mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress anti-spoofing: keep established bindings, load tables with bindings and leases in one transaction

Browse source
This commit is contained in:
atlas 2026-11-13 02:53:37 +01:00 • committed by mara
commit 70179b6c1f
1 changed files with 400 additions and 134 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nix/module-eval/core-toggle.nix
View file

@ -1624,17 +1624,24 @@ let
&& lib.all (l: lib.hasSuffix " drop" l) (spoofOf bare);
}
{
# The sets are filled at run time, from three places: the unit at start
# and reload, the udev rule for each new port, and dnsmasq for each
# lease. Each is present on `bare`; the host without the bridge has none.
name = "the bridge table's sets are filled by the unit, a udev rule per port and dnsmasq's lease script";
# The sets are filled at run time, from four places: the unit at start and
# reload (tables, bindings and leases in one transaction), the udev rule
# for each new port, a timer for the ports still unbound, and dnsmasq for
# each lease. Each is present on `bare`; the host without the bridge has
# none.
name = "the bridge table's sets load with the table, and a udev rule, a timer and dnsmasq's lease script keep them current";
ok =
let
unit = bare.systemd.services.hive-egress;
pin = bare.systemd.services."hive-egress-pin@";
sweep = bare.systemd.services.hive-egress-pin;
in
lib.hasInfix "egress-pin --seed" unit.serviceConfig.ExecStartPost
&& lib.any (lib.hasInfix "egress-pin --seed") unit.serviceConfig.ExecReload
lib.hasInfix "egress-load " unit.serviceConfig.ExecStart
&& lib.hasInfix "hive-egress.nft" unit.serviceConfig.ExecStart
&& unit.serviceConfig.ExecReload == unit.serviceConfig.ExecStart
&& !(unit.serviceConfig ? ExecStartPost)
&& lib.hasSuffix "egress-pin" sweep.serviceConfig.ExecStart
&& bare.systemd.timers.hive-egress-pin.timerConfig.OnUnitActiveSec == "30s"
&& unit.environment.HIVE_EGRESS_BRIDGE == "hive-br0"
&& lib.hasInfix "egress-pin %i" pin.serviceConfig.ExecStart
&& lib.hasInfix ''KERNEL=="vb-*"'' bare.services.udev.extraRules
@ -1642,7 +1649,8 @@ let
&&
bare.services.dnsmasq.settings.dhcp-script
== toString bare.services.hyperhive.network.egress.leaseScript
&& !(centralToggleOff.systemd.services ? "hive-egress-pin@");
&& !(centralToggleOff.systemd.services ? "hive-egress-pin@")
&& !(centralToggleOff.systemd ? timers && centralToggleOff.systemd.timers ? hive-egress-pin);
}
{
# `accept` renders the table without the forward chain and without the