Add Gateway Portal and PKI feature handlers#63
Merged
aidankhogg merged 4 commits intoJun 28, 2026
Conversation
…tion features PKI (pki_handler.py + phase_pki.py): - DNSSEC: setup_dnssec() generates KSK+ZSK via dnssec-keygen in BIND container, keys stored in netengines_dnssec_keys volume for CoreDNS dnssec plugin - CRL: _inject_crl_config() patches ca.json with crl.enabled before server start - OCSP: _inject_ocsp_config() patches ca.json authority.claims.enableOCSP - Intermediate CA: read_intermediate_cert() exposes step-ca's auto-generated intermediate cert; bootstrap() stores it in state when intermediate_ca_enabled - PKI Rotation Policy: _register_rotation_worker() refactored to be fully dynamic — handles all builtin cert types plus any extras declared in cert_type_overrides Real Internet Gateway (gateway_handler.py): - apply_internet_policy() dispatches to per-mode nftables rule generators - ISOLATED: block all WAN ingress/egress - SHADOWED: outbound HTTPS only + masquerade, no WAN inbound - MIRRORED: forward to configured service_mirrors, block all other WAN - EXPOSED: full pass-through with stateful inbound filtering - CUSTOM: no-op (operator manages rules) - remove_internet_policy() teardown method - apply_peer_routing() / remove_peer_routing() for cross-world peer endpoints Cross-World Federation (gateway_portal_handler.py — new): - GatewayPortalHandler implements BasePhaseHandler for the gateway_portal spec section - Applies real internet policy and sets up cross-world peers in one phase - Per-peer: installs trust anchor cert into gateway container CA bundle, adds nftables routing rules, configures CoreDNS forwarding stub zone - Supports PEERED and FEDERATED modes; NONE is a no-op State (state.py): - Added intermediate_ca_cert, dnssec_output, gateway_portal_output fields Tests: 55 new unit tests across test_pki_features.py and test_gateway_portal.py; all 186 existing tests continue to pass. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Run black on all 6 new/modified handler and test files
- Fix gateway_portal_handler.py mypy errors: add dict[str, Any] type args
on all 4 bare `dict` return/param annotations, add type: ignore for
untyped DockerHandler() call, fix pgmq send() to two-arg form
send("gateway_portal_events", event)
- Add setup_dnssec to SimpleNamespace mock in test_phase_3_pki_inserts_ca_dns_record
so the integration test survives phase_pki calling pki.setup_dnssec()
when minimal.yaml has dnssec_enabled: true
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR introduces comprehensive support for Gateway Portal (real internet access and cross-world federation) and extended PKI features (CRL, OCSP, intermediate CA, DNSSEC). It adds new handler implementations, test coverage, and integrates these features into the Phase 3 PKI bootstrap and post-Phase 7 gateway portal execution flows.
Key Changes
Gateway Portal Handler (
gateway_portal_handler.py)Gateway Handler Extensions (
gateway_handler.py)apply_internet_policy()andremove_internet_policy()methods_isolated_internet_rules(): Blocks all WAN traffic_shadowed_internet_rules(): Allows outbound HTTPS only with masquerade_mirrored_internet_rules(): Restricts traffic to configured service mirrors_exposed_internet_rules(): Full internet access with stateful filteringapply_peer_routing()andremove_peer_routing()for cross-world federationPKI Handler Extensions (
pki_handler.py)_pki_flag()helper to read boolean PKI flags from both Pydantic models and dict specsread_intermediate_cert()to expose intermediate CA certificate_read_ca_config()and_write_ca_config()for step-ca configuration management_inject_crl_config()to enable CRL generation in ca.json_inject_ocsp_config()to enable OCSP responder in ca.jsonsetup_dnssec()to generate DNSSEC keys (KSK and ZSK) for zonesPhase 3 PKI Handler (
phase_pki.py)Runtime State (
core/state.py)intermediate_ca_certfield to track intermediate CA certificategateway_portal_outputfield for gateway portal deployment resultsdnssec_outputfield for DNSSEC key informationTest Coverage
test_gateway_portal.py: 354 lines covering real internet policy generation, peer routing, trust anchor installation, and mock mode executiontest_pki_features.py: 354 lines covering intermediate CA, CRL, OCSP, and DNSSEC feature implementationsImplementation Details
https://claude.ai/code/session_01Et5va49PwFQRdDQFompEZ1