mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress: refresh a leased pair on dhcp renewal and default anti-spoof to log

Browse source 
dnsmasq runs the dhcp-script on a renewal only with script-on-renewal, so a pair loaded at the first lease timed out while the lease kept renewing and the bridge table dropped the container's traffic. Set script-on-renewal, time pairs out remaining + 300s, default antiSpoof to log, and run the vm test through renewals with drop.
This commit is contained in:
atlas 2026-11-13 23:55:07 +01:00
commit 5189e8fb4b
1 changed files with 107 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

29
nix/module-eval/core-toggle.nix
View file

@ -73,12 +73,12 @@ let
# The two settings of `egress.forward` the ordinary host (`log`) does not
# render, for ../host-modules/hive-egress.nix: `accept` leaves the table
# without a forward chain, `reject` renders the chain that refuses. The
# `accept` host also sets `egress.antiSpoof = "log"`, the one setting the
# ordinary host (`drop`) does not render.
# `accept` host also sets `egress.antiSpoof = "drop"`, the one setting the
# ordinary host (`log`) does not render.
egressForwardAccept = hive {
network.enable = true;
network.egress.forward = "accept";
network.egress.antiSpoof = "log";
network.egress.antiSpoof = "drop";
};
egressForwardReject = hiveWithController {
network.egress.forward = "reject";
@ -1587,17 +1587,17 @@ let
# its own, and logs it. The ruleset is read as text: the spoof chain
# ends every path in `drop`, and the accepts that remain are the ones that
# let the leased source through, which is the presence arm.
name = "the default egress table drops frames whose source is not the port's own";
name = "egress.antiSpoof drop renders the bridge table that drops frames whose source is not the port's own";
ok =
let
text = bare.services.hyperhive.network.egress.ruleset;
text = egressForwardAccept.services.hyperhive.network.egress.ruleset;
bridgeText = lib.last (lib.splitString "table bridge hive_egress" text);
section =
name: lib.head (lib.splitString "chain" (lib.last (lib.splitString "chain ${name} {" bridgeText)));
spoof = lib.filter (l: l != "" && l != "}") (map lib.trim (lib.splitString "\n" (section "spoof")));
ip4 = section "l3_v4";
in
bare.services.hyperhive.network.egress.antiSpoof == "drop"
egressForwardAccept.services.hyperhive.network.egress.antiSpoof == "drop"
&& lib.hasInfix "hook prerouting priority -300" bridgeText
&& lib.hasInfix ''meta ibrname != "hive-br0" accept'' bridgeText
&& lib.hasInfix "iifname . ether saddr != @port_mac goto spoof" bridgeText
@ -1614,10 +1614,10 @@ let
&& lib.hasInfix "goto spoof" ip4;
}
{
# `log` renders the same chains with `accept` where `drop` was: the lines
# and counters stay, the frame goes through. The `accept` host is the
# only fixture that sets it; `bare` is the control that the two differ.
name = "egress.antiSpoof log renders the spoof chain with accept and no drop";
# `log`, the default, renders the same chains with `accept` where `drop`
# was: the lines and counters stay, the frame goes through. The `accept`
# host sets `drop` and is the control that the two differ.
name = "egress.antiSpoof defaults to log and renders the spoof chain with accept and no drop";
ok =
let
textOf = m: m.services.hyperhive.network.egress.ruleset;
@ -1629,14 +1629,14 @@ let
lib.filter (l: l != "" && l != "}") (
map lib.trim (lib.splitString "\n" (lib.head (lib.splitString "chain" t)))
);
logged = spoofOf egressForwardAccept;
logged = spoofOf bare;
in
egressForwardAccept.services.hyperhive.network.egress.antiSpoof == "log"
bare.services.hyperhive.network.egress.antiSpoof == "log"
&& lib.length logged == 3
&& lib.all (l: lib.hasSuffix " accept" l) logged
&& lib.hasInfix ''log prefix "hive-egress-spoof "'' (textOf egressForwardAccept)
&& lib.hasInfix ''log prefix "hive-egress-spoof "'' (textOf bare)
&& !(lib.any (l: lib.hasSuffix " drop" l) logged)
&& lib.all (l: lib.hasSuffix " drop" l) (spoofOf bare);
&& lib.all (l: lib.hasSuffix " drop" l) (spoofOf egressForwardAccept);
}
{
# The sets are filled at run time, from four places: the unit at start and
@ -1664,6 +1664,7 @@ let
&& lib.elem (toString bare.services.hyperhive.network.egress.leaseScript) (
lib.toList bare.services.dnsmasq.settings.dhcp-script
)
&& lib.toList bare.services.dnsmasq.settings.script-on-renewal == [ true ]
&& !(centralToggleOff.systemd.services ? "hive-egress-pin@")
&& !(centralToggleOff.systemd ? timers && centralToggleOff.systemd.timers ? hive-egress-pin);
}