feat(egress): fleet DoH-443 blocking, telemetry, per-sandbox netns OUTPUT and connection refresh (OSEP-0022)

[Pangjiping]

Enhancements to the fleet profile (multi-sandbox egress control plane, OSEP-0022), on top of #1595.

Four problems solved

1. Encrypted DNS over 443 (DoH) was not blocked

The master chain only blocked DoT 853; encrypted DNS on port 443 had no interception mechanism. The fleet profile now supports OPENSANDBOX_EGRESS_BLOCK_DOH_443 + OPENSANDBOX_EGRESS_DOH_BLOCKLIST with the same semantics as the sidecar profile: drop TCP 443 to a configurable IP/CIDR list, or all TCP 443 in strict mode when the list is empty. The rules are global in the master dispatch chain and survive table resets/rebuilds.

2. The fleet profile exposed no observability metrics

Only the sidecar profile exported OpenTelemetry metrics; the fleet assembly had no telemetry at all. The fleet profile now wires the same OTLP export as the sidecar: DNS metrics (egress.dns.*) come from the shared proxy, and every nft operation (deny-first install, policy apply, DNS-learned dynamic adds, dispatch updates, reset, remove) records egress.nftables.updates.* success/failure counters plus the rules gauge.

3. Per-sandbox netns had only the Pod forward hook as a single layer of defense

OSEP-0022 requires per-sandbox OUTPUT enforcement installed from the host as defense in depth; previously only the Pod-netns forward hook was enforced. Each sandbox netns now gets a mirrored policy chain (table opensandbox-fleet-ns) installed via nsenter --net=<slot.HostNetnsPath>: deny-first full block, static allow/deny sets, DNS-learned dynamic leases, DoT/DoH blocking, and an explicit default verdict. This layer catches traffic the forward hook never sees (sandbox to Pod-host-local destinations, which take the INPUT path). Install failures fail closed (registration retries, subject stays denying); removal is best effort since the rules die with the netns.

4. Active TCP connections relied on DNS lease TTLs only

There was no connection refresh mechanism, so active connections could be dropped after their lease expired. A per-subject bucketed refresh loop now runs every 30s: one read of the Pod-netns conntrack table (/proc/net/nf_conntrack — the forward hook carries every sandbox flow, so a single read bucketed by source IP serves all subjects), renewing active leases, pruning expired idle entries, and issuing one final refresh when activity ends as the bounded reconnect grace period (mirroring the sidecar tracker). The sandbox-netns layer receives the same refreshed leases through a mirror callback, keeping both layers identical.

Wiring

The two layers (Pod-netns forward hook, authoritative; sandbox-netns OUTPUT, defense in depth) are composed behind the existing fleetNftApplier surface via fleetEnforcer — fleet_server.go is unchanged. A failure in either layer fails the whole operation (fail closed).

Tests

• 23 new unit tests (sandboxnft script shape / policy swap / rebind reset / DoH mirror; conntrack parsing / lease renewal and pruning / bucketed refresh).
• smoke-fleet.sh extended with real-kernel per-sandbox netns assertions (rule install, policy mirror, rebind/restart wipe, unload removal); the existing data-path tests now traverse both layers.
• Docs updated (docs/components/egress.md, opentelemetry.md, policy-traffic-vault-flow.md).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5644f1a801

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".