[lpcox]

Squid evaluated destination-IP exceptions before rejecting unlisted domains, resolving attacker-controlled hostnames even when HTTP access was denied. This exposed a DNS exfiltration path in default-mode runs.

• DNS-free IP exceptions: Add -n to API-proxy and explicit-IP destination ACLs:

  acl allow_api_proxy_ip dst -n 172.30.0.30
  

  Literal-IP access remains permitted; hostnames cannot inherit an IP exception through DNS resolution. Existing source exemptions and rule ordering remain unchanged.
• Regression coverage: Require numeric-only matching in generated ACLs.
• Documentation: Explain the leak mechanism and distinguish this mitigation from filtering direct DNS queries or allowlisted-name lookups.

• Fixes A host name the proxy refuses is still resolved, so it leaves the runner in a DNS query #11561

[Copilot]

🔵 Needs a closer look

The security-sensitive ACL change needs runtime validation on Squid 7.6 to confirm denied HTTP/CONNECT hostnames emit no DNS queries while literal-IP and sidecar access remain functional; generated-config assertions alone cannot establish this.

No open issues 🎉

What changed in this PR

Addresses #11561 by preventing Squid’s destination-IP access exceptions from resolving unlisted hostnames before denying access, closing that DNS leak path in AWF’s generated egress policy.

Changes:

• Add dst -n to API-proxy and explicit-IP exceptions while preserving rule ordering and source exemptions.
• Add regression assertions for numeric-only destination matching.
• Document the leak mechanism and distinguish this mitigation from broader DNS filtering.

File	Description
src/​squid/​config-sections.ts	Makes destination-IP exceptions match literal IPs without DNS resolution.
src/​squid/​config-sections.test.ts	Adds assertions for numeric-only API-proxy and allowlisted-IP ACLs.
src/​squid-config-policy.test.ts	Updates the API-proxy ACL expectation.
src/​squid-config-core.test.ts	Updates generated explicit-IP ACL expectations.
docs/​egress-filtering.md	Explains the mitigation, its scope, and remaining DNS-filtering needs.

_{Review effort: Max (dynamic)}

[github-actions]

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

1. Download the docs-preview-pr-11562 artifact from the workflow run
2. Unzip and open index.html in your browser

Built from commit b93993c

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Smoke Codex

Outcome: reported_action

The agent completed and reported one or more actions. The no-op output is a completion signal, not a claim that no action was taken.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Smoke Codex · gpt54 · ~16 AIC · ⊞ 22.5K · ◷

🔮 The oracle has spoken through Smoke Codex

[github-actions]

Testing chroot feature Smoke Chroot is validating functionality...

[github-actions]

Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

[github-actions]

🚀 Security Guard has started processing this pull request

[github-actions]

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

[github-actions]

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

🚀 Build Test Suite has started processing this pull request

[github-actions]

✅ Smoke Claude passed

Generated by Smoke Claude for #11562

[github-actions]

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

[github-actions]

📡 Smoke OTel Tracing is starting OTel tracing validation...

[github-actions]

✅ Smoke Test: Copilot Network Isolation - PASS

Both egress isolation checks passed:

Check	Result	Details
Allowed domain	✅ PASS	https://api.github.com/zen returned HTTP 200
Denied domain	✅ PASS	(example.com/redacted) was blocked (SSL certificate rejection)

Overall Result: PASS

EGRESS_RESULT allow=pass deny=pass

The firewall is correctly isolating egress traffic—allowing configured domains and blocking non-whitelisted domains.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

[github-actions]

Cloud Hypervisor + Copilot smoke test

1. Merged PR lookup: PASS
2. github.com connectivity: PASS (HTTP 200)
3. File write/read: PASS
4. example.com blocked: PASS (HTTP 000)

Overall: PASS

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

[github-actions]

Services smoke test: ✅ Redis PONG · ✅ pg_isready · ✅ SELECT 1. Overall: PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Overall result: PASS

Generated by Smoke Claude for #11562 · claude · haiku45 · ~14 AIC · ⊞ 6.3K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot BYOK (Direct) Mode

✅ GitHub MCP connectivity
✅ github.com HTTP 200
✅ File write/read test
✅ BYOK inference via api-proxy → api.githubcopilot.com

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY).

Status: PASS

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test

• Prevent DNS leaks from Squid IP access exceptions
• Use published AWF images for the firewall issue dispatcher
• Merged PR read: ✅
• PR detail read: ✅
• Playwright title check: ❌
• File write/read: ✅
• Build AWF: ✅
• Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}