[A·M3a follow-up] Per-address allow scope for discovered services #26

New issue

Closed

opened 2026-06-25 12:20:27 +00:00 by vxfemboy · 0 comments

vxfemboy commented

2026-06-25 12:20:27 +00:00

(Migrated from github.com)

From the M3a whole-branch review (important, inherited from the existing model). AllowRule is not address-scoped, so a discovered service attached to a tenant opens that port on ALL of that tenant's owned addresses, not just the discovered one. Config-file allows are tenant-wide by design, but discovery makes this auto-reachable from observed sockets, silently widening exposure. Consider an address-scoped allow (e.g. optional addr on AllowRule, or a per-address service list) so discovery opens a port only on the address it was observed on. Documented in reconcile rustdoc for now.

From the M3a whole-branch review (important, inherited from the existing model). `AllowRule` is not address-scoped, so a discovered service attached to a tenant opens that port on ALL of that tenant's owned addresses, not just the discovered one. Config-file allows are tenant-wide by design, but discovery makes this auto-reachable from observed sockets, silently widening exposure. Consider an address-scoped allow (e.g. optional addr on AllowRule, or a per-address service list) so discovery opens a port only on the address it was observed on. Documented in reconcile rustdoc for now.