A machine says which of its links face outside #45

2026-09-28T21:37:23Z

mesh-admin commented

2026-09-28 21:37:23 +00:00

First of two releases for novox/hq ADR 0140. This one only reports the fact; the control plane
does not read it yet, so nothing changes on any machine.

The derived filter blocks traffic passing through a machine — a container's published port is
traffic passing through — and then has to let the machine's own containers reach outward again.
It does that by naming the address ranges they sit on: two ranges fixed in the control plane's
source, the rest typed by an operator after converging a workstation had already cut every one
of its containers off. A range describes one machine, goes stale silently, and cannot tell a
network the mesh made from one a predecessor left behind.

ADR 0140 removes the list. The filter constrains what arrives from outside the machine and
says nothing about what did not, which needs one fact the machine alone can supply: which of its
links face outside.

internal/outward reads the links carrying a default route, for both families, from /proc/net
rather than by asking a program — a module naming a program the machine does not have is how the
mesh already reported success while doing nothing (issue 136), and every machine has /proc.
Reported on every apply whatever the node's mode, since a converged node's filter is written
around it and an adopted one becomes converged without a further round trip.

A machine with no default route reports nothing. The control plane will compose no filter for it
and leave the one it has, because a rule written around a link with no name is a rule set that
does not load, and that is a machine filtering nothing while its unit reports success.

Tests: the links are the ones carrying a default route and not the loopback or a bridge; a zero
destination with a real mask is not a default route (trusting the destination alone would name an
internal bridge as outward, which would constrain the machine's own guests — the fault 0140
removes); no default route is no links; a missing v6 table is not a failure; a link in both
families is reported once; and the parse is run against this machine's own routing table so it is
held to what the kernel writes rather than to a fixture written to agree with it.

First of two releases for novox/hq ADR 0140. This one only reports the fact; the control plane does not read it yet, so nothing changes on any machine. The derived filter blocks traffic passing through a machine — a container's published port is traffic passing through — and then has to let the machine's own containers reach outward again. It does that by naming the address ranges they sit on: two ranges fixed in the control plane's source, the rest typed by an operator after converging a workstation had already cut every one of its containers off. A range describes one machine, goes stale silently, and cannot tell a network the mesh made from one a predecessor left behind. ADR 0140 removes the list. The filter constrains what arrives from **outside** the machine and says nothing about what did not, which needs one fact the machine alone can supply: which of its links face outside. `internal/outward` reads the links carrying a default route, for both families, from `/proc/net` rather than by asking a program — a module naming a program the machine does not have is how the mesh already reported success while doing nothing (issue 136), and every machine has `/proc`. Reported on every apply whatever the node's mode, since a converged node's filter is written around it and an adopted one becomes converged without a further round trip. A machine with no default route reports nothing. The control plane will compose no filter for it and leave the one it has, because a rule written around a link with no name is a rule set that does not load, and that is a machine filtering nothing while its unit reports success. Tests: the links are the ones carrying a default route and not the loopback or a bridge; a zero destination with a real mask is not a default route (trusting the destination alone would name an internal bridge as outward, which would constrain the machine's own guests — the fault 0140 removes); no default route is no links; a missing v6 table is not a failure; a link in both families is reported once; and the parse is run against this machine's own routing table so it is held to what the kernel writes rather than to a fixture written to agree with it.

mesh-admin added 1 commit 2026-09-28 21:37:23 +00:00

A machine says which of its links face outside b0d11c2439

The filter blocks everything passing through the machine and then allows the
machine's own containers back by naming the address ranges they sit on — two
ranges fixed in the control plane and the rest typed after a flip had already
cut a workstation off. A range describes one machine and goes stale in silence.

Read the links carrying a default route instead, from /proc rather than by
asking a program, and report them on every apply. A machine with no route off
itself reports nothing, and the mesh composes no filter for it rather than
writing a rule around a link with no name.

novox/hq ADR 0140. The control plane does not read this yet.

mesh-admin merged commit b005d4ef17 into main

2026-09-28 21:37:24 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#45