Repository navigation
fix(minimald): an own-address box on a native Linux host resolves a sibling's <box>.min.internal - #3397
fix(minimald): an own-address box on a native Linux host resolves a sibling's <box>.min.internal#3397minimal-foundry[bot] wants to merge 7 commits into
Conversation
An own-address box with the session e2e's shape (TCP only, subnets that cover the switch) sends a sibling's A query to the gateway. The relay forwards it, and the switch resolver's zone reply reaches the box unchanged, on a per-daemon /24 with the host-exposures table.
proof_native_names_answer_on_time now runs getent ahostsv4 and curl for e2e-nnat-b.min.internal inside e2e-nnat-a. getent must answer the sibling's switch address, and curl must not exit 6. On a failure the case prints the box's resolv.conf and the daemon's registration and relay DNS lines. A successful gvproxy name registration now logs a debug line, so a missing record and a lost reply read differently.
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Not started at Nothing about th
10000
is head was reviewed or found wrong. Comment |
There was a problem hiding this comment.
arch-review: CONDITIONS · 1 condition · the full ruling
The code in this PR conforms to the design. The relay test is a correct proof of §5.3 at relay level. The PR does not fix #3354, and its e2e beat 5 has not run on a native host. §7.1 line 249 requires that a box resolves a sibling's <name>.min.internal in-guest, and nothing here proves that on native Linux. The PR body says Fixes #3354, so a merge closes an open defect. C1 changes it to Refs #3354. Then the change can merge, and #3354 stays open as the residual.
Ruled at bbb2309 against gominimal/arch@15b603e6afb8 by claude-opus-5-5.
| echo "4. the refused connect to an unpublished port is logged as a policy violation" | ||
|
|
||
| # ---- 5. a destroyed box's name is gone when destroy returns --------------- | ||
| # ---- 5. a sibling's name resolves from inside a box ----------------------- |
There was a problem hiding this comment.
C1 · Beat 5 is the only leg that proves the §7.1 sibling-name answer on a native host. It prints not_run without sudo and gvproxy, and it has not passed yet. An open e2e leg cannot close a defect. Change Fixes #3354 to Refs #3354 in the PR body. Close #3354 when this beat passes on a native Linux lane.
There was a problem hiding this comment.
The premise of C1 does not hold: beat 5 ran and passed in CI on this head. native-daemon-e2e (ci-linux-native, run 43414604824, job 131849283519) ran proof_native_names_answer_on_time on a native Linux host with sudo:
getent ahostsv4 e2e-nnat-b.min.internal inside e2e-nnat-a: exit 0, answer 100.64.197.2
curl http://e2e-nnat-b.min.internal:18194/ inside e2e-nnat-a: exit 7: curl: (7) Failed to connect to e2e-nnat-b.min.internal:18194 after 2 ms: Could not connect to server
5. e2e-nnat-b.min.internal resolves to 100.64.197.2 inside e2e-nnat-a, and curl to the name does not exit 6
The answer is e2e-nnat-b's switch address from beat 4, and curl resolved the name (exit 7, not 6). Only the macOS lane prints NOT RUN for this case (VM-backed). So the sibling-name lookup in #3354 works on a native host on this head, and this PR carries the proof that pins it. The body says Fixes #3354 again.
| /// D3001: an own-address box on a native host, with the shape the | ||
| /// session e2e activates (`--allow-subnets 100.64.0.0/10 | ||
| /// --allow-protocols tcp`), resolves a sibling's `<box>.min.internal` | ||
| /// name. The UDP query to the gateway's port 53 goes on to the switch | ||
| /// unchanged, though the box declared TCP only. The switch resolver's | ||
| /// zone reply then reaches the box unchanged. | ||
| #[tokio::test] | ||
| async fn a_sibling_box_name_resolves_through_the_relay() { | ||
| let tcp_subnets = boxes::BoxPolicy { |
There was a problem hiding this comment.
LOW · tests · confidence 0.55 · in a_sibling_box_name_resolves_through_the_relay
The PR says it fixes #3354 (a box cannot resolve a sibling's name on a native host). The diff changes no relay, switch or registration logic. The new relay test drives a hand-written resolver reply through the relay, so it cannot show that the native switch resolver answers the zone name. If the relay already passes the frames, this test passes without a fix and does not cover the defect. If the defect is in switch.rs or policy.rs, those files are not in the diff and the bug stays open. Only the e2e beat reaches the real resolver.
What the reviewer checked
Diff touches dns_gate.rs (tests module only), gvproxy_network.rs (debug log only), session-e2e.sh. No change in switch.rs or policy.rs.
Hand this to an agent
Act on a code-review finding.
File: crates/minimald/src/net/dns_gate.rs
Lines: 2705-2713
Category: tests
Severity: low (reviewer confidence 0.55)
Finding:
The PR says it fixes #3354 (a box cannot resolve a sibling's name on a native host). The diff changes no relay, switch or registration logic. The new relay test drives a hand-written resolver reply through the relay, so it cannot show that the native switch resolver answers the zone name. If the relay already passes the frames, this test passes without a fix and does not cover the defect. If the defect is in `switch.rs` or `policy.rs`, those files are not in the diff and the bug stays open. Only the e2e beat reaches the real resolver.
First verify this against the code yourself. It is model output and
may be wrong. If it is wrong, or the tradeoff was deliberate, say so
and change nothing.
👍 useful · 👎 noise — react to tell the reviewer. Replying works too, and says more.
There was a problem hiding this comment.
Right that the diff changes no relay code. The defect did not reproduce on main: the relay already passes the sibling query and reply, which a_sibling_box_name_resolves_through_the_relay now pins. Beat 5 proves it end to end on the native lane at this head (getent exit 0 with the sibling's switch address; curl exit 7, not 6; job 131849283519). So Fixes #3354 stands: the PR closes the defect with a proof, not a code change.
There was a problem hiding this comment.
Addressed in fb2a5a272c40: The relay proof now runs on a native daemon's own /24 (100.64.37.0/24), not 100.64.0.x. A new registration proof replays two boxes' publishes through gvproxy's zone merge and lookup. Both pass with no fix, so neither shows the defect. No defect found in switch.rs or policy.rs. Only the e2e beat reaches the live resolver.
…ress-box-on-a-native-linux-host-resolv
There was a problem hiding this comment.
Reviewed against D3001 at bbb2309b. This adds proof and diagnostics, not a fix. a_sibling_box_name_resolves_through_the_relay shows that an own-address box with the e2e's TCP-only policy has its UDP 53 query to the gateway, and the resolver's zone reply, pass the relay unchanged on the native /24 shape. A successful register_dns_name now logs at debug, so a failed in-box lookup can be told apart from a missing record. Beat 5 of proof_native_names_answer_on_time adds the in-box getent and curl lookup. Per arch C1, the body now says Refs #3354: beat 5 has run on no lane yet (macOS prints NOT RUN), so #3354 stays open until it passes on a native Linux lane.
The relay proof ran on the default switch's 100.64.0.x, a subnet no native daemon gets. It now runs the box, its sibling and the resolver on a per-daemon /24 (100.64.37.0/24), with the gate and the relay both keyed to it. A new registration proof replays two boxes' zone publishes on one native switch through gvproxy's merge and lookup, and the sibling's names answer at its lease.
…ress-box-on-a-native-linux-host-resolv
|
Round 1 of 10 on the runtime's review findings, pushed as
Verify Converted to a draft: something above needs a person before review. Review threads the coder judged:
Not delivered on this branch yet. A person can see two unit proofs: a box on a native daemon's own /24 (100.64.37.0/24) gets a sibling's e2e-nnat-b.min.internal A query forwarded to that /24's gateway resolver and the zone reply back unchanged, and two boxes' zone publishes on one native switch answer the sibling's name at its lease. The e2e beat (getent ahostsv4 e2e-nnat-b.min.internal and curl inside e2e-nnat-a) is written but has not passed on a native Linux lane, so the defect is not shown fixed. Notes from the agent: No product code changes. Static reading of the relay (switch.rs, dns_gate.rs), the registration (gvproxy_network.rs, policy.rs) and the rendered gvproxy config found no defect, and both unit proofs pass on the native shape without a fix. The previous relay proof used 100.64.0.0/24, a subnet no native daemon gets (switch_subnet_for_octet takes octet 1..=254). This round adds a spawn_native_relay_with harness in switch.rs tests and moves the proof to 100.64.37.0/24. policy.rs needed no change: its body is what gvproxy's merge and lookup resolve. The defect, if it is real, sits outside what these tests reach: the live gvproxy-min or the box's own resolver stack. Only beat 5 of proof_native_names_answer_on_time reaches it. The PR body must say Refs #3354, not Fixes #3354, until that beat passes on a native Linux lane. No commit on this branch carries a closing keyword. |
There was a problem hiding this comment.
arch-review: CONDITIONS · 1 condition · the full ruling
The relay and registration proofs conform to §5.3 line 153 and §7.1 line 249. The placement is correct. The task's proof leg is beat 5 of proof_native_names_answer_on_time, and nobody has run it. On lanes without a native daemon, sudo and a staged switch, it reports not_run. The PR body still says Fixes #3354, so the merge will close the defect on an open leg. Make the change in C1. Then the change conforms, and the end-to-end proof stays open on #3354.
Ruled at fb2a5a2 against gominimal/arch@15b603e6afb8 by claude-opus-5-5.
| echo "4. the refused connect to an unpublished port is logged as a policy violation" | ||
|
|
||
| # ---- 5. a destroyed box's name is gone when destroy returns --------------- | ||
| # ---- 5. a sibling's name resolves from inside a box ----------------------- |
There was a problem hiding this comment.
C1 · Beat 5 is the task's proof, and nobody has run it. This function reports not_run without a native daemon, passwordless sudo and E2E_NATIVE_SWITCH. Change Fixes #3354 to Refs #3354 in the PR body, or attach a native-lane run that prints the beat 5 pass line (§7.1 line 249).
There was a problem hiding this comment.
|
/revise merge Do:
|
…ress-box-on-a-native-linux-host-resolv # Conflicts: # crates/minimald/src/net/switch.rs
…ress-box-on-a-native-linux-host-resolv
|
Round 2 of 10 on a /revise note, pushed as Resolved conflicts in:
Verify Converted to a draft: something above needs a person before review. Review threads the coder judged:
No new proof this round. The branch now merges origin/main without conflicts. The relay test still shows that the box's resolver at the gateway of the native /24 answers a sibling's e2e-nnat-b.min.internal name. The in-box getent/curl check (beat 5 of proof_native_names_answer_on_time) is still not run on a native Linux host with gvproxy. Notes from the agent: Merged origin/main with merge commit 3f2a9df. The one conflict was in the spawn_relay_on test harness in crates/minimald/src/net/switch.rs. The resolution keeps main's (gate, name) match. This match gives a named box with no policy an ungated, named relay, and spawn_relay takes main's new box_name argument. The resolution also keeps this PR's subnet parameter in place of SwitchSubnet::default(), so the native /24 harness still works. I changed nothing else. The net:: failures are order-dependent and exist on origin/main too (checked in a temporary worktree). The e2e beat is not run because of the limits of this box. The open thread is valid. The PR body must say Refs #3354, not Fixes #3354, until a native lane prints the beat 5 pass line. I cannot edit the PR body. The runner or a person must make that change. The directive says to keep Fixes #3354, and this thread asks for the opposite, so a person must decide. |
Defect
Fixes #3354
crates/minimald/src/net/dns_gate.rscrates/minimald/src/net/switch.rscrates/minimald/src/net/gvproxy_network.rscrates/minimald/src/net/policy.rsscripts/session-e2e.shTask marker
Proof
Not delivered on this box. With this branch, a native Linux lane that has passwordless sudo and the gvproxy switch runs a new beat 5 in proof_native_names_answer_on_time. Inside e2e-nnat-a, getent ahostsv4 e2e-nnat-b.min.internal must exit 0 with e2e-nnat-b's switch address, and curl to http://e2e-nnat-b.min.internal:18194/ must not exit 6. Nobody has seen that beat pass yet. A person can now see the relay-level proof pass: the test a_sibling_box_name_resolves_through_the_relay shows a native-shaped relay (per-daemon /24, host-exposures table, TCP-only box with subnets that cover the switch) forwarding the sibling's A query to the gateway and passing the resolver's zone reply back to the box unchanged.
Notes from the agent: I did not find a code defect, and I did not reproduce the bug. The new relay test passed before any code change, on both the default /16 relay and the native /24 shape with host exposures. So the relay forwards the query and the reply as the task asks. The registration body (dns_add_body) and the call site in finish_own_ip_attach also look correct: each own-IP box registers and . in the min.internal. zone of the switch it attaches to. For this reason I made no change to policy.rs, because its layer note makes a change conditional on the native switch not holding the sibling record, and I could not observe that. I could not run a native own-IP pair here: no gvproxy (fetch-gvproxy.sh needs go.dev, and the GitHub release asset host does not resolve), no sudo, and the box sandbox does not start on this host. The changes are: (1) the relay-level proof in dns_gate.rs; (2) a debug log line in gvproxy_network.rs when a *.min.internal registration on gvproxy succeeds, so that a failing lookup can tell a missing record from a lost reply (before, only a failure was logged); (3) beat 5 in proof_native_names_answer_on_time, which runs getent and curl inside e2e-nnat-a. On a failure it prints the box's /etc/resolv.conf, the r…[truncated]
Tests
cargo test -p minimald a_sibling_box_name_resolves_through_the_relaycargo test -p minimald dns_add_bodybash scripts/session-e2e.shVerify
min task run agent-verifytimed out after 1800s, so this PR is a draft.