mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress anti-spoof: drop by default again

Browse source
This commit is contained in:
atlas 2026-11-14 12:35:51 +01:00 • committed by mara
commit 60aede950b
1 changed files with 33 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/4-implementation/networking/network.md
View file

@ -803,7 +803,7 @@ Every container on the agent bridge is root in its own network namespace and
shares one L2 segment with the others, so it can send with another container's
MAC or address. `services.hyperhive.network.egress.antiSpoof` sets what the
`bridge hive_egress` table (`nix/host-modules/hive-egress.nix`) does about it. It
takes `drop` or `log` (the default, until the renewal fix has run on a live hive). Two tables, not one: the bridge carries traffic between two
takes `drop` (the default) or `log`. Two tables, not one: the bridge carries traffic between two
ports, and the `inet` hooks never see it as coming from a port. Only a
`bridge`-family hook at `prerouting` sees which veth a frame came in on, so the
source check lives in that table and the host-side filtering stays in
@ -859,12 +859,14 @@ source check lives in that table and the host-side filtering stays in
sent; the port names the sender, because a bound port sends only its own MAC.
The counters in `nft list chain bridge hive_egress spoof` count every refused
frame.
- **Why `log` is the default.** A container that sends from its leased address
and its own MAC is never refused by `drop`, but only while the pair stays in
the table. Until a live hive has run through many lease renewals with
`script-on-renewal` set without a `hive-egress-spoof` line for a legitimate
container, `log` keeps the lines and the counters and blocks nothing. `drop`
is what the table is for: without it the egress log can't tell agents apart.
- **Reading the log.** A container that sends from its leased address and its
own MAC never gets a line, so a line is a frame to look at. A container that
has no lease yet logs a few lines in its first seconds: DNS queries from
`0.0.0.0`, and the DHCP replies and ICMP redirects its own stack reflects
while the address isn't configured. They stop at the first lease, and `drop`
loses nothing by refusing them. Set `antiSpoof = "log"` to let the frames
through while you check whether a refusal is a false positive. `drop` is what
the table is for: without it the egress log can't tell agents apart.
A binding that failed shows as `hive-egress-pin` errors in the journal and
`IN=` lines for that port.
- **What it doesn't cover.** A container can still send from any IPv6