Fix connected UDP learning - #196
Conversation
Allow TCP-only network profiles to create UDP sockets while keeping actual UDP traffic gated at connect/send/bind time. This lets libc DNS/address-selection probes work without opening UDP egress. Teach sandlock learn to promote a pending UDP connect when an address-less UDP send is observed, including when connect and send occur on sibling threads sharing the same fd table. Add learn-to-run connected UDP regression coverage and runtime tests proving TCP-only rules still deny UDP send, connect, and bind operations. Signed-off-by: Cong Wang <cwang@multikernel.io>
|
@ghazariann Please take a look. Thanks! |
|
LGTM. I just realized that I missed the comment in #165 earlier; glad this PR picks it up and fixes it, thanks! I'm interested in whether the glibc's getaddrinfo address-sorting probe breakage in Also, |
Thanks for review. I found it during a manual run of |
2 participants
Summary
Fix connected UDP learning and TCP-only network profiles.
TCP-only network profiles now allow UDP socket creation so libc
DNS/address-selection probes can run, while actual UDP traffic remains gated
at connect/send/bind time.
sandlock learnnow promotes a pending UDP connect when it observes anaddress-less UDP send, including when connect and send happen on sibling
threads sharing the same fd table.
Tests
cargo test -p sandlock-core test_arg_filters_udp -- --nocapturecargo test -p sandlock-core --test integration test_udp_send_time_gating_with_tcp_only_rules -- --nocapturecargo test -p sandlock-cli --test learn_integration connected_udp -- --nocapture --test-threads=1