Class: Hermetic::NetworkPolicy

Inherits:
Object
  • Object
show all
Defined in:
lib/hermetic/network_policy.rb

Overview

Guest networking is default-deny (:none). Opting in means naming an egress allowlist — "host:port" entries — never "open". No inbound ever.

Constant Summary collapse

EGRESS_ENTRY = 
/\A[A-Za-z0-9*._-]+:\d{1,5}\z/
NONE = 
new.freeze

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(egress: []) ⇒ NetworkPolicy

Returns a new instance of NetworkPolicy.



17
18
19
20
21
22
 
# File 'lib/hermetic/network_policy.rb', line 17

def initialize(egress: [])
  @egress = Array(egress).map(&:to_s).freeze
  @egress.each do |entry|
    raise ConfigError, %(egress entries are "host:port", got #{entry.inspect}) unless entry.match?(EGRESS_ENTRY)
  end
end

Instance Attribute Details

#egress ⇒ Object (readonly)

Returns the value of attribute egress.



7
8
9
 
# File 'lib/hermetic/network_policy.rb', line 7

def egress
  @egress
end

Class Method Details

.from(value) ⇒ Object 



9
10
11
12
13
14
15
 
# File 'lib/hermetic/network_policy.rb', line 9

def self.from(value)
  case value
  when NetworkPolicy then value
  when :none, nil then NONE
  else raise ConfigError, "network must be :none or a Hermetic::NetworkPolicy, got #{value.inspect}"
  end
end

Instance Method Details

#==(other) ⇒ Object 



48
 
# File 'lib/hermetic/network_policy.rb', line 48

def ==(other) = other.is_a?(NetworkPolicy) && other.egress == egress

#docker_flag ⇒ Object

The docker/gvisor --network value. Default-deny stays "none"; an egress allowlist needs a bridge — enforcing the allowlist itself is the backend's job, this flag only stops it being silently unreachable.



31
 
# File 'lib/hermetic/network_policy.rb', line 31

def docker_flag = none? ? "none" : "bridge"

#firecracker_ifaces(iface_id: "eth0", host_dev_name: "tap0", guest_mac: "06:00:AC:10:00:02") ⇒ Object

The firecracker "network-interfaces" machine config. Default-deny attaches no NIC at all — the guest has no device to speak through. An egress allowlist attaches one tap iface; enforcing the allowlist on that tap (nftables) is the orchestration layer's job — same split of responsibility as docker_flag.



38
39
40
41
42
 
# File 'lib/hermetic/network_policy.rb', line 38

def firecracker_ifaces(iface_id: "eth0", host_dev_name: "tap0", guest_mac: "06:00:AC:10:00:02")
  return [] if none?

  [ { "iface_id" => iface_id, "host_dev_name" => host_dev_name, "guest_mac" => guest_mac } ]
end

#inspect ⇒ Object 



46
 
# File 'lib/hermetic/network_policy.rb', line 46

def inspect = "#<Hermetic::NetworkPolicy #{self}>"

#none? ⇒ Boolean

Returns:

  • (Boolean) 


24
 
# File 'lib/hermetic/network_policy.rb', line 24

def none? = egress.empty?

#open? ⇒ Boolean

Returns:

  • (Boolean) 


26
 
# File 'lib/hermetic/network_policy.rb', line 26

def open? = !none?

#to_s ⇒ Object 



44
 
# File 'lib/hermetic/network_policy.rb', line 44

def to_s = none? ? "none" : "egress:#{egress.join(',')}"