fix(network-policy): respect SECUSCAN_ALLOW_LOOPBACK_SCANS for loopback targets#2053
fix(network-policy): respect SECUSCAN_ALLOW_LOOPBACK_SCANS for loopback targets#2053i-OmSharma wants to merge 2 commits into
Conversation
…ck targets Fixes utksh1#2047 by skipping denylist match for loopback IP addresses (127.0.0.1 and ::1) when settings.allow_loopback_scans is enabled in Network Policy. This brings network_policy.py in alignment with validation.py and fixes the default Quick Start experience for fresh installs. - Added TestLoopbackExemption test suite in testing/backend/unit/test_network_policy.py. - Preserved strict validation for webhook egress targets to prevent SSRF vulnerabilities. Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
There was a problem hiding this comment.
Pull request overview
This PR fixes an inconsistency where SECUSCAN_ALLOW_LOOPBACK_SCANS was honored by Safe Mode but ignored by the Network Policy engine, causing default installs to block loopback targets like 127.0.0.1 and breaking the Quick Start workflow.
Changes:
- Updated
NetworkPolicyEngine.check_access()to exempt loopback targets from denylist evaluation whensettings.allow_loopback_scansis enabled. - Added unit tests covering IPv4/IPv6 loopback allow/deny behavior under the flag, while ensuring non-loopback denylist rules remain enforced.
- Updated
.env.examplecommentary to document the setting’s intent.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
backend/secuscan/network_policy.py |
Adds a loopback exemption in denylist evaluation when allow_loopback_scans is enabled. |
testing/backend/unit/test_network_policy.py |
Adds loopback exemption test coverage and updates legacy assumptions about unconditional loopback blocking. |
.env.example |
Documents the loopback setting’s relationship to Safe Mode and Network Policy. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Applies to both Safe Mode (validation.py) and Network Policy (network_policy.py) — | ||
| # both gates must independently permit loopback, and both key off this one setting. |
There was a problem hiding this comment.
Updated the documentation in .env.example and tightened the inline commentary in network_policy.py to explicitly clarify that SECUSCAN_ALLOW_LOOPBACK_SCANS governs scan-target validation (check_access()) only, and does not alter validate_egress_target(), which continues to block loopback targets unconditionally for webhook egress.
Pushed in the latest commit!
Clarified in .env.example and network_policy.py that SECUSCAN_ALLOW_LOOPBACK_SCANS applies strictly to scan-target validation (check_access) and does not relax webhook egress validation (validate_egress_target).
Description
Resolves #2047.
SECUSCAN_ALLOW_LOOPBACK_SCANS(defaultTrue) was previously honored by Safe Mode (validation.py) but ignored by Network Policy (network_policy.py), which unconditionally blocked127.0.0.0/8via its default denylist. This caused default Quick Start installations to fail out-of-the-box when running local scans (e.g.,127.0.0.1).Changes Included
backend/secuscan/network_policy.py): Updated denylist evaluation to skip denylist matching for loopback targets (ip.is_loopback) whensettings.allow_loopback_scansis enabled.validate_egress_target()to avoid SSRF vectors.testing/backend/unit/test_network_policy.py): AddedTestLoopbackExemptiontest class covering:127.0.0.1IPv4 target allowed whenallow_loopback_scans=True.::1IPv6 loopback target allowed whenallow_loopback_scans=True.127.0.0.1blocked whenallow_loopback_scans=False.10.0.0.1,169.254.169.254) remain strictly blocked regardless of flag setting..env.example): Added inline commentary clarifying thatSECUSCAN_ALLOW_LOOPBACK_SCANSgoverns both Safe Mode and Network Policy gates.Verification
32/32passed intest_network_policy.py.rufflint checks: all clean.Fixes #2047