mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress: reject needs the intercept

Browse source
This commit is contained in:
atlas 2026-11-13 12:27:53 +01:00
commit 70a8e54038
2 changed files with 40 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
nix/host-modules/hive-egress.nix
View file

@ -473,6 +473,17 @@ in
the low 17 bits of the agent's address.
'';
}
{
assertion = cfg.egress.forward != "reject" || cfg.egress.intercept.enable;
message = ''
services.hyperhive.network.egress.forward = "reject" needs
services.hyperhive.network.egress.intercept.enable = true:
without the intercept nothing redirects the agents' web traffic into
squid, and the reject would refuse all of it.
Enable the intercept (hive-squid.nix does on a hive controller host),
or keep forward = "log".
'';
}
{
assertion = !(lib.any (k: isOn (config.boot.kernel.sysctl.${k} or 0)) routeLocalnetKeys);
message = ''

31
nix/module-eval/core-toggle.nix
View file

@ -80,7 +80,10 @@ let
network.egress.forward = "accept";
network.egress.antiSpoof = "log";
};
egressForwardReject = hive {
egressForwardReject = hiveWithController {
network.egress.forward = "reject";
};
egressRejectNoIntercept = hive {
network.enable = true;
network.egress.forward = "reject";
};
@ -1699,7 +1702,9 @@ let
logged = lib.filter (lib.hasInfix "log prefix") rules;
bareText = bare.services.hyperhive.network.egress.ruleset;
in
!(lib.any (a: !a.assertion) egressForwardReject.assertions)
!(lib.any (
a: !a.assertion && lib.hasInfix "network.egress" a.message
) egressForwardReject.assertions)
&& lib.hasInfix "type filter hook forward priority filter - 10; policy accept;" chain
&& lib.hasInfix "chain input" text
&& idx ''oifname "wg-hive" accept'' < idx "ether saddr @direct_mac accept"
@ -1722,6 +1727,28 @@ let
&& !(lib.hasInfix "reject with" bareText)
&& lib.hasInfix "would-drop" bareText;
}
{
# `reject` without the intercept is refused by an assertion that names
# the option and both ways out; the controller host with `reject` (the
# intercept on) and `bare` (`log`) are the controls that the lookup
# finds nothing for them.
name = "egress.forward reject without the intercept is refused";
ok =
let
refused =
m:
lib.filter (
a:
!a.assertion
&& lib.hasInfix "services.hyperhive.network.egress.forward = \"reject\" needs" a.message
) m.assertions;
in
lib.length (refused egressRejectNoIntercept) == 1
&& lib.hasInfix "intercept.enable = true" (lib.head (refused egressRejectNoIntercept)).message
&& lib.hasInfix "keep forward = \"log\"" (lib.head (refused egressRejectNoIntercept)).message
&& refused egressForwardReject == [ ]
&& refused bare == [ ];
}
{
# The redirect of the agents' web traffic: IPv4 TCP 80 and 443 from the
# bridge go to squid's two intercept ports, after the rules that leave