mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

refuse tls hellos that carry encrypted client hello before squid sees them

Browse source
This commit is contained in:
atlas 2026-11-13 06:23:42 +01:00 • committed by mara
commit dff662c6b3
1 changed files with 1537 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hive-priv/README.md
View file

@ -38,7 +38,9 @@ not the whole daemon-shared crate.
`storage` (btrfs subvolumes, quotas, snapshots, disk measurement), `files`
(pause marker, socket dir, legacy tmpfiles) and `infra` (gateway nginx, forge
admin, infra containers). `egress` holds four sub-commands that never
touch the socket, `egress-load`, `egress-pin`, `egress-lease` and `egress-whois`; the
touch the socket, `egress-load`, `egress-pin`, `egress-lease` and `egress-whois`, and
`egress_ech` a fifth, `egress-ech-relay`, the long-running ClientHello check in front of
squid's HTTPS intercept port; the
`hive-egress` unit, udev, a timer and dnsmasq run the first three to fill the sets of
the anti-spoofing table and the interception exemptions, and squid runs the last to
name the agent of an intercepted flow (see