mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress: refresh a leased pair on dhcp renewal and default anti-spoof to log

Browse source 
dnsmasq runs the dhcp-script on a renewal only with script-on-renewal, so a pair loaded at the first lease timed out while the lease kept renewing and the bridge table dropped the container's traffic. Set script-on-renewal, time pairs out remaining + 300s, default antiSpoof to log, and run the vm test through renewals with drop.
This commit is contained in:
atlas 2026-11-13 23:55:07 +01:00
commit 5189e8fb4b
1 changed files with 107 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

21
docs/4-implementation/networking/network.md
View file

@ -803,7 +803,7 @@ Every container on the agent bridge is root in its own network namespace and
shares one L2 segment with the others, so it can send with another container's
MAC or address. `services.hyperhive.network.egress.antiSpoof` sets what the
`bridge hive_egress` table (`nix/host-modules/hive-egress.nix`) does about it. It
takes `drop` (the default) or `log`. Two tables, not one: the bridge carries traffic between two
takes `drop` or `log` (the default, until the renewal fix has run on a live hive). Two tables, not one: the bridge carries traffic between two
ports, and the `inet` hooks never see it as coming from a port. Only a
`bridge`-family hook at `prerouting` sees which veth a frame came in on, so the
source check lives in that table and the host-side filtering stays in
@ -837,7 +837,10 @@ source check lives in that table and the host-side filtering stays in
that a binding already holds, so a newcomer can't evict an established
container. If two new ports claim one MAC, neither gets a binding. dnsmasq's
`dhcp-script` (`hive-priv egress-lease`) adds each lease as a (MAC, address)
pair that times out with the lease.
pair that times out with the lease plus 5 minutes. `script-on-renewal` makes
dnsmasq run it on every renewal too, which loads the pair again with the
new remaining time; without it a pair would leave the table when the first
lease ended, while dnsmasq kept renewing the lease.
- **The window.** The binding takes the MAC the container's link has when the
command first looks, normally within a second of the veth appearing. Until
then root in the container could change its own MAC, but in that time only
@ -856,12 +859,14 @@ source check lives in that table and the host-side filtering stays in
sent; the port names the sender, because a bound port sends only its own MAC.
The counters in `nft list chain bridge hive_egress spoof` count every refused
frame.
- **Why `drop` is the default.** A container that sends from its leased address
and its own MAC is never refused, so `drop` breaks nothing a container does
legitimately, and without it the egress log can't tell agents apart. `log` is
for a live hive where the table refuses a legitimate container (a binding that
failed shows as `hive-egress-pin` errors in the journal and `IN=` lines for
that port): the same lines and counters, nothing blocked.
- **Why `log` is the default.** A container that sends from its leased address
and its own MAC is never refused by `drop`, but only while the pair stays in
the table. Until a live hive has run through many lease renewals with
`script-on-renewal` set without a `hive-egress-spoof` line for a legitimate
container, `log` keeps the lines and the counters and blocks nothing. `drop`
is what the table is for: without it the egress log can't tell agents apart.
A binding that failed shows as `hive-egress-pin` errors in the journal and
`IN=` lines for that port.
- **What it doesn't cover.** A container can still send from any IPv6
link-local address and answer DHCP as a server on its own leased address.