glm-5.1
f6e62a37ef
- Replace admin socket section with admin HTTP API section - Update config table (admin_socket_path → admin_key_path) - Update project structure (admin/auth.rs, handler.rs, config/mod.rs) - Update architecture diagram (Admin HTTP API instead of Unix socket) - Update Docker compose volume (admin-key instead of socket dir) - Mark all four task files as status: completed with summaries
116 lines
4.3 KiB
Markdown
116 lines
4.3 KiB
Markdown
---
|
|
id: fix/wildcard-flag-reload
|
|
name: Store cli_allow_wildcard_bind in ConfigReloadHandle for consistent reload validation (ADR-030)
|
|
status: completed
|
|
depends_on: []
|
|
scope: narrow
|
|
risk: low
|
|
impact: component
|
|
level: implementation
|
|
review_findings: [W5]
|
|
adr: [030]
|
|
---
|
|
|
|
## Description
|
|
|
|
When the proxy starts with `--allow-wildcard-bind` (or `allow_wildcard_bind =
|
|
true` in config), bind addresses using `0.0.0.0` are accepted. But on config
|
|
reload, `validate()` is called with `cli_allow_wildcard_bind: false` — a
|
|
hardcoded value in `ConfigReloadHandle::reload()`. This means a config that was
|
|
valid at startup will be rejected on reload because the flag that enabled
|
|
wildcard binding is not preserved.
|
|
|
|
ADR-030 specifies storing `cli_allow_wildcard_bind` in `ConfigReloadHandle` at
|
|
construction time and using the stored value during reload validation.
|
|
|
|
### Changes Required
|
|
|
|
**`src/config/dynamic_config.rs`** — `ConfigReloadHandle` struct:
|
|
- Add `cli_allow_wildcard_bind: bool` field
|
|
- Update `ConfigReloadHandle::new()` to accept and store the flag:
|
|
```rust
|
|
pub fn new(
|
|
config: Arc<ArcSwap<DynamicConfig>>,
|
|
static_config: StaticConfig,
|
|
cli_allow_wildcard_bind: bool,
|
|
) -> Self {
|
|
Self {
|
|
config,
|
|
static_config: ArcSwap::from_pointee(static_config),
|
|
reload_mutex: Mutex::new(()),
|
|
cli_allow_wildcard_bind,
|
|
}
|
|
}
|
|
```
|
|
- In `reload()`, pass `self.cli_allow_wildcard_bind` to `validate()` instead
|
|
of `false`:
|
|
```rust
|
|
validate(&new_static, &new_dynamic, self.cli_allow_wildcard_bind)?;
|
|
```
|
|
|
|
**`src/main.rs`** — Update `ConfigReloadHandle::new()` call to pass
|
|
`cli_allow_wildcard_bind` from the loaded config:
|
|
```rust
|
|
let reload_handle = Arc::new(ConfigReloadHandle::new(
|
|
config_arc.clone(),
|
|
loaded_config.static_config.clone(),
|
|
loaded_config.cli_allow_wildcard_bind, // or args.allow_wildcard_bind
|
|
));
|
|
```
|
|
|
|
The `cli_allow_wildcard_bind` value should be the OR of the config flag and
|
|
the CLI flag, matching the startup validation logic. Check `src/cli.rs` for
|
|
how the flag is currently handled.
|
|
|
|
**`src/admin/socket.rs`** (or `src/admin/handler.rs` after migration) — Same
|
|
change: pass the flag through to `ConfigReloadHandle::new()`.
|
|
|
|
**`src/config/validation.rs`** — No changes needed; `validate()` already
|
|
accepts `cli_allow_wildcard_bind: bool` and uses it correctly.
|
|
|
|
**Tests** — Update all `ConfigReloadHandle::new()` calls to include the new
|
|
parameter. Add a test that verifies:
|
|
1. A config with `0.0.0.0` bind address is accepted on reload when
|
|
`cli_allow_wildcard_bind: true`
|
|
2. A config with `0.0.0.0` bind address is rejected on reload when
|
|
`cli_allow_wildcard_bind: false`
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] `ConfigReloadHandle` has a `cli_allow_wildcard_bind: bool` field
|
|
- [ ] `ConfigReloadHandle::new()` accepts and stores `cli_allow_wildcard_bind`
|
|
- [ ] `reload()` passes `self.cli_allow_wildcard_bind` to `validate()`
|
|
(not hardcoded `false`)
|
|
- [ ] All `ConfigReloadHandle::new()` call sites pass the correct flag
|
|
- [ ] Config with `0.0.0.0` bind address is accepted on reload when flag is
|
|
true (test)
|
|
- [ ] Config with `0.0.0.0` bind address is rejected on reload when flag is
|
|
false (test)
|
|
- [ ] `cargo test` passes
|
|
- [ ] `cargo clippy` passes with no warnings
|
|
|
|
## References
|
|
|
|
- docs/architecture/decisions/030-wildcard-flag-consistency.md — ADR-030
|
|
- docs/reviews/005-admin-socket-security-review.md — W5 finding
|
|
- docs/architecture/config.md — validation rules, allow_wildcard_bind
|
|
- src/config/dynamic_config.rs — ConfigReloadHandle
|
|
- src/config/validation.rs — validate()
|
|
- src/cli.rs — CLI flag handling
|
|
|
|
## Notes
|
|
|
|
> This fix is independent of the admin socket → HTTP migration. It should be
|
|
> applied to `ConfigReloadHandle` regardless of which admin interface is used.
|
|
> The implementation is straightforward: add a field, pass it through.
|
|
>
|
|
> The flag value should be `allow_wildcard_bind || cli_allow_wildcard_bind`
|
|
> (OR logic) matching the startup behavior documented in config.md.
|
|
|
|
## Summary
|
|
|
|
Added `cli_allow_wildcard_bind: bool` field to `ConfigReloadHandle`, stored at
|
|
construction time from `LoadedConfig.allow_wildcard_bind`. `reload()` now passes
|
|
`self.cli_allow_wildcard_bind` to `validate()` instead of hardcoded `false`.
|
|
All call sites updated. 2 new unit tests verify wildcard bind acceptance/rejection
|
|
on reload. |