boxlite-cli 0.11.0

Command-line interface for BoxLite container runtime
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137

use anyhow::{Result, anyhow};
use boxlite::runtime::options::{InboundNetworkConfig, NetworkMode, OutboundNetworkConfig};
use clap::Args;

use crate::cli::GlobalFlags;

#[derive(Args, Debug)]
pub struct InboundArgs {
    /// Box ID or name.
    #[arg(value_name = "BOX")]
    pub target: String,
    /// Access mode: enabled or disabled.
    #[arg(value_name = "MODE", value_parser = ["enabled", "disabled"])]
    pub mode: String,
}

#[derive(Args, Debug)]
pub struct OutboundArgs {
    #[command(flatten)]
    pub access: InboundArgs,
    /// Allow one hostname, wildcard, IPv4 or IPv4 CIDR. Repeat for multiple
    /// rules. Omit to use the default empty allowlist.
    #[arg(long, value_name = "RULE")]
    pub allow_net: Vec<String>,
}

impl OutboundArgs {
    fn config(&self) -> Result<OutboundNetworkConfig> {
        let config = OutboundNetworkConfig {
            mode: self.access.mode.parse::<NetworkMode>()?,
            allow_net: self.allow_net.clone(),
        };
        config.validate()?;
        Ok(config)
    }
}

pub async fn set_inbound(args: InboundArgs, global: &GlobalFlags) -> Result<()> {
    let config = InboundNetworkConfig {
        mode: args.mode.parse()?,
        allow_net: Vec::new(),
    };
    let runtime = global.create_runtime()?;
    let handle = runtime
        .get(&args.target)
        .await?
        .ok_or_else(|| anyhow!("No such box: {}", args.target))?;
    handle.network().update_inbound(config).await?;
    Ok(())
}

pub async fn set_outbound(args: OutboundArgs, global: &GlobalFlags) -> Result<()> {
    let config = args.config()?;
    let runtime = global.create_runtime()?;
    let handle = runtime
        .get(&args.access.target)
        .await?
        .ok_or_else(|| anyhow!("No such box: {}", args.access.target))?;
    handle.network().update_outbound(config).await?;
    Ok(())
}

#[cfg(test)]
mod tests {
    use crate::cli::{Cli, Commands};
    use crate::commands::network::NetworkCommand;
    use clap::Parser;

    #[test]
    fn network_policy_requires_box_mode_and_direction_specific_flags() {
        for args in [
            vec!["boxlite", "network", "inbound"],
            vec!["boxlite", "network", "inbound", "box"],
            vec!["boxlite", "network", "outbound", "box"],
            vec!["boxlite", "network", "outbound", "box", "on"],
            vec![
                "boxlite",
                "network",
                "inbound",
                "box",
                "enabled",
                "--allow-net",
                "example.com",
            ],
        ] {
            assert!(Cli::try_parse_from(args).is_err());
        }
    }

    #[test]
    fn network_policy_replaces_allowlist_and_rejects_conflicts() {
        let parse = |tail: &[&str]| {
            let mut args = vec!["boxlite", "network", "outbound", "box"];
            args.extend_from_slice(tail);
            let cli = Cli::try_parse_from(args).unwrap();
            let Commands::Network(args) = cli.command else {
                panic!("network command")
            };
            let NetworkCommand::Outbound(args) = args.command else {
                panic!("outbound")
            };
            args.config()
        };
        let config = parse(&[
            "enabled",
            "--allow-net",
            "*.example.com",
            "--allow-net",
            "10.0.0.0/8",
        ])
        .unwrap();
        assert_eq!(config.allow_net, ["*.example.com", "10.0.0.0/8"]);
        assert_eq!(
            serde_json::to_value(parse(&["enabled"]).unwrap()).unwrap(),
            serde_json::json!({"mode": "enabled", "allow_net": []})
        );
        let disabled = parse(&["disabled"]).unwrap();
        assert_eq!(
            serde_json::to_value(disabled).unwrap(),
            serde_json::json!({"mode": "disabled", "allow_net": []})
        );
        for args in [
            vec!["disabled", "--allow-net", "example.com"],
            // Create rejects an empty rule, so updates do too; omit the flag
            // for the empty list.
            vec!["enabled", "--allow-net", ""],
            vec!["disabled", "--allow-net", ""],
            vec!["enabled", "--allow-net", "", "--allow-net", "example.com"],
            vec!["enabled", "--allow-net", "example.com", "--allow-net", ""],
            vec!["enabled", "--allow-net", "", "--allow-net", ""],
            vec!["enabled", "--allow-net", "a.com,b.com"],
            vec!["enabled", "--allow-net", "10.0.0.0/33"],
        ] {
            assert!(parse(&args).is_err());
        }
    }
}