test(sandbox): reject malformed proxy hostnames#1562
Conversation
mjamiv
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
mjamiv
force-pushed
the
test/proxy-hostname-parser-differentials
branch
from
c36faac to
9ce9fde
Compare
mjamiv
force-pushed
the
test/proxy-hostname-parser-differentials
branch
from
9ce9fde to
eee1f72
Compare
| &self, | ||
| input: &NetworkInput, | ||
| ) -> Result<(NetworkAction, u64)> { | ||
| let generation = self.current_generation(); |
There was a problem hiding this comment.
Was this moved for a specific reason? This could return a generation that doesn't map to the engine snapshot actually used for policy eval if a policy reload happens between reload and a policy reload. Off chance but non-zero. Can we keep the malformed-host fast deny separate and move generation capture back under the engine lock?
|
@mjamiv one small question but otherwise looking good |
|
Addressed the generation-capture review note in bb0875b.\n\nWhat changed:\n- malformed-host fast deny stays before policy evaluation\n- policy-evaluated network actions now capture the generation after acquiring the OPA engine lock again, so the generation maps to the engine snapshot used for eval\n\nValidation passed:\n- cargo test -p openshell-sandbox malformed\n- cargo test -p openshell-sandbox --lib\n- cargo fmt --all -- --check\n- git diff --check |
2 participants
Summary
Fixes #1498.
Testing