Repository navigation
feat(minimald): route the documented host literal on a native daemon (T116) - #2715
norrietaylor merged 5 commits into
Conversation
A /24 switch carved from the default /16 now maps 100.64.255.254 to the host loopback and lists it as a gateway virtual IP, so the literal reaches what host.min.internal reaches. The /16 renders as before.
The relay's deprecation notice now watches 100.64.255.254, the default subnet's host alias, so a frame to host.min.internal on a carved /24 switch is never called deprecated. On such a switch the egress verdict decides the literal as the switch's own alias. The notice is a warn line.
…nted-host-literal-routes-and-notices-o
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Approved: no findings at Nothing to do. Clobber: none seen. |
There was a problem hiding this comment.
arch-review: PASS_WITH_CONDITIONS · 1 condition · the full ruling
The change routes 100.64.255.254 as host.min.internal on a carved /24 switch, and it keeps that reach default-deny. Section 7.1 line 248 requires this. The relay decides the literal as the switch alias, and a DNS pin cannot lift that drop. On a carved switch the literal is now one of the switch's own addresses. Section 5.3 line 146 says the rebinding deny set always refuses these, but that set holds only the carved alias. Add the literal to the fixed deny set, as C1 says. C1 can merge open as a filed residual.
Ruled at 87e597f against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
/revise Close arch condition C1 from the ruling at
Generated by Claude Code |
…nted-host-literal-routes-and-notices-o
On a carved /24 switch the literal 100.64.255.254 is a gateway virtual address mapped to the host loopback, so the rebinding deny set must refuse it like the switch's own alias.
There was a problem hiding this comment.
arch-review: PASS · the full ruling
The change conforms to design §7.1 line 248 and §5.3 line 146. On a carved switch, the literal 100.64.255.254 gets the verdict of the switch alias. The rebinding deny set now refuses the literal, the same as the alias. The deprecation line watches the literal only. No condition is open.
Ruled at 566ad48 against gominimal/arch@109541a48c31 by claude-opus-5-5.
|
Round 1 of 10 on a /revise note, pushed as
Verify Outside the task's
Converted to a draft: something above needs a person before review. Review threads the coder judged:
On a native Linux daemon a box on a carved /24 switch that connects to 100.64.255.254 reaches what host.min.internal reaches, and the daemon log records the deprecation for that box. A connection by name records none. No DNS answer, a box-zone answer included, can resolve a name to 100.64.255.254 on that switch, because the rebinding deny set refuses it as one of the switch's own addresses. Notes from the agent: Revise round 1 closes arch condition C1. crates/boxes/src/core/egress.rs is outside the task layers. The directive asked for the InfrastructureDenySet::with_host_literal builder there, so I touched it on purpose. In switch.rs, node_dns_layer() and BoxGate::for_session_steered() now build their deny set through one new helper, infrastructure_deny_set(subnet). The helper adds the literal as a /32 when documented_host_literal() is Some. The new test is rebinding_refuses_documented_literal_on_a_carved_switch. clippy -p minimald -p boxes --all-targets is clean. I did not run just clippy-strict. |
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — every review thread is resolved; @norrietaylor closed the last one. The review of 566ad488b5e2 withheld this approval on the threads open then. Posted as a comment: the App cannot approve its own pull request; the check and the label carry it.
There was a problem hiding this comment.
Babysitter review at 566ad488. I read the switch, minimald and boxes changes against T116's plan block. On a carved switch, crates/switch maps the documented host literal to the host loopback, and the daemon relay routes it as host.min.internal routes, with one deprecation warn line naming the literal. A connection by name records no deprecation. infrastructure_deny_set (switch.rs:613) adds the literal to the rebinding deny set for both the node DNS layer and the steered box gate, which closes arch C1. The three test lines in the PR body pass. The boxes builder is a recorded layer exception. No findings.
Generated by Claude Code
|
/review The minimal-review run on 566ad48 (check run 122697803118) has been in progress since 07:55Z and never finished. Re-run the review on this head. Generated by Claude Code |
There was a problem hiding this comment.
Babysitter approval at 566ad48: every merge gate passes at this head (arch PASS at 566ad48, zero open threads, every lane aggregator green). Squash title feat(minimald): route the documented host literal on a native daemon (T116) and the squashed message pass commitlint. Queued for squash merge.
Generated by Claude Code
T116 — The documented host literal routes and notices on a native daemon
slice: S18
kind: task
covers: NET-004
size: M
est: 120 code, 180 tests
executor: agent
difficulty: routine
model: standard
diagnostics: a person reads the daemon log, which carries the rate-limited deprecation line for a frame to the literal address, naming the box, and none for a frame to
host.min.internalobservability: one rate-limited warn line per box per interval on the relay span when a frame goes to the literal address, and no line for the switch's own alias
layers:
- switch:
- crates/switch/src/lib.rs: the gvproxy config for a /24 switch carved from the default /16 also maps the documented literal
100.64.255.254to the host loopback and carries it as a gateway virtual address, so the literal reaches whathost.min.internalreaches; the /16 switch a guest daemon uses renders as it does todaytest: cargo nextest run -p switch gvproxy_config_maps_documented_literal_on_a_slash_24
- relay:
- crates/minimald/src/net/switch.rs: the relay's deprecation notice watches the documented literal (the default subnet's host alias) instead of the attached switch's alias, so a frame to the supported name is never called deprecated; the egress verdict for the literal stays the verdict for the alias (minimal#2636's proposed fix)
test: cargo nextest run -p minimald legacy_host_literal_routes_with_deprecation
test: cargo nextest run -p minimald relay_notices_documented_literal_not_the_switch_alias
produces: none
consumes: none
proof: On a native Linux daemon a box that connects to
100.64.255.254reaches whathost.min.internalreaches and the daemon log records the deprecation, while a connection by name records none.Proof
On a native Linux daemon, who 8000 se switches are /24 blocks carved from 100.64.0.0/16, the gvproxy config now maps 100.64.255.254 to the host loopback and lists it as a gateway virtual IP. A box that connects to 100.64.255.254 reaches what host.min.internal reaches, and gets the same egress verdict as the switch alias. The daemon log carries one rate-limited warn line per box that names the box (switch_addr), the literal and host.min.internal. A connection by name goes to the switch's own alias and logs no deprecation line. The /16 switch of a guest daemon renders as before.
Notes from the agent: New helper SwitchSubnet::documented_host_literal() in the switch crate. It returns the literal only for a subnet carved from the default /16 that does not hold the literal itself. On a switch outside the default block (a custom subnet), the relay still notices the literal but does not decide it as the switch alias, because that switch does not map it. On the default /16 the literal is the switch alias, so a frame sent by name there still notices: a frame does not carry the name it was resolved from (unchanged behaviour). The deprecation line moved from info to warn, per the task's observability field. Its text is unchanged. The verdict reads a copy of the frame with its destination rewritten to the switch alias. The forwarded frame is unchanged, and the drop warning still names the literal. The proof is shown by unit tests only. No live gvproxy or native daemon ran on this box. Extra runs: cargo nextest run -p switch (63 passed), cargo nextest run -p minimald net:: (381 passed), cargo clippy -p minimald -p switch --all-targets (clean). The first switch test run timed out at 20 minutes during a cold git fetch of the topiary dependency. The re-run passed.
Layer exception
crates/boxes/src/core/egress.rsis outside T116's layers. Arch condition C1 at87e597fd(arch_rulings 499, §5.3 line 146) puts the documented host literal into the fixed class ofegress::InfrastructureDenySet, because on a carved switch it is one of the switch's own addresses. The deny set lives inboxes, so round 1 added a builder there that holds the literal as a/32. It adds no behaviour beyond that class entry.Tests
cargo nextest run -p switch gvproxy_config_maps_documented_literal_on_a_slash_24cargo nextest run -p minimald legacy_host_literal_routes_with_deprecationcargo nextest run -p minimald relay_notices_documented_literal_not_the_switch_aliasVerify
min task run agent-verifypassed ([tasks.verify]).Base
The base branch moved while the coder worked; it was merged in before the tests ran.
Closes #2698
Generated by Claude Code