Repository navigation
test(docker): cover controlled DNS rebinding - #53
Merged
Merged
Conversation
Add a loopback DNS resolver and a rebinding DNS server fixture that answers the first query with one address and subsequent queries with another, along with helpers to build and parse A queries and responses. These fixtures let the live Docker tests exercise DNS rebinding behaviour against a controlled server instead of a fixed resolver. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a live test that runs a loopback DNS server which rebinds to a second address after the sandbox is prepared, verifying the container stays pinned to the first answer and cannot reach the later listener. Also add a unit test for the rebinding resolver and a helper to read a container's bridge IPv4 address. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The container address parse now names Ipv4Addr explicitly so the error type is inferred correctly, and an unused container name binding in the DNS rebinding test was removed. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The live Docker helper now includes the invoked arguments and exit code in its error message, and the allowlist test fails early with both exit codes and stderr when the allowlisted listener cannot connect. This makes intermittent live-test failures diagnosable without rerunning with extra logging. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
…eners The DNS rebinding live test now runs as its own test entry point so CI can invoke it directly, and it waits for the controlled listener to be ready before probing instead of racing container startup. Cleanup on failure and a clearer assertion message were added, and the CI job runs both live network tests explicitly. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add the rustc internal compiler error report captured during a build so the failure can be referenced while investigating the underlying issue. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Delete an accidentally committed rustc internal compiler error report that was left in the repository. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The controlled DNS resolver and response parser now assume the exact single-question, single-answer shape the fixture produces instead of handling arbitrary counts, and the query id is fixed rather than incremented per call. Error messages were shortened and a redundant exit-code check was dropped, making the live test helpers easier to follow without changing what the test asserts. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Adds a controlled DNS rebinding integration test to the required rootful Ubuntu Docker lane. A test-owned UDP DNS server answers
rebinding.testwith listener #1 during sandbox planning, then returns listener #2 on the next query. The test verifies that planning performs one resolution, the container host mapping and hostname connection stay pinned to listener #1, and a direct connection to listener #2 is denied without reaching that listener.The resolver uses an explicit loopback UDP address. The test does not alter host resolver configuration, contact external DNS or services, or claim allowlist/DNS-rebinding coverage beyond this controlled native Linux Docker case.
The CI lane invokes the new exact live test under its existing required-Docker/fail-closed environment gate, in addition to the current network-policy live test.
Local validation
cargo test -p tinybox-docker loopback_dns_resolver_observes_first_and_rebound_addressescargo test -p tinybox-dockercargo fmt --all -- --checkcargo clippy --all-targets --all-features -- -D warningscargo build --all-targets --all-features --jobs 1scripts/ci-cancel-aware.sh cargo test --all-features --jobs 1All listed local checks pass. The local Docker daemon does not provide a valid enforcement result: the unchanged native allowlist positive control fails to connect to its controlled host listener (IPv4 and IPv6 both exit 1 with empty stderr). The new live test reaches its resolver and host-mapping assertions but fails its positive connectivity control for the same environment limitation. The required hosted rootful Ubuntu Docker lane must prove the positive and denied controls before this PR can be considered green.
Refs tinyhumansai#27
Part of tinyhumansai/openhuman#7328