mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

squid intercepts restricted and log agents' web traffic, named from the bound source address

Browse source
This commit is contained in:
atlas 2026-11-13 05:17:01 +01:00 • committed by mara
commit 712dcf2b25
1 changed files with 1005 additions and 154 deletions
Download patch file Download diff file Expand all files Collapse all files

14
hive-c0re/src/workers/squid_deny.rs
View file

@ -169,6 +169,12 @@ struct Rendered {
/// The destination ACL comes first in each rule: squid checks ACLs left to
/// right, so a swarm-wide rule never reaches a `proxy_auth` ACL, which would
/// answer an anonymous client 407 instead of the 403.
///
/// A per-agent name gets two rules. For a request through the proxy port the
/// agent is the one whose credential came with it; `!icpt` comes first, since a
/// `proxy_auth` ACL evaluated on an intercepted request only logs a warning.
/// For an intercepted request the agent is the user the `hive_agent` helper
/// named (`ext_user`).
fn render(list: &DenyList, agents: &[String]) -> Rendered {
let mut skipped = Vec::new();
let mut swarm_wide = Vec::new();
@ -217,7 +223,9 @@ fn render(list: &DenyList, agents: &[String]) -> Rendered {
rules,
"acl deny_agent_{agent}_dst dstdomain {}\n\
acl deny_agent_{agent} proxy_auth {agent}\n\
http_access deny deny_agent_{agent}_dst deny_agent_{agent} {MARK_ACL}\n",
acl deny_agent_{agent}_ix ext_user {agent}\n\
http_access deny deny_agent_{agent}_dst !icpt deny_agent_{agent} {MARK_ACL}\n\
http_access deny deny_agent_{agent}_dst icpt deny_agent_{agent}_ix {MARK_ACL}\n",
names.join(" ")
);
}
@ -292,7 +300,9 @@ mod tests {
format!(
"{MARK_LINE}acl deny_agent_atlas_dst dstdomain crates.io pypi.org\n\
acl deny_agent_atlas proxy_auth atlas\n\
http_access deny deny_agent_atlas_dst deny_agent_atlas deny_hit_mark\n"
acl deny_agent_atlas_ix ext_user atlas\n\
http_access deny deny_agent_atlas_dst !icpt deny_agent_atlas deny_hit_mark\n\
http_access deny deny_agent_atlas_dst icpt deny_agent_atlas_ix deny_hit_mark\n"
)
);
assert_eq!((r.swarm, r.agent), (0, 2));