novox/mesh-controller
13
0
Fork 0
Code Issues Pull Requests 5 Releases Wiki Activity

Admit a port from the machine's own local network, and never a public subnet (issue 154, ADR 0340)
mesh/delivery-group group fix/154-local-network checking: 0 of 2 member(s) ready
Details
mesh/merge-gate out of date: judged against trunk 1826b68a22b5, the trunk is now 404b4409e70e; judged again on a recheck or when it is merged
Details
mesh/repo-check out of date: judged against trunk 1826b68a22b5, the trunk is now 404b4409e70e; judged again on a recheck or when it is merged
Details
mesh/delivery superseded: a newer head of the same pull request
Details

Browse Source 
A local service could only be declared public, which says the internet. local-network is a source and a reach: the private network and the private networks the machine reported on a link facing outside, judged here, shown by plan and node, and said in the rule set when there are none.
This commit is contained in:
jochen
2026-10-13 11:20:22 +02:00
parent 1826b68a22
commit 6e6cd5e26d
14 changed files with 625 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/catalogue/declaration.go
+8 -2
View File
@@ -135,6 +135,12 @@ type Rendering struct {
// composes no filter for it rather than writing a rule around a link with no name.
OutwardLinks []string
// LocalNetworks is this machine's local networks (novox/hq ADR 0340): the networks it reported on a
// link facing outside it that lie wholly in a private range (JudgeLocalNetworks), which a port
// reached from `local-network` is admitted from beside the private network. Empty when it reported
// none, and the rule set then says so rather than widening the port or dropping it.
LocalNetworks []string
// TunnelInterface is the interface the mesh's private network runs on, named here rather than
// imported because the overlay package rests on this one. Traffic arriving on it is the mesh's,
// not this machine's own guest, so the filter admits it only by a rule.
@@ -527,8 +533,8 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
"`node show %s` says whether it has. Until then %s is not sent, and the machine "+
"keeps the filter it has", r.Node, r.Node, filters)
}
filtering := AsNftables(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
with.OutwardLinks, with.TunnelInterface)
filtering := AsNftablesWithLocal(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
with.OutwardLinks, with.TunnelInterface, with.LocalNetworks)
// **A variable two modules set is refused whether or not anything places it** (novox/hq ADR
// 0203 §5): the account has one environment, and a machine whose holder arrives later should not