Method start_with_bind_addr

crates/openshell-supervisor-network/src/proxy.rs:188–332

(
        policy: &ProxyPolicy,
        bind_addr: Option<SocketAddr>,
        opa_engine: Arc<OpaEngine>,
        identity_cache: Arc<BinaryIdentityCache>,
        entrypoint_pid: Arc<AtomicU32>,
   

    /// via `/proc/net/tcp`. All connections are evaluated through OPA policy.
    #[allow(clippy::too_many_arguments)]
    pub(crate) async fn start_with_bind_addr(
        policy: &ProxyPolicy,
        bind_addr: Option<SocketAddr>,
        opa_engine: Arc<OpaEngine>,
        identity_cache: Arc<BinaryIdentityCache>,
        entrypoint_pid: Arc<AtomicU32>,
        tls_state: Option<Arc<ProxyTlsState>>,
        inference_ctx: Option<Arc<InferenceContext>>,
        provider_credentials: Option<ProviderCredentialState>,
        policy_local_ctx: Option<Arc<PolicyLocalContext>>,
        denial_tx: Option<mpsc::UnboundedSender<DenialEvent>>,
        activity_tx: Option<ActivitySender>,
        engine_ready: tokio::sync::watch::Receiver<bool>,
    ) -> Result<Self> {
        // Use override bind_addr, fall back to policy http_addr, then default
        // to loopback:3128.  The default allows the proxy to function when no
        // network namespace is available (e.g. missing CAP_NET_ADMIN) and the
        // policy doesn't specify an explicit address.
        let default_addr: SocketAddr = ([127, 0, 0, 1], 3128).into();
        let http_addr = bind_addr.or(policy.http_addr).unwrap_or(default_addr);

        // Only enforce loopback restriction when not using network namespace override
        if bind_addr.is_none() && !http_addr.ip().is_loopback() {
            return Err(miette::miette!(
                "Proxy http_addr must be loopback-only: {http_addr}"
            ));
        }

        let listener = TcpListener::bind(http_addr).await.into_diagnostic()?;
        let local_addr = listener.local_addr().into_diagnostic()?;
        {
            let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx())
                .activity(ActivityId::Listen)
                .severity(SeverityId::Informational)
                .status(StatusId::Success)
                .dst_endpoint(Endpoint::from_ip(local_addr.ip(), local_addr.port()))
                .message(format!("Proxy listening on {local_addr}"))
                .build();
            ocsf_emit!(event);
        }

        // Detect the trusted host gateway IP from /etc/hosts before user code
        // runs. This is read once at startup so later /etc/hosts modifications
        // by sandbox workloads cannot influence the stored value.
        let trusted_host_gateway: Arc<Option<IpAddr>> = Arc::new(detect_trusted_host_gateway());
        if let Some(ref ip) = *trusted_host_gateway {
            tracing::info!(
                %ip,
                "Trusted host gateway detected from /etc/hosts; \
                 host-gateway aliases exempt from SSRF always-blocked check"
            );
        }

        let join = tokio::spawn(async move {
            // Wait for the OPA engine's symlink resolution reload to complete
            // before accepting connections. This prevents requests from
            // observing a generation transition mid-flight, which would cause
            // the generation guard to reject them with a 403.