feat: implement comprehensive TCP jailing with host-side PREROUTING

[blink-so]

Problem

The current jail implementation only intercepts HTTP (port 80) and HTTPS (port 443) traffic, allowing applications to bypass the jail by using non-standard ports.

Applications that can currently escape the jail:

• HTTP on port 8080: curl http://example.com:8080/api
• Database connections: mysql -h db.example.com -P 3306
• SSH connections: ssh [email protected]
• Custom API ports: wget https://api.example.com:5000/data
• Any TCP-based protocol on non-standard ports

Solution

Implemented comprehensive TCP jailing using the proven approach from the veth-pair branch:

Traffic Interception Strategy

Before (Limited):

# Only catches specific ports inside namespace
ip netns exec ns iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination 192.168.100.1:8040
ip netns exec ns iptables -t nat -A OUTPUT -p tcp --dport 443 -j DNAT --to-destination 192.168.100.1:8043

After (Comprehensive):

# Catches ALL TCP traffic from namespace interface on host
iptables -t nat -A PREROUTING -i veth_h_1234567 -p tcp -j REDIRECT --to-ports 8043

Key Changes

1. Added vethHost field to LinuxJail struct for interface tracking
2. Replaced namespace OUTPUT rules with host PREROUTING rules
3. Single comprehensive rule instead of port-specific rules
4. All TCP traffic redirected to HTTPS proxy port

Security Improvements

Traffic Type	Before	After
HTTP (80)	✅ Intercepted	✅ Intercepted
HTTPS (443)	✅ Intercepted	✅ Intercepted
HTTP (8080)	❌ Bypasses jail	✅ Intercepted
MySQL (3306)	❌ Bypasses jail	✅ Intercepted
SSH (22)	❌ Bypasses jail	✅ Intercepted
Custom ports	❌ Bypasses jail	✅ Intercepted
Any TCP protocol	❌ Bypasses jail	✅ Intercepted

Benefits

• 🔒 True network jailing: No TCP traffic can escape
• 🛡️ Closes all bypass routes: Applications cannot use alternative ports
• 📊 Complete audit trail: All network activity is logged
• 🎯 Simpler rules: Single comprehensive rule vs multiple port-specific rules
• 🏗️ Proven approach: Based on transparent proxy best practices

Technical Details

• PREROUTING chain: Intercepts traffic after it exits namespace but before routing
• Interface-based targeting: -i veth_h_* ensures only namespace traffic is affected
• REDIRECT target: More efficient than DNAT for localhost redirection
• Single proxy port: All traffic goes to HTTPS proxy (8043) which can handle both HTTP and HTTPS

Testing

• ✅ Build succeeds
• ✅ All tests pass
• ✅ Maintains backward compatibility
• ✅ No functional changes to proxy or CLI

This transforms jail from "HTTP/HTTPS proxy with some isolation" to "true network jail with comprehensive traffic control".