Skip to content

eggsec-nse 0.3.0 — breaking security release

Latest
Latest

Choose a tag to compare

View all tags
@dbowm91 dbowm91 released this 02 Oct 15:56
· 1 commit to main since this release
v0.3.0
16cb38e

eggsec-nse 0.3.0 — breaking security release

Breaking release carrying the M007A/M007B boundary work: the automated library
effect gate and the broker-compatible protocol migration. 0.3.0 removes
74 public functions relative to 0.2.0, so no 0.2.x can carry it.

Qualification: candidate 16cb38e; cargo semver-checks against published
0.2.0 reports exactly one failed lint, function_missing, with exactly those
74 items and no other breaking lint. Hosted CI green 5/5 on that SHA; full
release verification block green; published archive VCS identity equals the
candidate.

Security: two public helpers withdrawn, with no replacement

helpers::tls_connect and helpers::tcp_connect_with_timeout were pub on
both published releases (0.1.0 and 0.2.0). Each opened a raw socket
through std::net::TcpStream::connect_timeout without receiving an
NseCapabilityContext and without executing through NseHostServices or the
provider broker, so a consumer calling them bypassed the runtime's capability
decision, cancellation, accounting, and provider-selection boundary for that
connection (ADR-0004 §8).

They are removed in 0.3.0. There is no replacement and no deprecated alias —
an alias would still be a reachable bypass. Move connection work to the broker
(broker_tcp_connect, broker_dns_lookup). helpers::make_addr and
helpers::parse_socket_addr were removed alongside them; both are pure and
trivially inlined, and no crate-internal caller remains.

Their absence is now enforced by the compiler: compile_fail doctests in
src/libraries/helpers.rs fail the test run if either name reappears, and
scripts/check-boundaries.sh re-runs the specialized direct-I/O scan on the
untruncated file so a primitive hidden after a test module fails closed.

A security advisory for this range (>= 0.1.0, < 0.3.0) is being published
alongside this release, together with a disposition decision for the two
predecessor versions.

Breaking: 70 registration entry points now take services

// 0.2.0
nbd::register_nbd_library(lua)?;
// 0.3.0
nbd::register_nbd_library_with_services(lua, &capability_ctx, &services)?;

The arguments are mandatory on purpose: a &Lua-only entry point could only
ever construct native defaults, which is the fallback path ADR-0004 forbids
for automated authority claims. NseHostServices::native() is the escape
hatch for manual operator-driven use; it is not valid for automated authority
claims.

The changelog lists all 70 modules. register_telnet_library is also
_with_services-only but was never published as a plain function, so it is
additive rather than a break.

There is no 0.2.1: the two withdrawn helpers make a patch release
unachievable by construction.

Security: automated library effect gate

A deny-by-default effect manifest (159 entries) classifies every registered
library and global. 65 libraries move from manual-only to ProviderBacked and
target moves from Pure to ProviderBacked; manual-only registrations fall
106 → 41. Under AgentSafe/CiSafe, high-risk libraries route through
gate_then_register() and scrub_ineligible_globals() runs after every
registration, before any script executes.

target.resolve previously performed to_socket_addrs directly while
classified Pure, so CiSafe's DenyAll could not stop it and the resolved
name was never bound to scope. It is now brokered and ProviderBacked.

What 0.3.0 does not do

Four separate facts, deliberately not collapsed:

  1. the withdrawn public helper bypass is fixed by removing the two
    direct-connect helpers;
  2. the broader automated-library effect gating is the M007A/M007B work;
  3. a 22-file specialized direct-I/O residual (15 ungated + 7 advisory, down
    from 97) remains and those protocols are not provider-backed — they are
    manual-only and pinned against expansion;
  4. runtime DNS policy is still not bound to an embedding application's
    approved scope: broker_dns_lookup gates DnsResolution on DenyAll only
    and does not evaluate per-target membership for the resolved name.

0.3.0 is not complete protocol-wide scope enforcement. Also unchanged:
DnsResolution is not charged to network_operations, and upnp.discover
performs a brokered TCP connect rather than real SSDP multicast discovery.

MSRV remains 1.89. Features are unchanged: nse, nse-ssh2, sandbox,
stress-testing, no defaults.

Assets 2
Loading