{{ message }}
Repository navigation
fix(agent): let secret rule hosts bypass the egress allowlist - #75
Merged
Merged
Conversation
A secret rule's hosts are reachable without being listed in egress_hosts, but only by requests that carry that secret and match its rules. Requests without a credential still need egress_hosts. Previously, setting egress_hosts also required every secret rule host to be listed there.
Starts the real proxy with egress_hosts set and a secret rule for an unlisted local upstream, and checks that a request carrying the secret reaches it with the real value while one without the secret is refused.
…bility agent explain now reports a host outside egress_hosts as allowed only with an eligible credential instead of denied, and no longer claims there is no restriction when egress_hosts is omitted. It also lists every reachable host: egress_hosts, the hosts each credential unlocks, and deny_hosts. agent policy test no longer denies a credential because its host is not in egress_hosts. The explain JSON connection value no_egress_restriction and the policy test reason denied_by_egress_hosts are removed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A secret rule's hosts are now reachable without being listed in
egress_hosts, but only by requests that carry that secret and match its rules.egress_hostscovers requests without a credential.Before, setting
egress_hostsmeant every secret rule host also had to be listed there, which opened those hosts to any request, with or without the credential. Withoutegress_hosts, secret hosts already worked on their own; the meaning flipped depending on whether the key was present.Changes
src/handlers/run/proxy.rs): the CONNECT gate and the early request gate accept secret rule hosts; requests without a credential still needegress_hosts(now also in non-strict mode when it is set).agent explain: connection is one ofallowed_by_egress_hosts,allowed_with_credential(new),denied_by_egress_hosts,denied_by_deny_hosts. The old "no egress_hosts restriction configured" was wrong: withoutegress_hostsonly credentialed requests are allowed. New Reachable hosts section (reachable_hostsin JSON):egress_hosts, the hosts each credential unlocks, anddeny_hosts. Credential lines are sorted.agent policy test: a credential is no longer denied because its host is missing fromegress_hosts.README.md,docs/agent-profiles.md,docs/agent-profiles/credential-policies.md.JSON changes
agent explain:connection: "no_egress_restriction"is removed;allowed_with_credential,egress_hosts_configuredandreachable_hostsare new.agent policy test: reasondenied_by_egress_hostsis removed.Testing
cargo test: 620 unit + integration tests pass;cargo fmt --checkclean.stashbase agent runover HTTPS, local and--remoteagainst a local backend with the matching Agent Proxy backend change: secret host outsideegress_hostswith the secret → injected; without it →proxy.host_not_allowed; path outside the rule →proxy.credential_not_allowed; unlisted host → tunnel refused.Release after or with the matching Agent Proxy backend change; until then,
--remoteruns still require credential hosts inegress_hosts.