vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

refuse unlisted squid names before any destination lookup

Browse source
This commit is contained in:
atlas 2026-10-27 18:56:15 +01:00 • committed by mara
commit 078aed1335
1 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/module-eval/hive-otel.nix
View file

@ -461,7 +461,7 @@ let
}
{
# First match wins, so a destination deny after the allow is dead.
name = "squid denies loopback, link-local and bridge destinations before any destination allow";
name = "squid refuses unlisted names, then loopback, link-local and bridge destinations, before any allow";
ok =
let
lines = lib.splitString "\n" hiveOtel.services.squid.configText;
@ -475,6 +475,8 @@ let
&& at "http_access deny to_linklocal" < allow
&& at "http_access deny to_bridge" != null
&& at "http_access deny to_bridge" < allow
&& at "http_access deny !allowed_dst" != null
&& at "http_access deny !allowed_dst" < at "http_access deny to_localhost"
&& builtins.elem "cache deny all" lines
&& lib.last (lib.filter (l: l != "") lines) == "http_access deny all";
}