[pascalholthaus]

What

Add: bridge-subnet-settings

Why

CPB-1004

References

CPB-1004

Checklist

• I have added tests for the changes
• I have used the following LLMs/AI tools in this pull request:
• gpt
• copilot

[Copilot]

🟡 Changes recommended

Existing deployments lack the newly required files, and OpenVASD archives do not retain bridge subnet values.

5 open findings

• Backfill missing bridge files for existing deployments · New
• Include bridge subnet files in OpenVAS archives · New
• Document action persistence and required later --run · New
• Document value options with matching change actions · New
• Correct deploy action status and persistence behavior · New

What changed in this PR

This PR adds persisted bridge subnet settings for enterprise-container and security-intelligence deployments.

Changes:

• Initialize and load four bridge subnet values.
• Add CLI options to set and change those values, with help and README updates.
• Update OpenVASD regression commands to use the new change actions.

File	Description
src/​settings.sh	Adds shared bridge subnet setting helpers.
src/​settings_osi.sh	Initializes and loads subnets for security-intelligence.
src/​settings_ec.sh	Initializes and loads subnets for enterprise-container.
src/​help.sh	Lists the new CLI options.
src/​global.sh	Declares the subnet variables.
src/​args.sh	Parses and dispatches the new options.
regress/​ec.sh	Uses change actions in OpenVASD scenarios.
README.md	Documents the new actions and defaults.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

An archive can omit the feed-key-service image when its copied settings require it.

1 open finding

• Read FEED_MODE from source settings when bundling images · New

5 resolved since last review

• Include bridge subnet files in OpenVAS archives
• Backfill missing bridge files for existing deployments
• Correct deploy action status and persistence behavior
• Document value options with matching change actions
• Document action persistence and required later --run

🧠 Review effort: Lite

[Copilot]

🔵 Needs a closer look

Invalid subnet values can be saved and cause a later deployment to fail.

0 open findings

1 resolved since last review

• Read FEED_MODE from source settings when bundling images

Previously missed (2)

In code that hasn't changed since last review

Add regression coverage for ingress subnet change actions

regress/​ec.sh:127

These regression runs exercise backend subnet changes, but none exercises the new ingress IPv4 or IPv6 change action. An incorrect ingress option mapping or setting name could therefore pass the current runs. Add a regression case that changes each ingress subnet, checks the saved values, and runs the deployment with non-overlapping test networks; include the shared OSI load path if that product is part of this suite.

Validate bridge subnet CIDR values before persisting

src/​settings.sh:245

--change-bridge-*-subnet-* checks only that the value is non-empty before force-writing it. For example, --change-bridge-ingress-subnet-ipv4 --bridge-ingress-subnet-ipv4 not-a-cidr saves an invalid network, and the next --run fails when the network is created while the bad setting remains. --init also writes unchecked CLI values through init_bridge_subnet_settings(). Validate CIDR syntax, prefix length, and IPv4/IPv6 family in a shared helper before either path persists the value.

🧠 Review effort: Lite

[Copilot]

🟡 Changes recommended

The IPv6 validator rejects valid addresses with an embedded IPv4 suffix.

1 open finding

• IPv4-mapped IPv6 literals are rejected due to double-counted suffix groups · New

🧠 Review effort: Lite

[Copilot]

🔵 Needs a closer look

Invalid IPv4 values can pass validation, and a custom settings directory can produce an archive without the expected product settings.

0 open findings

1 resolved since last review

• IPv4-mapped IPv6 literals are rejected due to double-counted suffix groups

Previously missed (2)

In code that hasn't changed since last review

Copy custom settings directly to the product directory

src/​openvasd.sh:428

If the documented settings_dir override has a basename other than ${product}, this copies its files under that basename, but the next init_setting calls write to ${settings_dir_name}/${product}. That directory does not exist, so the writes fail and the archive lacks the expected product settings. Copy the source directory directly to the product-specific destination.

Reject trailing dots in IPv4 addresses

src/​settings_validation.sh:156

read -a drops a trailing . before counting octets, so ipv4_valid '192.0.2.1.' succeeds. This also lets --domain-ip and IPv4 bridge CIDRs persist invalid addresses. Reject a trailing dot before splitting the address.

🧠 Review effort: Lite