feat: dynamic ingress control for running sandboxes

packages/api/internal/handlers/sandbox_create.go

@@ -44,8 +44,8 @@ const (
 	metricTemplateAlias         = metrics.MetricPrefix + "template.alias"
 	minEnvdVersionForSecureFlag = "0.2.0" // Minimum version of envd that supports secure flag
 
-	// Network validation error messages
-	ErrMsgDomainsRequireBlockAll = "When specifying allowed domains in allow out, you must include 'ALL_TRAFFIC' in deny out to block all other traffic."
+	ErrMsgDomainsRequireBlockAll  = "When specifying allowed domains in allow out, you must include 'ALL_TRAFFIC' in deny out to block all other traffic."
+	ErrMsgAllowInRequiresBlockAll = "When specifying allowed sources in allow in, you must include 'ALL_TRAFFIC' (0.0.0.0/0) in deny in to block all other traffic."
 )
 
 func (a *APIStore) PostSandboxes(c *gin.Context) {
@@ -174,6 +174,8 @@ func (a *APIStore) PostSandboxes(c *gin.Context) {
 			Ingress: &types.SandboxNetworkIngressConfig{
 				AllowPublicAccess: n.AllowPublicTraffic,
 				MaskRequestHost:   n.MaskRequestHost,
+				AllowedAddresses:  sharedUtils.DerefOrDefault(n.AllowIn, nil),
+				DeniedAddresses:   sharedUtils.DerefOrDefault(n.DenyIn, nil),
 			},
 			Egress: &types.SandboxNetworkEgressConfig{
 				AllowedAddresses: sharedUtils.DerefOrDefault(n.AllowOut, nil),
@@ -532,44 +534,108 @@ func validateNetworkConfig(network *api.SandboxNetworkConfig) *api.APIError {
 	denyOut := sharedUtils.DerefOrDefault(network.DenyOut, nil)
 	allowOut := sharedUtils.DerefOrDefault(network.AllowOut, nil)
 
-	return validateEgressRules(allowOut, denyOut)
+	if apiErr := validateEgressRules(allowOut, denyOut); apiErr != nil {
+		return apiErr
+	}
+
+	denyIn := sharedUtils.DerefOrDefault(network.DenyIn, nil)
+	allowIn := sharedUtils.DerefOrDefault(network.AllowIn, nil)
+
+	return validateIngressRules(allowIn, denyIn)
+}
+
+func badRequest(err error, format string, args ...any) *api.APIError {
+	s := fmt.Sprintf(format, args...)
+	if err != nil {
+		s = fmt.Sprintf("%s: %s", s, err.Error())
+		err = fmt.Errorf("%s: %w", s, err)
+	}
+
+	return &api.APIError{Code: http.StatusBadRequest, Err: err, ClientMsg: s}
 }
 
 // validateEgressRules validates egress allow/deny rules:
-// - denyOut entries must be valid IPs or CIDRs (not domains)
-// - allowOut entries must be valid IPs, CIDRs, or domain names
+// - denyOut entries must be specified IPs or CIDRs (not domains)
+// - allowOut entries can be specified IPs, CIDRs, or domain names
 // - when allowOut contains domains, denyOut must include 0.0.0.0/0
 func validateEgressRules(allowOut, denyOut []string) *api.APIError {
-	for _, cidr := range denyOut {
-		if !sandbox_network.IsSpecifiedIPOrCIDR(cidr) {
-			return &api.APIError{
-				Code:      http.StatusBadRequest,
-				Err:       fmt.Errorf("invalid denied CIDR %s", cidr),
-				ClientMsg: fmt.Sprintf("invalid denied CIDR %s", cidr),
-			}
+	for _, entry := range denyOut {
+		host, port, _ := sandbox_network.SplitHostPort(entry)
+		if port != "" {
+			return badRequest(nil, "invalid deny out entry %q: port-specific rules are not supported for egress", entry)
+		}
+
+		if !sandbox_network.IsSpecifiedIPOrCIDR(host) {
+			return badRequest(nil, "invalid denied CIDR %s", host)
 		}
 	}
 
-	if len(allowOut) > 0 {
-		allowedAddresses, allowedDomains := sandbox_network.ParseAddressesAndDomains(allowOut)
+	hasDomains := false
+	for _, entry := range allowOut {
+		host, port, _ := sandbox_network.SplitHostPort(entry)
+		if port != "" {
+			return badRequest(nil, "invalid allow out entry %q: port-specific rules are not supported for egress", entry)
+		}
 
-		for _, addr := range allowedAddresses {
-			if !sandbox_network.IsSpecifiedIPOrCIDR(addr) {
-				return &api.APIError{
-					Code:      http.StatusBadRequest,
-					Err:       fmt.Errorf("invalid allowed address %s", addr),
-					ClientMsg: fmt.Sprintf("invalid allowed address %s", addr),
-				}
+		if sandbox_network.IsIPOrCIDR(host) {
+			if !sandbox_network.IsSpecifiedIPOrCIDR(host) {
+				return badRequest(nil, "invalid allowed address %s", host)
 			}
+		} else {
+			hasDomains = true
 		}
-		hasBlockAll := slices.Contains(denyOut, sandbox_network.AllInternetTrafficCIDR)
+	}
 
-		if len(allowedDomains) > 0 && !hasBlockAll {
-			return &api.APIError{
-				Code:      http.StatusBadRequest,
-				Err:       fmt.Errorf("allow out contains domains but deny out is missing 0.0.0.0/0 (ALL_TRAFFIC)"),
-				ClientMsg: ErrMsgDomainsRequireBlockAll,
-			}
+	hasBlockAll := slices.Contains(denyOut, sandbox_network.AllInternetTrafficCIDR)
+	if hasDomains && !hasBlockAll {
+		return badRequest(nil, ErrMsgDomainsRequireBlockAll)
+	}
+
+	return nil
+}
+
+// validateIngressRules validates ingress allow/deny rules:
+// - entries must be valid IPv4 or CIDR with optional port/port-range (no domains)
+// - when allowIn is set, denyIn must include 0.0.0.0/0
+func validateIngressRules(allowIn, denyIn []string) *api.APIError {
+	for _, entry := range denyIn {
+		if err := validateIngressEntry(entry); err != nil {
+			return badRequest(err, "invalid deny in entry %q", entry)
+		}
+	}
+
+	for _, entry := range allowIn {
+		if err := validateIngressEntry(entry); err != nil {
+			return badRequest(err, "invalid allow in entry %q", entry)
+		}
+	}
+
+	hasBlockAll := slices.Contains(denyIn, sandbox_network.AllInternetTrafficCIDR)
+	if len(allowIn) > 0 && !hasBlockAll {
+		return badRequest(nil, ErrMsgAllowInRequiresBlockAll)
+	}
+
+	return nil
+}
+
+// validateIngressEntry validates a single ingress rule entry (CIDR[:port]).
+func validateIngressEntry(entry string) error {
+	host, portStr, err := sandbox_network.SplitHostPort(entry)
+	if err != nil {
+		return err
+	}
+
+	if !sandbox_network.IsIPOrCIDR(host) {
+		return fmt.Errorf("domains are not supported for ingress rules")
+	}
+
+	if !sandbox_network.IsSpecifiedIPOrCIDR(host) {
+		return fmt.Errorf("unspecified address")
+	}
+
+	if portStr != "" {
+		if _, _, err := sandbox_network.ParsePortRange(portStr); err != nil {
+			return err
 		}
 	}
 

packages/api/internal/handlers/sandbox_create_test.go

@@ -82,6 +82,26 @@ func TestValidateNetworkConfig(t *testing.T) {
 		wantCode   int
 		wantErrMsg string
 	}{
+		// Port syntax rejected for egress
+		{
+			name: "deny_out with port is rejected",
+			network: &api.SandboxNetworkConfig{
+				DenyOut: &[]string{"10.0.0.0/8:22"},
+			},
+			wantErr:    true,
+			wantCode:   http.StatusBadRequest,
+			wantErrMsg: `invalid deny out entry "10.0.0.0/8:22": port-specific rules are not supported for egress`,
+		},
+		{
+			name: "allow_out with port is rejected",
+			network: &api.SandboxNetworkConfig{
+				AllowOut: &[]string{"8.8.8.8:80"},
+			},
+			wantErr:    true,
+			wantCode:   http.StatusBadRequest,
+			wantErrMsg: `invalid allow out entry "8.8.8.8:80": port-specific rules are not supported for egress`,
+		},
+		// Valid configurations
 		{
 			name:    "nil network config is valid",
 			network: nil,
@@ -109,33 +129,6 @@ func TestValidateNetworkConfig(t *testing.T) {
 			wantErrMsg: "invalid denied CIDR not-a-cidr",
 		},
 		// Domain validation tests
-		{
-			name: "allow_out with domain requires deny_out block-all",
-			network: &api.SandboxNetworkConfig{
-				AllowOut: &[]string{"example.com"},
-			},
-			wantErr:    true,
-			wantCode:   http.StatusBadRequest,
-			wantErrMsg: ErrMsgDomainsRequireBlockAll,
-		},
-		{
-			name: "allow_out with domain and block-all deny_out is valid",
-			network: &api.SandboxNetworkConfig{
-				AllowOut: &[]string{"example.com"},
-				DenyOut:  &[]string{sandbox_network.AllInternetTrafficCIDR},
-			},
-			wantErr: false,
-		},
-		{
-			name: "allow_out with domain and partial deny_out is invalid",
-			network: &api.SandboxNetworkConfig{
-				AllowOut: &[]string{"example.com"},
-				DenyOut:  &[]string{"10.0.0.0/8"},
-			},
-			wantErr:    true,
-			wantCode:   http.StatusBadRequest,
-			wantErrMsg: ErrMsgDomainsRequireBlockAll,
-		},
 		{
 			name: "allow_out with wildcard domain requires deny_out block-all",
 			network: &api.SandboxNetworkConfig{
@@ -241,6 +234,129 @@ func TestValidateNetworkConfig(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		// Ingress port validation tests (unified CIDR:port format)
+		{
+			name: "valid allowIn with port",
+			network: &api.SandboxNetworkConfig{
+				AllowIn: &[]string{"0.0.0.0/0:80", "0.0.0.0/0:443"},
+				DenyIn:  &[]string{sandbox_network.AllInternetTrafficCIDR},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid allowIn with port range",
+			network: &api.SandboxNetworkConfig{
+				AllowIn: &[]string{"10.0.0.0/8:80-443"},
+				DenyIn:  &[]string{sandbox_network.AllInternetTrafficCIDR},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid denyIn with port",
+			network: &api.SandboxNetworkConfig{
+				DenyIn: &[]string{"0.0.0.0/0:22", "0.0.0.0/0:3306"},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid denyIn port-only shorthand :80 means all IPs port 80",
+			network: &api.SandboxNetworkConfig{
+				DenyIn: &[]string{":80"},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid denyIn port-range shorthand :80-90 means all IPs ports 80-90",
+			network: &api.SandboxNetworkConfig{
+				DenyIn: &[]string{":80-90"},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid allowIn port-only shorthand :443 with deny-all",
+			network: &api.SandboxNetworkConfig{
+				AllowIn: &[]string{":443"},
+				DenyIn:  &[]string{sandbox_network.AllInternetTrafficCIDR},
+			},
+			wantErr: false,
+		},
+		// Ingress CIDR validation tests
+		{
+			name: "valid allowIn CIDR with deny-all",
+			network: &api.SandboxNetworkConfig{
+				AllowIn: &[]string{"10.0.0.0/8"},
+				DenyIn:  &[]string{sandbox_network.AllInternetTrafficCIDR},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid allowIn CIDR from IP with deny-all",
+			network: &api.SandboxNetworkConfig{
+				AllowIn: &[]string{"1.2.3.4/32"},
+				DenyIn:  &[]string{sandbox_network.AllInternetTrafficCIDR},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid allowIn bare IP with deny-all",
+			network: &api.SandboxNetworkConfig{
+				AllowIn: &[]string{"1.2.3.4"},
+				DenyIn:  &[]string{sandbox_network.AllInternetTrafficCIDR},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid allowIn bare IP with port and deny-all",
+			network: &api.SandboxNetworkConfig{
+				AllowIn: &[]string{"1.2.3.4:80"},
+				DenyIn:  &[]string{sandbox_network.AllInternetTrafficCIDR},
+			},
+			wantErr: false,
+		},
+		{
+			name: "allowIn without deny-all is rejected",
+			network: &api.SandboxNetworkConfig{
+				AllowIn: &[]string{"10.0.0.0/8"},
+			},
+			wantErr:    true,
+			wantCode:   http.StatusBadRequest,
+			wantErrMsg: ErrMsgAllowInRequiresBlockAll,
+		},
+		{
+			name: "allowIn with partial denyIn (no deny-all) is rejected",
+			network: &api.SandboxNetworkConfig{
+				AllowIn: &[]string{"10.0.0.0/8"},
+				DenyIn:  &[]string{"192.168.0.0/16"},
+			},
+			wantErr:    true,
+			wantCode:   http.StatusBadRequest,
+			wantErrMsg: ErrMsgAllowInRequiresBlockAll,
+		},
+		{
+			name: "invalid allowIn entry",
+			network: &api.SandboxNetworkConfig{
+				AllowIn: &[]string{"not-a-cidr"},
+			},
+			wantErr:    true,
+			wantCode:   http.StatusBadRequest,
+			wantErrMsg: `invalid allow in entry "not-a-cidr": domains are not supported for ingress rules`,
+		},
+		{
+			name: "valid denyIn CIDR",
+			network: &api.SandboxNetworkConfig{
+				DenyIn: &[]string{"192.168.0.0/16"},
+			},
+			wantErr: false,
+		},
+		{
+			name: "invalid denyIn entry",
+			network: &api.SandboxNetworkConfig{
+				DenyIn: &[]string{"bad"},
+			},
+			wantErr:    true,
+			wantCode:   http.StatusBadRequest,
+			wantErrMsg: `invalid deny in entry "bad": domains are not supported for ingress rules`,
+		},
 		// Mixed domain and CIDR tests
 		{
 			name: "allow_out with domain and CIDR without deny_out block-all is invalid",
@@ -260,6 +376,24 @@ func TestValidateNetworkConfig(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name: "deny_out with domain is rejected",
+			network: &api.SandboxNetworkConfig{
+				DenyOut: &[]string{"example.com"},
+			},
+			wantErr:    true,
+			wantCode:   http.StatusBadRequest,
+			wantErrMsg: `invalid denied CIDR example.com`,
+		},
+		{
+			name: "deny_out with invalid port is rejected",
+			network: &api.SandboxNetworkConfig{
+				DenyOut: &[]string{"10.0.0.0/8:abc"},
+			},
+			wantErr:    true,
+			wantCode:   http.StatusBadRequest,
+			wantErrMsg: `invalid deny out entry "10.0.0.0/8:abc": port-specific rules are not supported for egress`,
+		},
 	}
 
 	for _, tt := range tests {