From 86e9f49fe684ebabf54d3eb46dda04de84434688 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 28 Oct 2026 14:56:10 +0100 Subject: [PATCH] resolve the self-check's deny canary in the squid VM test --- nix/vm-tests/hive-squid.nix | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/nix/vm-tests/hive-squid.nix b/nix/vm-tests/hive-squid.nix index 36f0283e..735bf3d0 100644 --- a/nix/vm-tests/hive-squid.nix +++ b/nix/vm-tests/hive-squid.nix @@ -149,10 +149,14 @@ pkgs.testers.runNixOSTest { networking.interfaces.eth2.ipv6.addresses = [ (ulaAddr 1) ]; # Names the proxy resolves, each a different destination class. networking.hosts = { - # `other.t.local` resolves, is reachable and is on no allow-list. + # `other.t.local` and the self-check's deny canary resolve, are + # reachable and are on no allow-list. The canary is in the hosts file + # because the destination denies look every name up first, and the VM + # has no resolver to answer for an unknown one before the client gives up. "203.0.113.2" = [ "forge.t.local" "other.t.local" + "deny-canary.invalid" ]; "127.0.0.1" = [ "loop.t.local" ]; ${bridgeIp} = [ "bridge.t.local" ]; @@ -332,7 +336,7 @@ pkgs.testers.runNixOSTest { assert connect("forge.t.local", UMA) == "200", "unrestricted, listed name" assert connect("other.t.local") == "407", "no credential" assert connect("other.t.local", "uma:" + secrets.token_urlsafe(24)) == "407", "wrong password" - assert connect("deny-canary.invalid", ATLAS) == "403", "restricted, a name that does not resolve" + assert connect("deny-canary.invalid", ATLAS) == "403", "restricted, an unlisted name" with subtest("neither kind of user reaches a host-local or private destination, or another port"): for cred in (ATLAS, UMA):