[LXC] Address network policy gaps - model 2 (deny-all-except-proxy) - #632

Closed

Darren Hoehna (dhoehna) wants to merge 33 commits into

microsoft:mainfrom

dhoehna:user/dahoehna/lxc-net-model2-deny-all-except-proxy

Commits on Jul 10, 2026

[LXC] Network model 2: deny-all-except-proxy (AB#62830341)

Darren Hoehna (dhoehna)
and
Copilot
committed
5f5ae13

Commits on Jul 13, 2026

[LXC] Address PR #632 review: reject localhost proxy, gate DNS in proxy mode

Darren Hoehna (dhoehna)
and
Copilot
committed
64c072e

Commits on Jul 15, 2026

Commits on Jul 20, 2026

Merge remote-tracking branch 'upstream/main' into user/dahoehna/lxc-net-model2-deny-all-except-proxy
Darren Hoehna (dhoehna)
committed
9648284

Commits on Jul 30, 2026

Commits on Aug 4, 2026

Merge remote-tracking branch 'upstream/main' into user/dahoehna/lxc-net-model2-deny-all-except-proxy
Darren Hoehna (dhoehna)
committed
7389263
[LXC] Fix Bubblewrap regression from veth-scoped firewall enforcement

Darren Hoehna (dhoehna)
and
Copilot
committed
81362b6
[LXC] Set DHCP ownership flags only after the insert succeeds

Darren Hoehna (dhoehna)
and
Copilot
committed
8df9dff
[LXC] Stop rewrite_url_host from eating a query or fragment character

Darren Hoehna (dhoehna)
and
Copilot
committed
84ac24c
[LXC] Reject loopback proxy URLs under the deny-all model

Darren Hoehna (dhoehna)
and
Copilot
committed
29cf20e
[LXC] Explicitly reject IPv6 proxy endpoints

Darren Hoehna (dhoehna)
and
Copilot
committed
ed6ee5b
[LXC] Add executable deny-all-except-proxy integration test

Darren Hoehna (dhoehna)
and
Copilot
committed
a273708
[LXC] Restore fail-closed veth invariant coverage in lxc_runner

Darren Hoehna (dhoehna)
and
Copilot
committed
7c4e03b
[bwrap] Add + register no-veth firewall regression guard

Darren Hoehna (dhoehna)
and
Copilot
committed
c5484b1
Add spec-derived black-box tests for host_is_loopback and rewrite_url_host

Darren Hoehna (dhoehna)
and
Copilot
committed
f276fb2
Un-ignore documenting tests; add characterization tests for contract gaps

Darren Hoehna (dhoehna)
and
Copilot
committed
815758a
Fix IPv6 host bracketing in rewrite_url_host and pinned_to_ip fallback

Darren Hoehna (dhoehna)
and
Copilot
committed
fff3c93
fix(proxy_env): always return true from disabled branch

Darren Hoehna (dhoehna)
and
Copilot
committed
c917434
fix(tests): avoid expect_fun_call in IPv6 proxy URL tests

Darren Hoehna (dhoehna)
and
Copilot
committed
a7a6194
fix(tests): stop counting a skipped bwrap firewall run as a pass

Darren Hoehna (dhoehna)
and
Copilot
committed
6e7591c

Commits on Aug 5, 2026

Skip with exit 77 in the LXC proxy test so a skip is not tallied as a pass

Darren Hoehna (dhoehna)
and
Copilot
committed
1ed2ae6

Commits on Aug 6, 2026

Address review feedback on deny-all-except-proxy

authored and
Darren Hoehna
committed
63578db
Make the start-ownership bit impossible to forget rather than merely tested

Darren Hoehna (dhoehna)
and
Copilot
committed
d563cbb
Close two fail-open paths the review found

Darren Hoehna (dhoehna)
and
Copilot
committed
c3af5f3
Republish firewall ownership after teardown instead of leaving it stale

Darren Hoehna (dhoehna)
and
Copilot
committed
6756a3b
Fail closed on an unresolvable blocked host under either default policy

Darren Hoehna (dhoehna)
and
Copilot
committed
6c52d93

Commits on Aug 7, 2026

[LXC] Tear down only the firewall objects the record names

Darren Hoehna (dhoehna)
and
Copilot
committed
17ea610
[LXC] Attempt every hook delete, so a failed one cannot hide the next

Darren Hoehna (dhoehna)
and
Copilot
committed
96042f4
[LXC] Make hook teardown converge, and stop flushing a referenced chain

Darren Hoehna (dhoehna)
and
Copilot
committed
10f0599