mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-02 07:34:45 +08:00
Piotr Mlocek
aead95b7ab
* fix(policy): propose rules for unknown DNS hosts Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * docs(policy): clarify synthetic DNS use across protocols Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(policy): harden unknown-host DNS observations - Emit the policy_dns_ineligible denial for every unknown name and report observation staging failures as DNS failure events. - Refuse unknown names during fail-closed quarantine and after the observation budget, now a quarter of each address family's pool. - Pin transparent TCP to the mapping of the deciding policy generation so a reload between DNS and authorization fails closed. - Stop Docker workloads from inheriting host DNS search domains, which let the first expanded short name claim an observation address. - Share mechanistic draft polling in conformance, register new-hostname-proposal in the installed suite, and update docs. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * test(policy): build policy DNS proxy tests on every target The proxy tests name PolicyEndpointId, which proxy.rs imported only on Linux, so the macOS test build failed. Import it for test builds too. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * fix(policy): name DNS queries and mapped hosts in OCSF denials DNS denial and failure events attached port 53 to the queried name, which read as a connection to that host. They now carry only the name. Transparent TCP denials for a policy DNS address show the mapped hostname and keep the synthetic address in dst_endpoint.ip. Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> --------- Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>