Repository navigation
fix(diff-logs): ignore OCSF network Refuse (policy DNS) records - #72
Merged
Merged
Conversation
OpenShell logs a class 4001 / activity 5 "Refuse" record (status_detail policy_dns_ineligible) when policy DNS refuses a name. It has no port or actor, and the connection attempt that follows is logged separately as a denied Open. parse_json_line counted it as a second denial and produced a bogus "manual review: host:?" item. Skip it, matching the shorthand parser, which ignores NET:REFUSE. Closes #69 Signed-off-by: Ilan Harel <ilan@Ilans-MacBook-Pro.local>
ilanh
force-pushed
the
fix/69-diff-logs-dns-refuse
branch
from
November 9, 2026 07:36
7ca5d93 to
401eda6
Compare
ilanh
added a commit
that referenced
this pull request
Nov 9, 2026
Closes #70 Rebased onto main after #71 and #72 merged. The golden note now says OpenShell 0.1.7. Adds a log fixture captured from a real OpenShell v0.1.7 sandbox: the playground image and policy, with `ocsf_json_enabled=true`. - `tests/fixtures/logs/ocsf-1.8.0.jsonl`: 17 native OCSF 1.8.0 records (`metadata.version` is `1.8.0` on every line): - 4001 Open, allowed and denied - two 4001 Refuse records with `policy_dns_ineligible` - 4002 L7 allow and deny - one record each of 0 (relay open/close), 4007 (SSH) and 5019 (policy DNS mapped/staged), which `diff-logs` ignores - Scrubbed: - Device hostname → `sandbox`. - Container → `fixture` with an all-zero UUID. - `metadata.uid`, SSH channel ids and DNS mapping ids → fixed fake UUIDs. - Real resolved IPs → 203.0.113.x (TEST-NET-3). - The 198.18.x synthetic IPs, the proxy loopback address and the public test hostnames are unchanged. - Timestamps rebased. - No usernames or tokens. - `tests/fixtures/ocsf-1.8.0-app/`: a minimal annotated app that matches the captured run. - `tests/cli.rs` `diff_logs_reads_openshell_0_1_7_ocsf_1_8_0_records`: - Checks `10 events: 3 denied, 7 allowed`. - Expects `missing_egress` for example.com (curl) and pypi.org (python3.12), and `l7_allow` for httpbin.org POST /post. - Expects no `manual` items. - Adds the plain human golden `tests/golden/diff_logs_ocsf_1_8_0_plain.txt`. Filesystem denials (two in the run) were not logged at all, which matches NVIDIA/OpenShell#4270 (still open). Ran locally: fmt, clippy `-D warnings`, `cargo test --locked`, `--test gateway_policies` and `gen-docs.sh --check` all pass. Signed-off-by: Ilan Harel <ilan@Ilans-MacBook-Pro.local> Co-authored-by: Ilan Harel <ilan@Ilans-MacBook-Pro.local>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #69
OpenShell logs a Network Activity "Refuse" record (
class_uid4001,activity_id5,status_detail: policy_dns_ineligible) when policy DNS refuses a name the policy doesn't allow. The record has no port and no actor. The connection attempt that follows gets its own record: a denied Open with host, port and binary.parse_json_linecounted the Refuse record as a second denial and added a bogusmanual review: <host>:? (denied connection without a port)item. It now skips 4001 records withactivity_id5 orstatus_detail == "policy_dns_ineligible". The shorthand parser already ignoresNET:REFUSE, so JSON and shorthand logs now give the same results.skips_ocsf_network_refuse_recordsuses a record shaped like the real OpenShell v0.1.7 (OCSF 1.8.0) Refuse record.12 events: 5 denied, 7 allowed, plus twomanual review: example.com:?/pypi.org:?items.10 events: 3 denied, 7 allowed, the same as the shorthand log from the same run.Ran locally: fmt, clippy
-D warnings,cargo test --locked,--test gateway_policiesandgen-docs.sh --checkall pass.