feat(chv): 架构与代码质量 9.5+ 提升——长函数清零、WarmPool facade、#215 对齐、审计计数、只读 VM 字段、ADR-8~11

cloud/chv/hardening.py

@@ -99,33 +99,47 @@ def validate_net_entries(entries: list, existing_entries: list) -> list:
       vm}）的 tap/mac/ip 任一重复即 net_tap_conflict，
       拒绝启动并由调用方审计。
     返回归一化后的条目 list。"""
-    seen_taps, seen_macs, seen_ips = set(), set(), set()
-    normalized = []
-    for entry in entries:
-        unknown = set(entry) - _NET_FIELDS
-        if unknown:
-            raise ChvFailure(
-                "net_config_invalid",
-                "CHV_NET_JSON 条目含未知字段：%s（白名单：%s）"
-                % (",".join(sorted(unknown)),
-                   ",".join(sorted(_NET_FIELDS))))
-        tap = str(entry.get("tap") or "").strip()
-        mac = str(entry.get("mac") or "").strip().lower()
-        ip = str(entry.get("ip") or "").strip()
-        for kind, value, seen in (("tap", tap, seen_taps),
-                                  ("mac", mac, seen_macs),
-                                  ("ip", ip, seen_ips)):
+    normalized = [_normalize_net_entry(e) for e in entries]
+    _check_net_duplicates(normalized)
+    _check_net_conflicts(normalized, existing_entries)
+    return normalized
+
+
+def _normalize_net_entry(entry: dict) -> dict:
+    """单条 net 条目归一化：字段白名单 + tap/mac/ip 归一化。
+
+    空 tap 视为未指定，不参与 tap 冲突比较（见
+    validate_net_entries 的说明，纯移动）。"""
+    unknown = set(entry) - _NET_FIELDS
+    if unknown:
+        raise ChvFailure(
+            "net_config_invalid",
+            "CHV_NET_JSON 条目含未知字段：%s（白名单：%s）"
+            % (",".join(sorted(unknown)),
+               ",".join(sorted(_NET_FIELDS))))
+    return {"tap": str(entry.get("tap") or "").strip(),
+            "mac": str(entry.get("mac") or "").strip().lower(),
+            "ip": str(entry.get("ip") or "").strip(),
+            "mask": str(entry.get("mask") or "")}
+
+
+def _check_net_duplicates(normalized: list) -> None:
+    """本次条目内 tap/mac/ip 重复即 net_config_invalid。"""
+    seen = {"tap": set(), "mac": set(), "ip": set()}
+    for entry in normalized:
+        for kind in ("tap", "mac", "ip"):
+            value = entry.get(kind)
             if not value:
                 continue
-            if kind == "tap" and not tap:
-                continue
-            if value in seen:
+            if value in seen[kind]:
                 raise ChvFailure(
                     "net_config_invalid",
                     "CHV_NET_JSON 内 %s 重复：%s" % (kind, value))
-            seen.add(value)
-        normalized.append({"tap": tap, "mac": mac, "ip": ip,
-                           "mask": str(entry.get("mask") or "")})
+            seen[kind].add(value)
+
+
+def _check_net_conflicts(normalized: list, existing_entries: list) -> None:
+    """与已登记 VM 的 tap/mac/ip 任一重复即 net_tap_conflict。"""
     for entry in normalized:
         for other in existing_entries:
             for kind in ("tap", "mac", "ip"):
@@ -136,7 +150,6 @@ def validate_net_entries(entries: list, existing_entries: list) -> list:
                         "net %s %s 已被 VM %s 使用，拒绝共享"
                         " tap/mac/ip：每 VM 必须独立"
                         % (kind, value, other.get("vm")))
-    return normalized
 
 
 def validate_egress_proxy(egress_proxy: str) -> None:
@@ -162,9 +175,12 @@ def validate_egress_proxy(egress_proxy: str) -> None:
 
 
 def _is_within(directory, path):
-    directory = os.path.realpath(directory)
-    path = os.path.realpath(path)
-    return path == directory or path.startswith(directory + os.sep)
+    """目录内判定：经 compat215.resolve_inside（#215 目录门
+    同签名），越界回 None 即不在内。绝对路径先转相对路径
+    再过门，.. 逃逸与符号链接逃逸一律挡。"""
+    from cloud.chv.compat215 import resolve_inside
+    rel = os.path.relpath(path, directory)
+    return resolve_inside(directory, rel) is not None
 
 
 def validate_snapshot_url(snapshot_url: str, state_dir: str, snapshot_dir=None,