bytecodealliance / bytecodealliance/WASI-Virt

Advanced HTTP ACL

Open
#53 4 comments 1 reaction 0 assignees View on GitHub
Dominant language
Rust
Stars
235
Forks
27
PR merge metrics
No merged PRs in 30d

Description

In (https://github.com/bytecodealliance/wasmtime/pull/6808 / https://github.com/nethunterslabs/wasmtime/tree/wasi-http-acl) I integrated a HTTP ACL to be used for outgoing HTTP requests. We are still using this custom fork (which I'm hopefully going to update soon) until we can possibly create a component generator or another solution.

The HTTP ACL has the following flow:
- Is the HTTP method allowed
- Is the URL Scheme allowed (i.e. HTTP or HTTPS)
- Is the port allowed (if set)
- Check the authority:
- If it is a domain/hostname:
- Check if there is a static DNS record in the ACL
- If no static record then check if it is allowed
- Resolve the host/domain and check the IP address/es is/are allowed
- If it is an IP address check the IP address is allowed
- Check the URL path is allowed

In the PR it was mentioned that a HTTP ACL could be solved by a component generator. I can see how this can be done for all the steps aside from the IP address resolution without resolving it twice, once here and once in `wasi-http`. Is there a plan or scope to create an advanced HTTP ACL like this in `wasi-virt` or is there another approach that would be better?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the linked wasmtime PR 6808 and the wasi-http-acl branch, then compare their ACL flow with wasi-http address resolution. Done means establishing whether advanced HTTP ACLs belong in wasi-virt or require another approach, especially without resolving IP addresses twice, and documenting the resulting scope.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.