Intercept api.anthropic.com at the network layer so sandboxed sessions carry no base-URL fingerprint #46
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: dejima/dejima#46
Reference in New Issue
Block a user
Summary generated by LLM agent
Replaces the credential proxy's transport so the sandbox stops announcing itself to the API on every request.
Why
The existing credential proxy keeps the real OAuth token out of the container by pointing Claude Code at a local forwarder with
ANTHROPIC_BASE_URL=http://127.0.0.1:18300and a placeholderANTHROPIC_AUTH_TOKEN, and injecting the real token host-side. The security property is good; the delivery mechanism is not. Claude Code checks whether its base URL is first-party and changes its request attribution headers when it isn't, so every request from a sandboxed session carries a per-request, server-visible marker that the session is unusual. Some client features gate on the same check.The fix is to stop telling the client anything. Intercept at the network layer instead, so the client's own configuration is byte-for-byte a stock install.
What changed
/etc/hostspinsapi.anthropic.comto 127.0.0.1 inside the container. This wins insidegetaddrinfo, so it takes effect without touching DNS.api.anthropic.com) at container start and trusts it viaNODE_EXTRA_CA_CERTS.docker/anthropic-proxy-forwarder.jsgains a TLS mode: it terminates TLS on :443 and relays raw bytes to the unix socket where the unchanged host-side proxy injects the real token. It stays a byte pipe with no HTTP awareness — ALPN is pinned to exactly["http/1.1"], because the far end cannot parse HTTP/2 frames. An h2 client gets alert 120 rather than a hang.net.ipv4.ip_unprivileged_port_start: 0, added as a composesysctlsentry.bin/dejimawrites a fakeclaudeAiOauthcredential with a far-future expiry, so the client has a credential to load and never tries to refresh it. Non-secret fields (scopes,subscriptionType,rateLimitTier,clientId) are copied by name from the real file so the session looks normal; no token-bearing field is.ANTHROPIC_*environment variable is set in the container at all. That absence is what the change is for, andruntime.batsasserts it directly against/proc/1/environ.The old transport is preserved as
SANDBOX_ANTHROPIC_TRANSPORT=loopbackand is still tested.SANDBOX_CREDENTIAL_PROXY=0still works exactly as before.Egress allowlist
api.anthropic.comis no longer unconditionally allowlisted. With the proxy on, the session reaches the API through the forwarder, so leaving the name unresolvable defeats a bypass that looks it up by DNS. With the proxy off — the kill switch, or API-key auth — DNS is the only path to the API and the name must resolve.This is conditional rather than absolute, which was a deliberate deviation from the original plan: deleting the entry outright broke both proxy-off paths. The conditional lives in
docker/fixed-domains.sh, which bothdns-proxy.shandinit-firewall.shalready source specifically so the two can't drift. Putting it there rather than inEXTRA_ALLOWED_DOMAINSmatters: extras are deliberately exempt fromstop-dns-rebind(they're expected to be self-hosted Gitea/Loki addresses), and an earlier revision of this branch inherited that exemption for a public SaaS domain — a real regression against "the kill switch behaves exactly as before," caught in review and fixed.Worth stating plainly, since three comments previously got it wrong: this is not a route block.
platform.claude.comis still allowlisted and resolves to the same address, so the API stays reachable as an IP literal. What the change defeats is a bypass that resolves the name.Testing
test/static.bats— 127 pass (up from 115).test/proxy.bats— 22 pass (up from 18); the four new ones exercise the real forwarder host-side, including the TLS chain against a generated cert and the ALPN pin.test/runtime.bats— 37 tests (up from 34), covering the TLS chain end-to-end in a container, the kill switch leaving/etc/hostsunpinned, and an invalid transport value aborting at startup.test/runtime.batswas never executed. This branch was developed inside a dejima sandbox, which has no Docker, so the container-level suite could not run at any point and no image was ever built. Every other check was run; the runtime file was verified by reading each test against the real sources and bybats --count. Please runbats test/runtime.batson a Docker-capable host before merging. Specifically unproven: the forwarder binding :443 as an unprivileged user, in-image cert generation and both FATAL abort paths, the/etc/hostspin redirecting real glibc resolution,NODE_EXTRA_CA_CERTSreaching the session process through gosu and tini,stop-dns-rebindcovering the domain again on the kill-switch path, and the full TLS → byte pipe → unix socket → host proxy chain.Also unverifiable from this repo: whether Claude Code itself accepts the fake credential without attempting a refresh. The no-fingerprint claim rests on that, and only a live session confirms it.
Review
Seven tasks, each reviewed on completion, plus a whole-branch review that found four Important issues — all fixed here — and no Critical ones. Deferred as not worth fixing: duplicated FATAL remediation text, a redundant
chmod 600, and host-side test processes leaking on a failure path (pre-existing pattern).One thing the branch does not fix: it removes the client-side fingerprint, but the request Anthropic actually receives still originates from the host proxy's CPython
http.client, with its own header casing. "Indistinguishable from a stock install" holds at the container layer, not on the wire. Closing that would mean rewritingbin/dejima-anthropic-proxy, which this work deliberately left untouched.Refs #26 — adds three more per-test containers to the set that issue enumerates. The new ones are registered in
teardown(); the interrupted-run reaping that issue asks for is still not implemented.The branch removes the sandbox's client-side fingerprint - no ANTHROPIC_* variables, no explicit base URL - but the request the API actually received was still built by CPython's http.client, which put a different one back on the wire. Measured against a raw upstream socket, three tells: - `Accept-Encoding: identity`, which putrequest() supplies whenever the caller passed no accept-encoding. No browser or Node client sends it. - every header name lowercased, where the client sent mixed case (`Content-Type`, `Anthropic-Version`, `X-Stainless-Lang`). - the block reordered: a dict puts every header the proxy touches (authorization, content-length) at the end, whatever position the client gave it. A dict also collapses repeated headers to the last value, silently. Emit the block header by header instead - putrequest(skip_host, skip_accept_encoding) then putheader() per header in arrival order - so what goes upstream is the client's own block with only the values that must change changed: Authorization, Host, Content-Length, and anthropic-beta when the OAuth value isn't already among the client's own. That last case is now left completely untouched rather than re-joined, since re-joining normalizes the client's spacing, which is the same class of tell as the casing. A bodyless request no longer gains a Content-Length it never sent. The fixture grew a `header_lines` field (names as they arrived, in order, repeats included) because its existing `headers` map lowercases keys and so cannot see any of this. Eight tests, five of which fail against the previous implementation; the other three guard behavior the rewrite could have broken (one injected token for a repeated Authorization, chunked de-framing, Host rewritten to the upstream). Not closed, and now stated in docs/security.md rather than left implied: the connection is still made by CPython's ssl, so the TLS handshake (JA3/JA4) and the absence of connection reuse distinguish it at that layer. Verified: proxy 30/30, static 134/134, audit 84/84, project 69/69. runtime.bats still needs a Docker-capable host.