Richer support for 'allowed_outbound_hosts'

Signed-off-by: Ryan Levick <[email protected]>

Author: rylev

Cargo.lock

@@ -16,6 +16,7 @@ itertools = "0.10.3"
 lazy_static = "1.4.0"
 mime_guess = { version = "2.0" }
 outbound-http = { path = "../outbound-http", default-features = false }
+spin-outbound-networking = { path = "../outbound-networking" }
 path-absolutize = "3.0.11"
 regex = "1.5.4"
 reqwest = "0.11.9"
@@ -30,7 +31,7 @@ spin-manifest = { path = "../manifest" }
 tempfile = "3.8.0"
 terminal = { path = "../terminal" }
 thiserror = "1.0.49"
-tokio = { version = "1.23", features = [ "full" ] }
+tokio = { version = "1.23", features = ["full"] }
 tokio-util = "0.6"
 toml = "0.8.2"
 tracing = { workspace = true }
@@ -43,4 +44,4 @@ ui-testing = { path = "../ui-testing" }
 [[test]]
 name = "ui"
 path = "tests/ui.rs"
-harness = false
+harness = false

crates/loader/Cargo.toml

@@ -111,6 +111,10 @@ impl LocalLoader {
         component: v2::Component,
     ) -> Result<LockedComponent> {
         outbound_http::allowed_http_hosts::parse_allowed_http_hosts(&component.allowed_http_hosts)?;
+        if let Some(hosts) = &component.allowed_outbound_hosts {
+            spin_outbound_networking::AllowedHosts::parse(hosts)
+                .context("`allowed_outbound_hosts` is malformed")?;
+        }
         let metadata = ValuesMapBuilder::new()
             .string("description", component.description)
             .string_array("allowed_http_hosts", component.allowed_http_hosts)

crates/loader/src/local.rs

@@ -28,7 +28,8 @@
         "allowed_http_hosts": [
           "insecure:allow-all",
           "random-data-api.fermyon.app"
-        ]
+        ],
+        "allowed_outbound_hosts": null
       },
       "source": {
         "content_type": "application/wasm",

crates/loader/tests/ui/insecure-allow-all-with-invalid-url.lock

@@ -32,6 +32,9 @@
   "components": [
     {
       "id": "hello",
+      "metadata": {
+        "allowed_outbound_hosts": null
+      },
       "source": {
         "content_type": "application/wasm",
         "source": "file://<test-dir>/wasm/dummy.wasm"

crates/loader/tests/ui/invalid-manifest-duplicate-id.lock

@@ -49,6 +49,9 @@
   "components": [
     {
       "id": "four-lights",
+      "metadata": {
+        "allowed_outbound_hosts": null
+      },
       "source": {
         "content_type": "application/wasm",
         "source": "file://<test-dir>/wasm/dummy.wasm"
@@ -60,13 +63,19 @@
     },
     {
       "id": "old-test",
+      "metadata": {
+        "allowed_outbound_hosts": null
+      },
       "source": {
         "content_type": "application/wasm",
         "source": "file://<test-dir>/wasm/dummy.wasm"
       }
     },
     {
       "id": "web",
+      "metadata": {
+        "allowed_outbound_hosts": null
+      },
       "source": {
         "content_type": "application/wasm",
         "source": "file://<cache-dir>/spin/registry/wasm/sha256:0000000000000000000000000000000000000000000000000000000000000000"

crates/loader/tests/ui/valid-manifest.lock

@@ -30,6 +30,9 @@
   "components": [
     {
       "id": "fs",
+      "metadata": {
+        "allowed_outbound_hosts": null
+      },
       "source": {
         "content_type": "application/wasm",
         "source": "file://<test-dir>/spin-fs.wasm"

crates/loader/tests/ui/valid-with-files/spin.lock

@@ -31,6 +31,9 @@
   "components": [
     {
       "id": "fs",
+      "metadata": {
+        "allowed_outbound_hosts": null
+      },
       "source": {
         "content_type": "application/wasm",
         "source": "file://<test-dir>/wasm/dummy.wasm"

crates/loader/tests/ui/wagi-custom-entrypoint.lock

@@ -121,7 +121,7 @@ pub struct Component {
 
 /// Used to skip serializing if the value is either `None` or `Some(v)` where `v` is empty
 fn is_none_or_empty<T>(value: &Option<Vec<T>>) -> bool {
-    value.as_ref().map(|s| !s.is_empty()).unwrap_or_default()
+    value.as_ref().map(|s| s.is_empty()).unwrap_or(true)
 }
 
 mod one_or_many {

crates/manifest/src/schema/v2.rs

@@ -0,0 +1,9 @@
+[package]
+name = "spin-outbound-networking"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+
+[dependencies]
+anyhow = "1.0"
+url = "2.4.1"