feat(cubenet): support arbitrary custom L7 port + scheme in egress rules - #1347

Merged

zhouxianping merged 31 commits into

TencentCloud:masterfrom

zhouxianping:feat/custom_l7_port

Aug 18, 2026

Commits on Aug 14, 2026

feat(cubenet): port L7 custom-port dataplane and spec tests
hankzhou
committed
ce88fac
feat(cubelet): port L7 custom-port runtime into embedded network runtime
hankzhou
committed
26c09b1
feat(cubeegress): port L7 custom-port lua policy and iptables mark validation
hankzhou
committed
5c9f374
feat(cubeapi,cubemaster): validate egress rule port/scheme at API and master layers
hankzhou
committed
30ba7de
feat(sdk): validate L7 custom port in egress rule policy
hankzhou
committed
c36913d
feat(sdk/node): add port/scheme validation to egress rule match
hankzhou
committed
f95039d
feat(sdk/go): add port/scheme validation to egress rule match
hankzhou
committed
88794f6
feat(deploy): bind L7 skb-mark config into one-click install
hankzhou
committed
86ceca1
feat(examples): port L7 egress network demos incl. custom-port echo
hankzhou
committed
7d68c8f
docs(cubenet): add L7 custom-port design docs and fix bpf object wildcards
hankzhou
committed
5b63864
docs(cubenet): fix stale map-name and function-name comments
hankzhou
committed
458cf1a
fix(examples): probe cube-egress admin on :9091 after #1285 port move
hankzhou
committed
e1f86aa
test(sdk_compat): add L7 custom-port e2e coverage and integration fixes
hankzhou
committed
a3fa691

Commits on Aug 17, 2026

fix(cubenet): keep legacy allow_out pin until DNS migration succeeds
hankzhou
committed
5b15f9b
fix(cubeegress): make port-less deny rules match all intercepted ports
hankzhou
committed
f31f29e
fix(cubeegress): install TPROXY chain atomically via scratch+swap
hankzhou
committed
eff0440
fix(cubelet): deep-copy egress rule match pointers
hankzhou
committed
bcdcd45
fix(cubenet): let plain allow_out coexist with L7 rules on a shared domain
hankzhou
committed
b0cf925
fix(cubenet): recover from half-pinned policy map generation on startup
hankzhou
committed
2862ca9
fix(cubenet): let plain allow_out coexist with L7 rules for static IP hosts
hankzhou
committed
1724f76
fix(cubenet): keep plain L3 access for L7 hosts covered by a wildcard allow_out
hankzhou
committed
f5abd12

Commits on Aug 18, 2026

test(cubevs): run cubevs module unit tests in CI and run.sh
hankzhou
committed
16b53cb
test(cubevs): assert FLOW_HTTP verdict in classify_egress_flow
hankzhou
committed
2b2571d
test(cubeegress): cover sandbox_gateway_ip_from_cidr arithmetic
hankzhou
committed
fcdf0fa
test(cubevs): cover allow_out migration success path and dump port rendering
hankzhou
committed
1baa6cc
test(sdk_compat): prove HTTPS custom-port interception via TLS issuer
hankzhou
committed
e66b524
fix(cubenet): keep tcp_conntracks index bounds-checkable on older clang
hankzhou
committed
3c2904d
ci(unit-test): add cubevs display_name to the test matrix mapping
hankzhou
committed
22d324c
test(sdk_compat): add retry hardening to external-endpoint e2e requests
hankzhou
committed
de6701d
test(sdk_compat): unify MITM CA CN default to the authoritative value
hankzhou
committed
5fc90dc
test(sdk_compat): use an OS-assigned port for the L7 echo server
hankzhou
committed
d1fe16b