Refactor host iptables into focused modules with a stable public facade by Copilot · Pull Request #3030 · github/gh-aw-firewall

Copilot · 2026-05-12T16:26:51Z

✨ Enhancement

src/host-iptables.ts had grown into a 700+ line mixed-responsibility module, with a 379-line setupHostIptables path handling multiple security-critical rule categories. This PR decomposes the file by concern to make firewall behavior easier to audit and evolve without changing call sites.

What does this improve?

Isolates network lifecycle, rule construction, and cleanup into separate modules for clearer ownership in a security-sensitive path.
Preserves existing imports/API surface through a thin facade, so callers continue to use ./host-iptables unchanged.

Why is this valuable?

Reduces review risk in firewall logic (DNS allowlisting, proxy paths, host access, IPv6 handling) by shrinking cognitive scope per file.
Makes future changes to one concern (e.g., network creation) less likely to unintentionally impact others (e.g., iptables policy setup).

Implementation approach:

Module split (by concern)
- src/host-iptables-network.ts: ensureFirewallNetwork, cleanupFirewallNetwork
- src/host-iptables-rules.ts: setupHostIptables, isValidPortSpec, host-access and proxy rule sections
- src/host-iptables-cleanup.ts: cleanupHostIptables
- src/host-iptables-shared.ts: shared constants + IPv6/bridge helper state/functions
Facade preserved
- src/host-iptables.ts now re-exports the public API and types (HostAccessConfig, CliProxyHostConfig) and keeps __testing._resetIpv6State available.

// src/host-iptables.ts
export { setupHostIptables, isValidPortSpec } from './host-iptables-rules';
export type { HostAccessConfig, CliProxyHostConfig } from './host-iptables-rules';
export { ensureFirewallNetwork, cleanupFirewallNetwork } from './host-iptables-network';
export { cleanupHostIptables } from './host-iptables-cleanup';

github-actions · 2026-05-12T16:50:00Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	87.63%	87.78%	📈 +0.15%
Statements	87.60%	87.75%	📈 +0.15%
Functions	92.16%	92.25%	📈 +0.09%
Branches	79.65%	79.69%	📈 +0.04%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/container-lifecycle.ts`	87.4% → 88.4% (+1.08%)	87.7% → 88.8% (+1.06%)
`src/host-iptables.ts`	97.7% → 100.0% (+2.34%)	97.3% → 100.0% (+2.70%)

✨ New Files (4 files)

src/host-iptables-cleanup.ts: 100.0% lines
src/host-iptables-network.ts: 100.0% lines
src/host-iptables-rules.ts: 97.3% lines
src/host-iptables-shared.ts: 96.5% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

This PR refactors the security-critical host iptables implementation into smaller, concern-focused modules while preserving the existing public import surface via a thin src/host-iptables.ts facade.

Changes:

Replaced the monolithic src/host-iptables.ts implementation with a stable facade that re-exports the existing public API.
Extracted shared constants/state and helper functions (bridge/gateway lookup, IPv6/sysctl state) into a shared module.
Split network lifecycle and iptables cleanup into dedicated modules to reduce responsibility overlap.

Show a summary per file

File	Description
src/host-iptables.ts	Converts the original module into a stable public facade re-exporting the same API and preserving `__testing._resetIpv6State`.
src/host-iptables-shared.ts	Introduces shared constants and helper functions (bridge name lookup, gateway lookup, IPv6 availability + sysctl toggling/state).
src/host-iptables-rules.ts	Contains the extracted `setupHostIptables`, `isValidPortSpec`, and related rule construction logic and types.
src/host-iptables-network.ts	Contains the extracted Docker network creation/removal logic for the firewall network.
src/host-iptables-cleanup.ts	Contains the extracted iptables/ip6tables cleanup logic plus IPv6 sysctl re-enable behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 5/5 changed files
Comments generated: 1

+/**
+ * Creates the dedicated firewall network if it doesn't exist
+ * Returns the Squid and agent IPs
+ */
+export async function ensureFirewallNetwork(): Promise<{
+  subnet: string;
+  squidIp: string;
+  agentIp: string;
+  proxyIp: string;
+}> {


lpcox · 2026-05-12T17:08:47Z

@copilot address the review feedback

Copilot · 2026-05-12T17:15:25Z

@copilot address the review feedback

Addressed in commit a1df012. I updated the ensureFirewallNetwork doc comment in src/host-iptables-network.ts to accurately describe the full return shape.

github-actions · 2026-05-12T17:23:38Z

Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP connectivity	❌ (401 — token not available in this context)
GitHub.com HTTP connectivity	⚠️ pre-step template vars not resolved
File write/read	⚠️ pre-step template vars not resolved
BYOK inference (api-proxy → api.githubcopilot.com)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.

Overall: FAIL — pre-step outputs were not interpolated into the prompt; GitHub MCP returned 401.

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-05-12T17:23:55Z

Smoke Test Results

✅ Playwright: GitHub page title verified
✅ File Writing: smoke-test file created
✅ Bash Tool: File verified with cat
❌ GitHub MCP: gh CLI auth error

Status: FAIL (3/4 tests passed)

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-05-12T17:24:20Z

🧪 Smoke Test Results

Test	Status
GitHub MCP connectivity	❌ (401 – MCP token not available in this context)
GitHub.com HTTP connectivity	✅ HTTP 200
File write/read	✅ Content verified

Overall: PARTIAL PASS (infra checks pass; MCP auth unavailable)

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-05-12T17:25:04Z

Smoke test Codex: FAIL
PRs: [docs] docs: document Squid allow_api_proxy_ip ACL and Gemini raw-IP fix; feat: --max-model-multiplier CLI flag + token steering body injection
✅ GitHub PR review, Playwright title, file/bash, AWF build
❌ safeinputs-gh unavailable; Tavily exposes no search tool; github-discussion-query unavailable
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-05-12T17:25:55Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #3030 · ● 764.5K · ◷

github-actions · 2026-05-12T17:26:02Z

Smoke Test Results — Services Connectivity

Check	Result
Redis PING	❌ Timeout/no response
PostgreSQL pg_isready	❌ No response on port 5432
PostgreSQL SELECT 1	❌ Timeout/error

Overall: FAIL — host.docker.internal is not reachable from this environment. Service containers appear to be unavailable.

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-05-12T17:35:34Z

Chroot Smoke Test Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.14.1	v20.20.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: ❌ FAILED — Python and Node.js versions differ between host and chroot environment.

Tested by Smoke Chroot

Initial plan

aec14cc

Copilot AI assigned Copilot and lpcox May 12, 2026

Copilot started work on behalf of lpcox May 12, 2026 16:32 View session

Copilot AI linked an issue May 12, 2026 that may be closed by this pull request

[Refactoring] Split host-iptables.ts: decompose 379-line setupHostIptables into focused rule sections #3021

Closed

refactor: split host iptables module by concern

d4b011c

Copilot AI changed the title ~~[WIP] Refactor host-iptables.ts by decomposing setupHostIptables~~ Refactor host iptables into focused modules with a stable public facade May 12, 2026

Copilot finished work on behalf of lpcox May 12, 2026 16:39

Copilot AI requested a review from lpcox May 12, 2026 16:39

lpcox marked this pull request as ready for review May 12, 2026 16:48

lpcox requested a review from Mossaka as a code owner May 12, 2026 16:48

Copilot AI review requested due to automatic review settings May 12, 2026 16:48

This comment has been minimized.

Sign in to view

Copilot AI reviewed May 12, 2026

View reviewed changes

github-actions Bot added the build-test label May 12, 2026

This comment has been minimized.

Sign in to view

Copilot started work on behalf of lpcox May 12, 2026 17:13 View session

docs: clarify ensureFirewallNetwork return comment

a1df012

Copilot finished work on behalf of lpcox May 12, 2026 17:16

lpcox merged commit 8945c4a into main May 12, 2026
63 of 68 checks passed

lpcox deleted the copilot/refactor-split-host-iptables branch May 12, 2026 18:15

github-actions Bot mentioned this pull request May 12, 2026

Refactor squid config generation into focused modules #3028

Merged

Conversation

Copilot AI commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✨ Enhancement

Uh oh!

github-actions Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented May 12, 2026

Uh oh!

Copilot AI commented May 12, 2026

Uh oh!

github-actions Bot commented May 12, 2026

Smoke Test: Copilot BYOK (Offline) Mode

Uh oh!

github-actions Bot commented May 12, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented May 12, 2026

🧪 Smoke Test Results

Uh oh!

github-actions Bot commented May 12, 2026

Uh oh!

github-actions Bot commented May 12, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented May 12, 2026

Smoke Test Results — Services Connectivity

Uh oh!

github-actions Bot commented May 12, 2026

Chroot Smoke Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 12, 2026 •

edited

Loading

github-actions Bot commented May 12, 2026 •

edited

Loading