mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-17 05:31:16 +08:00
John T. Myers
2ca553a4a0
Policies with allowed_ips entries targeting loopback, link-local, or unspecified ranges now fail at connection time instead of being silently blocked at runtime. The shorthand log format for DENIED events includes a [reason:...] suffix so operators can distinguish 'allowlist miss' from 'structurally un-allowable'. The mechanistic mapper skips proposals for always-blocked destinations, preventing the infinite TUI notification loop. The gateway validates proposed rules on approval as defense-in-depth. - Extract shared IP helpers (is_always_blocked_ip, is_always_blocked_net, is_internal_ip) to openshell_core::net - Reject always-blocked entries in parse_allowed_ips with hard error - Skip implicit allowed_ips synthesis for always-blocked literal IP hosts - Add status_detail to HttpActivityBuilder for denial reason propagation - Enrich NET and HTTP shorthand with [reason:...] for DENIED events - Add engine: tag to HTTP shorthand (consistency with NET shorthand) - Filter always-blocked proposals in mechanistic mapper generate_proposals - Add validate_rule_not_always_blocked server-side defense-in-depth - Update architecture docs, published docs, and E2E test assertions
39 lines
1.0 KiB
TOML
39 lines
1.0 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
[package]
|
|
name = "openshell-core"
|
|
description = "Shared library for OpenShell - proto definitions, config, and errors"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
|
|
[dependencies]
|
|
prost = { workspace = true }
|
|
prost-types = { workspace = true }
|
|
tonic = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
miette = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
url = { workspace = true }
|
|
ipnet = "2"
|
|
|
|
[features]
|
|
## Include test-only settings (dummy_bool, dummy_int) in the registry.
|
|
## Off by default so production builds have an empty registry.
|
|
## Enabled by e2e tests and during development.
|
|
dev-settings = []
|
|
|
|
[build-dependencies]
|
|
tonic-build = { workspace = true }
|
|
protobuf-src = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
|
|
[lints]
|
|
workspace = true
|