wiki: build egress measured on bay1 !521

merged merged by cmc on 2026-09-29 04:36 UTC · krz/gitbay:runner-egress-result-260 into main

4 files changed, +26 −5

Layout: unified · split

.gitbay/wiki/Architecture/09-Controls.org +1 −1

	@@ -88,7 +88,7 @@ chapter names of OWASP ASVS 4.0 where one fits.
88	\| No secrets for untrusted builds \| in place \| =internal/control/build.go= \|	88	\| No secrets for untrusted builds \| in place \| =internal/control/build.go= \|
89	\| Runner limited to attached repositories \| in place \| =runnerMayBuild= (=build.go=) \|	89	\| Runner limited to attached repositories \| in place \| =runnerMayBuild= (=build.go=) \|
90	\| Build images fixed by the operator \| in place \| =--pull=never= \|	90	\| Build images fixed by the operator \| in place \| =--pull=never= \|
91	\| Build network egress restricted \| partial \| by build cgroup (=gitbay-runner-builds.nft=): host loopback (but DNS) and private ranges closed; trusted: host public 22/80/443, internet open by decision; untrusted: internet TCP 80/443 and DNS only. Not yet measured from a build (#260) \|	91	\| Build network egress restricted \| in place \| by build cgroup (=gitbay-runner-builds.nft=): host loopback (but DNS) and private ranges closed; trusted: host public 22/80/443, internet open by decision; untrusted: internet TCP 80/443 and DNS only. measured on bay1 2026-09-29 (CI page) \|
92	\| Build results reused only across equal trust \| in place \| =SuccessBuildForTree=, =SuccessBuildFor= (=internal/store/builds.go=) \|	92	\| Build results reused only across equal trust \| in place \| =SuccessBuildForTree=, =SuccessBuildFor= (=internal/store/builds.go=) \|
93		93
94	** Availability and operations	94	** Availability and operations

.gitbay/wiki/Architecture/10-Known-Gaps.org −2

 | Issue | Area             | Gap                                                                   | Severity |
 |-------+------------------+-----------------------------------------------------------------------+----------|
 | #259  | Recovery         | No restore has been exercised; the procedure and tooling (=admin restore-drill=, =backup --verify=) are in place, the clean-host drill is pending | high |
-| #260  | CI network       | Separation and egress tables written; not yet measured from a build on bay1 (=deploy/runner-auth-flood-test.sh=) | medium |
 | #261  | Various          | Migration foreign-key check after commit; three web writes bypass dispatch; documentation drift | medium |
 * Not filed
 |-----------------------------------------------------------+------------------------------------------|
 | What is the measured recovery time?                       | unmeasured (#259)                        |
 | How many concurrent clones does the host sustain?         | unmeasured (#262)                        |
-| What can a build reach on the host's network?             | policy on the CI page; reachability untested until the flood test runs (#260) |
 | Have the collaboration features been used by independent users? | no; one human user, tests only     |

.gitbay/wiki/CI.org +23

	@@ -101,6 +101,29 @@ until the limiter locks its address, and the script checks that the
101	runner still reported the build and kept polling, and that the build's	101	runner still reported the build and kept polling, and that the build's
102	log shows what the table allowed and refused.	102	log shows what the table allowed and refused.
103		103
		104	** Measured on bay1
		105
		106	2026-09-29, runner and daemon at 8b73af2, kernel 6.12.107, nftables
		107	1.1.3, podman 5.4.2, the runner scoped to =cmc/runner-scratch=. pasta
		108	ran in the build's cgroup both times
		109	(=builds/trusted/build-2144=, =builds/untrusted/build-2146=). Both runs
		110	passed.
		111
		112	\| Probe \| trusted \| untrusted \|
		113	\|----------------------+------------------+------------------\|
		114	\| DNS \| ok \| ok \|
		115	\| 169.254.1.2:22/80/443 \| open \| refused \|
		116	\| 169.254.1.2:2222 \| refused \| refused \|
		117	\| 10.0.0.1:80, 192.168.0.1:80 \| refused \| refused \|
		118	\| proxy.golang.org:443 \| open \| open \|
		119	\| github.com:22 \| open \| refused \|
		120	\| 12 logins \| 12 denied (sshd) \| 12 refused (table) \|
		121
		122	The trusted build's logins arrived from the host's public address,
		123	46.232.248.67: ten =auth.expired= and one =auth.throttled= for it, none
		124	for =127.0.0.1=. The untrusted build's logins never reached sshd. The
		125	runner kept polling through both builds.
		126
104	* The table	127	* The table
105		128
106	One =ci.yml= with five jobs, each isolating one rule:	129	One =ci.yml= with five jobs, each isolating one rule:

deploy/runner-auth-flood-test.sh +2 −2

	@@ -56,7 +56,7 @@ job=flood260
56	tmp=$(mktemp -d)	56	tmp=$(mktemp -d)
57	fp=	57	fp=
58	cleanup() {	58	cleanup() {
59	if [ -n "$fp" ]; then gitbay keys remove "$fp" >/dev/null \|\| echo "remove key $fp by hand" >&2; fi	59	if [ -n "$fp" ]; then gitbay auth keys remove "$fp" >/dev/null \|\| echo "remove key $fp by hand" >&2; fi
60	fp=	60	fp=
61	rm -rf "$tmp"	61	rm -rf "$tmp"
62	}	62	}
	@@ -65,7 +65,7 @@ trap 'cleanup; exit 130' INT TERM
65		65
66	echo "==> an expired key"	66	echo "==> an expired key"
67	ssh-keygen -q -t ed25519 -N '' -C auth-flood-260 -f "$tmp/key"	67	ssh-keygen -q -t ed25519 -N '' -C auth-flood-260 -f "$tmp/key"
68	gitbay keys add --scope git --label auth-flood-260 --ttl 1s <"$tmp/key.pub" >/dev/null	68	gitbay auth keys add --scope git --label auth-flood-260 --ttl 1s <"$tmp/key.pub" >/dev/null
69	fp=$(ssh-keygen -lf "$tmp/key.pub" \| awk '{print $2}')	69	fp=$(ssh-keygen -lf "$tmp/key.pub" \| awk '{print $2}')
70	sleep 2	70	sleep 2
71		71