ADR 0186: a ban list never holds a neighbour, and the mesh's own bans are its own wherever they hang; design 31

2026-10-02 18:42:16 +02:00
parent a9f91fdd0c
commit d4a2f99ab5
3 changed files with 93 additions and 0 deletions
@@ -0,0 +1,81 @@
+---
+topic: the mesh
+status: accepted
+date: 2026-10-02
+deciders: jochen
+reconstructed: false
+extends: 02-DECISIONS/0179-the-intrusion-seat-serves-its-verbs-and-every-door-declares-its-jail.md
+---
+
+# 186. A ban list never holds a neighbour, and the mesh's own bans are its own wherever they hang
+
+## Context
+
+[ADR 0179](0179-the-intrusion-seat-serves-its-verbs-and-every-door-declares-its-jail.md) gave the
+public proxy a jail. Within the hour the home server's ban list held `192.168.1.1` — the house's own
+router. The router reflects local traffic, so every client in the building reaches that machine as
+the gateway's address; one local request for a name the mesh does not serve, three times in a day,
+and the whole house is refused by the machine it was asking. The jails inherited an `ignoreip` of
+the loopback and the mesh's own range, which was right when the only jail read the ssh daemon and
+the only clients were the mesh's; a jail on a public front door sees the neighbours too.
+
+The same jail broke the other half of [ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md).
+The home server began reading *NOT the mesh alone: 1 rule set the mesh did not write refuses traffic
+here*, and the rule set named was the mesh's own ban chain, written by the mesh's own intrusion
+prevention minutes earlier. The host's reader of the legacy filter required every path into a chain
+of refusals to come from a built-in chain whose policy accepts, before it would call that chain a
+ban. On that machine the chain hangs off the container runtime's user chain as well as the input
+chain, and the runtime had set the forward policy to DROP — so the mesh reported its own work as a
+foreigner's, on the one machine where the group's exit condition was supposed to hold.
+
+Both faults are one mistake in two places: a rule written about the public internet, applied to
+everything that arrives.
+
+## Decision
+
+**1. A ban list never holds a neighbour.** The jails the mesh composes never ban a source on a
+private range — the mesh's own range, which was already named rather than written
+([ADR 0112](0112-a-module-definition-names-no-node-mesh-or-path.md)), and every address space
+reserved for private use beside it, in both families. A machine behind a router that reflects local
+traffic sees its whole building as one address; a ban there is a self-inflicted outage, and the
+sources worth banning are not on those ranges in the first place.
+
+**2. The mesh's own bans are its own wherever they hang.** A chain of refusals is a ban list when
+every refusal names the sources it refuses and the chain accepts nothing — the rule the host already
+applied to the packet filter's own tables, now applied to the legacy filter too, and nothing more.
+The policy of the chains that jump into it says nothing about what it is: that policy is already
+classified where it belongs, as the container runtime's, and requiring it here counted it twice.
+
+**3. A chain that accepts anything is still not a ban.** That is what keeps a predecessor's
+allow-these-and-drop-the-rest chain classified as something an operator must look at, which is the
+distinction [ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md) exists to draw.
+
+## Consequences
+
+- The composed jails gain the private ranges in their never-ban list. An address already banned
+  stays banned until it is released; the house's router was released by hand the moment it was found.
+- The home server reads *the mesh alone* again, which is group 7's exit condition and was false for
+  about an hour.
+- A machine whose apply fails for an unrelated reason does not revisit its found firewall's record
+  at all — the step runs only after a clean apply ([ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md)).
+  The home server's record therefore still reads *retired by the mesh* although the front end is
+  uninstalled, and will correct itself once that machine's own stuck module is fixed. It is a stale
+  record, not a wrong machine.
+- The record number the front end's removal was given moved under it: another session took 0175
+  while that record was in review, and it is now
+  [ADR 0180](0180-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md). The citations
+  the host and the control plane print were pointing at an unrelated record and are corrected here.
+
+## How this is checked
+
+| Rule | Checked by |
+|---|---|
+| A private source is never banned | the module's jail configuration, read back by `fail2ban.fail2ban_settings` on a machine |
+| The mesh's own ban chain reads as a ban behind a dropping forward policy | a host test over the home server's own captured rule set |
+| A chain that accepts anything is not a ban | a host test |
+| Live | the home server reads *the mesh alone*; no ban held on either machine is a private address |
+
+## References
+
+- [ADR 0179](0179-the-intrusion-seat-serves-its-verbs-and-every-door-declares-its-jail.md), [ADR 0168](0168-a-converged-machine-is-filtered-by-the-mesh-alone.md), [ADR 0112](0112-a-module-definition-names-no-node-mesh-or-path.md), [ADR 0180](0180-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md)
+- [Design 08 — Connectivity](../03-DESIGN/01-to-be/08-connectivity.md), [Design 31 — A module declares its fail2ban jail](../03-DESIGN/01-to-be/31-a-module-declares-its-fail2ban-jail.md)
@@ -186,6 +186,7 @@ python3 00-META/checks/index.py            fail if stale
 - **0180** — [The found front end is uninstalled once a machine is converged](0180-the-found-front-end-is-uninstalled-once-a-machine-is-converged.md)
 - **0184** — [A service the mesh asked to run is still running a moment later](0184-a-service-the-mesh-asked-to-run-is-still-running-a-moment-later.md)
 - **0185** — [A control plane behind its seat's row serves what it can](0185-a-control-plane-behind-its-seats-row-serves-what-it-can.md)
+- **0186** — [A ban list never holds a neighbour, and the mesh's own bans are its own wherever they hang](0186-a-ban-list-never-holds-a-neighbour.md)

 ### Its tiers, from the bottom up

@@ -9,6 +9,7 @@ updated: 2026-10-02
 decisions:
  - 02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md
  - 02-DECISIONS/0179-the-intrusion-seat-serves-its-verbs-and-every-door-declares-its-jail.md
+  - 02-DECISIONS/0186-a-ban-list-never-holds-a-neighbour.md
 ---

 # 31 — A module declares its fail2ban jail, and the mesh composes them per node
@@ -92,3 +93,13 @@ the daemon's, and both are read through the console.

 *How it is checked:* ADR 0179's table.

+## What the first jails taught, 2026-10-02
+
+[ADR 0186](../../02-DECISIONS/0186-a-ban-list-never-holds-a-neighbour.md). Within an hour of the
+first public jail the home server had banned the house's own router: the router reflects local
+traffic, so every client in the building arrives as the gateway's address. The never-ban list now
+holds every private range as well as the mesh's own. And the mesh read its own ban chain as a
+foreign rule set on that machine, because the chain hangs off the container runtime's user chain and
+that machine's forward policy is the runtime's DROP — the reader now calls a chain of source-named
+refusals a ban wherever it hangs, as it already did for the packet filter's own tables.
+