vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

refuse unlisted squid names before any destination lookup

Browse source
This commit is contained in:
atlas 2026-10-27 18:56:15 +01:00 • committed by mara
commit 078aed1335
1 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/networking/network.md
View file

@ -222,6 +222,7 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
- **Allow-list.** `services.hyperhive.squid.allowedDomains` defaults to the
swarm's own service names (`services.hyperhive.swarm.serviceDomains`). Each
entry matches that exact name. Everything else gets a 403.
- **Unlisted names.** Refused first, without a DNS lookup.
- **Denied before any allow.** Destinations that resolve to loopback,
link-local or the bridge subnet, and IP-literal hosts. Squid resolves names
on the host, so without these a listed name pointing at `127.0.0.1` would