From 8884c3ba287d61b232d7bcaf721b4d9cbf2bcea8 Mon Sep 17 00:00:00 2001 From: hiroTamada <88675973+hiroTamada@users.noreply.github.com> Date: Mon, 10 Aug 2026 18:39:58 +0000 Subject: [PATCH 1/2] Bypass private networks by default --- server/cmd/chromium-launcher/main.go | 17 ++++++- server/cmd/chromium-launcher/main_test.go | 56 +++++++++++++++++++++++ 2 files changed, 72 insertions(+), 1 deletion(-) diff --git a/server/cmd/chromium-launcher/main.go b/server/cmd/chromium-launcher/main.go index 19f93e47..69fa34a4 100644 --- a/server/cmd/chromium-launcher/main.go +++ b/server/cmd/chromium-launcher/main.go @@ -25,6 +25,8 @@ const ( // pulseSink is the null sink chromium plays into; the recorder captures // its .monitor source. pulseSink = "KernelOutput" + + defaultPrivateNetworkBypassFlag = "--proxy-bypass-list=10.0.0.0/8;172.16.0.0/12;192.168.0.0/16;100.64.0.0/10;fc00::/7" ) func main() { @@ -78,7 +80,7 @@ func main() { fmt.Fprintf(os.Stderr, "failed reading runtime flags: %v\n", err) os.Exit(1) } - final := chromiumflags.MergeFlagsWithRuntimeTokens(baseFlags, runtimeTokens) + final := mergeChromiumFlags(baseFlags, runtimeTokens) // Diagnostics for parity with previous scripts fmt.Printf("BASE_FLAGS: %s\n", baseFlags) @@ -158,6 +160,19 @@ func main() { } } +func mergeChromiumFlags(baseFlags string, runtimeTokens []string) []string { + configured := chromiumflags.MergeFlagsWithRuntimeTokens(baseFlags, runtimeTokens) + // Chromium applies only the last --proxy-bypass-list flag. Keep the image + // default first so a runtime list, including an empty one, replaces it. + flags := []string{defaultPrivateNetworkBypassFlag} + for _, flag := range configured { + if flag != defaultPrivateNetworkBypassFlag { + flags = append(flags, flag) + } + } + return flags +} + // execLookPath helps satisfy syscall.Exec's requirement to pass an absolute path. func execLookPath(file string) (string, error) { if strings.ContainsRune(file, os.PathSeparator) { diff --git a/server/cmd/chromium-launcher/main_test.go b/server/cmd/chromium-launcher/main_test.go index 7b4ba40a..ed56cc8f 100644 --- a/server/cmd/chromium-launcher/main_test.go +++ b/server/cmd/chromium-launcher/main_test.go @@ -4,9 +4,65 @@ import ( "os" "os/exec" "path/filepath" + "reflect" "testing" ) +func TestMergeChromiumFlags(t *testing.T) { + tests := []struct { + name string + baseFlags string + runtimeTokens []string + want []string + }{ + { + name: "image default", + want: []string{defaultPrivateNetworkBypassFlag}, + }, + { + name: "base list replaces image default", + baseFlags: "--proxy-bypass-list=preview.internal", + want: []string{ + defaultPrivateNetworkBypassFlag, + "--proxy-bypass-list=preview.internal", + }, + }, + { + name: "runtime list replaces image and base lists", + baseFlags: "--proxy-bypass-list=base.internal --kiosk", + runtimeTokens: []string{"--proxy-bypass-list=runtime.internal"}, + want: []string{ + defaultPrivateNetworkBypassFlag, + "--proxy-bypass-list=base.internal", + "--kiosk", + "--proxy-bypass-list=runtime.internal", + }, + }, + { + name: "explicit empty runtime list clears image default", + runtimeTokens: []string{"--proxy-bypass-list="}, + want: []string{ + defaultPrivateNetworkBypassFlag, + "--proxy-bypass-list=", + }, + }, + { + name: "duplicate image default is removed", + baseFlags: defaultPrivateNetworkBypassFlag, + want: []string{defaultPrivateNetworkBypassFlag}, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := mergeChromiumFlags(tt.baseFlags, tt.runtimeTokens) + if !reflect.DeepEqual(got, tt.want) { + t.Fatalf("mergeChromiumFlags() mismatch:\n got: %#v\nwant: %#v", got, tt.want) + } + }) + } +} + func TestExecLookPath(t *testing.T) { dir := t.TempDir() bin := filepath.Join(dir, "mybin") From e874dd8d7f35ad6e60e70bdea61c5d4808199c99 Mon Sep 17 00:00:00 2001 From: hiroTamada <88675973+hiroTamada@users.noreply.github.com> Date: Mon, 10 Aug 2026 19:40:36 +0000 Subject: [PATCH 2/2] Preserve configured proxy bypass precedence --- server/cmd/chromium-launcher/main.go | 17 +++--- server/cmd/chromium-launcher/main_test.go | 66 ++++++++++++----------- 2 files changed, 42 insertions(+), 41 deletions(-) diff --git a/server/cmd/chromium-launcher/main.go b/server/cmd/chromium-launcher/main.go index 69fa34a4..7bce8506 100644 --- a/server/cmd/chromium-launcher/main.go +++ b/server/cmd/chromium-launcher/main.go @@ -80,7 +80,8 @@ func main() { fmt.Fprintf(os.Stderr, "failed reading runtime flags: %v\n", err) os.Exit(1) } - final := mergeChromiumFlags(baseFlags, runtimeTokens) + final := chromiumflags.MergeFlagsWithRuntimeTokens(baseFlags, runtimeTokens) + final = withDefaultPrivateNetworkBypass(final) // Diagnostics for parity with previous scripts fmt.Printf("BASE_FLAGS: %s\n", baseFlags) @@ -160,17 +161,13 @@ func main() { } } -func mergeChromiumFlags(baseFlags string, runtimeTokens []string) []string { - configured := chromiumflags.MergeFlagsWithRuntimeTokens(baseFlags, runtimeTokens) - // Chromium applies only the last --proxy-bypass-list flag. Keep the image - // default first so a runtime list, including an empty one, replaces it. - flags := []string{defaultPrivateNetworkBypassFlag} - for _, flag := range configured { - if flag != defaultPrivateNetworkBypassFlag { - flags = append(flags, flag) +func withDefaultPrivateNetworkBypass(flags []string) []string { + for _, flag := range flags { + if flag == "--proxy-bypass-list" || strings.HasPrefix(flag, "--proxy-bypass-list=") { + return flags } } - return flags + return append(flags, defaultPrivateNetworkBypassFlag) } // execLookPath helps satisfy syscall.Exec's requirement to pass an absolute path. diff --git a/server/cmd/chromium-launcher/main_test.go b/server/cmd/chromium-launcher/main_test.go index ed56cc8f..6e6d11b0 100644 --- a/server/cmd/chromium-launcher/main_test.go +++ b/server/cmd/chromium-launcher/main_test.go @@ -6,63 +6,67 @@ import ( "path/filepath" "reflect" "testing" + + "github.com/kernel/kernel-images/server/lib/chromiumflags" ) -func TestMergeChromiumFlags(t *testing.T) { +func TestWithDefaultPrivateNetworkBypass(t *testing.T) { tests := []struct { - name string - baseFlags string - runtimeTokens []string - want []string + name string + flags []string + want []string }{ { name: "image default", want: []string{defaultPrivateNetworkBypassFlag}, }, { - name: "base list replaces image default", - baseFlags: "--proxy-bypass-list=preview.internal", - want: []string{ - defaultPrivateNetworkBypassFlag, - "--proxy-bypass-list=preview.internal", - }, + name: "default follows unrelated flags", + flags: []string{"--kiosk"}, + want: []string{"--kiosk", defaultPrivateNetworkBypassFlag}, }, { - name: "runtime list replaces image and base lists", - baseFlags: "--proxy-bypass-list=base.internal --kiosk", - runtimeTokens: []string{"--proxy-bypass-list=runtime.internal"}, - want: []string{ - defaultPrivateNetworkBypassFlag, - "--proxy-bypass-list=base.internal", - "--kiosk", - "--proxy-bypass-list=runtime.internal", - }, + name: "custom list replaces image default", + flags: []string{"--proxy-bypass-list=preview.internal"}, + want: []string{"--proxy-bypass-list=preview.internal"}, }, { - name: "explicit empty runtime list clears image default", - runtimeTokens: []string{"--proxy-bypass-list="}, - want: []string{ - defaultPrivateNetworkBypassFlag, - "--proxy-bypass-list=", - }, + name: "explicit empty list clears image default", + flags: []string{"--proxy-bypass-list="}, + want: []string{"--proxy-bypass-list="}, }, { - name: "duplicate image default is removed", - baseFlags: defaultPrivateNetworkBypassFlag, - want: []string{defaultPrivateNetworkBypassFlag}, + name: "bare empty list clears image default", + flags: []string{"--proxy-bypass-list"}, + want: []string{"--proxy-bypass-list"}, }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - got := mergeChromiumFlags(tt.baseFlags, tt.runtimeTokens) + got := withDefaultPrivateNetworkBypass(tt.flags) if !reflect.DeepEqual(got, tt.want) { - t.Fatalf("mergeChromiumFlags() mismatch:\n got: %#v\nwant: %#v", got, tt.want) + t.Fatalf("withDefaultPrivateNetworkBypass() mismatch:\n got: %#v\nwant: %#v", got, tt.want) } }) } } +func TestDefaultPrivateNetworkBypassPreservesRuntimePrecedence(t *testing.T) { + configured := chromiumflags.MergeFlagsWithRuntimeTokens( + "--proxy-bypass-list=preview.internal", + []string{defaultPrivateNetworkBypassFlag}, + ) + got := withDefaultPrivateNetworkBypass(configured) + want := []string{ + "--proxy-bypass-list=preview.internal", + defaultPrivateNetworkBypassFlag, + } + if !reflect.DeepEqual(got, want) { + t.Fatalf("runtime precedence changed:\n got: %#v\nwant: %#v", got, want) + } +} + func TestExecLookPath(t *testing.T) { dir := t.TempDir() bin := filepath.Join(dir, "mybin")