didericis
d4b27ebf1f
Codex review: the /31 TAP doesn't make source IP unspoofable, and the app-layer token was returned by launch but never delivered or enforced, so a spoofed source could select a victim bottle's policy/tokens. Make the token mandatory and deliver it on each attributed plane (anti-spoof landed separately as the network boundary). Enforcement (control plane): - `Orchestrator.resolve` now requires a matching (source_ip, identity_token) pair (constant-time) — no source-IP-only fallback. `/resolve` fail-closes (403) on a missing/empty/mismatched token. Delivery, per plane (the token is `token_urlsafe`, safe in a URL): - egress: proxy credentials (`HTTPS_PROXY=http://bottle:<token>@gw`). The addon reads `Proxy-Authorization` — from the request (HTTP) or captured at the CONNECT for HTTPS tunnels (keyed by client conn, cleared on disconnect) — validates, and strips it (+ the legacy header) before upstream. - git-http: a URL-scoped `http.<gate>/.extraHeader: x-bot-bottle-identity` in the agent's git config (only over the http transport). - supervise: `mcp add --header x-bot-bottle-identity: <token>` (claude + codex); the server reads the header and passes it to resolve. Wiring: thread `ctx.identity_token` onto the firecracker + docker plans and into the agent env/config at launch. Verified on a KVM host: egress with the correct proxy-cred token returns 200 (HTTP and HTTPS/CONNECT), and no-token / wrong-token return 403; a real `cli.py start --backend=firecracker` launch provisions git config + the supervise MCP header and reaches the agent session, all under mandatory enforcement. Fixed a `claude mcp add` arg-order bug (--header must follow the positional name/url) found by that launch. Transparent proxy for tools that ignore proxy env is deferred to a follow-up (see thread); anti-spoof + host firewall remain the fail-closed boundary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
68 lines
2.1 KiB
Python
68 lines
2.1 KiB
Python
"""Plan type for the Firecracker backend."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass, field
|
|
from pathlib import Path
|
|
|
|
from ...agent_provider import PromptMode
|
|
from .. import BottlePlan
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class FirecrackerBottlePlan(BottlePlan):
|
|
slug: str
|
|
forwarded_env: dict[str, str] = field(repr=False)
|
|
# Stamped by launch once the gateway is up and its ports are
|
|
# published on the host-side TAP IP (empty at prepare time).
|
|
agent_proxy_url: str = ""
|
|
agent_git_gate_url: str = ""
|
|
agent_supervise_url: str = ""
|
|
# Per-bottle identity token the agent presents on every attributed request
|
|
# (egress proxy credentials, git-gate/supervise headers); set by launch
|
|
# from the orchestrator registration. Empty pre-registration.
|
|
identity_token: str = ""
|
|
|
|
@property
|
|
def container_name(self) -> str:
|
|
"""Instance name, reused for the gateway container + VM run dir.
|
|
Matches the `bot-bottle-<slug>` convention the other backends
|
|
use so cleanup/enumerate discovery-by-prefix keeps working."""
|
|
return self.agent_provision.instance_name
|
|
|
|
@property
|
|
def image(self) -> str:
|
|
return self.agent_provision.image
|
|
|
|
@property
|
|
def dockerfile_path(self) -> str:
|
|
return self.agent_provision.dockerfile
|
|
|
|
@property
|
|
def prompt_file(self) -> Path:
|
|
return self.agent_provision.prompt_file
|
|
|
|
@property
|
|
def agent_command(self) -> str:
|
|
return self.agent_provision.command
|
|
|
|
@property
|
|
def agent_prompt_mode(self) -> PromptMode:
|
|
return self.agent_provision.prompt_mode
|
|
|
|
@property
|
|
def agent_provider_template(self) -> str:
|
|
return self.agent_provision.template
|
|
|
|
@property
|
|
def git_gate_insteadof_host(self) -> str:
|
|
if self.agent_git_gate_url.startswith("http://"):
|
|
return self.agent_git_gate_url.removeprefix("http://").rstrip("/")
|
|
return super().git_gate_insteadof_host
|
|
|
|
@property
|
|
def git_gate_insteadof_scheme(self) -> str:
|
|
if self.agent_git_gate_url.startswith("http://"):
|
|
return "http"
|
|
return super().git_gate_insteadof_scheme
|