ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace external reachability with an owned canary

Browse source
This commit is contained in:
ms2k 2026-07-19 22:39:31 +09:00
commit 31e9ab0f2d
3 changed files with 1409 additions and 1972 deletions
Download patch file Download diff file Expand all files Collapse all files

1
crates/lazaret-core/tests/schema_records/documents.rs
View file

@ -175,7 +175,6 @@ fn trusted_host_configuration_postcard_dispatch_rejects_unknown_schema() {
persistent_dirs: vec![],
allow_egress: vec![],
deny_egress: vec![],
readiness: NetworkReadinessConfigurationV1::default(),
env: BTreeMap::new(),
volumes: vec![],
escalation: EscalationConfigurationV1::default(),

59
crates/lazaret-core/tests/schema_records/encoding.rs
View file

@ -531,29 +531,7 @@ fn every_schema_shape_round_trips_and_rejects_malformed_or_unknown_versions() {
verify_shape(network_observation(), &mut seen);
verify_shape(PolicyDelivery::SealedMemfd, &mut seen);
verify_shape(readiness_identity(), &mut seen);
verify_shape(reachability_probe(), &mut seen);
verify_shape(
DeniedDestinationObservation {
destination: IpAddress::V4([10, 0, 0, 1]),
unreachable: true,
},
&mut seen,
);
verify_shape(
PermittedDestinationObservation {
destination: IpAddress::V4([1, 0, 0, 1]),
reachable: true,
},
&mut seen,
);
verify_shape(
DnsObservation {
resolver: IpAddress::V4([9, 9, 9, 9]),
query_name: "example.invalid".into(),
resolved_addresses: vec![IpAddress::V4([203, 0, 113, 1])],
},
&mut seen,
);
verify_shape(canary_observation(), &mut seen);
verify_shape(
DomainStore {
metadata: DomainStoreMetadata::v1(),
@ -606,20 +584,6 @@ image = "example.invalid/agent:v1"
}],
effective_allow_prefixes: vec![([1, 1, 1, 1], 32)],
effective_deny_prefixes: vec![([10, 0, 0, 0], 8)],
network_readiness: ResolvedNetworkReadinessV1 {
denied: vec![ResolvedNetworkProbeTargetV1 {
address: [10, 0, 0, 1],
port: 9,
}],
permitted: vec![ResolvedNetworkProbeTargetV1 {
address: [1, 1, 1, 1],
port: 443,
}],
dns: vec![ResolvedDnsProbeTargetV1 {
resolver: [8, 8, 8, 8],
query: "example.invalid".into(),
}],
},
escalation_enabled: true,
auto_approval_rules: vec![ResolvedAutoApprovalRule {
canonical_executable: HostPath::new(b"/usr/bin/true".to_vec()),
@ -654,23 +618,6 @@ image = "example.invalid/agent:v1"
},
&mut seen,
);
verify_shape(
ResolvedNetworkReadinessV1 {
denied: vec![ResolvedNetworkProbeTargetV1 {
address: [10, 0, 0, 1],
port: 9,
}],
permitted: vec![ResolvedNetworkProbeTargetV1 {
address: [1, 1, 1, 1],
port: 443,
}],
dns: vec![ResolvedDnsProbeTargetV1 {
resolver: [8, 8, 8, 8],
query: "example.invalid".into(),
}],
},
&mut seen,
);
verify_shape(
BootstrapWaitRequest {
protocol_version: ProtocolVersion::V1,
@ -693,8 +640,8 @@ image = "example.invalid/agent:v1"
assert_eq!(
seen.digest(),
[
255, 220, 6, 56, 49, 12, 147, 182, 148, 61, 218, 228, 124, 211, 136, 128, 186, 186,
138, 239, 246, 197, 75, 0, 75, 85, 27, 244, 21, 21, 246, 41,
245, 169, 157, 164, 67, 211, 165, 23, 129, 62, 119, 92, 247, 248, 131, 4, 252, 42, 34,
214, 207, 60, 126, 219, 81, 68, 159, 6, 26, 88, 233, 108,
]
);
}

12
crates/lazaret-core/tests/schema_records/process_evidence.rs
View file

@ -370,14 +370,14 @@ fn active_network_rejects_every_mismatched_readiness_relation() {
}),
),
(
"reachability domain",
"canary domain",
generation_id(),
mutate_network_ownership(|ownership| {
ownership
.readiness_evidence
.as_mut()
.unwrap()
.reachability_probe
.canary_observation
.domain_id = other_domain;
}),
),
@ -406,14 +406,14 @@ fn active_network_rejects_every_mismatched_readiness_relation() {
}),
),
(
"reachability generation",
"canary generation",
generation_id(),
mutate_network_ownership(|ownership| {
ownership
.readiness_evidence
.as_mut()
.unwrap()
.reachability_probe
.canary_observation
.generation_id = other_generation;
}),
),
@ -502,14 +502,14 @@ fn active_network_rejects_every_mismatched_readiness_relation() {
}),
),
(
"reachability namespace",
"canary namespace",
generation_id(),
mutate_network_ownership(|ownership| {
ownership
.readiness_evidence
.as_mut()
.unwrap()
.reachability_probe
.canary_observation
.enforcement_namespace = other_namespace;
}),
),