Harden untrusted mode after duplication and reuse review

Consolidate the private-IP classifier: the egress broker's dial
allowlist now uses networking.IsPrivateIP instead of a second local
table, gaining NAT64 embedded-IPv4 decoding (64:ff9b::/96,
64:ff9b:1::/48) so a crafted DNS answer can no longer smuggle the
cloud metadata endpoint past D7 on NAT64 networks. The shared
classifier absorbs the two benchmarking prefixes the egress table
had, making the merged set a strict superset.

Render the Envoy bootstrap as data: all config-derived values
(vhosts, routes, ext_authz address, scan posture) go through
yaml.Marshal instead of string substitution, matching the operator
side and removing the reliance on cross-package validation alone.

TokenMap rebuilt on hashicorp/golang-lru/v2 (already a dependency),
keeping consume-on-read semantics via Peek+Remove under the map
mutex; the hand-rolled container/list machinery is gone.

Converge tokenenc on pkg/secrets/aes: new EncryptWithAAD/
DecryptWithAAD helpers carry the nonce|ct|tag convention and size
bound; tokenenc deletes its duplicated GCM boilerplate and calls
them, keeping the redis-key AAD cut-and-paste defense.

Also: slices.Contains/Sort/ContainsFunc in the policy hot path, and
cross-referenced drift-guard comments between the operator and vMCP
secret-material gate test suites.

Author: JAORMX

cmd/thv-operator/pkg/controllerutil/untrusted_env_validation_test.go

@@ -39,6 +39,15 @@ func configMapEnvVar(name, configMapName, key string) corev1.EnvVar {
 	}
 }
 
+// TestValidateNoSecretEnvForUntrusted pins the operator admission-side
+// untrusted pod gate. CHANNEL-COVERAGE MIRROR: the vmcp runtime-side gate's
+// test — pkg/vmcp/session/untrusted/template_clone_test.go
+// (TestClonePodFromTemplate_FailClosed / TestReverifyAllowsFieldRefEnv) —
+// covers the same secret-injection channels (secretKeyRef / configMapKeyRef
+// env, envFrom secret/configmap refs, secret / configmap / projected
+// volumes). When a new injection channel is added or allowed on one side,
+// update the other side's suite too — drift between the two is a silent gap
+// in the untrusted isolation boundary.
 func TestValidateNoSecretEnvForUntrusted(t *testing.T) {
 	t.Parallel()
 

pkg/authserver/tokenenc/tokenenc.go

@@ -29,14 +29,14 @@
 package tokenenc
 
 import (
-	"crypto/aes"
-	"crypto/cipher"
 	"crypto/rand"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+
+	"github.com/stacklok/toolhive/pkg/secrets/aes"
 )
 
 const (
@@ -144,12 +144,12 @@ func Seal(kr Keyring, redisKey string, plaintext []byte) ([]byte, error) {
 
 	activeID, kek := kr.Active()
 
-	edek, err := gcmSeal(kek, dek, nil)
+	edek, err := aes.Encrypt(dek, kek)
 	if err != nil {
 		return nil, fmt.Errorf("token encryption: failed to wrap data key: %w", err)
 	}
 
-	ct, err := gcmSeal(dek, plaintext, []byte(redisKey))
+	ct, err := aes.EncryptWithAAD(plaintext, dek, []byte(redisKey))
 	if err != nil {
 		return nil, fmt.Errorf("token encryption: failed to encrypt record: %w", err)
 	}
@@ -201,7 +201,7 @@ func Open(kr Keyring, redisKey string, value []byte) (plaintext []byte, legacy b
 	if err != nil {
 		return nil, false, fmt.Errorf("token encryption: malformed wrapped data key: %w", err)
 	}
-	dek, err := gcmOpen(kek, edek, nil)
+	dek, err := aes.Decrypt(edek, kek)
 	if err != nil {
 		return nil, false, fmt.Errorf("token encryption: failed to unwrap data key: %w", err)
 	}
@@ -210,7 +210,7 @@ func Open(kr Keyring, redisKey string, value []byte) (plaintext []byte, legacy b
 	if err != nil {
 		return nil, false, fmt.Errorf("token encryption: malformed ciphertext: %w", err)
 	}
-	plaintext, err = gcmOpen(dek, ct, []byte(redisKey))
+	plaintext, err = aes.DecryptWithAAD(ct, dek, []byte(redisKey))
 	if err != nil {
 		return nil, false, fmt.Errorf("token encryption: failed to decrypt record: %w", err)
 	}
@@ -246,37 +246,3 @@ func NeedsRotation(kr Keyring, value []byte) bool {
 	activeID, _ := kr.Active()
 	return env.KID != activeID
 }
-
-// gcmSeal encrypts plaintext with AES-256-GCM under key, returning
-// nonce|ciphertext|tag. aad is additional authenticated data (may be nil).
-func gcmSeal(key, plaintext, aad []byte) ([]byte, error) {
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return nil, err
-	}
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return nil, err
-	}
-	nonce := make([]byte, gcm.NonceSize())
-	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
-		return nil, err
-	}
-	return gcm.Seal(nonce, nonce, plaintext, aad), nil
-}
-
-// gcmOpen reverses gcmSeal.
-func gcmOpen(key, ciphertext, aad []byte) ([]byte, error) {
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return nil, err
-	}
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return nil, err
-	}
-	if len(ciphertext) < gcm.NonceSize() {
-		return nil, errors.New("malformed ciphertext")
-	}
-	return gcm.Open(nil, ciphertext[:gcm.NonceSize()], ciphertext[gcm.NonceSize():], aad)
-}