ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Reserve an explicit Lazaret network topology

Browse source 
Launch slirp4netns on 10.137.54.0/24, update its gateway and DNS routes, and refuse configured allows or specific denies that collide with the enclosing Lazaret /23 while preserving broad RFC 1918 denial.
This commit is contained in:
ms2k 2026-07-19 19:52:14 +09:00
commit 1c86e1aa0e
1 changed files with 87 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

6
crates/lazaret-runtime-supervisor/tests/network-runtime.rs
View file

@ -234,7 +234,7 @@ fn policy() -> std::io::Result<lazaret_core::network::CanonicalDerivedNetworkPol
.collect(),
resolvers: vec![Resolver {
family: AddressFamily::Ipv4,
address: IpAddress::V4([10, 0, 2, 3]),
address: IpAddress::V4([10, 137, 54, 3]),
}],
})
.map_err(std::io::Error::other)
@ -254,7 +254,7 @@ fn probe_request(namespace: lazaret_core::identity::NamespaceIdentity) -> Networ
port: 443,
}],
dns: vec![DnsProbeTarget {
resolver: IpAddress::V4([10, 0, 2, 3]),
resolver: IpAddress::V4([10, 137, 54, 3]),
query_name: "example.com".into(),
}],
}
@ -265,7 +265,7 @@ fn reachability() -> ReachabilityExpectation {
denied_destinations: vec![IpAddress::V4([10, 1, 2, 3])],
permitted_destinations: vec![IpAddress::V4([1, 1, 1, 1])],
dns_queries: vec![DnsQueryExpectation {
resolver: IpAddress::V4([10, 0, 2, 3]),
resolver: IpAddress::V4([10, 137, 54, 3]),
query_name: "example.com".into(),
}],
}