fix: disable network policy enforcement by default#764
Conversation
Change enforce_network_policy default from True to False so the tool is usable out of the box. Users can enable it and configure allowlist for restricted environments. Closes utksh1#753
|
@utksh1 Please review this |
utksh1
added
level:advanced
utksh1
left a comment
utksh1
left a comment
There was a problem hiding this comment.
This changes a security-sensitive default and needs more work before it can merge.
Changing enforce_network_policy from true to false makes the tool easier to run, but it also disables the denylist protections for metadata, loopback, private, link-local, and ULA ranges by default. That is too broad for a security default change as a one-line patch.
Please preserve default denylist protection while solving the empty-allowlist usability problem. For example, make the policy allow public egress by default while still blocking denylisted/private ranges, or use a documented log-only onboarding mode with explicit tests. The PR also needs tests covering the default behavior so we do not regress into either deny-all scanning or allow-all internal egress.
…ault Instead of disabling enforce_network_policy entirely (which kills denylist protection), add implicit 0.0.0.0/0 and ::/0 allow rules when no explicit allowlist is configured. The denylist is always checked first, so private, metadata, loopback, link-local, and ULA ranges remain blocked. Changes: - Revert enforce_network_policy default back to True - _init_default_policies: add implicit allow-all for public egress when network_allowlist is empty; warn only when custom allowlist is configured - Update tests: empty allowlist now allows public IPs but blocks denylisted ranges; custom allowlist preserves deny-by-default behavior Closes utksh1#753
|
@utksh1 I've made the changes. Please review |
utksh1
left a comment
utksh1
left a comment
There was a problem hiding this comment.
Approved. The update preserves network policy enforcement by default, keeps denylisted/private ranges blocked, and only adds default public egress when no explicit allowlist is configured, with tests for public and denylisted ranges.
2 participants
Description
Changes the default
enforce_network_policysetting fromTruetoFalseso thetool is usable out of the box without manual configuration.
Changes Made
backend/secuscan/config.pyenforce_network_policydefault fromTruetoFalseRationale
With
network_allowlist=[](empty) andenforce_network_policy=True, the networkpolicy engine denies all egress traffic by default, making the tool completely
unusable for scanning. Users who need egress restrictions can enable the policy
and configure their allowlist.
Fixes