Refactor host iptables setup into validation, chain, and rule modules by Copilot · Pull Request #5355 · github/gh-aw-firewall

Copilot · 2026-06-21T16:01:23Z

src/host-iptables-rules.ts had grown into a single security-critical module mixing input validation, chain lifecycle management, and rule application. This change splits those concerns into focused modules while keeping the public setupHostIptables API and rule behavior intact.

Validation helpers
- Moved port-spec parsing and iptables error-shape helpers into src/host-iptables-validation.ts
- Kept the test-only validation helper export available through src/host-iptables-rules.test-utils.ts
Chain lifecycle management
- Moved chain setup, DOCKER-USER jump insertion, and debug logging into src/host-iptables-chain.ts
- Preserved the existing permission checks, missing-iptables handling, and prior-chain cleanup flow
Rule application module
- Reduced src/host-iptables-rules.ts to rule construction/orchestration plus the public host-access config types
- Left setupHostIptables(...) and its caller-facing contract unchanged

Example of the new separation:

// host-iptables-rules.ts
import {
  checkPermissionsAndSetupChain,
  insertDockerUserJumpRule,
  logChainDebugOutput,
} from './host-iptables-chain';
import { parseValidPortSpecs } from './host-iptables-validation';

Copilot

Pull request overview

This PR refactors the host iptables implementation by separating validation, chain lifecycle management, and rule orchestration into dedicated modules, while keeping the setupHostIptables(...) entrypoint and runtime behavior intended to remain unchanged.

Changes:

Added src/host-iptables-validation.ts to house port-spec parsing and iptables error-shape helpers (plus test-only helper export).
Added src/host-iptables-chain.ts to encapsulate chain setup/cleanup, DOCKER-USER jump insertion, and chain debug logging.
Updated src/host-iptables-rules.ts to focus on rule construction/orchestration and delegate chain + validation responsibilities to the new modules.

Show a summary per file

File	Description
src/host-iptables-validation.ts	New validation/error-shape helper module extracted from the prior monolithic rules file.
src/host-iptables-chain.ts	New chain lifecycle module for permissions checks, chain creation/cleanup, and DOCKER-USER jump management.
src/host-iptables-rules.ts	Reduced to orchestration + rule application; imports chain/validation helpers from new modules.
src/host-iptables-rules.test-utils.ts	Redirected test-only helper re-export to the new validation module.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 4/4 changed files
Comments generated: 1

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-06-21T17:24:47Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-06-21T17:24:47Z

✅ Smoke Claude passed

github-actions · 2026-06-21T17:24:48Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

github-actions · 2026-06-21T17:24:49Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

github-actions · 2026-06-21T17:24:49Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-06-21T17:24:50Z

✅ Smoke Gemini completed. All facets verified. 💎

github-actions · 2026-06-21T17:24:50Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-06-21T17:24:50Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-06-21T17:24:51Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-06-21T17:24:53Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-06-21T17:24:56Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-06-21T17:25:02Z

✅ Build Test Suite completed successfully!

github-actions · 2026-06-21T17:27:54Z

Smoke Test: BYOK Mode ✅

Mode: Direct BYOK via api-proxy → api.githubcopilot.com

✅ MCP Connectivity: GitHub API responding
✅ BYOK Inference: Copilot executing prompts
✅ Placeholder Auth: Agent has dummy key, real key in sidecar
✅ API Environment: Copilot variables properly injected

Status: PASS — All BYOK inference tests verified.

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-06-21T17:28:08Z

Smoke Test: Claude Engine Validation

API status: ✅ PASS
gh check: ✅ PASS
File status: ✅ PASS

Overall result: PASS

Generated by Smoke Claude for issue #5355 · 36.6 AIC · ⊞ 3.1K · ◷

github-actions · 2026-06-21T17:28:22Z

🔬 Smoke Test Results

PR: Refactor host iptables setup into validation, chain, and rule modules
Author: @Copilot | Assignees: @lpcox @Copilot

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	❌ (pre-step data missing)
File write/read	❌ (pre-step data missing)

Overall: FAIL — pre-step outputs were not resolved (unsubstituted ${{ steps.smoke-data.outputs.* }} variables).

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-06-21T17:28:28Z

🔍 Smoke Test: PAT Auth — PASS

PR: Refactor host iptables setup into validation, chain, and rule modules
Author: @Copilot | Assignees: @lpcox @Copilot
Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	⚠️ template vars unexpanded

Overall: PASS (2/2 verifiable tests passed; file test skipped — pre-step template expansion issue)

🔑 PAT report filed by Smoke Copilot PAT

github-actions · 2026-06-21T17:29:01Z

PRs reviewed:

[Test Coverage] Cover regex rules in policy-manifest and signals in log-streamer
perf(security-guard): prioritize security-relevant files in PR diff
GitHub title check: ✅
File write/verify: ✅
Discussion comment: ✅
Build: ✅
Overall: PASS

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-06-21T17:29:09Z

🧪 Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.16.0	v22.22.3	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall result: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

github-actions · 2026-06-21T17:29:14Z

🔍 Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
1. Module Loading	✅ Pass	`otel.js` loads successfully; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled` + internal helpers
2. Test Suite	✅ Pass	59 tests passed, 0 failed across `otel.test.js` + `otel-fanout.test.js`
3. Env Var Forwarding	✅ Pass	`api-proxy-service-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME`
4. Token Tracker Integration	✅ Pass	`onUsage` callback exists in `token-tracker-http.js` (line 283/324) as the OTEL hook point
5. OTEL Diagnostics / Graceful Degradation	✅ Pass	When no OTEL endpoint is configured, `isEnabled()` returns `true` with local file fallback (`/var/log/api-proxy/otel.jsonl`); provider initializes cleanly

All scenarios pass. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-06-21T17:30:09Z

Smoke Test Results: Gemini

GitHub MCP Testing: ❌ (Tool not found)
GitHub.com Connectivity: ❌ (SSL error 35)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

github-actions · 2026-06-21T17:30:28Z

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ Connection timed out
PostgreSQL pg_isready	❌ No response
PostgreSQL SELECT 1	❌ Connection timed out

Overall: FAIL

host.docker.internal resolves to 172.17.0.1 but none of the service containers (Redis :6379, PostgreSQL :5432) are reachable from this environment.

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-06-21T17:30:37Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #5355 · 34.3 AIC · ⊞ 7.7K · ◷

github-actions · 2026-06-22T01:43:46Z

@Copilot @lpcox

Smoke test results:

PR 5352: ❌ live MCP test skipped (using pre-fetched data)
GitHub.com HTTP: ✅
File I/O: ✅
BYOK path: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

Initial plan

f5a4ee2

Copilot AI assigned Copilot and lpcox Jun 21, 2026

Copilot started work on behalf of lpcox June 21, 2026 16:03 View session

refactor: split host iptables helper modules

4e80a3b

Copilot AI changed the title ~~[WIP] Refactor host iptables rules into focused modules~~ Refactor host iptables setup into validation, chain, and rule modules Jun 21, 2026

Copilot AI requested a review from lpcox June 21, 2026 16:07

Copilot finished work on behalf of lpcox June 21, 2026 16:07

lpcox marked this pull request as ready for review June 21, 2026 17:12

Copilot AI review requested due to automatic review settings June 21, 2026 17:12

Copilot started reviewing on behalf of lpcox June 21, 2026 17:13 View session

Copilot AI reviewed Jun 21, 2026

View reviewed changes

Comment thread src/host-iptables-validation.ts Outdated

Potential fix for pull request finding

8d35889

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

lpcox added the ready-for-aw label Jun 21, 2026

lpcox had a problem deploying to aoai-model June 21, 2026 17:24 — with GitHub Actions Failure

lpcox temporarily deployed to aoai-model June 21, 2026 17:27 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok label Jun 21, 2026

lpcox temporarily deployed to aoai-model June 21, 2026 17:27 — with GitHub Actions Inactive

github-actions Bot added the smoke-claude label Jun 21, 2026

github-actions Bot mentioned this pull request Jun 21, 2026

[aw] Smoke Copilot BYOK AOAI (Entra) failed #5360

Closed

github-actions Bot added the smoke-copilot-pat label Jun 21, 2026

github-actions Bot mentioned this pull request Jun 21, 2026

[aw] Smoke Copilot BYOK AOAI (api-key) failed #5361

Closed

github-actions Bot added the smoke-codex label Jun 21, 2026

github-actions Bot added the build-test label Jun 21, 2026

lpcox enabled auto-merge (squash) June 21, 2026 17:50

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jun 22, 2026

lpcox disabled auto-merge June 22, 2026 03:18

lpcox merged commit ab49ab8 into main Jun 22, 2026
61 of 65 checks passed

lpcox deleted the copilot/refactor-host-iptables-rules branch June 22, 2026 03:18

Conversation

Copilot AI commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 21, 2026

Smoke Test: BYOK Mode ✅

Uh oh!

github-actions Bot commented Jun 21, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jun 21, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Jun 21, 2026

🔍 Smoke Test: PAT Auth — PASS

Uh oh!

github-actions Bot commented Jun 21, 2026

Uh oh!

github-actions Bot commented Jun 21, 2026

🧪 Chroot Version Comparison Results

Uh oh!

github-actions Bot commented Jun 21, 2026

🔍 Smoke Test: API Proxy OpenTelemetry Tracing

Uh oh!

github-actions Bot commented Jun 21, 2026

Smoke Test Results: Gemini

Uh oh!

github-actions Bot commented Jun 21, 2026

Smoke Test: GitHub Actions Services Connectivity

Uh oh!

github-actions Bot commented Jun 21, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Copilot AI commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading

github-actions Bot commented Jun 21, 2026 •

edited

Loading