From 961bf804c9dc56249f73981e0b8177e338337a8e Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 2 Oct 2026 17:02:49 +0200 Subject: [PATCH] The intrusion-prevention seat serves status, banned, ban and unban; the proxy logs a refused name (hq ADR 0179) Every holder of node-intrusion-prevention owes the four verbs, as the packet filter's holder owes its three (ADR 0170). The proxy says in its log when a name this mesh does not serve is asked for, with the asking address last, so its own jail can read it. --- modules/route-proxy/cmd/route-proxy/main.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/route-proxy/cmd/route-proxy/main.go b/modules/route-proxy/cmd/route-proxy/main.go index 47d4f93..4a12f3a 100644 --- a/modules/route-proxy/cmd/route-proxy/main.go +++ b/modules/route-proxy/cmd/route-proxy/main.go @@ -732,6 +732,11 @@ func handler(held *table) http.Handler { // And since a host may now be routed only on some paths, those are a third thing: // saying "no route for this name" while listing that very name as served is a // contradiction an operator would have to disbelieve the proxy to get past. + // **Said in the log as well as to the client.** A name this mesh does not serve, asked + // for from outside, is what a scanner does, and the machine's intrusion prevention reads + // this proxy's log for exactly that line (novox/hq ADR 0179): the address last, as the + // jail's filter expects it. + log.Printf("refused: no route for %q, asked from %s", r.Host, r.RemoteAddr) w.Header().Set("Content-Type", "text/plain; charset=utf-8") w.WriteHeader(http.StatusNotFound) if !hidden && held.routed(r.Host) {