ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Reserve an explicit Lazaret network topology

Browse source 
Launch slirp4netns on 10.137.54.0/24, update its gateway and DNS routes, and refuse configured allows or specific denies that collide with the enclosing Lazaret /23 while preserving broad RFC 1918 denial.
This commit is contained in:
ms2k 2026-07-19 19:52:14 +09:00
commit 1c86e1aa0e
1 changed files with 87 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

40
crates/lazaret-core/src/configuration/confined_io.rs
View file

@ -384,6 +384,36 @@ pub(super) fn resolve_network(
configuration: &TrustedHostConfigurationV1,
selected: &ProfileConfigurationV1,
) -> Result<(Vec<Ipv4Prefix>, Vec<Ipv4Prefix>), ConfigurationError> {
let reserved = parse_ipv4_prefix("10.137.54.0/23")?;
for declared in configuration
.network()
.default_allow
.iter()
.chain(&selected.allow_egress)
{
if ipv4_prefixes_overlap(parse_ipv4_prefix(declared)?, reserved) {
return Err(ConfigurationError::new(
ConfigurationErrorKind::InvalidNetwork,
"configured allow overlaps Lazaret's reserved topology",
));
}
}
for declared in configuration
.network()
.default_deny
.iter()
.chain(&selected.deny_egress)
{
let denied = parse_ipv4_prefix(declared)?;
if denied.prefix_length() >= reserved.prefix_length()
&& ipv4_prefixes_overlap(denied, reserved)
{
return Err(ConfigurationError::new(
ConfigurationErrorKind::InvalidNetwork,
"configured deny conflicts with Lazaret's reserved topology",
));
}
}
let mut allow = BTreeSet::new();
let mut deny = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
.into_iter()
@ -414,6 +444,16 @@ pub(super) fn resolve_network(
Ok((allow.into_iter().collect(), deny.into_iter().collect()))
}
fn ipv4_prefixes_overlap(left: Ipv4Prefix, right: Ipv4Prefix) -> bool {
let prefix_length = left.prefix_length().min(right.prefix_length());
let mask = if prefix_length == 0 {
0
} else {
u32::MAX << (32 - prefix_length)
};
u32::from_be_bytes(left.address()) & mask == u32::from_be_bytes(right.address()) & mask
}
const MAX_READINESS_TARGETS: usize = 32;
pub(super) fn resolve_network_readiness(
readiness: &NetworkReadinessConfigurationV1,