ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Require explicit canonical network readiness targets

Browse source
This commit is contained in:
ms2k 2026-07-16 20:41:13 +09:00
commit fbd332c31f
2 changed files with 339 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

1
crates/lazaret-core/tests/schema_records/documents.rs
View file

@ -175,6 +175,7 @@ fn trusted_host_configuration_postcard_dispatch_rejects_unknown_schema() {
persistent_dirs: vec![],
allow_egress: vec![],
deny_egress: vec![],
readiness: NetworkReadinessConfigurationV1::default(),
env: BTreeMap::new(),
volumes: vec![],
escalation: EscalationConfigurationV1::default(),

31
crates/lazaret-core/tests/schema_records/encoding.rs
View file

@ -514,6 +514,20 @@ image = "example.invalid/agent:v1"
}],
effective_allow_prefixes: vec![([1, 1, 1, 1], 32)],
effective_deny_prefixes: vec![([10, 0, 0, 0], 8)],
network_readiness: ResolvedNetworkReadinessV1 {
denied: vec![ResolvedNetworkProbeTargetV1 {
address: [10, 0, 0, 1],
port: 9,
}],
permitted: vec![ResolvedNetworkProbeTargetV1 {
address: [1, 1, 1, 1],
port: 443,
}],
dns: vec![ResolvedDnsProbeTargetV1 {
resolver: [8, 8, 8, 8],
query: "example.invalid".into(),
}],
},
escalation_enabled: true,
auto_approval_rules: vec![ResolvedAutoApprovalRule {
canonical_executable: HostPath::new(b"/usr/bin/true".to_vec()),
@ -548,6 +562,23 @@ image = "example.invalid/agent:v1"
},
&mut seen,
);
verify_shape(
ResolvedNetworkReadinessV1 {
denied: vec![ResolvedNetworkProbeTargetV1 {
address: [10, 0, 0, 1],
port: 9,
}],
permitted: vec![ResolvedNetworkProbeTargetV1 {
address: [1, 1, 1, 1],
port: 443,
}],
dns: vec![ResolvedDnsProbeTargetV1 {
resolver: [8, 8, 8, 8],
query: "example.invalid".into(),
}],
},
&mut seen,
);
assert_eq!(seen.len(), IMPLEMENTED_SERIALIZED_SCHEMA_TYPE_NAMES.len());
assert!(