ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace external reachability with an owned canary

Browse source
This commit is contained in:
ms2k 2026-07-19 22:39:31 +09:00
commit 31e9ab0f2d
1 changed files with 1409 additions and 1972 deletions
Download patch file Download diff file Expand all files Collapse all files

34
crates/lazaret-core/src/configuration/validation.rs
View file

@ -68,34 +68,6 @@ pub fn derive_configuration_fingerprint(
.iter()
.map(|prefix| Ok([prefix.0.as_slice(), &[prefix.1]].concat())),
)?;
push_sorted_list(
&mut preimage,
record.network_readiness.denied.iter().map(|target| {
Ok([
target.address.as_slice(),
target.port.to_be_bytes().as_slice(),
]
.concat())
}),
)?;
push_sorted_list(
&mut preimage,
record.network_readiness.permitted.iter().map(|target| {
Ok([
target.address.as_slice(),
target.port.to_be_bytes().as_slice(),
]
.concat())
}),
)?;
push_sorted_list(
&mut preimage,
record.network_readiness.dns.iter().map(|target| {
let mut item = target.resolver.to_vec();
push_bytes(&mut item, target.query.as_bytes())?;
Ok(item)
}),
)?;
push_bool(&mut preimage, record.escalation_enabled);
push_sorted_list(
&mut preimage,
@ -128,6 +100,12 @@ pub(super) fn validate_structural_configuration(
}
for (sandbox_name, reference) in &profile.env {
validate_environment_name(sandbox_name)?;
if sandbox_name == "LAZARET_SESSION_ID" {
return Err(ConfigurationError::new(
ConfigurationErrorKind::InvalidProfile,
"environment name is reserved by Lazaret",
));
}
let host_name = reference.strip_prefix("env:").ok_or_else(|| {
ConfigurationError::new(
ConfigurationErrorKind::InvalidProfile,