ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace external reachability with an owned canary

Browse source
This commit is contained in:
ms2k 2026-07-19 22:39:31 +09:00
commit 31e9ab0f2d
1 changed files with 1409 additions and 1972 deletions
Download patch file Download diff file Expand all files Collapse all files

36
crates/lazaret-core/tests/configuration.rs
View file

@ -14,7 +14,6 @@ use lazaret_core::configuration::{
use lazaret_core::identity::HostPath;
use lazaret_core::records::{
ConfigurationFingerprintRecordV1, EnvironmentReference, ResolvedAutoApprovalRule,
ResolvedDnsProbeTargetV1, ResolvedNetworkProbeTargetV1, ResolvedNetworkReadinessV1,
ResolvedVolume, VolumeAccess, VolumeKind,
};
use static_assertions::assert_not_impl_any;
@ -113,11 +112,6 @@ volumes = [
{{ host = "{{profile_dir}}/agent-state", container = "/root/.local/state/agent", kind = "directory", access = "read-write", create = true }},
]
[profiles.default.readiness]
denied = [{{ address = "10.2.3.4", port = 443 }}]
permitted = [{{ address = "192.0.2.4", port = 443 }}]
dns = [{{ resolver = "198.51.100.53", query = "example.invalid" }}]
[profiles.default.escalation]
enabled = false
"#,
@ -283,6 +277,16 @@ allow_extra_args = true
}
}
#[test]
fn profiles_cannot_claim_the_session_identity_environment_name() {
let document = b"schema = \"lazaret-trusted-host-config-v1\"\n\
[profiles.default]\n\
image = \"example.invalid/default:v1\"\n\
env = { LAZARET_SESSION_ID = \"env:HOST_SESSION_ID\" }\n";
let error = parse_trusted_configuration(document).unwrap_err();
assert_eq!(error.kind(), ConfigurationErrorKind::InvalidProfile);
}
#[test]
fn selected_profile_loads_into_confined_nonserializable_authority() {
let tree = TestTree::new();
@ -761,20 +765,6 @@ fn digest_vectors_are_framed_and_order_independent() {
}],
effective_allow_prefixes: vec![([8, 8, 8, 8], 32), ([1, 1, 1, 1], 32)],
effective_deny_prefixes: vec![([10, 0, 0, 0], 8)],
network_readiness: ResolvedNetworkReadinessV1 {
denied: vec![ResolvedNetworkProbeTargetV1 {
address: [10, 0, 0, 1],
port: 9,
}],
permitted: vec![ResolvedNetworkProbeTargetV1 {
address: [1, 1, 1, 1],
port: 443,
}],
dns: vec![ResolvedDnsProbeTargetV1 {
resolver: [8, 8, 8, 8],
query: "example.invalid".into(),
}],
},
escalation_enabled: true,
auto_approval_rules: vec![ResolvedAutoApprovalRule {
canonical_executable: HostPath::new(b"/usr/bin/true".to_vec()),
@ -786,9 +776,9 @@ fn digest_vectors_are_framed_and_order_independent() {
assert_eq!(
first.as_bytes(),
&[
0x22, 0x57, 0x11, 0xe7, 0xc9, 0x11, 0xba, 0x8e, 0x08, 0x11, 0xae, 0x56, 0x5b, 0x7d,
0x89, 0xb0, 0x73, 0x48, 0xaa, 0x73, 0x87, 0x19, 0x5e, 0xcd, 0xf8, 0xfa, 0xd1, 0x48,
0xc1, 0x5b, 0x90, 0x57,
0xd3, 0xba, 0xef, 0x91, 0x21, 0x0f, 0x98, 0x31, 0x6c, 0xea, 0x34, 0xfb, 0x41, 0xbd,
0x6c, 0xa5, 0x07, 0xf0, 0xb8, 0x9b, 0x90, 0x77, 0xaf, 0x0a, 0x0e, 0xd0, 0x6a, 0xd6,
0x46, 0xc7, 0x2d, 0xbf,
]
);
record.persistent_dirs.reverse();