Repository navigation
Edge pod attachments: unchecked caller inputs and weak isolation tests #989
Description
The edge packages from #947, #950, #951 and #952 have follow-ups that did not block review. None of these packages has a caller yet, so each item must be settled before the PR that wires them in.
- Gateway admission trusts its caller to supply the tenant's grants and VPC.
- Cross-VPC isolation tests show the right answer arriving, but never show a wrong packet being refused.
- The real-node test can pass without proving anything, and does not check that it cleaned up.
- Attachment MTU has a floor but no ceiling tied to the underlay.
Done when each is fixed in its package or in the wiring PR. The detail is in the first comment.
Related to #947, #950, #951, #952
Galactic Edge integration (#992)
Implement this milestone as a consumer of the Galactic Edge provider contract. #992 owns provider authorization, host attachment lifecycle, shared-state fencing and maintenance, independently enforced forwarding expiry, prefix conflict arbitration/publication, and gVPC traffic policy. MASQUE owns client authentication, connector /96 assignment and retention, session packet checks, transport behavior and its provider adapter. Use the foundation's versioned contract and existing provider helpers; do not introduce a second host-networking controller, lease store or BGP publisher. Any required foundation change must be tracked and qualified under #992 before this milestone claims integrated acceptance.
Integration disposition and acceptance
This issue remains a pre-integration findings ledger. Its source-PR comments describe earlier packages and must be checked against the #992 path; they are not evidence that the completed foundation still has every original defect.
- For every finding in the issue and all its comments, record the current consumer/path, a linked fix and regression check, or evidence that MASQUE does not use that path. Do not mark the entire issue satisfied solely because Galactic Edge Foundation #992 merged replacements.
- Integrate MASQUE with Galactic Edge provider attachments #975/Implement admission, credential expiry and access revocation #977 consume Implement provider admission #994 trusted admission and Implement attachment reconciliation and recovery #995/Integrate attachment ownership with maintenance #996 lifecycle/maintenance instead of wiring caller-supplied authority or a second host owner. Integrate connector ownership with Edge claims and independent expiry #976 uses Enforce forwarding ownership and expiry #997/provider helpers; legacy claim/fence caveats must not leak into a new adapter.
- Prove MASQUE packet attachments on the Galactic Edge foundation #974/Enforce delegated-prefix ownership and bidirectional traffic policy #979/Add reproducible end-to-end feature acceptance tests #985 supply negative isolation/policy packet checks, namespace-identity and recovery evidence, real target execution and asserted cleanup. Implement and verify CONNECT-IP MTU and ICMPv6 behavior #982 owns the MASQUE MTU disposition with foundation fixes tracked under Galactic Edge Foundation #992 where needed.
- Complete applicable dispositions before Integrate MASQUE with Galactic Edge provider attachments #975/Implement the HTTP/3 CONNECT-IP edge service #980 integration; preserve the detailed findings in the comments.
Activity
ecv commentedon Oct 22, 2026
Detail by source PR:
#947, admission
Admittakesgrantsandreq.VPCfrom the caller and binds neither to a tenant identity. An emptyreq.VPCor provider is not rejected, so a grant with an empty VPC matches. Reject both invalidate, and document the caller contract.Coremay set any non-Readycondition type. Use a closed list.#950, datapath
Attachment.MTUmust be at least 1280 and has no upper bound against the encapsulated underlay.Readbacknow reports MTU drift, so attachments made by a feat(edge): Attach socket and packet consumer pods to a VPC from the host #949 build will read as drifted.datapath_test.goshows identical addresses answering with different identities but never sends a packet that must not arrive, such as an address registered only in VPC B to VPC A's SID. Add one negative per direction.attachreg.InterfaceTypeVeth. Confirm that matches what the CNI registers for a packet consumer.#951, policy
#952, real-node test
attachedProgramstreats aFilterListerror as no programs, and the controlcheckCNIProgramsVisibleruns only whenGALACTIC_EDGE_TARGET_BPF_CNIis set, so the CNI negative can pass vacuously.0x7EDC0001andedgefx-*links are gone from the live node.TestTargetConsumersleeps 10 minutes by default, equal togo test's default timeout.ecv commentedon Oct 22, 2026
From #945 at 762314d and #946 at eb52c8f (both approved once their blockers were fixed):
mutateandFenceare documented but not enforced. The wiring PR has to honor them.claim.Instanceholds one mutex across store calls, so a slow Acquire or Release on one key delays Renew on another and can let that lease lapse. Document one instance per key, or drop the lock around store I/O.Duration,MaxDriftorMarginyet, and its safety depends on the store never reusing versions. Check both when the store adapter lands.ecv commentedon Oct 22, 2026
From #949 at 217bc0c (approved once its blockers were fixed):
verifyPaircompareshostLink.NetNsIDwith the pod's namespace ID, but netlink reports 0 whenIFLA_LINK_NETNSIDis absent, which is the case for a same-namespace peer. A pod namespace that was assigned ID 0 therefore matches a host link whose peer is in the host namespace. The reciprocal index check has to line up as well, so this is contrived. Treat the ID as meaningful only when the attribute is present.TestPeerNamespaceOwnershippasses even without the namespace check, because its impostor already fails the index check. Add a case where only the namespace differs.Still open after the #950 to #952 rewrite: isolation negatives per direction (counters are compared only after both pings), TUN registration as veth, the VPC B policy case, the ICMP counter, the opt-in CNI control, cleanup assertions, the 10-minute sleep, and a recorded real-node run.