mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-11 10:23:17 +08:00
Lior Lieberman
e517df95d4
The egress gateway is about to enforce EgressPolicy, which means two components now interpret the same hostname patterns and CIDRs: ateapi when it validates a policy, and atenet when it matches one. Putting the parsers in internal/egresspolicy and having ateapi's custom validators call them keeps "accepted by the API" and "enforceable by the gateway" the same set by construction. The package also compiles a policy once and evaluates it the way the API describes, in rule order over whatever the caller knows of the destination, first match wins: a hostname rule never matches a destination with no name, and an IP rule never matches one whose address the caller does not know. The decision says which kind of rule matched, because the gateway sends the bytes to what that rule checked. HasHostnameRules answers the question that follows, which is whether a decision point holding only an address should refuse outright or leave the destination to one that will see a name. Hostname patterns now reject any name whose last label is all digits, per RFC 1123 section 2.1, instead of consulting an IP parser. That is the same set as before for every real address and additionally refuses dotted-quad spellings such as "01.2.3.4" that no parser accepts. The actor SPIFFE ID moves to internal/resources with a parser next to the builder: ateapi mints it into the certificate's URI SAN and the egress gateway reads it back as the actor identity on the legs inside the tunnel, so both ends need the one definition.