Repository navigation
T72 — Reject UDP 443 from a blocked cohort's own leaves, sockets opened before the flip included #2558
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Round-two conditions closed | M | unknown ground | strongest | an agent | 420 (220 code, 200 tests) |
A host_ip cohort member's UDP 443 socket opened before the cohort turns blocked stops sending when the block flips, and sends again when it lifts.
Covers:
- BEP-018
Layers:
- ruleset:
- scripts/install-host-classifier.sh:
render_rulesetdeclares a set of cgroup v2 leaves (typeof socket cgroupv2 level N) and the UDP 443 reject rule also matches a socket whose leaf is in it, so a socket created in a member's own leaf before the flip is rejected from its next datagram; the install step adds a root-owned helper that only adds or removes one leaf under the delegatedboxesslice in that set, refusing any other path, and a sudoers drop-in that lets the login run only that helper withsudo -n(owner's decision 2026-10-26: a narrow helper, not CAP_NET_ADMIN for minimald) - scripts/install_test.sh: the rendered set and rule, and the helper refusing a path outside the slice
cargo nextest run -p minimald the_ruleset_rejects_udp_443_from_leaves_in_the_blocked_set
- scripts/install-host-classifier.sh:
- cohort:
- crates/minimald/src/net/classifier.rs:
CohortQuic443keeps every residentallowmember's own leaf in the blocked set while the cohort blocks: all of them when it turns blocked, a joining member's at admit, none once the last blocker leaves; the process moves stay - crates/minimald/src/box_actor/host.rs: runs the helper through
sudo -nfor each set change, and logs a refusal without failing the box cargo nextest run -p minimald cohort_flip_puts_member_leaves_in_the_blocked_set
- crates/minimald/src/net/classifier.rs:
Waits on:
Plan block
### T72 — Reject UDP 443 from a blocked cohort's own leaves, sockets opened before the flip included
slice: S10
kind: task
covers: BEP-018
size: M
est: 220 code, 200 tests
executor: agent
difficulty: unknown ground
model: strongest
diagnostics: the daemon log names each leaf added to or removed from the blocked set, and `min finalize-install` names the helper item and why it cannot install it
observability: one info line per set change with the leaf and the cohort's blocking members
layers:
- ruleset:
- scripts/install-host-classifier.sh: `render_ruleset` declares a set of cgroup v2 leaves (`typeof socket cgroupv2 level N`) and the UDP 443 reject rule also matches a socket whose leaf is in it, so a socket created in a member's own leaf before the flip is rejected from its next datagram; the install step adds a root-owned helper that only adds or removes one leaf under the delegated `boxes` slice in that set, refusing any other path, and a sudoers drop-in that lets the login run only that helper with `sudo -n` (owner's decision 2026-10-26: a narrow helper, not CAP_NET_ADMIN for minimald)
- scripts/install_test.sh: the rendered set and rule, and the helper refusing a path outside the slice
test: cargo nextest run -p minimald the_ruleset_rejects_udp_443_from_leaves_in_the_blocked_set
- cohort:
- crates/minimald/src/net/classifier.rs: `CohortQuic443` keeps every resident `allow` member's own leaf in the blocked set while the cohort blocks: all of them when it turns blocked, a joining member's at admit, none once the last blocker leaves; the process moves stay
- crates/minimald/src/box_actor/host.rs: runs the helper through `sudo -n` for each set change, and logs a refusal without failing the box
test: cargo nextest run -p minimald cohort_flip_puts_member_leaves_in_the_blocked_set
produces: none
consumes: none
proof: A host_ip cohort member's UDP 443 socket opened before the cohort turns blocked stops sending when the block flips, and sends again when it lifts.
depends on:
- blocked by #2534
Generated by Claude Code
Reacted by minimal-foundry
Activity
norrietaylor commentedon Oct 26, 2026
The epic owner added this residual to the plan on 2026-10-26 as
T72(slice S10). Its body is now the rendered task. The residual text it replaces is kept below.Residual text
Residual filed from T53 #2553, arch condition C1 at ecdb372 (review thread 4370706131; the HIGH finding in thread 4370699747 is the same gap for the joining box), epic #1501.
Situation
T53 blocks the cohort's UDP 443 with a
socket cgroupv2rule on theboxes/quic443-blockedleaf (render_rulesetinscripts/install-host-classifier.sh) and moves members' processes into that leaf when the cohort turns blocked. The nftsocket cgroupv2match reads the cgroup a socket was created in, and a socket keeps that cgroup when its process moves (Networking §4.1 line 56). So UDP sockets that members opened in their own leaves before the flip, including the joining blocked box's sockets between its spawn andjoin_quic443_cohort, never match the rule, and their QUIC flows continue. §5.3 line 150 blocks UDP 443 for the whole cohort, and §4.1 line 56 says a tightened declaration terminates established flows. The daemon moves processes only and cannot end those flows without a privileged step.What closes this
Generated by Claude Code
[-]Terminate host_ip cohort UDP 443 flows opened before the QUIC block flips (BEP-018)[/-][+]T72 — Terminate cohort UDP 443 flows opened before the QUIC block flips[/+]minimal-foundry commentedon Oct 26, 2026
Done. #2601 merged.
branch
agent/2558-reject-udp-443-from-a-blocked-cohort-s-own-leave· epic #1501 · PR #2601433b395068441e23d877261b5e17d056d8e927612ec12ffe09278686Updated 2026-10-26T19:00:22.316Z.
[-]T72 — Terminate cohort UDP 443 flows opened before the QUIC block flips[/-][+]T72 — Reject UDP 443 from a blocked cohort's own leaves, sockets opened before the flip included[/+]