vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

deny the IPv6 unspecified address at squid

Browse source
This commit is contained in:
atlas 2026-10-28 14:27:43 +01:00 • committed by mara
commit e8868d52a8
1 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
nix/host-modules/hive-squid.nix
View file

@ -35,6 +35,10 @@ let
# bridge, and the private, shared (CGNAT), unspecified, multicast and
# reserved ranges. Squid checks the address it connects to, so a name an
# agent controls cannot point past them.
# `::` is listed because a connect to it lands on loopback; squid's
# built-in `to_localhost` has `0.0.0.0/32` and `::1` but not `::`. NAT64
# (`64:ff9b::/96`) and 6to4 (`2002::/16`) embed IPv4 addresses and are left
# out: they matter only on a host with such a route.
privateRanges = [
"10.0.0.0/8"
"172.16.0.0/12"
@ -45,6 +49,7 @@ let
"240.0.0.0/4"
"fc00::/7"
"ff00::/8"
"::/128"
];
# Evaluated top to bottom, first match wins. The destination denies sit
@ -206,7 +211,7 @@ in
for an unrestricted user. The self-check canary is allowed on top of
this list. A name must resolve, on this host's resolver, to a public
address: one in a loopback, link-local, private, shared (100.64.0.0/10),
multicast or reserved range, or in the bridge subnet, gets a 403 for
multicast or reserved range (or is `::`), or in the bridge subnet, gets a 403 for
every user.
'';
};