mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress anti-spoof: drop by default again

Browse source
This commit is contained in:
atlas 2026-11-14 12:35:51 +01:00 • committed by mara
commit 60aede950b
1 changed files with 33 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/host-modules/hive-egress.nix
View file

@ -335,7 +335,7 @@ in
"drop"
"log"
];
default = "log";
default = "drop";
description = ''
What the `bridge hive_egress` table does with a frame whose source is not
the sending container's own. Every port of the agent bridge is checked:
@ -345,15 +345,13 @@ in
`0.0.0.0` whose `chaddr` is the port's MAC, ARP probes, and IPv6 link-local
sources (and `::` in neighbour discovery and listener reports).
- `drop`: the frame is dropped and logged with the prefix
- `drop` (the default): the frame is dropped and logged with the prefix
`hive-egress-spoof `, rate limited per port. A packet the per-port limit
cannot log gets a line with the prefix `hive-egress-spoof-unmetered `
from a limit shared by all ports. A container sending from its leased
address is never affected, so nothing legitimate breaks.
- `log` (the default): the same lines and counters, and the frame goes
through. For finding out why a legitimate container is refused on a
live hive. The default goes back to `drop` once the renewal fix
(dnsmasq runs the lease script on a renewal) is proven live.
- `log`: the same lines and counters, and the frame goes through. For
finding out whether a suspected false positive of `drop` is one.
With `log`, the identity squid takes from the source of an intercepted
flow (`egress.intercept`) can be spoofed: use it to diagnose, not to run.