bind_addr);
+
+ let socket_clone = socket.try_clone()?;
+ let shutdown_clone = self.shutdown.clone();
+
+ let thread_handle = thread::spawn(move || {
+ if let Err(e) = run_dns_server(socket_clone, shutdown_clone) {
+ error!("DNS server error: {}", e);
+ }
+ });
+
+ self.socket = Some(socket);
+ self.thread_handle = Some(thread_handle);
+
+ Ok(())
+ }
+
+ pub fn stop(&mut self) {
+ debug!("Stopping dummy DNS server");
+ self.shutdown.store(true, Ordering::Relaxed);
+
+ if let Some(handle) = self.thread_handle.take() {
+ let _ = handle.join();
+ }
+
+ self.socket = None;
+ }
+}
+
+impl Drop for DummyDnsServer {
+ fn drop(&mut self) {
+ self.stop();
+ }
+}
+
+fn run_dns_server(socket: UdpSocket, shutdown: Arc<AtomicBool>) -> Result<()> {
+ let mut buf = [0u8; MAX_DNS_PACKET_SIZE];
+
+ while !shutdown.load(Ordering::Relaxed) {
+ match socket.recv_from(&mut buf) {
+ Ok((size, src)) => {
+ debug!("Received DNS query from {}: {} bytes", src, size);
+
+ // Parse the DNS query using simple-dns
+ match Packet::parse(&buf[..size]) {
+ Ok(query) => {
+ if let Ok(response) = build_dummy_response(query) {
+ if let Err(e) = socket.send_to(&response, src) {
+ warn!("Failed to send DNS response to {}: {}", src, e);
+ } else {
+ debug!("Sent dummy DNS response to {}", src);
+ }
+ }
+ }
+ Err(e) => {
+ debug!("Failed to parse DNS query: {}", e);
+ }
+ }
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {
+ continue;
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::TimedOut => {
+ continue;
+ }
+ Err(e) => {
+ if !shutdown.load(Ordering::Relaxed) {
+ error!("DNS server receive error: {}", e);
+ }
+ break;
+ }
+ }
+ }
+
+ Ok(())
+}
+
+fn build_dummy_response(query: Packet<'_>) -> Result<Vec<u8>> {
+ // Create a response packet based on the query
+ let mut response = Packet::new_reply(query.id());
+
+ // Set standard response flags
+ response.set_flags(PacketFlag::RESPONSE | PacketFlag::RECURSION_AVAILABLE);
+
+ // Copy all questions from the query to the response
+ for question in &query.questions {
+ response.questions.push(question.clone());
+ }
+
+ // For each question, add a dummy A record response
+ for question in &query.questions {
+ // Only respond to A record queries (TYPE 1)
+ // But we'll respond to all queries with an A record anyway
+ // to prevent any DNS exfiltration attempts
+ let answer = ResourceRecord::new(
+ question.qname.clone(),
+ CLASS::IN,
+ 60, // TTL in seconds
+ RData::A(DUMMY_IPV4.into()),
+ );
+ response.answers.push(answer);
+ }
+
+ // Build the response packet into bytes
+ response
+ .build_bytes_vec()
+ .map_err(|e| anyhow::anyhow!("Failed to build DNS response: {}", e))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use simple_dns::{Name, Question, TYPE};
+
+ #[test]
+ fn test_dns_response_builder() {
+ // Create a test query using simple-dns
+ let mut query = Packet::new_query(0x1234);
+ let qname = Name::new("google.com").unwrap();
+ query.questions.push(Question::new(
+ qname.clone(),
+ TYPE::A.into(),
+ CLASS::IN.into(),
+ false,
+ ));
+
+ // Build the response
+ let response_packet = build_dummy_response(query.clone()).unwrap();
+
+ // Parse the response back
+ let response = Packet::parse(&response_packet).unwrap();
+
+ // Verify the response
+ assert_eq!(response.id(), 0x1234);
+ assert!(response.has_flags(PacketFlag::RESPONSE));
+ assert_eq!(response.questions.len(), 1);
+ assert_eq!(response.answers.len(), 1);
+
+ // Check that the answer contains our dummy IP
+ if let Some(answer) = response.answers.first() {
+ if let RData::A(ip) = &answer.rdata {
+ assert_eq!(Ipv4Addr::from(ip.address), DUMMY_IPV4);
+ } else {
+ panic!("Expected A record in response");
+ }
+ } else {
+ panic!("No answer in response");
+ }
+ }
+}

src/jail/linux/docker.rs

@@ -284,6 +284,7 @@ impl DockerLinux {
  &["-e", "-v", "-p", "--name", "--entrypoint", "-w", "--user"];
 
  /// Build the docker command with isolated network
+ #[allow(clippy::collapsible_if)]
  fn build_docker_command(
  &self,
  docker_args: &[String],

.github/workflows/tests.yml

@@ -6,6 +6,7 @@ on:
  - main
  pull_request:
  workflow_call:
+ workflow_dispatch:
 
 env:
  CARGO_TERM_COLOR: always

Cargo.toml

@@ -38,6 +38,7 @@ filetime = "0.2"
 ctrlc = "3.4"
 url = "2.5"
 v8 = "129"
+simple-dns = "0.7"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 libc = "0.2"

README.md

@@ -20,6 +20,7 @@ Or download a pre-built binary from the [releases page](https://github.com/coder
 
 - 🔒 **Process-level network isolation** - Isolate processes in restricted network environments
 - 🌐 **HTTP/HTTPS interception** - Transparent proxy with TLS certificate injection
+- 🛡️ **DNS exfiltration protection** - Prevents data leakage through DNS queries
 - 🔧 **Script-based evaluation** - Custom request evaluation logic via external scripts
 - 🚀 **JavaScript evaluation** - Fast, secure request filtering using V8 JavaScript engine
 - 📝 **Request logging** - Monitor and log all HTTP/HTTPS requests
@@ -70,7 +71,7 @@ httpjail creates an isolated network environment for the target process, interce
 ├─────────────────────────────────────────────────┤
 │ 1. Create network namespace │
 │ 2. Setup nftables rules │
-│ 3. Start embedded proxy  │
+│ 3. Start embedded proxy + DNS server │
 │ 4. Export CA trust env vars │
 │ 5. Execute target process in namespace │
 └─────────────────────────────────────────────────┘
@@ -79,6 +80,7 @@ httpjail creates an isolated network environment for the target process, interce
 │ Target Process │
 │ • Isolated in network namespace │
 │ • All HTTP/HTTPS → local proxy │
+│ • All DNS queries → dummy resolver (6.6.6.6) │
 │ • CA cert trusted via env vars │
 └─────────────────────────────────────────────────┘
 ```
@@ -114,6 +116,50 @@ httpjail creates an isolated network environment for the target process, interce
 | Sudo required | ⚠️ Yes | ✅ No | 🚧 |
 | Force all traffic | ✅ Yes | ❌ No (apps must cooperate) | 🚧 |
 
+## DNS Exfiltration Protection
+
+httpjail includes built-in protection against DNS exfiltration attacks. In isolated environments (Linux strong mode), all DNS queries are intercepted and answered with a dummy response (6.6.6.6), preventing data leakage through DNS subdomain encoding.
+
+**Attack Prevention**: Without this protection, malicious code could exfiltrate sensitive data (environment variables, secrets, etc.) by encoding it in DNS queries like `secret-data.attacker.com`. Our dummy DNS server ensures:
+
+1. All DNS queries receive the same response (6.6.6.6)
+2. External DNS servers (1.1.1.1, 8.8.8.8) cannot be reached
+3. HTTP/HTTPS traffic still works as it's redirected through our proxy
+4. No actual DNS resolution occurs, preventing data leakage
+
+This approach blocks DNS tunneling while maintaining full HTTP/HTTPS functionality through transparent proxy redirection.
+
+```mermaid
+sequenceDiagram
+ participant J as Jailed Process
+ participant S as Jail Server
+ participant D as Public DNS Resolvers
+
+ Note over J,D: DNS Exfiltration Attempt
+ J->>S: DNS Query: secret-data.attacker.com
+ S-->>J: Response: 6.6.6.6 (dummy)
+ Note over S,D: ❌ Query never reaches public resolvers
+
+ Note over J,D: Blocked HTTP Flow
+ J->>S: HTTP GET http://blocked.com
+ Note over S: Rule evaluation: denied
+ S-->>J: 403 Forbidden
+ Note over S,D: ❌ No DNS resolution needed
+
+ Note over J,D: Allowed HTTP Flow
+ J->>S: HTTP GET http://example.com
+ Note over S: Rule evaluation: allowed
+ S->>D: DNS Query: example.com (only if needed)
+ D-->>S: Real IP address
+ S->>S: Forward to upstream server
+ S-->>J: HTTP response
+```
+
+The diagram illustrates three key scenarios:
+1. **DNS Exfiltration Prevention**: All DNS queries from the jailed process receive a dummy response (6.6.6.6), never reaching public resolvers
+2. **Blocked HTTP Traffic**: Requests to denied domains are rejected without any DNS resolution
+3. **Allowed HTTP Traffic**: Only when rules permit, the server performs actual DNS resolution and forwards the request
+
 ## Prerequisites
 
 ### Linux

src/jail/linux/dns.rs

@@ -0,0 +1,184 @@
+use anyhow::{Context, Result};
+use simple_dns::rdata::RData;
+use simple_dns::{CLASS, Packet, PacketFlag, ResourceRecord};
+use std::net::{Ipv4Addr, UdpSocket};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::Duration;
+use tracing::{debug, error, info, warn};
+
+const DUMMY_IPV4: Ipv4Addr = Ipv4Addr::new(6, 6, 6, 6);
+const MAX_DNS_PACKET_SIZE: usize = 512;
+
+pub struct DummyDnsServer {
+ socket: Option<UdpSocket>,
+ shutdown: Arc<AtomicBool>,
+ thread_handle: Option<thread::JoinHandle<()>>,
+}
+
+impl DummyDnsServer {
+ pub fn new() -> Self {
+ Self {
+ socket: None,
+ shutdown: Arc::new(AtomicBool::new(false)),
+ thread_handle: None,
+ }
+ }
+
+ pub fn start(&mut self, bind_addr: &str) -> Result<()> {
+ let socket = UdpSocket::bind(bind_addr)
+ .with_context(|| format!("Failed to bind DNS server to {}", bind_addr))?;
+
+ socket.set_read_timeout(Some(Duration::from_millis(100)))?;
+
+ info!("Starting dummy DNS server on {}", bind_addr);
+
+ let socket_clone = socket.try_clone()?;
+ let shutdown_clone = self.shutdown.clone();
+
+ let thread_handle = thread::spawn(move || {
+ if let Err(e) = run_dns_server(socket_clone, shutdown_clone) {
+ error!("DNS server error: {}", e);
+ }
+ });
+
+ self.socket = Some(socket);
+ self.thread_handle = Some(thread_handle);
+
+ Ok(())
+ }
+
+ pub fn stop(&mut self) {
+ debug!("Stopping dummy DNS server");
+ self.shutdown.store(true, Ordering::Relaxed);
+
+ if let Some(handle) = self.thread_handle.take() {
+ let _ = handle.join();
+ }
+
+ self.socket = None;
+ }
+}
+
+impl Drop for DummyDnsServer {
+ fn drop(&mut self) {
+ self.stop();
+ }
+}
+
+fn run_dns_server(socket: UdpSocket, shutdown: Arc<AtomicBool>) -> Result<()> {
+ let mut buf = [0u8; MAX_DNS_PACKET_SIZE];
+
+ while !shutdown.load(Ordering::Relaxed) {
+ match socket.recv_from(&mut buf) {
+ Ok((size, src)) => {
+ debug!("Received DNS query from {}: {} bytes", src, size);
+
+ // Parse the DNS query using simple-dns
+ match Packet::parse(&buf[..size]) {
+ Ok(query) => {
+ if let Ok(response) = build_dummy_response(query) {
+ if let Err(e) = socket.send_to(&response, src) {
+ warn!("Failed to send DNS response to {}: {}", src, e);
+ } else {
+ debug!("Sent dummy DNS response to {}", src);
+ }
+ }
+ }
+ Err(e) => {
+ debug!("Failed to parse DNS query: {}", e);
+ }
+ }
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {
+ continue;
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::TimedOut => {
+ continue;
+ }
+ Err(e) => {
+ if !shutdown.load(Ordering::Relaxed) {
+ error!("DNS server receive error: {}", e);
+ }
+ break;
+ }
+ }
+ }
+
+ Ok(())
+}
+
+fn build_dummy_response(query: Packet<'_>) -> Result<Vec<u8>> {
+ // Create a response packet based on the query
+ let mut response = Packet::new_reply(query.id());
+
+ // Set standard response flags
+ response.set_flags(PacketFlag::RESPONSE | PacketFlag::RECURSION_AVAILABLE);
+
+ // Copy all questions from the query to the response
+ for question in &query.questions {
+ response.questions.push(question.clone());
+ }
+
+ // For each question, add a dummy A record response
+ for question in &query.questions {
+ // Only respond to A record queries (TYPE 1)
+ // But we'll respond to all queries with an A record anyway
+ // to prevent any DNS exfiltration attempts
+ let answer = ResourceRecord::new(
+ question.qname.clone(),
+ CLASS::IN,
+ 60, // TTL in seconds
+ RData::A(DUMMY_IPV4.into()),
+ );
+ response.answers.push(answer);
+ }
+
+ // Build the response packet into bytes
+ response
+ .build_bytes_vec()
+ .map_err(|e| anyhow::anyhow!("Failed to build DNS response: {}", e))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use simple_dns::{Name, Question, TYPE};
+
+ #[test]
+ fn test_dns_response_builder() {
+ // Create a test query using simple-dns
+ let mut query = Packet::new_query(0x1234);
+ let qname = Name::new("google.com").unwrap();
+ query.questions.push(Question::new(
+ qname.clone(),
+ TYPE::A.into(),
+ CLASS::IN.into(),
+ false,
+ ));
+
+ // Build the response
+ let response_packet = build_dummy_response(query.clone()).unwrap();
+
+ // Parse the response back
+ let response = Packet::parse(&response_packet).unwrap();
+
+ // Verify the response
+ assert_eq!(response.id(), 0x1234);
+ assert!(response.has_flags(PacketFlag::RESPONSE));
+ assert_eq!(response.questions.len(), 1);
+ assert_eq!(response.answers.len(), 1);
+
+ // Check that the answer contains our dummy IP
+ if let Some(answer) = response.answers.first() {
+ if let RData::A(ip) = &answer.rdata {
+ assert_eq!(Ipv4Addr::from(ip.address), DUMMY_IPV4);
+ } else {
+ panic!("Expected A record in response");
+ }
+ } else {
+ panic!("No answer in response");
+ }
+ }
+}

src/jail/linux/docker.rs

@@ -284,6 +284,7 @@ impl DockerLinux {
  &["-e", "-v", "-p", "--name", "--entrypoint", "-w", "--user"];
 
  /// Build the docker command with isolated network
+ #[allow(clippy::collapsible_if)]
  fn build_docker_command(
  &self,
  docker_args: &[String],

.github/workflows/tests.yml

@@ -6,6 +6,7 @@ on:
  - main
  pull_request:
  workflow_call:
+ workflow_dispatch:
 
 env:
  CARGO_TERM_COLOR: always

Cargo.toml

@@ -38,6 +38,7 @@ filetime = "0.2"
 ctrlc = "3.4"
 url = "2.5"
 v8 = "129"
+simple-dns = "0.7"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 libc = "0.2"

README.md

@@ -20,6 +20,7 @@ Or download a pre-built binary from the [releases page](https://github.com/coder
 
 - 🔒 **Process-level network isolation** - Isolate processes in restricted network environments
 - 🌐 **HTTP/HTTPS interception** - Transparent proxy with TLS certificate injection
+- 🛡️ **DNS exfiltration protection** - Prevents data leakage through DNS queries
 - 🔧 **Script-based evaluation** - Custom request evaluation logic via external scripts
 - 🚀 **JavaScript evaluation** - Fast, secure request filtering using V8 JavaScript engine
 - 📝 **Request logging** - Monitor and log all HTTP/HTTPS requests
@@ -70,7 +71,7 @@ httpjail creates an isolated network environment for the target process, interce
 ├─────────────────────────────────────────────────┤
 │ 1. Create network namespace │
 │ 2. Setup nftables rules │
-│ 3. Start embedded proxy  │
+│ 3. Start embedded proxy + DNS server │
 │ 4. Export CA trust env vars │
 │ 5. Execute target process in namespace │
 └─────────────────────────────────────────────────┘
@@ -79,6 +80,7 @@ httpjail creates an isolated network environment for the target process, interce
 │ Target Process │
 │ • Isolated in network namespace │
 │ • All HTTP/HTTPS → local proxy │
+│ • All DNS queries → dummy resolver (6.6.6.6) │
 │ • CA cert trusted via env vars │
 └─────────────────────────────────────────────────┘
 ```
@@ -114,6 +116,50 @@ httpjail creates an isolated network environment for the target process, interce
 | Sudo required | ⚠️ Yes | ✅ No | 🚧 |
 | Force all traffic | ✅ Yes | ❌ No (apps must cooperate) | 🚧 |
 
+## DNS Exfiltration Protection
+
+httpjail includes built-in protection against DNS exfiltration attacks. In isolated environments (Linux strong mode), all DNS queries are intercepted and answered with a dummy response (6.6.6.6), preventing data leakage through DNS subdomain encoding.
+
+**Attack Prevention**: Without this protection, malicious code could exfiltrate sensitive data (environment variables, secrets, etc.) by encoding it in DNS queries like `secret-data.attacker.com`. Our dummy DNS server ensures:
+
+1. All DNS queries receive the same response (6.6.6.6)
+2. External DNS servers (1.1.1.1, 8.8.8.8) cannot be reached
+3. HTTP/HTTPS traffic still works as it's redirected through our proxy
+4. No actual DNS resolution occurs, preventing data leakage
+
+This approach blocks DNS tunneling while maintaining full HTTP/HTTPS functionality through transparent proxy redirection.
+
+```mermaid
+sequenceDiagram
+ participant J as Jailed Process
+ participant S as Jail Server
+ participant D as Public DNS Resolvers
+
+ Note over J,D: DNS Exfiltration Attempt
+ J->>S: DNS Query: secret-data.attacker.com
+ S-->>J: Response: 6.6.6.6 (dummy)
+ Note over S,D: ❌ Query never reaches public resolvers
+
+ Note over J,D: Blocked HTTP Flow
+ J->>S: HTTP GET http://blocked.com
+ Note over S: Rule evaluation: denied
+ S-->>J: 403 Forbidden
+ Note over S,D: ❌ No DNS resolution needed
+
+ Note over J,D: Allowed HTTP Flow
+ J->>S: HTTP GET http://example.com
+ Note over S: Rule evaluation: allowed
+ S->>D: DNS Query: example.com (only if needed)
+ D-->>S: Real IP address
+ S->>S: Forward to upstream server
+ S-->>J: HTTP response
+```
+
+The diagram illustrates three key scenarios:
+1. **DNS Exfiltration Prevention**: All DNS queries from the jailed process receive a dummy response (6.6.6.6), never reaching public resolvers
+2. **Blocked HTTP Traffic**: Requests to denied domains are rejected without any DNS resolution
+3. **Allowed HTTP Traffic**: Only when rules permit, the server performs actual DNS resolution and forwards the request
+
 ## Prerequisites
 
 ### Linux

src/jail/linux/dns.rs

@@ -0,0 +1,184 @@
+use anyhow::{Context, Result};
+use simple_dns::rdata::RData;
+use simple_dns::{CLASS, Packet, PacketFlag, ResourceRecord};
+use std::net::{Ipv4Addr, UdpSocket};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::Duration;
+use tracing::{debug, error, info, warn};
+
+const DUMMY_IPV4: Ipv4Addr = Ipv4Addr::new(6, 6, 6, 6);
+const MAX_DNS_PACKET_SIZE: usize = 512;
+
+pub struct DummyDnsServer {
+ socket: Option<UdpSocket>,
+ shutdown: Arc<AtomicBool>,
+ thread_handle: Option<thread::JoinHandle<()>>,
+}
+
+impl DummyDnsServer {
+ pub fn new() -> Self {
+ Self {
+ socket: None,
+ shutdown: Arc::new(AtomicBool::new(false)),
+ thread_handle: None,
+ }
+ }
+
+ pub fn start(&mut self, bind_addr: &str) -> Result<()> {
+ let socket = UdpSocket::bind(bind_addr)
+ .with_context(|| format!("Failed to bind DNS server to {}", bind_addr))?;
+
+ socket.set_read_timeout(Some(Duration::from_millis(100)))?;
+
+ info!("Starting dummy DNS server on {}", bind_addr);
+
+ let socket_clone = socket.try_clone()?;
+ let shutdown_clone = self.shutdown.clone();
+
+ let thread_handle = thread::spawn(move || {
+ if let Err(e) = run_dns_server(socket_clone, shutdown_clone) {
+ error!("DNS server error: {}", e);
+ }
+ });
+
+ self.socket = Some(socket);
+ self.thread_handle = Some(thread_handle);
+
+ Ok(())
+ }
+
+ pub fn stop(&mut self) {
+ debug!("Stopping dummy DNS server");
+ self.shutdown.store(true, Ordering::Relaxed);
+
+ if let Some(handle) = self.thread_handle.take() {
+ let _ = handle.join();
+ }
+
+ self.socket = None;
+ }
+}
+
+impl Drop for DummyDnsServer {
+ fn drop(&mut self) {
+ self.stop();
+ }
+}
+
+fn run_dns_server(socket: UdpSocket, shutdown: Arc<AtomicBool>) -> Result<()> {
+ let mut buf = [0u8; MAX_DNS_PACKET_SIZE];
+
+ while !shutdown.load(Ordering::Relaxed) {
+ match socket.recv_from(&mut buf) {
+ Ok((size, src)) => {
+ debug!("Received DNS query from {}: {} bytes", src, size);
+
+ // Parse the DNS query using simple-dns
+ match Packet::parse(&buf[..size]) {
+ Ok(query) => {
+ if let Ok(response) = build_dummy_response(query) {
+ if let Err(e) = socket.send_to(&response, src) {
+ warn!("Failed to send DNS response to {}: {}", src, e);
+ } else {
+ debug!("Sent dummy DNS response to {}", src);
+ }
+ }
+ }
+ Err(e) => {
+ debug!("Failed to parse DNS query: {}", e);
+ }
+ }
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::WouldBlock => {
+ continue;
+ }
+ Err(e) if e.kind() == std::io::ErrorKind::TimedOut => {
+ continue;
+ }
+ Err(e) => {
+ if !shutdown.load(Ordering::Relaxed) {
+ error!("DNS server receive error: {}", e);
+ }
+ break;
+ }
+ }
+ }
+
+ Ok(())
+}
+
+fn build_dummy_response(query: Packet<'_>) -> Result<Vec<u8>> {
+ // Create a response packet based on the query
+ let mut response = Packet::new_reply(query.id());
+
+ // Set standard response flags
+ response.set_flags(PacketFlag::RESPONSE | PacketFlag::RECURSION_AVAILABLE);
+
+ // Copy all questions from the query to the response
+ for question in &query.questions {
+ response.questions.push(question.clone());
+ }
+
+ // For each question, add a dummy A record response
+ for question in &query.questions {
+ // Only respond to A record queries (TYPE 1)
+ // But we'll respond to all queries with an A record anyway
+ // to prevent any DNS exfiltration attempts
+ let answer = ResourceRecord::new(
+ question.qname.clone(),
+ CLASS::IN,
+ 60, // TTL in seconds
+ RData::A(DUMMY_IPV4.into()),
+ );
+ response.answers.push(answer);
+ }
+
+ // Build the response packet into bytes
+ response
+ .build_bytes_vec()
+ .map_err(|e| anyhow::anyhow!("Failed to build DNS response: {}", e))
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use simple_dns::{Name, Question, TYPE};
+
+ #[test]
+ fn test_dns_response_builder() {
+ // Create a test query using simple-dns
+ let mut query = Packet::new_query(0x1234);
+ let qname = Name::new("google.com").unwrap();
+ query.questions.push(Question::new(
+ qname.clone(),
+ TYPE::A.into(),
+ CLASS::IN.into(),
+ false,
+ ));
+
+ // Build the response
+ let response_packet = build_dummy_response(query.clone()).unwrap();
+
+ // Parse the response back
+ let response = Packet::parse(&response_packet).unwrap();
+
+ // Verify the response
+ assert_eq!(response.id(), 0x1234);
+ assert!(response.has_flags(PacketFlag::RESPONSE));
+ assert_eq!(response.questions.len(), 1);
+ assert_eq!(response.answers.len(), 1);
+
+ // Check that the answer contains our dummy IP
+ if let Some(answer) = response.answers.first() {
+ if let RData::A(ip) = &answer.rdata {
+ assert_eq!(Ipv4Addr::from(ip.address), DUMMY_IPV4);
+ } else {
+ panic!("Expected A record in response");
+ }
+ } else {
+ panic!("No answer in response");
+ }
+ }
+}

src/jail/linux/docker.rs

@@ -284,6 +284,7 @@ impl DockerLinux {
  &["-e", "-v", "-p", "--name", "--entrypoint", "-w", "--user"];
 
  /// Build the docker command with isolated network
+ #[allow(clippy::collapsible_if)]
  fn build_docker_command(
  &self,
  docker_args: &[String],