Repository navigation
T14 — Accept the four egress fields on own-address and host-address boxes and show the effective rules - #1569
Conversation
- Add deny_subnets to EgressPolicy and validate allow/deny CIDRs. - Accept egress on OwnIp and HostNet boxes; keep rejecting it on NoNet. - Extend GetSessionPolicy tests to cover own-address and host-address boxes. - Add session-start logging with parsed egress rule counts. - Render deny_subnets in the TUI policy pane. - Route min session policy stdout through the data-contract logger and add an end-to-end test proving all four fields round-trip as JSON. - Add switch Enrollment type and default plan for unenrolled hosts. NET-060, NET-061, NET-065, NET-102, NET-120
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
|
|
Round 1 of 3 on a failed check suite, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. A box spec with allow_subnets, allow_protocols, allow_dns_hosts and deny_subnets is accepted on an own-address or host-address box, rejected on a none box, and Notes from the agent: The functional implementation was already present on the branch from the prior commit (dd01f37). The only remaining change was a clippy fix: removing a redundant |
The HostNet path now accepts egress declarations (NET-120) but must still reject ingress port forwarding, since host-address boxes share their node's address and static mappings would collide. Restructure validate_policy so OwnIp allows both egress and ingress, HostNet allows only egress, and NoNet rejects both. NET-060, NET-065, NET-120
|
Round 2 of 3 on a failed check suite, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. A box spec with allow_subnets, allow_protocols, allow_dns_hosts and deny_subnets is accepted on an own-address or host-address box, rejected on a none box, and Notes from the agent: Revised |
T14 — Accept the four egress fields on own-address and host-address boxes and show the effective rules
slice: S4
kind: task
covers: NET-060, NET-061, NET-065, NET-102, NET-120
size: M
est: 350
executor: agent
difficulty: routine
model: standard
diagnostics: the bundle's session policy dump shows the four egress fields as the daemon parsed them, with the box's network mode beside them
observability: one info log line per session start with the parsed egress rule counts per field
layers:
- schema: crates/sessions/src/lib.rs
test: cargo nextest run -p sessions spec_accepts_egress_fields
test: cargo nextest run -p sessions egress_on_none_box_is_validation_error
test: cargo nextest run -p sessions egress_on_host_ip_box_accepted
- cli: crates/minimal/src/cli.rs, crates/minimal/src/cmd/session.rs
test: cargo nextest run -p minimal policy_shows_effective_egress
- tui: crates/minimal-tui/src/render.rs
test: cargo nextest run -p minimal-tui policy_lines_show_deny_subnets
- daemon: crates/minimald/src/sessions.rs, crates/minimald/src/rpc.rs
test: cargo nextest run -p minimald get_session_policy_returns_effective_egress
- switch: crates/switch/src/lib.rs
test: cargo nextest run -p switch unenrolled_self_allocates_default_plan
produces: none
consumes: none
proof: A box spec with allow_subnets, allow_protocols, allow_dns_hosts and deny_subnets is accepted on an own-address or host-address box, rejected on a none box, and
min session policyshows the effective rules.Proof
A box spec carrying allow_subnets, allow_protocols, allow_dns_hosts and deny_subnets is now accepted for both own-address and host-address boxes, rejected for none boxes, and
min session policyreturns the effective egress rules as JSON for own-address and host-address sessions.Tests
cargo nextest run -p sessions spec_accepts_egress_fieldscargo nextest run -p sessions egress_on_none_box_is_validation_errorcargo nextest run -p sessions egress_on_host_ip_box_acceptedcargo nextest run -p minimal policy_shows_effective_egresscargo nextest run -p minimal-tui policy_lines_show_deny_subnetscargo nextest run -p minimald get_session_policy_returns_effective_egresscargo nextest run -p switch unenrolled_self_allocates_default_planVerify
min task run verifypassed ([tasks.verify]).Out of scope
These files are outside the task's
layers:, so this PR is a draft:crates/minimal-tui/tests/snapshots.rscrates/minimal-tui/tests/snapshots/snapshots__detail_pane_with_policy.snapcrates/minimal/src/main.rscrates/minimal/tests/cli.rscrates/sessions/src/store.rsCloses #1461