Repository navigation
Refuse a host_ip cohort member with no credentialed lane at the in-VM classifier #2876
Description
Residual of T117 (#2854, PR #2861), from the arch ruling (C3) and the HIGH minimal-review thread on crates/minvmd/src/net/egress_gate.rs host_ip_verdict. Epic #1501.
Gap
The host_ip boxes on a VM host share one cohort address. The host gate sees them only by that address (networking §4.3 rule 2), so the cohort's proxy lane is the union of its resident members' lanes (BEP-083). While any resident member declares a credentialed upstream, every member, including one that declares none, reaches the Box Egress Proxy's listener and TCP 443 at its address.
Gatehouse §6.10 line 833 says the listener is reachable only by credentialed-lane boxes. §7.1 line 244 and §4.3 rule 2 (T28) give the per-member refusal to the in-VM classifier.
Effect today
A member with no grant holds no sealed value, so it reaches the proxy but has nothing to redeem. The gap is reachability, not credential use. It widens once T119 (#2855) admits cohort-attributed requests.
Done when
The in-VM classifier refuses a TCP connection from a host_ip member that declares no credentialed upstream to the proxy's address (listener port and 443). It is logged like the classifier's other refusals. A member that declares one still reaches it. A test drives two resident members, one declaring and one not, and shows only the declaring one connecting. The interim note in the host_ip_verdict doc comment then goes away. Spec 24 BEP-083 gets the matching sub-requirement.
Activity
fix(minvmd): refuse a host_ip registration while its name is held
norrietaylor commentedon Nov 5, 2026
Planned as task T124, #3047, in epic #1501. This issue stays open as the residual record until #3047 lands.
T117 — Give a host-address grant box an id and open the proxy lane to…
norrietaylor commentedon Nov 6, 2026
Done by T124 (#3052): the in-VM classifier refuses a resident host_ip box with no credentialed upstream at the proxy's listener and TCP 443. The guest's blocked-leaves path is tracked as #3059.