[privateip]

Summary

Running the Looking Glass service on real fabric routers found four defects that tests against fake nodes miss: the gateway charged and dispatched probes to forbidden destinations, logged callers' probe targets, and broke direct operator probes once permits were required, because node certificates lacked client auth and a node kept presenting a replaced certificate.

This change refuses forbidden targets before any charge, keeps targets out of service failure logs, issues node certificates for client auth when permits are required, and reconnects to the gateway whenever a node's credentials reload.

Each deployment should give the gateway the same denied platform ranges its nodes have, which the security guide describes, and the certificate change adds a restart of the certificate pods to the permits rollout but none of the routers.

Stack

First of two stacked PRs. The second, #1142, adds the qualification suite that found these defects, with its results. Rolling back needs no migration.

Test plan

• Unit tests reproduce each defect, failing without the fix and passing with it
• On the containerlab lab, the qualification suite's destination, confidentiality and direct-probe scenarios pass, including a direct probe after its node's certificate pod is replaced

Related to #1048

[privateip]

Two independent reviews ran on this PR, then a second pass on the fixed head. The first pass split. One reviewer held on a manifest render it could not run and on a claim that an empty deny list makes the destination check inert. The render fixture in the repository shows the client auth key usage on the certificate DaemonSet, and a new unit test shows the gateway refuses a unique local target with no deny list. The second pass also split, holding on body wording about router restarts, which is now corrected in the body and the commit message. The open nits are left as is.

CI is green on the current head. This is the bottom of a native stack with #1142, and GitHub does not allow auto-merge on stacked pull requests, so the stack merges by hand from #1142 once approved.

[ecv]

Approve.

Forbidden probe targets are now refused at the gateway before any charge or dispatch, the target is gone from the gateway's service-call logs, and the redial cannot loop. One log path still quotes the target on the nodes.

• Refusal runs in serviceQuery during validate, ahead of the snapshot and budget charge. DestinationPolicy.Check unmaps v4-mapped addresses, rejects zones, and covers private, CGN, loopback, link-local, multicast, reserved, documentation and 6to4 for v4, plus everything outside 2000::/3 for v6. Table tests cover private, multicast, ULA, documentation, a configured deny range, and an empty --deny-prefixes.
• Log leak remains on the node: logCall only drops the message for LookingGlassService methods. A service probe the gateway forwards to a node as FabricService/Execute still fails with "destination is in ..." (runProbe policy.Check), and the node logs that message at Info. It triggers whenever the node refuses what the gateway admitted, for example a gateway --deny-prefixes narrower than the nodes'. Omit the message for any request that carries a service-origin probe, or log by code alone on Execute failures from the gateway role.
• Client-auth EKU does not widen what a node cert can do. Nodes only reach the gateway's RequestPermit/ReleasePermit per GatewayMethods, and node servers still accept only gateway and operator identities (AllowedCaller). The patch changes only the fabric-api-certs DaemonSet's CSI usages, and the require-permits component is opt-in.
• Redial cannot spin: OnLoad fires only when the cert, key or CA digest changes (30 s poll), grpc.NewClient dials lazily, a failed redial keeps the old connection, and the old one closes after in-flight calls finish. A call with no deadline would hold the old connection open; permit calls carry a deadline from the request.
• --deny-prefixes defaults to empty on the gateway and nothing under config/ sets it, so until each cell sets it the platform ranges are enforced only on the nodes, after the request is charged. The docs say so, and the gap is real for a new cell.

Follow-ups:

• Wire the gateway's --deny-prefixes from the same source as the nodes' value, or fail the gateway start when nodes and gateway disagree, so the pre-charge refusal covers platform ranges by default.
• Add a test that the node's failure log for a refused service probe omits the target.