Repository navigation
fix(minimald): allow --restore-mark, bind probe datagrams first
PASS
Baseline. This re-reviews 62b1ec1e against the PASS on 16d91608 (this PR), on arch 109541a4. The checkout has no arch-map.md, so I started from the lines the baselines cite: §4.1 line 54 and §7 line 231 of specs/networking/deployment-and-egress-gateway.md. No findings.json was staged. I checked that since.diff equals git diff 16d91608 62b1ec1e and that pr.diff equals git diff 1f4bfd63 62b1ec1e. The compare is one clean merge of main (b40e5237, no resolution hunks) and one PR commit, 62b1ec1e.
Governs. §4.1 line 54: the classifier is one cgroup-match ruleset, and a deny-all host_ip box's verdict is decided on its own cgroup. §7 line 231: the pin is dual-stack default-deny.
Ruling. 62b1ec1e makes two changes.
- It reverts the
16d91608refusal of a CONNMARK--restore-mark. A restore copies the connection mark into the packet mark and does not write the connection mark. The table reads onlyct mark(scripts/install-host-classifier.shlines 946-947 and 991-992), and no rule matchesmeta mark. So a restore cannot corrupt the classification that §4.1 depends on. The overlap scan still refuses a masked restore whose hex mask touches the classifier bits, so the scan still fails closed. The whole-mark writers stay refused: an nftct mark setof a value that is notct mark, a--set-mark/--set-xmarkwith no mask, and a--save-markwith no mask. The wg-quick fixture ininstall_refuses_a_whole_mark_ct_writeralready treatsmeta mark set ct mark(the nft restore) as safe and refuses only the save half, so the revert agrees with it. The shell harness and the unit test now pin a restore with no mask as no conflict. hold_probe_listenersnow binds its datagram endpoints before it spawns any TCP drain thread. A failed datagram bind returns before any endpoint is served or published (rule 7).
Neither change moves a §4.1 or §7 line. NET-079 conforms, as on the baseline. No condition or residual is open.
Precedent. This ruling follows the PASS on 16d91608 and on ee454d3c. It does not depart from either one. The 16d91608 ruling passed the restore refusal as a stricter scan, and the design does not require that refusal.
Not checked. No build ran, by instruction. The root-lane proofs did not run here. The PR body cites them as passed on f7cbcee5. The compare does not touch classifier_root_integration.rs or the table that those proofs load.
Ruled at 62b1ec1 against gominima 2240 l/arch@109541a48c31 by claude-opus-5-5; arch_rulings 550, job c72238cf-ce88-4a48-8578-971f2cbd9044.