fix(policy)!: reject removed tls endpoint values

Signed-off-by: Yuedong Wu <dwcn22@outlook.com>

Author: lunarwhite

architecture/security-policy.md

@@ -242,8 +242,11 @@ higher specificity rank deterministically overrides broader request-processing
 metadata. Equally specific overlapping endpoints must agree.
 
 Endpoint `tls`, `enforcement`, and `access` use protobuf enums and retain their
-named YAML spellings. `protocol` remains a string so the supported protocol set
-can evolve, but every ingress validates it before persistence or activation.
+named YAML spellings. `tls` admits only an omitted value, meaning auto-detect
+and terminate for inspection, or `skip`; every other value, including the
+removed `terminate` and `passthrough` spellings, is rejected. `protocol`
+remains a string so the supported protocol set can evolve, but every ingress
+validates it before persistence or activation.
 The supervisor also refuses unknown enum numbers and protocol values
 defensively; an unrecognized enforcement value never falls back to audit.
 

crates/openshell-cli/src/commands/provider.rs

@@ -2909,13 +2909,7 @@ binaries: [/usr/bin/curl]
         )
         .expect("valid profile fixture");
         let mut descriptions = Vec::new();
-        for (tls, allow_uninspected_credentials) in [
-            ("", false),
-            ("", true),
-            ("skip", true),
-            ("terminate", false),
-            ("passthrough", false),
-        ] {
+        for (tls, allow_uninspected_credentials) in [("", false), ("", true), ("skip", true)] {
             let mut variant = profile.clone();
             variant.endpoints[0].tls = tls.to_string();
             variant.endpoints[0].allow_uninspected_credentials = allow_uninspected_credentials;
@@ -2947,8 +2941,6 @@ binaries: [/usr/bin/curl]
                 .contains("TLS: skip (raw tunnel; no L7 inspection or credential rewrite)\n")
         );
         assert!(descriptions[2].contains("Allow uninspected credentials: true\n"));
-        assert!(descriptions[3].contains("TLS: terminate (automatic TLS detection)\n"));
-        assert!(descriptions[4].contains("TLS: passthrough (automatic TLS detection)\n"));
     }
 
     #[test]

crates/openshell-cli/tests/provider_commands_integration.rs

@@ -4863,7 +4863,6 @@ endpoints:
   - host: api.advanced.example
     ports: [443, 8443]
     protocol: rest
-    tls: terminate
     enforcement: enforce
     rules:
       - allow:

crates/openshell-policy/src/l7_validate.rs

@@ -68,10 +68,17 @@ pub fn network_access_preset_to_str(value: i32) -> Option<&'static str> {
     }
 }
 
+fn unknown_tls_value(tls: &str) -> Option<String> {
+    (!matches!(tls, "" | "skip")).then(|| {
+        format!("unknown tls value '{tls}'; omit the field to keep automatic TLS termination")
+    })
+}
+
 pub fn validate_endpoint_mode_values(tls: i32, enforcement: i32, access: i32) -> Vec<String> {
     let mut errors = Vec::new();
-    if network_tls_mode_to_str(tls).is_none() {
-        errors.push(format!("unknown tls enum value {tls}"));
+    match network_tls_mode_to_str(tls) {
+        Some(value) => errors.extend(unknown_tls_value(value)),
+        None => errors.push(format!("unknown tls enum value {tls}")),
     }
     if network_enforcement_mode_to_str(enforcement).is_none() {
         errors.push(format!("unknown enforcement enum value {enforcement}"));
@@ -174,7 +181,7 @@ mod agent_transport_tests {
     #[test]
     fn agent_cannot_request_native_tcp_or_skip_tls_inspection() {
         assert!(agent_authored_transport_rejection("tcp", "").is_some());
-        assert!(agent_authored_transport_rejection("TCP", "terminate").is_some());
+        assert!(agent_authored_transport_rejection("TCP", "").is_some());
         assert!(agent_authored_transport_rejection("", "skip").is_some());
         assert!(agent_authored_transport_rejection("rest", "SKIP").is_some());
     }
@@ -185,11 +192,7 @@ mod agent_transport_tests {
 pub fn validate_endpoint_modes(tls: &str, enforcement: &str, access: &str) -> Vec<String> {
     let mut errors = Vec::new();
 
-    if !matches!(tls, "" | "skip" | "terminate" | "passthrough") {
-        errors.push(format!(
-            "unknown tls value '{tls}' (expected skip, terminate, or passthrough)"
-        ));
-    }
+    errors.extend(unknown_tls_value(tls));
     if !matches!(enforcement, "" | "enforce" | "audit") {
         errors.push(format!(
             "unknown enforcement value '{enforcement}' (expected enforce or audit)"
@@ -357,9 +360,18 @@ mod tests {
         assert!(errors[2].contains("unknown access value 'read-wirte'"));
     }
 
+    #[test]
+    fn endpoint_mode_values_reject_removed_tls_enums() {
+        for legacy in [2, 3] {
+            let errors = validate_endpoint_mode_values(legacy, 0, 0);
+            assert_eq!(errors.len(), 1, "tls: {legacy}");
+            assert!(errors[0].contains("unknown tls value"));
+        }
+    }
+
     #[test]
     fn endpoint_modes_accept_documented_values_and_defaults() {
-        for tls in ["", "skip", "terminate", "passthrough"] {
+        for tls in ["", "skip"] {
             for enforcement in ["", "enforce", "audit"] {
                 for access in ["", "read-only", "read-write", "full"] {
                     assert!(validate_endpoint_modes(tls, enforcement, access).is_empty());

crates/openshell-policy/src/merge.rs

@@ -833,9 +833,7 @@ fn endpoint_attributes_cover(loaded: &NetworkEndpoint, proposed: &NetworkEndpoin
     if !proposed.protocol.is_empty() && !protocols_match(&loaded.protocol, &proposed.protocol) {
         return false;
     }
-    if proposed.tls != NetworkTlsMode::Unspecified as i32
-        && effective_tls(loaded.tls) != effective_tls(proposed.tls)
-    {
+    if proposed.tls != NetworkTlsMode::Unspecified as i32 && loaded.tls != proposed.tls {
         return false;
     }
     if proposed.enforcement != NetworkEnforcementMode::Unspecified as i32
@@ -940,19 +938,6 @@ fn protocols_match(left: &str, right: &str) -> bool {
     }
 }
 
-#[allow(deprecated)]
-fn effective_tls(value: i32) -> i32 {
-    match value {
-        value
-            if value == NetworkTlsMode::Terminate as i32
-                || value == NetworkTlsMode::Passthrough as i32 =>
-        {
-            NetworkTlsMode::Unspecified as i32
-        }
-        value => value,
-    }
-}
-
 fn effective_enforcement(value: i32) -> i32 {
     if value == NetworkEnforcementMode::Unspecified as i32 {
         NetworkEnforcementMode::Audit as i32
@@ -3783,7 +3768,6 @@ mod tests {
         assert!(!policy_covers_rule(&loaded, &different_body));
 
         let mut explicit_defaults = loaded_endpoint;
-        explicit_defaults.tls = 3; // deprecated passthrough compatibility value
         explicit_defaults.enforcement = NetworkEnforcementMode::Audit as i32;
         let runtime_defaults = rule_with_authorizations(
             "proposed",
@@ -3792,14 +3776,6 @@ mod tests {
         );
         assert!(policy_covers_rule(&loaded, &runtime_defaults));
 
-        explicit_defaults.tls = 2; // deprecated terminate compatibility value
-        let legacy_terminate = rule_with_authorizations(
-            "proposed",
-            vec![explicit_defaults.clone()],
-            &["/usr/bin/client"],
-        );
-        assert!(policy_covers_rule(&loaded, &legacy_terminate));
-
         explicit_defaults.tls = NetworkTlsMode::Skip as i32;
         let skip_tls = rule_with_authorizations(
             "proposed",

crates/openshell-prover/src/containment.rs

@@ -1596,7 +1596,7 @@ fn validate_supported_endpoint_extensions(
     context: &str,
     endpoint: &Endpoint,
 ) -> Result<(), UnsupportedFeature> {
-    if !matches!(endpoint.tls.as_str(), "" | "terminate" | "passthrough")
+    if !endpoint.tls.is_empty()
         || endpoint.allow_encoded_slash
         || endpoint.websocket_credential_rewrite
         || endpoint.request_body_credential_rewrite
@@ -3184,17 +3184,20 @@ network_policies:
     }
 
     #[test]
-    fn deprecated_tls_spelling_does_not_change_authority() {
-        let boundary = parse(
-            "version: 1\nnetwork_policies:\n  n:\n    endpoints:\n      - host: api.example.com\n        port: 443\n        protocol: rest\n        tls: terminate\n        enforcement: enforce\n        access: read-only\n    binaries: [{ path: /usr/bin/curl }]\n",
-        );
-        let candidate = parse(
-            "version: 1\nnetwork_policies:\n  n:\n    endpoints:\n      - host: api.example.com\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        rules:\n          - allow: { method: GET, path: '/v1/**' }\n    binaries: [{ path: /usr/bin/curl }]\n",
-        );
-        assert!(matches!(
-            check_within_boundary(&boundary, &candidate, options()),
-            CheckResult::Within(_)
-        ));
+    fn removed_tls_spelling_is_outside_the_authority_model() {
+        for tls in ["terminate", "passthrough"] {
+            let policy = parse(&format!(
+                "version: 1\nnetwork_policies:\n  n:\n    endpoints:\n      - host: api.example.com\n        port: 443\n        protocol: rest\n        tls: {tls}\n        enforcement: enforce\n        access: read-only\n    binaries: [{{ path: /usr/bin/curl }}]\n"
+            ));
+            assert!(
+                matches!(
+                    check_within_boundary(&policy, &policy, options()),
+                    CheckResult::Unsupported(ref evidence)
+                        if evidence.reason().contains("outside the initial model")
+                ),
+                "tls: {tls}"
+            );
+        }
     }
 
     #[test]

crates/openshell-providers/src/profiles.rs

@@ -5516,7 +5516,6 @@ endpoints:
   - host: api.example.com
     ports: [443, 8443]
     protocol: rest
-    tls: terminate
     enforcement: enforce
     rules:
       - allow:
@@ -5563,10 +5562,6 @@ binaries:
         let rest_ep = &proto.endpoints[1];
         assert_eq!(rest_ep.port, 0);
         assert_eq!(rest_ep.ports, vec![443, 8443]);
-        assert_eq!(
-            rest_ep.tls,
-            openshell_core::proto::NetworkTlsMode::Terminate as i32
-        );
         assert_eq!(rest_ep.allowed_ips, vec!["10.0.0.0/24"]);
         assert!(rest_ep.allow_encoded_slash);
         assert!(rest_ep.allow_uninspected_credentials);

crates/openshell-server/src/grpc/policy.rs

@@ -10019,14 +10019,12 @@ mod tests {
         }
     }
 
-    #[allow(deprecated)]
     fn l7_scope_policy() -> ProtoSandboxPolicy {
         let endpoint = NetworkEndpoint {
             host: "api.example.com".to_string(),
             port: 443,
             ports: vec![443, 8443],
             protocol: "rest".to_string(),
-            tls: openshell_core::proto::NetworkTlsMode::Terminate as i32,
             access: openshell_core::proto::NetworkAccessPreset::ReadOnly as i32,
             ..Default::default()
         };
@@ -10982,7 +10980,6 @@ mod tests {
         let mut policy = test_policy_with_rule("aws", host);
         let endpoint = &mut policy.network_policies.get_mut("aws").unwrap().endpoints[0];
         endpoint.protocol = "rest".to_string();
-        endpoint.tls = 2;
         endpoint.access = openshell_core::proto::NetworkAccessPreset::Full as i32;
         endpoint.credential_signing = "sigv4".to_string();
         endpoint.signing_service = "s3".to_string();
@@ -13047,7 +13044,6 @@ mod tests {
             .endpoints[0];
         bound_endpoint.protocol = "rest".to_string();
         bound_endpoint.access = openshell_core::proto::NetworkAccessPreset::Full as i32;
-        bound_endpoint.tls = 2;
         openshell_policy::ensure_sandbox_process_identity(&mut policy);
         state
             .store