mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress anti-spoof: drop by default again

Browse source
This commit is contained in:
atlas 2026-11-14 12:35:51 +01:00 • committed by mara
commit 60aede950b
1 changed files with 33 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/vm-tests/hive-egress-antispoof.nix
View file

@ -6,7 +6,9 @@
# stand-in bridge is one NIC, so every agent shares one port.
#
# What it pins:
# - each port is bound to its container's MAC and each lease is in the
# - the default verdict is `drop`, and each container takes its first lease
# (DHCP from `0.0.0.0`, the reply, the first ARP and IP traffic) with it in
# place; each port is bound to its container's MAC and each lease is in the
# table, without the test adding either;
# - a container sending from its own address reaches the host and the other
# container (the control for every drop below);
@ -15,7 +17,7 @@
# dropped, and each leaves a `hive-egress-spoof ` line that names the port;
# - a container that keeps talking across several renewals of a 2-minute lease
# is never dropped, and its pair is still in `lease_v4` after the first
# lease and its margin would have ended, with `antiSpoof = "drop"`;
# lease and its margin would have ended;
# - a DHCP renewal, a link-local IPv6 packet and a restored MAC go through;
# - a port with no bound MAC sends nothing, and the timer binds it again;
# - `antiSpoof = "log"`, reached by a reload of the unit, brings the bindings
@ -98,7 +100,6 @@ pkgs.testers.runNixOSTest {
../host-modules/hive-priv.nix
];
virtualisation.memorySize = 2048;
services.hyperhive.network.egress.antiSpoof = "drop";
networking.bridges.${bridge}.interfaces = [ ];
networking.interfaces.${bridge}.ipv4.addresses = [
{
@ -190,6 +191,9 @@ pkgs.testers.runNixOSTest {
host.wait_for_unit("multi-user.target")
host.wait_for_unit("dnsmasq.service")
host.wait_for_unit("hive-egress.service")
# The default verdict, loaded before either container exists: the first
# lease of each container below is taken with the drop rule in place.
assert "counter drop" in host.succeed(f"nft list chain {TABLE} spoof"), "the default is drop"
for name in ("a", "b"):
host.wait_for_unit(f"container@{name}.service")
host.wait_until_succeeds(