vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

refuse unlisted squid names before any destination lookup

Browse source
This commit is contained in:
atlas 2026-10-27 18:56:15 +01:00 • committed by mara
commit 078aed1335
3 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
docs/networking/network.md
View file

@ -222,6 +222,7 @@ host. It never decrypts TLS, so it holds no signing key. It caches nothing.
- **Allow-list.** `services.hyperhive.squid.allowedDomains` defaults to the - **Allow-list.** `services.hyperhive.squid.allowedDomains` defaults to the
swarm's own service names (`services.hyperhive.swarm.serviceDomains`). Each swarm's own service names (`services.hyperhive.swarm.serviceDomains`). Each
entry matches that exact name. Everything else gets a 403. entry matches that exact name. Everything else gets a 403.
- **Unlisted names.** Refused first, without a DNS lookup.
- **Denied before any allow.** Destinations that resolve to loopback, - **Denied before any allow.** Destinations that resolve to loopback,
link-local or the bridge subnet, and IP-literal hosts. Squid resolves names link-local or the bridge subnet, and IP-literal hosts. Squid resolves names
on the host, so without these a listed name pointing at `127.0.0.1` would on the host, so without these a listed name pointing at `127.0.0.1` would

10
nix/host-modules/hive-squid.nix
View file

@ -24,7 +24,10 @@ let
# Evaluated top to bottom, first match wins. The three destination denies # Evaluated top to bottom, first match wins. The three destination denies
# sit before the only allow: squid resolves names on the host, so a name # sit before the only allow: squid resolves names on the host, so a name
# that answers 127.0.0.1, 169.254.169.254 or a bridge address would # that answers 127.0.0.1, 169.254.169.254 or a bridge address would
# otherwise reach services the bridge firewall keeps agents out of. # otherwise reach services the bridge firewall keeps agents out of. The
# unlisted-name deny comes first because `dstdomain` needs no lookup while
# the `dst` ACLs do: an unlisted name is refused at once instead of waiting
# on the host resolver, and costs a client no DNS query.
squidConf = '' squidConf = ''
http_port ${netCfg.bridgeIp}:${toString port} http_port ${netCfg.bridgeIp}:${toString port}
pid_filename /run/squid/squid.pid pid_filename /run/squid/squid.pid
@ -60,11 +63,12 @@ let
http_access deny !Safe_ports http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports http_access deny CONNECT !SSL_ports
http_access deny ip_v4_host
http_access deny ip_v6_host
${lib.optionalString (allowed != [ ]) "http_access deny !allowed_dst"}
http_access deny to_localhost http_access deny to_localhost
http_access deny to_linklocal http_access deny to_linklocal
http_access deny to_bridge http_access deny to_bridge
http_access deny ip_v4_host
http_access deny ip_v6_host
${lib.optionalString (allowed != [ ]) "http_access allow allowed_dst"} ${lib.optionalString (allowed != [ ]) "http_access allow allowed_dst"}
http_access deny all http_access deny all
''; '';

4
nix/module-eval/hive-otel.nix
View file

@ -461,7 +461,7 @@ let
} }
{ {
# First match wins, so a destination deny after the allow is dead. # First match wins, so a destination deny after the allow is dead.
name = "squid denies loopback, link-local and bridge destinations before any destination allow"; name = "squid refuses unlisted names, then loopback, link-local and bridge destinations, before any allow";
ok = ok =
let let
lines = lib.splitString "\n" hiveOtel.services.squid.configText; lines = lib.splitString "\n" hiveOtel.services.squid.configText;
@ -475,6 +475,8 @@ let
&& at "http_access deny to_linklocal" < allow && at "http_access deny to_linklocal" < allow
&& at "http_access deny to_bridge" != null && at "http_access deny to_bridge" != null
&& at "http_access deny to_bridge" < allow && at "http_access deny to_bridge" < allow
&& at "http_access deny !allowed_dst" != null
&& at "http_access deny !allowed_dst" < at "http_access deny to_localhost"
&& builtins.elem "cache deny all" lines && builtins.elem "cache deny all" lines
&& lib.last (lib.filter (l: l != "") lines) == "http_access deny all"; && lib.last (lib.filter (l: l != "") lines) == "http_access deny all";
} }