Skip to content

components/egress 1.1.6

Latest
Latest

Choose a tag to compare

View all tags
@Pangjiping Pangjiping released this 11 Aug 11:43
docker/egress/v1.1.6
c3e97bf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's New

✨ Features

  • Failure counters for DNS resolution and nftables updates. New egress.dns.query.failed_total{reason} (no_upstreams / upstream_error / empty_response / rcode) and egress.nftables.updates.failed_total{operation} counters make failures that previously existed only in logs observable — including the silent fail-closed case where a failed dynamic allow-set update drops traffic the policy permits. (#1410)

  • mitmdump output now lands in the egress log sink. mitmproxy and credential-proxy logs printed via ctx.log are piped line-by-line into the egress zap logger, so they reach the log file and rotation when OPENSANDBOX_LOG_OUTPUT is set; with the env var unset, behavior stays on stdout as before. (#1468)

🐛 Bug Fixes

  • mitmproxy 11.0.2 restores HTTP/2 throughput. The upstream HTTP/2 flow-control fix (mitmproxy/mitmproxy#7317) removes severe throttling of large HTTP/2 responses: a 216 MiB response went from 0.61 MiB/s on mitmproxy 10.4.2 to 24.43 MiB/s — near the direct-path throughput. (#1396)

  • DNS-derived nft entries no longer expire under long-lived connections. In dns+nft mode, IPs learned from allowed DNS responses are renewed while an active TCP connection holds them, with one final renewal after activity ends. The stock six-minute lease previously dropped reconnects after ~370s in a persistent gRPC-channel scenario; that scenario now reconnects cleanly. TCP only — UDP/QUIC still rely on DNS-driven refresh. (#1399)

  • DNS latency histogram buckets now match its seconds unit. egress.dns.query.duration was using the SDK-default millisecond ladder, so every realistic latency landed in a single bucket and quantiles were meaningless interpolations. Explicit second-based boundaries restore a usable distribution, with a regression test guarding them. (#1405)

  • Credential Vault header injection fixed for streamed request bodies. With stream_large_bodies, bodies over 1 MiB are forwarded before the request hook fired, so auth headers arrived too late and uploads failed with 403 invalid api-key. Injection moved to the requestheaders hook (fires before the upstream connection), and this also fixes missed response redaction when the response arrives before the request hook (e.g. a 413 mid-upload). (#1466)

  • No-SNI TLS connections now pass through transparent MITM instead of breaking. With no hostname in the ClientHello, mitmproxy's hostname verification fell back to the destination IP and tore down the connection (hostname mismatch) — breaking HTTPS egress to OSS for clients like ossfs2 that connect by IP, unless the insecure flag was set (which Credential Vault rejects). No-SNI flows now pass through untouched; hostname-based ignore_hosts matching and TCP deny/allow enforcement still apply. (#1469)

📦 Misc

  • mitmproxy SSE truncation repro tooling. Self-contained reproduction scripts and docs for mitmproxy/mitmproxy#8364, where large SSE bodies over TLS HTTP/1.1 are truncated when the upstream closes right after the body: TLS mode reproduces, plain/delayed-close controls pass. (#1462)

👥 Contributors

Thanks to these contributors ❤️

  • Docker Hub: opensandbox/egress:v1.1.6
  • Aliyun Registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com/opensandbox/egress:v1.1.6
  • GHCR: ghcr.io/opensandbox-group/opensandbox/egress:v1.1.6

Contributors

bcho, ferponse, and Pangjiping
Assets 2
Loading