ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace external reachability with an owned canary

Browse source
This commit is contained in:
ms2k 2026-07-19 22:39:31 +09:00
commit 31e9ab0f2d
1 changed files with 1409 additions and 1972 deletions
Download patch file Download diff file Expand all files Collapse all files

36
crates/lazaret-core/tests/schema_records.rs
View file

@ -387,24 +387,28 @@ fn readiness_identity() -> NetworkReadinessIdentity {
})
}
fn reachability_probe() -> NetworkReachabilityProbe {
NetworkReachabilityProbe {
fn canary_observation() -> NetworkCanaryObservation {
NetworkCanaryObservation {
domain_id: domain_id(),
generation_id: generation_id(),
enforcement_namespace: namespace(),
denied_destinations: vec![DeniedDestinationObservation {
destination: IpAddress::V4([10, 1, 2, 3]),
unreachable: true,
}],
permitted_destinations: vec![PermittedDestinationObservation {
destination: IpAddress::V4([1, 1, 1, 1]),
reachable: true,
}],
dns_observations: vec![DnsObservation {
resolver: IpAddress::V4([9, 9, 9, 9]),
query_name: "example.invalid".into(),
resolved_addresses: vec![IpAddress::V6([1; 16])],
}],
linux_policy_matches: true,
endpoints_authenticated_before_policy: true,
allowed_endpoint_authenticated: true,
denied_endpoint_unreachable: true,
imported_interface_matches: true,
tap_present: true,
ipv6_absent: true,
network_capabilities_empty: true,
route_mutation_refused: true,
cleanup_shape_matched: true,
responder_closed: true,
peer_namespace_closed: true,
host_interface_deleted: true,
allowed_endpoint_unreachable_after_cleanup: true,
tap_present_after_cleanup: true,
ipv6_unchanged_after_cleanup: true,
network_admin_dropped: true,
}
}
@ -417,7 +421,7 @@ fn readiness_evidence() -> NetworkReadinessEvidence {
readiness_fingerprint: derive_readiness_fingerprint(&readiness_identity).unwrap(),
attestation: readiness_attestation(),
readiness_identity,
reachability_probe: reachability_probe(),
canary_observation: canary_observation(),
}
}