From bdf0c50e1f4ef7b86bebc05524f65c4e6bd58724 Mon Sep 17 00:00:00 2001 From: Pedro Henrique Penna Date: Wed, 11 Nov 2026 13:19:32 -0800 Subject: [PATCH] sandbox: name the runtime identity and gateway without the old store and plan Two of the shared sandbox modules still reached old APIs for values that the new interface already owns. `sandbox/mod.rs` named the artifacts' runtime identity through `host::store`, which only re-exports `host::runtime::RuntimeIdentity`, and `sandbox/options.rs` found the gateway of `--net` through `host::sandbox::plan::guest_gateway`, the old plan's wrapper around `net::guest_gateway`. `sandbox/mod.rs` now imports `RuntimeIdentity` from `host::runtime`. `sandbox_network` checks `--net` with `Ipv4Cidr::parse`, whose refusal is the plan's word for word, `guest network "ADDRESS" must be an IPv4 address with a /1 to /30 prefix that is not its network's network, broadcast, or gateway (first) address`, with the same code, and takes the gateway from `net::guest_gateway`, which finds one for every address that parses. The order of the refusals does not change, and `SandboxNetwork::new` still checks the network. This is the first step of SL3.10b, whose split was approved once its measured scope came to about ten times its estimate: SL3.10c moves the sandbox network to `NetworkConfig`, and SL3.10d moves the launch off `SandboxLaunch`, `SandboxSettings` and `SandboxUpper`. Tests: `network_policies_that_the_planner_refuses_fail_before_launch` in tests/cli.rs keeps checking, word for word, that `sandbox run --dry-run` and `sandbox provision` refuse `--net 10.0.0.1/24` before they launch or record anything. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- nvx-rs/src/host/cli/sandbox/mod.rs | 2 +- nvx-rs/src/host/cli/sandbox/options.rs | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/nvx-rs/src/host/cli/sandbox/mod.rs b/nvx-rs/src/host/cli/sandbox/mod.rs index 88254b554..e5def05a8 100644 --- a/nvx-rs/src/host/cli/sandbox/mod.rs +++ b/nvx-rs/src/host/cli/sandbox/mod.rs @@ -29,13 +29,13 @@ use super::{Exit, Result, io_error, output}; use crate::ErrorCode; use crate::host::artifacts::{Guest, KERNEL_NAME, require_artifact}; use crate::host::paths; +use crate::host::runtime::RuntimeIdentity; use crate::host::sandbox::distro::DistroFormat; use crate::host::sandbox::mount::{plan_mounts, validate_mounts}; use crate::host::sandbox::options::{ SandboxOperation, SandboxOptions, sandbox_mounts, validate_sandbox_systemd_policy, }; use crate::host::sandbox::{SandboxLaunch, SandboxSettings, SandboxUpper}; -use crate::host::store::RuntimeIdentity; use crate::protocol::root::RootUpper; pub(crate) use self::lifecycle::ProvisionConfig; diff --git a/nvx-rs/src/host/cli/sandbox/options.rs b/nvx-rs/src/host/cli/sandbox/options.rs index dd2b706c6..bf82e4c95 100644 --- a/nvx-rs/src/host/cli/sandbox/options.rs +++ b/nvx-rs/src/host/cli/sandbox/options.rs @@ -14,11 +14,11 @@ use crate::host::paths; use crate::host::sandbox::distro::DistroFormat; use crate::host::sandbox::mount::{MountOwner, PolicyKind}; use crate::host::sandbox::options::{PolicyPathOption, SandboxOperation}; -use crate::host::sandbox::plan::guest_gateway; use crate::host::sandbox::{ DEFAULT_ENTRYPOINT, DEFAULT_HOSTNAME, DEFAULT_WORKLOAD_IDENTITY, SandboxLayer, SandboxNetwork, parse_workload_identity, }; +use crate::net::{Ipv4Cidr, guest_gateway}; use crate::protocol::root::RootUpper; /// The usage and help of the parser. @@ -431,7 +431,10 @@ pub(in crate::host::cli) fn sandbox_network( } return Ok(None); }; - let gateway = guest_gateway(net)?; + // `Ipv4Cidr` gives a guest network's refusal, and one that it accepts has a gateway: its + // network's first address. + Ipv4Cidr::parse(net).map_err(|message| Exit::error(ErrorCode::Unsupported, message))?; + let gateway = guest_gateway(net).expect("a guest network that parses has a gateway"); if network.network_egress.is_none() && (!rules.allow.is_empty() || !rules.deny.is_empty()) { return Err(Exit::error( ErrorCode::Unsupported,