fix(policy): reject unknown endpoint security modes - #3187
Conversation
Closes NVIDIA#3046 Validate TLS, enforcement, and access values across policy and provider profile ingress, and prevent runtime parsing from falling back to audit for unknown enforcement values. Signed-off-by: Krzysztof Malczuk <kmalczuk@redhat.com>
267b665 to
c1c3bdd
Compare
There was a problem hiding this comment.
Great work on this!! @2000krysztof , the centralization in l7_validate.rs is a clean design and the test coverage there is thorough.
One question: I noticed that sandbox policies are persisted as binary protobuf blobs (encode_to_vec / decode in policy_store.rs). Changing NetworkEndpoint.tls, .enforcement, and .access from string (wire type 2) to enum (wire type 0) means that existing stored blobs with non-empty values for those fields will have those fields silently dropped to 0 (Unspecified) when decoded by the new code, since prost skips fields with a wire type mismatch rather than erroring.
The most sensitive case seems to be tls: skip, which would silently become tls: Unspecified (auto-detect) on upgrade. How is this currently handled for existing deployments?
| } | ||
| } | ||
|
|
||
| pub fn network_access_preset_from_str(value: &str) -> Option<NetworkAccessPreset> { |
There was a problem hiding this comment.
With the proto fields now typed as enums on the wire, I'm curious whether these string-to-enum conversion functions are still needed for an active code path, for example YAML/Helm config that arrives as strings before being mapped to proto, or whether they're now primarily used for legacy input validation. Just trying to understand if there's an external config surface that still uses the string form.
There was a problem hiding this comment.
Yes, these are still used by active input paths rather than only for legacy validation. The protobuf/gRPC representation is now typed, but policy YAML, provider-profile YAML, CLI policy-update arguments, and proposal JSON retain their documented lowercase string spellings. These helpers centralize conversion from those authored forms into the protobuf enums. The corresponding to_str helpers are also used when serializing policies and producing runtime/UI representations.
Good catch I hadn’t called out the persisted wire-format impact. One relevant detail is that this is pre-0.1 work intended to stabilize the contract for the first release, so my assumption was that compatibility with existing development databases isn’t guaranteed. I also checked Prost’s behavior: it returns UnexpectedWireType here rather than silently defaulting the field, so it would fail closed instead of weakening the policy. If we do want to support upgrades from current development deployments, I’m happy to add a migration path. I’m just not sure the additional legacy support is worthwhile before 0.1. What do you think? |
Replace the public TLS, enforcement, and access strings with protobuf enums and carry the typed values through policy composition, provider profiles, drivers, and runtime conversion. Preserve the documented YAML spellings, reject unknown and invalid numeric enum values consistently, and update generated Go bindings, SDK conversions, tests, and policy documentation. Signed-off-by: Krzysztof Malczuk <kmalczuk@redhat.com>
c1c3bdd to
4d2a055
Compare
johntmyers
left a comment
johntmyers
left a comment
There was a problem hiding this comment.
gator-agent
PR Review Status
Thanks @2000krysztof. I checked your explanation of the persisted protobuf wire-format concern: Prost does fail closed with UnexpectedWireType, but that still makes existing non-empty policy records unreadable after an in-place gateway upgrade. One blocking compatibility finding remains.
Action required: preserve readable upgrades for persisted policies, or obtain an explicit maintainer waiver of that compatibility requirement.
Blocking findings:
GATOR-4d2a055a-01: changing established protobuf tags from strings to enums causes existing policy blobs to fail decoding after upgrade.
Carried findings:
- None
Gator metadata
- Validation: Implements the fail-closed security-policy contract in linked issue #3046.
- Docs: Fern policy-schema and provider-profile docs are updated.
- Checks: DCO is green; Branch Checks and Helm Lint are pending on the current head.
- E2E:
test:e2eis required for policy-enforcement behavior and will be dispatched after blocking review feedback is resolved or waived. - Head SHA:
4d2a055ad370c710b0e857a069b369c5d4bf1a54 - Base SHA:
8af79a7f4b68abf09299371f20987fde90667139 - Merge base SHA:
320d4ef79dd572c642133f175f12bafc20d89fd9 - Patch ID:
d0b11f729c98eb3e534292f5774206b0e9686e32 - Gator payload:
8 - Review mode:
initial - Previous reviewed SHA: none
- Review budget exhausted: no
- Maintainer decision required: no
- Next state:
gator:in-review
| string enforcement = 5; | ||
| // Access preset shorthand: "read-only", "read-write", "full". | ||
| // TLS handling. Unspecified enables automatic detection and termination. | ||
| NetworkTlsMode tls = 4; |
There was a problem hiding this comment.
gator-agent
Warning — GATOR-4d2a055a-01 · Existing policy blobs become unreadable
Summary: An operator upgrading a gateway with persisted endpoints containing TLS, enforcement, or access values will hit UnexpectedWireType when the new schema decodes those records. This fails closed, but policy reads, reloads, and updates can fail until the database is repaired or the gateway is rolled back.
Fix: Keep tags 4–6 as strings with strict allowlist validation, or add typed fields on new tags with transitional dual-read/write behavior and a migration before retiring the string fields.
Verify: Encode a policy with non-empty values using the base schema, load it from SQLite with the head gateway, and confirm GetSandboxConfig succeeds with equivalent values.
Agent context
- Location:
proto/sandbox.proto:150 - Ownership: This PR changes established length-delimited fields to varint enums without a compatibility decoder or migration.
- Related sinks: persisted policy decode in
policy_store.rsand global-policy decode ingrpc/policy.rs.
johntmyers
added
the
gator:in-review
3 participants
Summary
Make security-sensitive network policy values fail closed across all policy ingress paths. Replace the public TLS, enforcement, and access strings with typed protobuf enums so invalid values cannot silently weaken enforcement.
Related Issue
Closes #3046
Changes
Testing
mise run pre-commitpassesmise run testpassesChecklist