Repository navigation
test(minimald): prove DNS steering fails closed end to end (T32) - #2550
Conversation
One case, bep_dns_steering_fails_closed_end_to_end, on a VM lane with the gvproxy switch. It starts a credentialed-lane box with the default dns steering and quic443 = "block", stops `bep serve`, and from inside the box asserts that AAAA, HTTPS and SVCB lookups of api.github.com are NODATA and that UDP to port 443 is refused within 2 s. The steered A lookup is a known gap until #2523 wires the steering into the relay's DNS gate: the case passes it on SERVFAIL and otherwise counts it as KNOWN GAP with the rcode it got.
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: every review thread resolved at @norrietaylor resolved the last thread, which releases the approval this review had withheld. Nothing to do. |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The case tests the §5.3 line 151 NODATA rule and the §5.7 line 218 UDP 443 active reject with hard assertions. It reports the steered SERVFAIL leg as a known gap on #2523. That follows the #2519 ruling. The PR body still says Closes #2289, but the proof's first clause is still open. Make the edit in C1, and keep #2289 open until the known_gap becomes a failure.
Ruled at f6e540b against gominimal/arch@109541a48c31 by claude-opus-5-5.
When the steered A lookup gets no SERVFAIL, the case records a known gap. The closing line now says so, and does not read as a full pass.
|
Round 1 of 10 on the runtime's review findings, pushed as
Verify Review threads the coder judged:
With the proxy down, the e2e case checks that the steered A lookup answers SERVFAIL, that AAAA, HTTPS and SVCB answer NODATA, and that UDP 443 from a quic443 = "block" box is refused within 2000 ms. The closing line now claims a full pass only when the A lookup got SERVFAIL. When it did not, the line names the known gap (#2523). Notes from the agent: This round changes only the closing line of proof_bep_dns_steering_fails_closed_end_to_end. The case did not execute here because there is no KVM and no gvproxy, so the e2e lane still owes the evidence. bash -n and shellcheck -S warning are clean. |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The compare fixes the closing line. It no longer claims a full pass when the steered A lookup is a known gap. Legs 2 and 3 are hard assertions of §5.3 lines 150 and 151. Leg 1 is still a known gap on #2523, and §5.3 line 147 requires fail-closed. That leg is open, and C1 makes it a hard failure when #2523 lands. No leg ran in this sandbox, so the ci-macos just e2e run is the first proof of legs 2 and 3.
Ruled at b2198c2 against gominimal/arch@109541a48c31 by claude-opus-5-5.
There was a problem hiding this comment.
minimal-review — approval withheld
Verdict COMMENT — APPROVE withheld: 3 unresolved threads — minimal-foundry[bot] scripts/session-e2e.sh, minimal-arch[bot] scripts/session-e2e.sh:12290, minimal-arch[bot] scripts/session-e2e.sh:12290. No findings.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of b2198c2c15ff withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Babysitter approval at b2198c2: every merge gate passes at this head (arch PASS_WITH_CONDITIONS at b2198c2 whose condition is a filed residual owned by #2523 and T58 #2538, zero open threads, every lane aggregator green including ci-macos-success). The PR keeps Closes #2289 by the epic owner's ruling. Squash title test(minimald): prove DNS steering fails closed end to end (T32) and the squashed message pass commitlint. Queued for squash merge.
Generated by Claude Code
T32 — DNS steering fails closed, end to end
slice: S4
kind: integration
covers: none
size: M
est: 80 code, 120 tes 8000 ts
executor: agent
difficulty: needs care
model: standard
diagnostics: the bundle's daemon log tail carries the SERVFAIL answers and the rejected datagrams of the run
observability: the warn and debug lines both tasks emit, in one run
layers:
- e2e:
- scripts/session-e2e.sh: one case: stop the proxy, resolve a steered name, query its HTTPS record, send QUIC to 443
test: ./scripts/session-e2e.sh bep_dns_steering_fails_closed_end_to_end
produces: none
consumes: none
proof: A steered name answers SERVFAIL while the proxy is down, AAAA, HTTPS and SVCB answer NODATA, and UDP 443 from a blocked box is rejected at once.
depends on:
- blocked by #2281
- blocked by #2282
Proof
Partly delivered. On a VM lane with the gvproxy switch, ./scripts/session-e2e.sh bep_dns_steering_fails_closed_end_to_end starts a credentialed-lane box with the default dns steering and quic443 = "block", then stops bep serve. It asserts that AAAA, HTTPS and SVCB lookups of api.github.com are NODATA, and that UDP to 192.0.2.1:443 is refused with 'Connection refused' in under 2 s. The proof's first clause, a steered name that answers SERVFAIL while the proxy is down, is not true at this branch. The case reports that leg as KNOWN GAP on issue #2523 and does not count it as passed.
Notes from the agent: 1. The SERVFAIL leg cannot pass at this branch head. DnsGate::with_steering and ProxyListenerState exist (#2519), but no production code calls them. Their own comments say this and name #2523. A steered A lookup is forwarded to real DNS. The case passes this leg when it gets rcode 2. Otherwise it calls known_gap with the rcode it got. When #2523 lands, change that known_gap to a fail.
2. Activation refuses a box that has a broker secret and dns steering on every host. crates/minimal/src/cmd/boxes/create.rs uses HostFacts::LOCAL, which sets box_zone_resolver: false (BEP-017). So the case gets its credentialed lane from --credentialed-upstream with no secret. quic443 = "auto" blocks only with a credentialed secret, so the case declares quic443 = "block". Once a box with a secret can use dns steering, a box with a GitHub grant is the closer match to the task.
3. Nothing in the case ran on this box. The test line exits 0 with NOT RUN because there is no E2E_VM and no MINVMD_GVPROXY_BIN. The NODATA and UDP 443 legs are hard assertions, but they are not yet exercised. They need a run on a VM lane (macOS HVF, or Linux KVM with gvproxy). On macOS the case kills 'bep serve --listener /minimal/providers/local-minvmd0/gvproxy-bep.sock'. On other VM lanes no proxy runs, so the proxy is down from the start.
4. Observabi…[truncated]
Tests
./scripts/session-e2e.sh bep_dns_steering_fails_closed_end_to_endVerify
min task run agent-verifyexited 101 under rustc 1.98.1, which the repository does not pin (1.97.0 in rust-toolchain.toml); the PR is not a draft on that alone — CI, which honours the pin, is the gate.Residuals
bep_dns_steering_fails_closed_end_to_end(the steered A lookup failing closed while the proxy is down, Networking §5.3 line 147) stays aknown_gapuntil steering is wired in production by T113 — Admit dns and both steering where the host's switch resolves box names #2523, implemented by T58 (T58 — Steer a dns or both box's credentialed names through the relay's gate in production #2538). T58's layers now include turning that leg into a hardds_failassertion (arch C1 at b2198c2). This PR keepsCloses #2289under the epic owner's residuals rule; the open leg is owned by T113 — Admit dns and both steering where the host's switch resolves box names #2523 and T58.Closes #2289
Generated by Claude Code