Skip to content

Update firewall to v0.9.0 with SSL Bump and URL path filtering support #9985

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mossaka merged 6 commits into from
Jan 14, 2026
Merged

Update firewall to v0.9.0 with SSL Bump and URL path filtering support #9985

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
fc1920e
Initial plan
Copilot Jan 14, 2026
0a47bed
Initial plan for firewall v0.9.0 update
Copilot Jan 14, 2026
788a077
feat: update firewall to v0.9.0 with SSL Bump and URL path filtering …
Copilot Jan 14, 2026
b683c13
refactor: extract SSL Bump args logic into shared helper function get…
Copilot Jan 14, 2026
74c8e23
docs: clarify SSL Bump and allow-urls are AWF-specific features, not SRT
Copilot Jan 14, 2026
ffc2484
Merge branch 'main' into copilot/update-firewall-to-v0-9-0
Mossaka Jan 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
docs: clarify SSL Bump and allow-urls are AWF-specific features, not SRT 
Co-authored-by: Mossaka <5447827+Mossaka@users.noreply.github.com>
  • Loading branch information
@Mossaka
Copilot and Mossaka committed Jan 14, 2026
commit 74c8e23e93d7fedd5660c6263402c573df4a82da
8 changes: 4 additions & 4 deletions .github/workflows/daily-team-status.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions pkg/parser/schemas/included_file_schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -947,12 +947,12 @@
},
"ssl-bump": {
"type": "boolean",
"description": "Enable SSL Bump for HTTPS content inspection (allows URL path filtering for HTTPS). When enabled, AWF can filter HTTPS traffic by URL patterns instead of just domain names. Default: false",
"description": "AWF-only feature: Enable SSL Bump for HTTPS content inspection. When enabled, AWF can filter HTTPS traffic by URL patterns instead of just domain names. This feature is specific to AWF and does not apply to Sandbox Runtime (SRT). Default: false",
"default": false
},
"allow-urls": {
"type": "array",
"description": "URL patterns to allow for HTTPS traffic (requires ssl-bump: true). Supports wildcards for flexible path matching. Must include https:// scheme.",
"description": "AWF-only feature: URL patterns to allow for HTTPS traffic (requires ssl-bump: true). Supports wildcards for flexible path matching. Must include https:// scheme. This feature is specific to AWF and does not apply to Sandbox Runtime (SRT).",
"items": {
"type": "string",
"pattern": "^https://.*",
Expand Down
4 changes: 2 additions & 2 deletions pkg/parser/schemas/main_workflow_schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2118,12 +2118,12 @@
},
"ssl-bump": {
"type": "boolean",
"description": "Enable SSL Bump for HTTPS content inspection (allows URL path filtering for HTTPS). When enabled, AWF can filter HTTPS traffic by URL patterns instead of just domain names. Default: false",
"description": "AWF-only feature: Enable SSL Bump for HTTPS content inspection. When enabled, AWF can filter HTTPS traffic by URL patterns instead of just domain names. This feature is specific to AWF and does not apply to Sandbox Runtime (SRT). Default: false",
"default": false
},
"allow-urls": {
"type": "array",
"description": "URL patterns to allow for HTTPS traffic (requires ssl-bump: true). Supports wildcards for flexible path matching. Must include https:// scheme.",
"description": "AWF-only feature: URL patterns to allow for HTTPS traffic (requires ssl-bump: true). Supports wildcards for flexible path matching. Must include https:// scheme. This feature is specific to AWF and does not apply to Sandbox Runtime (SRT).",
"items": {
"type": "string",
"pattern": "^https://.*",
Expand Down
10 changes: 7 additions & 3 deletions pkg/workflow/firewall.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,16 @@ import (

var firewallLog = logger.New("workflow:firewall")

// FirewallConfig represents AWF (gh-aw-firewall) configuration for network egress control
// FirewallConfig represents AWF (gh-aw-firewall) configuration for network egress control.
// These settings are specific to the AWF sandbox and do not apply to Sandbox Runtime (SRT).
type FirewallConfig struct {
Enabled bool `yaml:"enabled,omitempty"` // Enable/disable AWF (default: true for copilot when network restrictions present)
Version string `yaml:"version,omitempty"` // AWF version (empty = latest)
Args []string `yaml:"args,omitempty"` // Additional arguments to pass to AWF
LogLevel string `yaml:"log_level,omitempty"` // AWF log level (default: "info")
CleanupScript string `yaml:"cleanup_script,omitempty"` // Cleanup script path (default: "./scripts/ci/cleanup.sh")
SSLBump bool `yaml:"ssl_bump,omitempty"` // Enable SSL Bump for HTTPS content inspection (allows URL path filtering)
AllowURLs []string `yaml:"allow_urls,omitempty"` // URL patterns to allow for HTTPS (requires SSLBump), e.g., "https://github.com/githubnext/*"
SSLBump bool `yaml:"ssl_bump,omitempty"` // AWF-only: Enable SSL Bump for HTTPS content inspection (allows URL path filtering)
AllowURLs []string `yaml:"allow_urls,omitempty"` // AWF-only: URL patterns to allow for HTTPS (requires SSLBump), e.g., "https://github.com/githubnext/*"
}

// isFirewallDisabledBySandboxAgent checks if the firewall is disabled via sandbox.agent: false
Expand Down Expand Up @@ -194,6 +195,9 @@ func getAWFImageTag(firewallConfig *FirewallConfig) string {
// Returns arguments for --ssl-bump and --allow-urls flags if SSL Bump is enabled.
// SSL Bump enables HTTPS content inspection (v0.9.0+), allowing URL path filtering
// instead of domain-only filtering.
//
// Note: These features are specific to AWF (Agent Workflow Firewall) and do not
// apply to Sandbox Runtime (SRT) or other sandbox configurations.
func getSSLBumpArgs(firewallConfig *FirewallConfig) []string {
if firewallConfig == nil || !firewallConfig.SSLBump {
return nil
Expand Down