bytecodealliance / bytecodealliance/WASI-Virt
Advanced HTTP ACL
- Dominant language
- Rust
- Stars
- 235
- Forks
- 27
- PR merge metrics
- No merged PRs in 30d
Description
In (https://github.com/bytecodealliance/wasmtime/pull/6808 / https://github.com/nethunterslabs/wasmtime/tree/wasi-http-acl) I integrated a HTTP ACL to be used for outgoing HTTP requests. We are still using this custom fork (which I'm hopefully going to update soon) until we can possibly create a component generator or another solution.
The HTTP ACL has the following flow:
- Is the HTTP method allowed
- Is the URL Scheme allowed (i.e. HTTP or HTTPS)
- Is the port allowed (if set)
- Check the authority:
- If it is a domain/hostname:
- Check if there is a static DNS record in the ACL
- If no static record then check if it is allowed
- Resolve the host/domain and check the IP address/es is/are allowed
- If it is an IP address check the IP address is allowed
- Check the URL path is allowed
In the PR it was mentioned that a HTTP ACL could be solved by a component generator. I can see how this can be done for all the steps aside from the IP address resolution without resolving it twice, once here and once in `wasi-http`. Is there a plan or scope to create an advanced HTTP ACL like this in `wasi-virt` or is there another approach that would be better?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading the linked wasmtime PR 6808 and the wasi-http-acl branch, then compare their ACL flow with wasi-http address resolution. Done means establishing whether advanced HTTP ACLs belong in wasi-virt or require another approach, especially without resolving IP addresses twice, and documenting the resulting scope.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100