vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

refuse unlisted squid names before any destination lookup

Browse source
This commit is contained in:
atlas 2026-10-27 18:56:15 +01:00 • committed by mara
commit 078aed1335
2 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/host-modules/hive-squid.nix
View file

@ -24,7 +24,10 @@ let
# Evaluated top to bottom, first match wins. The three destination denies
# sit before the only allow: squid resolves names on the host, so a name
# that answers 127.0.0.1, 169.254.169.254 or a bridge address would
# otherwise reach services the bridge firewall keeps agents out of.
# otherwise reach services the bridge firewall keeps agents out of. The
# unlisted-name deny comes first because `dstdomain` needs no lookup while
# the `dst` ACLs do: an unlisted name is refused at once instead of waiting
# on the host resolver, and costs a client no DNS query.
squidConf = ''
http_port ${netCfg.bridgeIp}:${toString port}
pid_filename /run/squid/squid.pid
@ -60,11 +63,12 @@ let
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access deny ip_v4_host
http_access deny ip_v6_host
${lib.optionalString (allowed != [ ]) "http_access deny !allowed_dst"}
http_access deny to_localhost
http_access deny to_linklocal
http_access deny to_bridge
http_access deny ip_v4_host
http_access deny ip_v6_host
${lib.optionalString (allowed != [ ]) "http_access allow allowed_dst"}
http_access deny all
'';

4
nix/module-eval/hive-otel.nix
View file

@ -461,7 +461,7 @@ let
}
{
# First match wins, so a destination deny after the allow is dead.
name = "squid denies loopback, link-local and bridge destinations before any destination allow";
name = "squid refuses unlisted names, then loopback, link-local and bridge destinations, before any allow";
ok =
let
lines = lib.splitString "\n" hiveOtel.services.squid.configText;
@ -475,6 +475,8 @@ let
&& at "http_access deny to_linklocal" < allow
&& at "http_access deny to_bridge" != null
&& at "http_access deny to_bridge" < allow
&& at "http_access deny !allowed_dst" != null
&& at "http_access deny !allowed_dst" < at "http_access deny to_localhost"
&& builtins.elem "cache deny all" lines
&& lib.last (lib.filter (l: l != "") lines) == "http_access deny all";
}