vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

resolve the self-check's deny canary in the squid VM test

Browse source
This commit is contained in:
atlas 2026-10-28 14:56:10 +01:00 • committed by mara
commit 86e9f49fe6
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
nix/vm-tests/hive-squid.nix
View file

@ -149,10 +149,14 @@ pkgs.testers.runNixOSTest {
networking.interfaces.eth2.ipv6.addresses = [ (ulaAddr 1) ]; networking.interfaces.eth2.ipv6.addresses = [ (ulaAddr 1) ];
# Names the proxy resolves, each a different destination class. # Names the proxy resolves, each a different destination class.
networking.hosts = { networking.hosts = {
# `other.t.local` resolves, is reachable and is on no allow-list. # `other.t.local` and the self-check's deny canary resolve, are
# reachable and are on no allow-list. The canary is in the hosts file
# because the destination denies look every name up first, and the VM
# has no resolver to answer for an unknown one before the client gives up.
"203.0.113.2" = [ "203.0.113.2" = [
"forge.t.local" "forge.t.local"
"other.t.local" "other.t.local"
"deny-canary.invalid"
]; ];
"127.0.0.1" = [ "loop.t.local" ]; "127.0.0.1" = [ "loop.t.local" ];
${bridgeIp} = [ "bridge.t.local" ]; ${bridgeIp} = [ "bridge.t.local" ];
@ -332,7 +336,7 @@ pkgs.testers.runNixOSTest {
assert connect("forge.t.local", UMA) == "200", "unrestricted, listed name" assert connect("forge.t.local", UMA) == "200", "unrestricted, listed name"
assert connect("other.t.local") == "407", "no credential" assert connect("other.t.local") == "407", "no credential"
assert connect("other.t.local", "uma:" + secrets.token_urlsafe(24)) == "407", "wrong password" assert connect("other.t.local", "uma:" + secrets.token_urlsafe(24)) == "407", "wrong password"
assert connect("deny-canary.invalid", ATLAS) == "403", "restricted, a name that does not resolve" assert connect("deny-canary.invalid", ATLAS) == "403", "restricted, an unlisted name"
with subtest("neither kind of user reaches a host-local or private destination, or another port"): with subtest("neither kind of user reaches a host-local or private destination, or another port"):
for cred in (ATLAS, UMA): for cred in (ATLAS, UMA):