Repository navigation
T53 — Evaluate min net expose against dynamic_ingress and publish only under an allow - #1865
Conversation
min net expose <port> inside a box reaches the session channel as net-expose%<port>, and the session actor decides it against the box's dynamic_ingress: mode first — the deny-all default for a box that declared nothing, and ask failing closed until NET-045's prompt exists — then the declared dynamic_allowed_range. An allowed port is published through the switch's forwarder with the same expose request a declared mapping takes, recorded as a live mapping, unbound when the box stops, and served over a new GetLiveIngress RPC. A denied or out-of-range request answers a typed refusal and leaves nothing behind: one mapping is one request, so a bind that failed binds nothing. Every request says one info line naming the box, the port, the decision and the outcome, so a diagnostics bundle's daemon log tail carries each expose request with what became of it.
min session policy reads GetLiveIngress beside the effective policy and lists each port the box published at runtime under its declaration — one row a publish, naming the address the forward is bound on and the in-box port it delivers to, shaped like the declared mapping rows. The read is a view of live state, so it degrades with a warning rather than failing the listing when a daemon cannot serve it, and a box that published nothing prints no live section at all.
The strict gate holds changed lines to lints the tree is not yet clean for, so the expose path's best-effort writes — the session channel's replies, the actor's mailbox sends, and the stand-in forwarder's answers — each say why their result may be dropped, and the channel test's two handle calls say why their futures are as large as the harness channel itself.
…in-net-expose-against-dynamic-ingress
|
Important Review skippedThis PR was authored by a bot without an assigned CodeRabbit review seat. Ask an organization administrator to assign a seat to the bot. See the seat-assignment guide. After the seat is assigned, request a review again. ⚙️ Run configuration
You can disable this status message by setting the
Comment |
|
Approved: no findings at Nothing to do. Verdict APPROVE, posted as a comment: the App cannot review its own pull request; the check and the label carry it. Clobber: none found: |
|
/revise Round 1. Allowed files (all inside the plan's layers):
Do not touch other files. In particular, do not change the relay gate or
Keep every existing test passing, and re-run the five plan test lines plus the new tests. The PR body is edited by hand; do not rewrite it. |
|
The CLI-level proof of NET-043 and NET-044 ( |
T53 — Evaluate min net expose against dynamic_ingress and publish only under an allow
slice: S13
kind: task
covers: NET-043, NET-044, NET-047
size: L
est: 400 code, 300 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: the bundle's daemon log tail carries each expose request with its decision and outcome
observability: one info log line per expose request with the box, the port, the decision and the outcome
layers:
- daemon:
- crates/minimald/src/env_min_helper.sh: the in-box helper gains net expose, sent over the box's daemon socket
- crates/minimald/src/env.rs: the session channel handles the expose request
- crates/minimald/src/session.rs: the session actor evaluates dynamic_ingress, publishes and records the live mapping
- crates/minimald/src/net/policy.rs: one-mapping expose that leaves nothing behind on failure
- crates/minimald/src/rpc.rs: the policy handler returns the live mappings
- crates/minimald-rpc/src/lib.rs: a live-mappings response beside the strict session policy
- crates/minimald/src/session/tests.rs: hosts the expose tests
test: cargo nextest run -p minimald expose_unenrolled_local_rpc_evaluates_dynamic_ingress
test: cargo nextest run -p minimald expose_allow_publishes_and_lists
test: cargo nextest run -p minimald expose_deny_typed_error
test: cargo nextest run -p minimald expose_rejected_leaves_no_partial_mapping
- cli:
- crates/minimal/src/cmd/session.rs: session policy shows live mappings
test: cargo nextest run -p minimal policy_shows_live_mappings
produces: none
consumes: none
proof:
min net expose 3000inside a box publishes the port and lists it inmin session policywhen the box's dynamic_ingress allows, returns a typed error when it denies, and leaves no partial mapping when the port is out of range. With two VMs running,min net exposefinds the VM from the box name alone, through the resolution T60 adds for attach (NET-057).depends on:
- blocked by #1657
- blocked by #1625
Proof
min net expose 3000inside a box now publishes the port and lists it inmin session policyas a live mapping beside the declaration when the box'sdynamic_ingressallows; a box that denies (explicitly or by the deny-all default) answers with the typed refusaldynamic ingress is denied for this boxinstead of a bare message; and a request outside the declared range — or one whose bind the switch itself refuses — leaves no partial mapping and lists nothing. Every request says one info line in the daemon log naming the box, the port, the decision and the outcome.Notes from the agent: All five
test:lines pass, as do the supplementary tests this task adds outside them (threedynamic_ingress_decision/ExposeRefusalunit tests in net/policy.rs, the session-channel test in env.rs, and theGetLiveIngressround-trip in minimald-rpc — one batched run, 5 passed).cargo fmt --all -- --check,cargo clippy -p minimald -p minimal -p minimald-rpc --all-targetsandjust clippy-strictare all clean; the strict gate's ten hits on the new lines are quieted by#[expect]markers in the third commit. Three things the next slice should know: (1) a publish needs the address pair fromrecord.box_addresses— the T66 hand a VM host's registration gives the box — and the registry's own switch-lease map (net/dns.rs) is private with no accessor, so a native host's self-allocated box is refused with the typedNoPublishedAddressrather than published at its lease; closing that gap means an accessor on the lease book or recording the pair for self-allocated boxes, both outside this task's layers. (2)dynamic_ingress: askfails closed withAskNeedsAnswer— the attached-human prompt is NET-045. (3) the box's relaySessionGateadmits inbound by declared internal ports only, so a dynamically published port binds and lists but is not yet admitted through the box's gate; that is the listen-published set of NET-016/017. Also:GetLiveIngressresolves the sess…[truncated]Tests
cargo nextest run -p minimald expose_unenrolled_local_rpc_evaluates_dynamic_ingresscargo nextest run -p minimald expose_allow_publishes_and_listscargo nextest run -p minimald expose_deny_typed_errorcargo nextest run -p minimald expose_rejected_leaves_no_partial_mappingcargo nextest run -p minimal policy_shows_live_mappingsVerify
min task run agent-verifypassed ([tasks.verify]).Base
The base branch moved while the coder worked and was merged in before the tests ran. These files changed on BOTH sides since the branch point — read them first, because a rewrite from a stale reading can undo a merge without a conflict:
crates/minimald/src/session.rsCloses #1666