ducoterra
144e322391
Everything else in the file gates egress, which left an everyday request unanswered: the agent starts a dev server inside the sandbox and a human wants to look at it. This puts a listener on the host that forwards into the container, so a browser, curl or an API tester reaches the server the sandboxed process runs. `--publish [ADDR:]HOST:CONTAINER`, config `publish` and AISB_PUBLISH, repeatable, with the cost named in the flag: it is ingress, so whatever that server serves is reachable from the address it binds. The default address is 127.0.0.1 because a bare podman -p binds every interface (measured) -- a port committed in a repo config must not quietly be a port on the LAN. publish_addr changes the default machine-wide; a spec with a non-loopback address warns on every run. The grammar is smaller than podman's on purpose: one port per entry, no ranges, no /udp, no `*` -- this list is reviewed line by line, and typing 0.0.0.0 is the whole warning. An address means three parts, so `127.0.0.1:8000` is refused rather than guessed. No -p alias: that flag belongs to the harness (claude -p prints). Fail closed, as elsewhere: --net none cannot forward a port and podman discards the mapping while starting the container anyway, so "it ran" would mean "nothing is listening"; a host port already in use is named before the container starts, not after a build; pick_port() will not hand the gate a port this run publishes. The container is labelled with the ports it was given, and doctor reports them. Inside, publish_rules() accepts tcp on the published ports in the input chain and never the output one. Measured (docs/networking.md): pasta delivers the connection over loopback, so that rule counts 0 packets on the reference host; it is there for a host or a bridge network that delivers on the interface, and so that `nft list table inet aisb` answers "what can reach this container". The ports are validated again inside the entrypoint, because a ruleset is not somewhere to splice an unvalidated string. And the measurement that makes a configured preview look broken: a server bound to 127.0.0.1 inside answers inside and refuses the published port outside, so dev servers must bind 0.0.0.0 -- both skills say so in the change that writes the port. Tests. Unit: the grammar and every port list that looks right and is not, config/env/flag precedence and dedup, the canonical spec in --print-policy, the `# ingress:` header, the flags reaching the invocation before the image, egress enforcement byte-identical with a port open, which chain the rule lands in and that a non-numeric port never reaches nft as code. e2e (tests/e2e/13_publish.sh): one real container with enforce=nft where the host gets its 200 and the same run still refuses a domain outside the allowlist at 403, the server runs as uid 1000 with no capabilities so it cannot widen its own port, and the host listener is gone when the container exits. LLM-Generated: true
64 lines
3.4 KiB
Bash
Executable File
64 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# tests/unit/05_policy.sh -- how allow entries are classified.
|
|
source "$TESTS/lib.sh"
|
|
|
|
PROJ="$WORK/proj"; mkdir -p "$PROJ"; cd "$PROJ" || exit 1
|
|
export AISB_CONFIG_DIR="$WORK/cfg-empty"; mkdir -p "$AISB_CONFIG_DIR"
|
|
|
|
direct_line() { printf '%s' "$1" | grep '^direct=' | cut -d= -f2-; }
|
|
|
|
t_name "domains go to the gate, not to netfilter"
|
|
sb --print-policy --net allow --allow api.openai.com
|
|
assert_contains "gate_domains=api.openai.com" "domain listed for the gate"
|
|
assert_eq "" "$(direct_line "$OUT")" "no netfilter entry for a domain in gate mode"
|
|
assert_contains "proxy=100.64.0.1:18081" "gate address is the proxy"
|
|
|
|
t_name "IP and CIDR entries become direct rules"
|
|
sb --print-policy --net allow --allow 10.0.0.5:5432
|
|
assert_eq "direct=10.0.0.5 5432" "$(printf '%s' "$OUT" | grep '^direct=')" "explicit host:port"
|
|
sb --print-policy --net allow --allow 10.1.0.0/16
|
|
assert_eq "direct=10.1.0.0/16 80,443" "$(printf '%s' "$OUT" | grep '^direct=')" "CIDR gets the default ports"
|
|
sb --print-policy --net allow --allow 10.0.0.5:5432 --allow 10.9.9.9
|
|
assert_eq "direct=10.0.0.5 5432;10.9.9.9 80,443" "$(printf '%s' "$OUT" | grep '^direct=')" "several direct entries"
|
|
|
|
t_name "ipv6"
|
|
sb --print-policy --net allow --allow "[::1]:8080"
|
|
assert_eq "direct6=::1 8080" "$(printf '%s' "$OUT" | grep '^direct6=')" "bracketed [ipv6]:port parses"
|
|
assert_eq "direct=" "$(printf '%s' "$OUT" | grep '^direct=')" "and stays out of the ipv4 rules"
|
|
assert_contains "gate_domains=" "policy printed for an ipv6 entry"
|
|
|
|
t_name "--no-gate resolves names up front"
|
|
sb --print-policy --net allow --no-gate --allow localhost
|
|
assert_contains "direct=127.0.0.1 80,443" "localhost resolves to a direct rule"
|
|
assert_contains "proxy=none" "--no-gate has no proxy"
|
|
sb --print-policy --net allow --no-gate --allow nope.invalid
|
|
assert_rc 1 "an unresolvable name is an error, not a silent no-op"
|
|
assert_contains "could not resolve" "and it says so"
|
|
|
|
t_name "ports"
|
|
sb --allow api.openai.com:not-a-port --print-policy
|
|
assert_rc 1 "non-numeric port rejected"
|
|
sb --print-policy --net allow --allow api.openai.com:8443
|
|
assert_contains "gate_domains=api.openai.com" "domain+port still routed through the gate"
|
|
|
|
t_name "publish is its own line, because it is a different direction"
|
|
sb --print-policy --net allow --allow example.com
|
|
assert_contains "publish=" "published ports are reported even when there are none"
|
|
assert_eq "publish=" "$(printf '%s' "$OUT" | grep '^publish=')" " ... and the line is empty, not 'none'"
|
|
sb --print-policy --net allow --allow example.com --publish 8000 --publish 18080:9000
|
|
assert_contains "publish=127.0.0.1:8000:8000 127.0.0.1:18080:9000" "canonical specs: address, host port, container port"
|
|
sb --print-policy --net allow --allow example.com --publish 0.0.0.0:8000
|
|
assert_rc 1 "a two-part spec with an address is not guessed at"
|
|
|
|
# An allow entry and a published port are answers to different questions; a config that
|
|
# reads like one must not quietly become the other.
|
|
sb --print-policy --net allow --allow 100.64.0.1:5432 --publish 8000
|
|
assert_contains "direct=100.64.0.1 5432" "the allow entry stayed an egress rule"
|
|
assert_contains "publish=127.0.0.1:8000:8000" "and the published port stayed ingress"
|
|
|
|
t_name "mixed list"
|
|
sb --print-policy --net allow --allow api.openai.com --allow 10.0.0.5:5432 --allow files.pythonhosted.org
|
|
assert_contains "api.openai.com" "domain 1"
|
|
assert_contains "files.pythonhosted.org" "domain 2"
|
|
assert_contains "10.0.0.5 5432" "ip entry"
|