mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

refuse tls hellos that carry encrypted client hello before squid sees them

Browse source
This commit is contained in:
atlas 2026-11-13 06:23:42 +01:00 • committed by mara
commit dff662c6b3
1 changed files with 1537 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

8
hive-priv/src/main.rs
View file

@ -23,7 +23,8 @@
//! turns ephemeral, with [`salvage_io`] for its space, reflink and lock calls),
//! [`prestart`] (the check of a container's root that runs before each start,
//! as a sub-command), [`egress`] (the bridge anti-spoofing bindings, also
//! sub-commands), [`storage`] (btrfs subvolumes, quotas, snapshots, disk
//! sub-commands), [`egress_ech`] (the `ClientHello` check in front of squid's
//! HTTPS intercept port), [`storage`] (btrfs subvolumes, quotas, snapshots, disk
//! measurement), [`files`] (pause marker, socket dir, legacy tmpfiles),
//! [`infra`] (gateway nginx, infra containers) and [`closure`] (the swarm-signature
//! check before an apply, and the cache-facts refresh). Helpers more than one family uses are in [`shared`].
@ -32,6 +33,7 @@ mod closure;
mod container;
mod container_config;
mod egress;
mod egress_ech;
mod files;
mod infra;
mod prestart;
@ -60,6 +62,10 @@ async fn main() -> Result<()> {
if let Some(code) = egress::run(&args) {
std::process::exit(code);
}
// `egress-ech-relay` is a long-running unit of its own, not a request either.
if let Some(code) = egress_ech::run(&args).await {
std::process::exit(code);
}
tracing_subscriber::fmt()
.with_env_filter(