dns_stub

Module: dns_stub

Contents

Structs

• DnsStubInput - Lib-level input for [execute_dns_stub]. The CLI layer builds this
• HostDnsStubHandle - Owning handle for a host-side DNS refusal stub started for the macOS

Functions

• execute_dns_stub - Run the internal sandbox-local DNS stub.

---

firma_run::dns_stub::DnsStubInput

Struct

Lib-level input for [execute_dns_stub]. The CLI layer builds this from its clap-derived args struct.

Fields:

• listen: std::net::SocketAddr - UDP/TCP DNS listen address reachable by the sandboxed agent process.

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> DnsStubInput
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result

firma_run::dns_stub::HostDnsStubHandle

Struct

Owning handle for a host-side DNS refusal stub started for the macOS structural network path.

The stub binds an ephemeral loopback UDP+TCP port and returns REFUSED (RCODE 5) for every DNS query. It is the DNS analog of [super::proxy_bridge::HostBridgeHandle]: a host-side service that the sandbox-exec profile allows through (loopback), while all other DNS destinations (external resolvers) are blocked by the deny network-outbound policy.

[Drop] signals the listener threads to stop and joins them.

Methods:

• fn start() -> Result<Self, RunError> - Start a host-side DNS refusal stub on an ephemeral loopback port.
• fn listen_addr(self: &Self) -> SocketAddr - UDP+TCP address the stub is listening on.

Trait Implementations:

• Drop
  • fn drop(self: & mut Self)

firma_run::dns_stub::execute_dns_stub

Function

Run the internal sandbox-local DNS stub.

The stub provides an explicit resolver endpoint for structurally confined bwrap sandboxes. It refuses all queries deterministically instead of forwarding to the host ambient resolver.

Errors

Returns an error if UDP or TCP DNS listeners cannot bind.

fn execute_dns_stub(args: &DnsStubInput) -> Result<i32, crate::error::RunError>