Repository navigation
T46 — The Box Egress Proxy sees each box by its own address, end to end - #1930
norrietaylor merged 5 commits into
Conversation
Add the proxy_sees_boxes_by_address case to the ONE session e2e script: one scenario on one VM host daemon that reads every half of the Box Egress Proxy's view of a box together — the delivery's identity, the attachment's lifecycle, the lane's necessity, and the host process's absence, each named in the daemon's own log. Two deny-all boxes on credentialed lanes connect at once and each acceptor answer names its own box's switch address, never the other box's; the case prints each answer, the source as the acceptor saw it. The pool's delivered records name the same source, and the attachment issue lines precede them — NET-133's "ahead of the box's first connection" read as positions in the case's own log window. A third box with no lane gets silence at the proxy's address (its control probe to the node's own address reset through the same fabric, the host gate's log silent), so only a box with a credentialed lane reaches the acceptor. A process outside every box connects straight to the acceptor's own unix socket and is refused before it is presented: zero bytes answered, the refusal audited with the per-OS reason (the peer's pid on Linux, the missing token off it). Box A's end withdraws its attachment with its row while box B's second connection is still answered from its own address. The case is VM-lane-only: every surface it reads is the VM host daemon's, so it gates like the unpublished-port case (E2E_VM, then a writable /dev/kvm on Linux, then MINVMD_GVPROXY_BIN) and self-skips where they do. Its name joins the auto-set KVM-env block so the bare task test line behaves as the KVM lane, like the ones before it, and the header case list also gains the two credentialed-lane entries the dispatch already ran but the list never named.
…ress-proxy-sees-each-box-by-its-own-ad
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
…ress-proxy-sees-each-box-by-its-own-ad Union of the two case additions that met in the dispatch order and the header docs: this branch's proxy_sees_boxes_by_address (NET-132/133/134 end to end) and main's published_proxy_routes_from_host (NET-059/081, from T86). Each proof stops and respawns its own daemon pair, so both run late in the whole-lane order, immediately before the daemon-fetch proof, either side intact.
…ress-proxy-sees-each-box-by-its-own-ad # Conflicts: # scripts/session-e2e.sh
|
Round 1 of 1 on a conflict with the base branch, pushed as Resolved conflicts in:
Verify Converted to a draft: something above needs a person before review. On the merged branch the proxy_sees_boxes_by_address case is intact and dispatched beside main's new published_proxy_routes_from_host case: on a KVM host with a switch it shows two credentialed-lane boxes answered at the proxy's acceptor each from its own switch address, a host process refused and audited, one host-issued attachment per live box withdrawn with the ended box, and a laneless box silent at the proxy's address — this host has no /dev/kvm, so the case ran to its skip gate here and those assertions were not observed in this session; the KVM CI lane is where they print. Notes from the agent: Revise round 1 was a conflict-only round (directive listed no threads). Resolved the single conflicted path, scripts/session-e2e.sh, in all six marker regions (header case docs, seed-dir vars, teardown, whole-lane order, single-case dispatch, usage list) as a union of the two case additions that met: this branch's proxy_sees_boxes_by_address and main's published_proxy_routes_from_host from T86 (#1905). Both are late-order proofs that stop and respawn their own daemon pair first (cred_begin / the PUBP preamble), so each stays self-contained in the merged whole-lane order, which keeps the daemon-fetch proof last as both sides had it. Verified the resolution is exact: the merged file differs from the branch parent by exactly main's +170 lines and from main by exactly this branch's +549/-6; bash -n is clean; the run built the min + minvmd pair from the merged tree without error, which also compiles the crate changes the merge carried in (crates/minimald, crates/minvmd, crates/sandbox2, crates/sessions — staged by the runner's merge, not edited by me). The test line's case self-skipped at its built-in /dev/kvm gate: no /dev/kvm and no MINVMD_GVPROXY_BIN on this box, so the VM-host-daemon diagnostics the case owes (each attachment, each delivery, each connection's source as the acceptor saw it) run on the ci-linux-kvm lane, not here. Nothing outside the layers w…[truncated] |
|
The runtime will not revise this pull request again on its own: round 2 would exceed the cap of 1 (the last trigger was a conflict with the base branch). A person decides now. Remove |
# Conflicts: # scripts/session-e2e.sh
|
/review |
|
Approved: no findings at Nothing to do. Verdict APPROVE, posted as a comment: the App cannot review its own pull request; the check and the label carry it. Clobber: none. |
There was a problem hiding this comment.
Approved at 83f714a. Scope matches the T46 plan block, and ARCH passed it. The case ran its full body, not a skip branch, on both the KVM and macOS lanes, with per-box attribution printed. minimal-review concluded on this head with no open threads.
T46 — The Box Egress Proxy sees each box by its own address, end to end
slice: S10
kind: integration
covers: none
size: M
est: 60 code, 160 tests
executor: agent
difficulty: routine
model: standard
di 8000 agnostics: the VM host daemon log from the run shows each attachment and delivery
observability: the case prints each connection's source as the stand-in acceptor saw it
layers:
- e2e:
- scripts/session-e2e.sh: adds the case proxy_sees_boxes_by_address
test: ./scripts/session-e2e.sh proxy_sees_boxes_by_address
produces: none
consumes: none
proof: a box's connection reaches the proxy's stand-in acceptor (MINVMD_BEP_STUB) from its own switch address and a host process never arrives from a box address; the proxy holds an attachment per live box from outside the VM; only a box with a credentialed lane reaches the acceptor. The real acceptor's own checks are not covered; this case runs unchanged against it once it lands.
depends on:
- blocked by #1652
- blocked by #1794
- blocked by #1660
- blocked by #1665
Proof
The ONE session e2e script now has the case proxy_sees_boxes_by_address, and on a VM lane its run shows a person every half of the proxy's view of a box at once: the stand-in acceptor's answer (MINVMD_BEP_STUB) for each of two lane boxes' connections names that box's own switch address as the source (and the case prints each one, plus each delivery's own trace and each attachment's issue and withdrawal lines from the host daemon's log), a host process connecting straight to the acceptor's socket is refused with zero bytes and audited (the peer's pid on Linux, the missing token elsewhere), the daemon's log shows one attachment per live box issued ahead of each box's first delivery and withdrawn with the ended box while its sibling still answers from its own address, and a laneless box alone is silent at the proxy's address while its control probe through the same fabric is reset.
Notes from the agent: The case body cannot run on this box: no /dev/kvm, no gvproxy binary, no VM. The test line therefore validated the plumbing end to end — the auto-set KVM-env block (added, so a bare invocation behaves as the KVM lane, the same treatment the fresh-install and unpublished-port cases already get), the standalone dispatch, all three gates, the group/skip lines, and the CLI-pair build — and exited 0 on the case's designed KVM-gate skip. The body's assertions run on the VM lanes (the Linux KVM CI lane and the macOS lane, which is always VM-backed), and every pattern it uses is copied from the three sibling proxy cases that already run there (cred_begin/cred_restore/cred_fail, the socket + peer-up gates, the socat answer probe shape, the no-lane control/silence probes); every log string it greps was verified against the source that writes it (bep_attach.rs issue/withdraw, bep_host.rs delivered, bep_stub.rs refused, run.rs stand-in/peer-up). One thing beyond the layer note's strictest reading, same file, comments only: the header case list at the top of the script was missing the two T45 cre…[truncated]
Tests
./scripts/session-e2e.sh proxy_sees_boxes_by_addressVerify
min task run agent-verifyexited 101, so this PR is a draft.Base
The base branch moved while the coder worked; it was merged in before the tests ran.
Closes #1668