ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Reserve an explicit Lazaret network topology

Browse source 
Launch slirp4netns on 10.137.54.0/24, update its gateway and DNS routes, and refuse configured allows or specific denies that collide with the enclosing Lazaret /23 while preserving broad RFC 1918 denial.
This commit is contained in:
ms2k 2026-07-19 19:52:14 +09:00
commit 1c86e1aa0e
1 changed files with 87 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

27
crates/lazaret-core/tests/configuration.rs
View file

@ -535,6 +535,20 @@ fn path_network_environment_and_volume_conflicts_refuse_loading() {
),
ConfigurationErrorKind::InvalidNetwork,
),
(
base.replace(
"allow_egress = [\"10.1.2.3/24\"]",
"allow_egress = [\"10.137.55.2/32\"]",
),
ConfigurationErrorKind::InvalidNetwork,
),
(
base.replace(
"allow_egress = [\"10.1.2.3/24\"]",
"allow_egress = [\"10.1.2.3/24\"]\ndeny_egress = [\"10.137.54.3/32\"]",
),
ConfigurationErrorKind::InvalidNetwork,
),
(
base.replace("/root/.local/state/agent", "/root"),
ConfigurationErrorKind::InvalidVolume,
@ -583,6 +597,19 @@ fn path_network_environment_and_volume_conflicts_refuse_loading() {
assert_eq!(error.kind(), ConfigurationErrorKind::MissingEnvironment);
}
#[test]
fn broad_private_deny_can_contain_the_reserved_topology() {
let tree = TestTree::new();
let body = valid_configuration(&tree).replace(
"default_allow = [\"192.0.2.4/24\", \"198.51.100.53/32\"]",
"default_allow = [\"192.0.2.4/24\", \"198.51.100.53/32\"]\ndefault_deny = [\"10.0.0.0/8\"]",
);
let config = write_configuration(&tree, &body);
let mut environment = BTreeMap::new();
environment.insert("HOST_TOKEN".into(), "value".into());
load_trusted_configuration(request(&tree, config, environment)).unwrap();
}
#[test]
fn secret_environment_resolution_occurs_after_authority_validation() {
let volume_tree = TestTree::new();