fix(supervisor): quote nft log prefix in bypass rules

[gracesmith6504]

Summary

The nft log prefix value in bypass detection rules contains colons but is not wrapped in double quotes, causing nft to reject the command with a syntax error. This silently disables all bypass-attempt logging. This PR adds an nft_quote() helper that wraps prefixes in nft-quoted strings, and applies it to all four log-rule generation sites.

Related Issue

Fixes NVIDIA#2470

Changes

• Add nft_quote() helper function that wraps a string in double quotes and strips any embedded double-quotes (nft quoted strings don't support escape sequences)
• Quote the log prefix in all 4 LOG rule generation sites (TCP + UDP, for both per-sandbox and sidecar bypass rulesets) in nft_ruleset.rs
• Update 2 existing tests to assert the quoted form
• Add regression test that structurally validates log prefix quoting
• Add unit test for nft_quote() covering colons, quotes, and backslashes

Testing

• mise run pre-commit passes (all checks green: clippy, format, license, markdown, helm)
• Unit tests added/updated
• E2E tests added/updated (if applicable) — N/A, no E2E changes
• Note: netns module is #[cfg(target_os = "linux")] so unit tests only run in CI, not on macOS. Compilation and clippy verified locally.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable) — N/A, no architecture changes

Summary by CodeRabbit

• Bug Fixes
  • Improved network logging rule generation by correctly formatting log prefixes as quoted values.
  • Ensured log prefixes containing double quotes or backslashes are handled consistently.
• Tests
  • Added coverage for quoted log prefixes in standard and sidecar network rules.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fb44c6d9-51e2-4af5-b866-2bcc5a7a2ffc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Changes

NFT log prefix quoting

Layer / File(s)	Summary
Quote log prefixes in generated rules crates/openshell-supervisor-process/src/netns/nft_ruleset.rs	nft_quote creates quoted nft string literals, and bypass and sidecar TCP/UDP rules use it for log prefixes.
Validate quoted prefix output crates/openshell-supervisor-process/src/netns/nft_ruleset.rs	Updated tests expect quoted prefixes and cover embedded double quotes and backslashes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: derekwaynecarr

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: quoting nft log prefixes in bypass rules.
Linked Issues check	✅ Passed	The PR quotes TCP/UDP bypass log prefixes and adds regression coverage, matching issue #2470's fix for nft syntax errors.
Out of Scope Changes check	✅ Passed	The changes stay within nft bypass logging fixes and related tests, with no clear unrelated code or scope creep.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/2470-nft-log-prefix-quoting

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/openshell-supervisor-process/src/netns/nft_ruleset.rs`:
- Around line 380-383: Validate nft_quote against the actual nftables parser
rather than relying only on helper-output tests. Add parser-level coverage
across supported nftables versions for log prefixes containing quotes and
backslashes; if those escapes are unsupported, update nft_quote to preserve only
characters accepted by nftables while retaining valid quoting behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eadccb6f-7a52-4bd2-ad97-b85ba263e45e

📥 Commits

Reviewing files that changed from the base of the PR and between 101cbc9 and 7c06aec.

📒 Files selected for processing (1)

• crates/openshell-supervisor-process/src/netns/nft_ruleset.rs

[gracesmith6504]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[gracesmith6504]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.