ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Reserve an explicit Lazaret network topology

Browse source 
Launch slirp4netns on 10.137.54.0/24, update its gateway and DNS routes, and refuse configured allows or specific denies that collide with the enclosing Lazaret /23 while preserving broad RFC 1918 denial.
This commit is contained in:
ms2k 2026-07-19 19:52:14 +09:00
commit 1c86e1aa0e
2 changed files with 87 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

19
crates/lazaret-runtime-supervisor/src/network.rs
View file

@ -39,6 +39,11 @@ const MAX_POLICY_BYTES: u64 = 64 * 1024;
const HELPER_READY_TIMEOUT: Duration = Duration::from_secs(30);
const ROUTE_READY_TIMEOUT: Duration = Duration::from_secs(15);
const SLIRP4NETNS: &str = "/usr/bin/slirp4netns";
const SLIRP_CIDR: &str = "10.137.54.0/24";
const SLIRP_GATEWAY: &str = "10.137.54.2";
const SLIRP_GATEWAY_OCTETS: [u8; 4] = [10, 137, 54, 2];
const SLIRP_DNS_CIDR: &str = "10.137.54.3/32";
const SLIRP_DNS_OCTETS: [u8; 4] = [10, 137, 54, 3];
const IP: &str = "/usr/bin/ip";
const PROBE_TIMEOUT: Duration = Duration::from_secs(3);
const MAX_DNS_PACKET: usize = 4096;
@ -469,6 +474,7 @@ fn read_sealed_policy(
fn slirp_target(runtime: PidfsProcessIdentityV1, exit_fd: i32, ready_fd: i32) -> TargetCommand {
TargetCommand::new(SLIRP4NETNS)
.argument("--configure")
.argument(format!("--cidr={SLIRP_CIDR}"))
.argument("--mtu=65520")
.argument("--disable-host-loopback")
.argument("--enable-sandbox")
@ -552,17 +558,24 @@ fn install_policy_routes(policy: &CanonicalDerivedNetworkPolicy) -> io::Result<V
let cidr = ipv4_cidr(address, 32);
install_tap_route(&cidr, address, 32)?;
}
install_tap_route("10.0.2.3/32", [10, 0, 2, 3], 32)?;
install_tap_route(SLIRP_DNS_CIDR, SLIRP_DNS_OCTETS, 32)?;
verify_loopback_routes(&denied)?;
Ok(denied)
}
fn install_tap_route(cidr: &str, address: [u8; 4], prefix_length: u8) -> io::Result<()> {
if ipv4_network_contains(address, prefix_length, [10, 0, 2, 2]) {
if ipv4_network_contains(address, prefix_length, SLIRP_GATEWAY_OCTETS) {
run_ip(["-4", "route", "replace", cidr, "dev", "tap0"])
} else {
run_ip([
"-4", "route", "replace", cidr, "via", "10.0.2.2", "dev", "tap0",
"-4",
"route",
"replace",
cidr,
"via",
SLIRP_GATEWAY,
"dev",
"tap0",
])
}
}

6
crates/lazaret-runtime-supervisor/tests/network-runtime.rs
View file

@ -234,7 +234,7 @@ fn policy() -> std::io::Result<lazaret_core::network::CanonicalDerivedNetworkPol
.collect(),
resolvers: vec![Resolver {
family: AddressFamily::Ipv4,
address: IpAddress::V4([10, 0, 2, 3]),
address: IpAddress::V4([10, 137, 54, 3]),
}],
})
.map_err(std::io::Error::other)
@ -254,7 +254,7 @@ fn probe_request(namespace: lazaret_core::identity::NamespaceIdentity) -> Networ
port: 443,
}],
dns: vec![DnsProbeTarget {
resolver: IpAddress::V4([10, 0, 2, 3]),
resolver: IpAddress::V4([10, 137, 54, 3]),
query_name: "example.com".into(),
}],
}
@ -265,7 +265,7 @@ fn reachability() -> ReachabilityExpectation {
denied_destinations: vec![IpAddress::V4([10, 1, 2, 3])],
permitted_destinations: vec![IpAddress::V4([1, 1, 1, 1])],
dns_queries: vec![DnsQueryExpectation {
resolver: IpAddress::V4([10, 0, 2, 3]),
resolver: IpAddress::V4([10, 137, 54, 3]),
query_name: "example.com".into(),
}],
}