Can network policy use REST query params as filters ? ClawHub uses params for skill slug / version in REST download API

[didier-durand]

Hi,

I'd like to use the Openshell network policy to restrict the skills that are downloadable via ClawHub download endpoints.

The skill to download is defined by its slug and version which are given as parems to the REST query.

Can I include those params in the path of the policy definition witn /foo/bar?param1=val1&param2=val2 ? Or does the policy configuration limit itself to path chunks separated by / ?

The doc examples never show paths with params included in filtering. For example,

github_repos:
    name: github_repos
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow:
              method: GET
              path: "/**"
          - allow:
              method: HEAD
              path: "/**"
          - allow:
              method: OPTIONS
              path: "/**"
          - allow:
              method: POST
              path: "/graphql"
          - allow:
              method: "*"
              path: "/repos/<org_name>/alpha-repo/**"
          - allow:
              method: POST
              path: "/repos/<org_name>/bravo-repo/issues"
          - allow:
              method: PATCH

at https://docs.nvidia.com/openshell/latest/sandboxes/policies.html

[johntmyers]

Great question. Short answer: no. Also query params may inadvertently cause denials in connections after further investigation. I'm looking into how we might be able to support this and avoid false positive blocking events.

[didier-durand]

Yes, ClawHub now contains almost 40k skills. We must be able to allow some skill downloads and deny others.
Please, ping back here as you progress on your investigation.

[johntmyers]

Here's a tentative plan.

#615

I understand you want deny too, we will plan deny rules separately, but want to get the allow query params in first.

[didier-durand]

@johntmyers : Hi, I subscribed to #617: great fix. Thks!
Didier