mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

nix: move the egress firewall options under deploy.hive-controller.egress

Browse source
This commit is contained in:
damocles 2026-11-14 18:38:47 +01:00 • committed by mara
commit 7468aa4cff
1 changed files with 148 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

33
nix/module-eval/core-toggle.nix
View file

@ -76,16 +76,23 @@ let
# `accept` host also sets `egress.antiSpoof = "log"`, the one setting the
# ordinary host (`drop`) does not render.
egressForwardAccept = hive {
network.enable = true;
deploy.hive-controller.egress.forward = "accept";
deploy.hive-controller.egress.antiSpoof = "log";
};
# The same two settings under their old names, `network.egress.*`, which
# `deploy.nix` still renames.
egressForwardAcceptLegacy = hive {
network.enable = true;
network.egress.forward = "accept";
network.egress.antiSpoof = "log";
};
egressForwardReject = hiveWithController {
network.egress.forward = "reject";
deploy.hive-controller.egress.forward = "reject";
};
egressRejectNoIntercept = hive {
network.enable = true;
network.egress.forward = "reject";
deploy.hive-controller.egress.forward = "reject";
};
# Every hive defaults the agents' queue address to the queue's name, so the
@ -94,7 +101,7 @@ let
# It is also the one controller host with `egress.intercept.refuseEch` off,
# which the egress cases read.
noAgentQueue = hiveWithController {
network.egress.intercept.refuseEch = false;
deploy.hive-controller.egress.intercept.refuseEch = false;
deploy.hive-controller.queue.agentNatsUrl = null;
c0re.operatorPronouns = "they/them";
c0re.contextWindowTokens.sonnet = 900000;
@ -1642,7 +1649,7 @@ let
spoof = lib.filter (l: l != "" && l != "}") (map lib.trim (lib.splitString "\n" (section "spoof")));
ip4 = section "l3_v4";
in
bare.services.hyperhive.network.egress.antiSpoof == "drop"
bare.services.hyperhive.deploy.hive-controller.egress.antiSpoof == "drop"
&& lib.hasInfix "hook prerouting priority -300" bridgeText
&& lib.hasInfix ''meta ibrname != "hive-br0" accept'' bridgeText
&& lib.hasInfix "iifname . ether saddr != @port_mac goto spoof" bridgeText
@ -1676,7 +1683,7 @@ let
);
logged = spoofOf egressForwardAccept;
in
egressForwardAccept.services.hyperhive.network.egress.antiSpoof == "log"
egressForwardAccept.services.hyperhive.deploy.hive-controller.egress.antiSpoof == "log"
&& lib.length logged == 3
&& lib.all (l: lib.hasSuffix " accept" l) logged
&& lib.hasInfix ''log prefix "hive-egress-spoof "'' (textOf egressForwardAccept)
@ -1727,6 +1734,18 @@ let
&& !(lib.hasInfix "hive-egress-would-drop" text)
&& !(lib.any (a: !a.assertion) egressForwardAccept.assertions);
}
{
# A host still setting the old `network.egress.*` names gets the same
# table, and a deprecation warning for each name.
name = "the old network.egress names still set the egress options";
ok =
egressForwardAcceptLegacy.services.hyperhive.deploy.hive-controller.egress.forward == "accept"
&& egressForwardAcceptLegacy.services.hyperhive.deploy.hive-controller.egress.antiSpoof == "log"
&&
egressForwardAcceptLegacy.services.hyperhive.network.egress.ruleset
== egressForwardAccept.services.hyperhive.network.egress.ruleset
&& lib.any (w: lib.hasInfix "network.egress.forward" w) egressForwardAcceptLegacy.warnings;
}
{
# `reject` logs and refuses in one rule, as a TCP rule (reset) and a
# non-TCP rule (ICMP admin-prohibited) for each of the four log/verdict
@ -1749,7 +1768,7 @@ let
bareText = bare.services.hyperhive.network.egress.ruleset;
in
!(lib.any (
a: !a.assertion && lib.hasInfix "network.egress" a.message
a: !a.assertion && lib.hasInfix "deploy.hive-controller.egress" a.message
) egressForwardReject.assertions)
&& lib.hasInfix "type filter hook forward priority filter - 10; policy accept;" chain
&& lib.hasInfix "chain input" text
@ -1786,7 +1805,7 @@ let
lib.filter (
a:
!a.assertion
&& lib.hasInfix "services.hyperhive.network.egress.forward = \"reject\" needs" a.message
&& lib.hasInfix "services.hyperhive.deploy.hive-controller.egress.forward = \"reject\" needs" a.message
) m.assertions;
in
lib.length (refused egressRejectNoIntercept) == 1