The mesh's own ban chain is a ban wherever it hangs (hq ADR 0186) #76

2026-10-02T16:42:39Z

mesh-admin commented

2026-10-02 16:42:39 +00:00

The home server began reading "NOT the mesh alone: 1 rule set the mesh did not write refuses traffic here", and the rule set named was the mesh's own ban chain, written by the mesh's own intrusion prevention minutes earlier.

The legacy reader required every path into a chain of refusals to come from a built-in chain whose policy accepts. That chain hangs off the container runtime's user chain as well as input, and the runtime had set the forward policy to DROP. The policy is already classified where it belongs, as the runtime's, so requiring it here counted it twice. A chain is a ban when every refusal names the sources it refuses and the chain accepts nothing, which is the rule the nftables side already applied. A chain that accepts anything is still not a ban.

Fixture captured from the machine itself; the test fails against main. Also repoints the uninstalled-front-end citations to ADR 0180, which another session's renumber had left pointing at an unrelated record, and sets the service settle to nothing in tests so the suite does not pay it.

The home server began reading "NOT the mesh alone: 1 rule set the mesh did not write refuses traffic here", and the rule set named was the mesh's own ban chain, written by the mesh's own intrusion prevention minutes earlier. The legacy reader required every path into a chain of refusals to come from a built-in chain whose policy accepts. That chain hangs off the container runtime's user chain as well as input, and the runtime had set the forward policy to DROP. The policy is already classified where it belongs, as the runtime's, so requiring it here counted it twice. A chain is a ban when every refusal names the sources it refuses and the chain accepts nothing, which is the rule the nftables side already applied. A chain that accepts anything is still not a ban. Fixture captured from the machine itself; the test fails against main. Also repoints the uninstalled-front-end citations to ADR 0180, which another session's renumber had left pointing at an unrelated record, and sets the service settle to nothing in tests so the suite does not pay it.

mesh-admin added 1 commit 2026-10-02 16:42:39 +00:00

The mesh's own ban chain is a ban wherever it hangs; the front end's record is cited as 0180 (hq ADR 0186) b94e0f9a77

The legacy reader required every path into a chain of refusals to come from a built-in whose policy
accepts. The home server's ban chain hangs off the container runtime's user chain, whose forward
policy the runtime set to DROP, so the machine reported the mesh's own intrusion prevention as a
rule set the mesh did not write. A chain is a ban when every refusal names its sources and the
chain accepts nothing — the rule the nftables side already used. A chain that accepts anything is
still not a ban. Fixture captured from the machine. The citations for the uninstalled front end move
to ADR 0180, which another session's renumber had left pointing at an unrelated record.

mesh-admin merged commit 2a332b0e6e into main

2026-10-02 16:43:09 +00:00

mesh-admin deleted branch fix/a-ban-list-never-holds-a-neighbour

2026-10-02 16:43:10 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-host#76