fix(ci): pin GitHub-hosted Ubuntu runner image - #145
Conversation
* feat(gateway): trust forwarded IPs only from trusted proxies * fix(gateway): harden trusted proxy attribution * test(gateway): fuzz trusted forwarded client attribution * fix(gateway): accept mapped trusted proxy peers * test(gateway): align mapped proxy trust invariants * docs(gateway): clarify trusted proxy runtime contract * fix(gateway): reject invalid mapped proxy cidrs * fix(gateway): keep admin credential provenance accurate * test(gateway): run trusted-proxy fuzz target in CI * style: apply rustfmt to credential regression --------- Co-authored-by: OpenAI Codex <codex@openai.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔍 Unrelated feature expands review scope
This runner-label fix also adds trusted-proxy attribution and rewrites shutdown handling. The extra runtime changes obscure the narrow CI repair.
Was this helpful? React with 👍 or 👎 to provide feedback.
| None => { | ||
| return error( | ||
| StatusCode::INTERNAL_SERVER_ERROR, | ||
| "gateway requires peer address metadata; serve with `serve(...)` or `into_make_service_with_connect_info::<SocketAddr>()`", | ||
| ); |
There was a problem hiding this comment.
🟡 Direct router serving breaks gateways
Serving build_app directly leaves gateway without peer metadata, so every gateway request returns 500. Existing embedders must adopt a new serving path.
Prompt for agents
The public build_app function still returns a Router, but that Router's gateway route now requires ConnectInfo<SocketAddr>. Existing embedders can continue compiling with axum::serve(listener, build_app(state)), yet all /gateway requests return 500. Preserve a functional serving contract for build_app callers, or change the API so callers cannot construct a gateway service without installing connect-info. Keep the fail-closed client-IP behavior while making the required serving mode explicit and mechanically enforced.
Was this helpful? React with 👍 or 👎 to provide feedback.
| [[bin]] | ||
| name = "fuzz_trusted_forwarded_client_ip" | ||
| path = "fuzz_targets/fuzz_trusted_forwarded_client_ip.rs" | ||
| test = false | ||
| doc = false | ||
| bench = false |
There was a problem hiding this comment.
🔍 New fuzz target lacks documentation
The fuzzing target table omits fuzz_trusted_forwarded_client_ip and its invariant. Repository guidance says this document lists each target's invariants.
Was this helpful? React with 👍 or 👎 to provide feedback.
| let ip = match candidate.parse::<IpAddr>() { | ||
| Ok(ip) => ip, | ||
| Err(_) => continue, |
There was a problem hiding this comment.
🟥 Malformed forwarding chains bypass client controls
A malformed right-side hop makes trusted_forwarded_chain_client_ip accept an earlier attacker-controlled address. Clients can evade rate limits and IP blocking by varying it.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Superseded integration lane
This PR originally owned only the Wardnet repository runner-selection repair at exact commit
2d41c4079f9a4465c3142a0aa2dd5895cb11f793. While building a dependency stack, trusted-proxy PR #131 was merged into this feature branch, moving the branch tip toced58fe17e4fda2d014bd9d18d2008fde93c1dcaand expanding the effectivemaindiff from four runner-control files to eleven files across runner and gateway-security responsibilities.That combined branch is no longer an acceptable bounded integration vehicle. No protected-main merge occurred.
The clean runner-only lineage has been preserved unchanged as PR #147 (
fix/pin-hosted-runner-20260902-v2at2d41c4079f9a4465c3142a0aa2dd5895cb11f793). The trusted-proxy delta has been preserved as replacement PR #148 at72ac1a2a2902a10aabc6e20169b9ae89adb5f9c8, stacked on #147. This PR is closed to prevent the accidental combined branch from being treated as the canonical merge candidate.No predecessor review/check evidence from the contaminated tip transfers to #147 or #148.