stripe / smokescreen / 36691896449

63%

push

github

Make the self-connection guard configurable (#335)

* smokescreen: make all-port self-connection checks optional

Preserve blocking of local interface addresses on every port by default, while allowing deployments to restore the earlier listening-port-only behavior. Explicitly disabling the new setting keeps self-connection protection on the configured listening port and leaves other destinations subject to normal IP and ACL checks.

Expose the setting through Go configuration, YAML, and the CLI, preserving the default when YAML omits it and honoring explicit command-line overrides.

Committed-By-Agent: codex
Co-authored-by: codex <noreply@openai.com>
Committed-By-Agent: codex
Co-authored-by: codex <noreply@openai.com>

* smokescreen: expose self-connections as an opt-in

Keep self-connections to all local ports blocked by default, and let callers explicitly allow other local ports with AllowSelfConnections. Preserve the listening-port guard and normal destination checks when the option is enabled.

Committed-By-Agent: codex
Co-authored-by: codex <noreply@openai.com>

* smokescreen: guard the active listener port

Einhorn and custom listeners can use a different port from Config.Port. With self-connections enabled, checking the configured port would exempt the actual listener from recursion protection and deny the wrong local port.

Record the selected listener during startup and use its TCP address for the guard and startup logging. Keep Config.Port as the fallback when no TCP listener is available, and cover inherited and custom listeners with startup regression tests.

Committed-By-Agent: codex
Co-authored-by: codex <noreply@openai.com>

* smokescreen: restore the original listener-port check

Keep the self-connection opt-in scoped to restoring the behavior before #328. That behavior compares against Config.Port, including its existing limitations for inherited and custom listeners; tracking the actual runtime port is a separate change.

Committed-... (continued)

8 of 9 new or added lines in 3 files covered. (88.89%)

1873 of 2895 relevant lines covered (64.7%)

14.72 hits per line