mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress: refresh a leased pair on dhcp renewal and default anti-spoof to log

Browse source 
dnsmasq runs the dhcp-script on a renewal only with script-on-renewal, so a pair loaded at the first lease timed out while the lease kept renewing and the bridge table dropped the container's traffic. Set script-on-renewal, time pairs out remaining + 300s, default antiSpoof to log, and run the vm test through renewals with drop.
This commit is contained in:
atlas 2026-11-13 23:55:07 +01:00
commit 5189e8fb4b
1 changed files with 107 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

6
nix/host-modules/hive-gateway/dnsmasq.nix
View file

@ -84,8 +84,12 @@ in
# `hive-priv egress-load` reads this file back (hive-egress.nix).
dhcp-leasefile = "/var/lib/dnsmasq/dnsmasq.leases";
# Each lease change updates the leased (MAC, IPv4) pairs the bridge
# anti-spoofing table checks sources against (hive-egress.nix).
# anti-spoofing table checks sources against (hive-egress.nix). A pair
# times out with its lease, so the script must also run on a renewal:
# without `script-on-renewal` dnsmasq runs it only for a new lease, and a
# renewed one leaves the table when the first lease would have ended.
dhcp-script = toString networkCfg.egress.leaseScript;
script-on-renewal = true;
# No explicit upstream: non-hive queries follow dnsmasq's
# resolv.conf default — the host's own `/etc/resolv.conf`, so the
# hive always uses the host's resolvers and follows them live with