mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress anti-spoof: renewals from the leased address pass, a stale lease delete is skipped

Browse source
This commit is contained in:
atlas 2026-11-14 20:55:07 +01:00 • committed by mara
commit 1cef99e992
1 changed files with 305 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

12
nix/host-modules/hive-egress.nix
View file

@ -205,8 +205,11 @@ let
# duplicate address detection and multicast listener reports send before an
# address exists. The bridge carries no other IPv6 traffic.
# - DHCP: any message to port 67 must carry the sender's own MAC as `chaddr`,
# so a port cannot lease, renew or release another's address; a client with
# no address yet sends from 0.0.0.0 to the broadcast address.
# so a port cannot lease, renew or release another's address. A client
# message to the broadcast address or the bridge address then passes from
# any source address: a client with no address sends from 0.0.0.0, and one
# whose pair has left `lease_v4` renews (unicast) or rebinds (broadcast)
# from its own address. The reply puts the pair back.
# - ARP: the sender's MAC is the port's, and its address 0.0.0.0 (a probe) or
# leased to that MAC.
# - A VLAN tag is refused: a tagged frame would carry its packet past the
@ -233,7 +236,7 @@ let
chain l3_v4 {
udp dport 67 iifname . @th,288,48 != @port_chaddr goto spoof
ip saddr 0.0.0.0 ip daddr 255.255.255.255 udp sport 68 udp dport 67 accept
ip daddr { 255.255.255.255, ${cfg.bridgeIp} } udp sport 68 udp dport 67 accept
ether saddr . ip saddr @lease_v4 accept
goto spoof
}
@ -342,7 +345,8 @@ in
the frame's MAC must be the one bound to the port when its container
started, and its IPv4 address the one leased to that MAC. A port with no
bound MAC sends nothing. Allowed besides the leased address: DHCP from
`0.0.0.0` whose `chaddr` is the port's MAC, ARP probes, and IPv6 link-local
a DHCP client message to the broadcast or bridge address from any source
address whose `chaddr` is the port's MAC, ARP probes, and IPv6 link-local
sources (and `::` in neighbour discovery and listener reports).
- `drop` (the default): the frame is dropped and logged with the prefix