From a812e4dd21a8904a54961fc3bfb6ad521c1bfb55 Mon Sep 17 00:00:00 2001 From: atlas Date: Sun, 15 Nov 2026 01:21:31 +0100 Subject: [PATCH] egress anti-spoof: the vm test names drop as explicit, and the log default waits for the stale-delete lines --- docs/4-implementation/networking/network.md | 3 ++- nix/host-modules/hive-egress.nix | 3 ++- nix/vm-tests/hive-egress-antispoof.nix | 6 +++--- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/4-implementation/networking/network.md b/docs/4-implementation/networking/network.md index d950e18e5..a09ec368d 100644 --- a/docs/4-implementation/networking/network.md +++ b/docs/4-implementation/networking/network.md @@ -876,7 +876,8 @@ source check lives in that table and the host-side filtering stays in and its own MAC is never refused by `drop`, but only while the pair stays in the table, and a host suspend/resume empties it. `log` keeps the lines and the counters and blocks nothing; `drop` returns once a resume test proves the - lease set survives it. `drop` + lease set survives it and the `egress-lease: … skipped (stale)` lines confirm + the renewal fix on a live hive. `drop` is what the table is for: without it the egress log can't tell agents apart. A binding that failed shows as `hive-egress-pin` errors in the journal and `IN=` lines for that port. diff --git a/nix/host-modules/hive-egress.nix b/nix/host-modules/hive-egress.nix index 1a83942ad..e83e5812b 100644 --- a/nix/host-modules/hive-egress.nix +++ b/nix/host-modules/hive-egress.nix @@ -360,7 +360,8 @@ in - `log` (the default): the same lines and counters, and the frame goes through. For finding out why a legitimate container is refused on a live hive. It is the default because the lease set does not yet survive - a host suspend/resume; `drop` returns once a resume test proves it. + a host suspend/resume; `drop` returns once a resume test proves it and the + `egress-lease: … skipped (stale)` lines confirm the renewal fix on a live hive. With `log`, the identity squid takes from the source of an intercepted flow (`egress.intercept`) can be spoofed: use it to diagnose, not to run. diff --git a/nix/vm-tests/hive-egress-antispoof.nix b/nix/vm-tests/hive-egress-antispoof.nix index a569618b7..29265dd25 100644 --- a/nix/vm-tests/hive-egress-antispoof.nix +++ b/nix/vm-tests/hive-egress-antispoof.nix @@ -221,9 +221,9 @@ pkgs.testers.runNixOSTest { host.wait_for_unit("multi-user.target") host.wait_for_unit("dnsmasq.service") host.wait_for_unit("hive-egress.service") - # The default verdict, loaded before either container exists: the first - # lease of each container below is taken with the drop rule in place. - assert "counter drop" in host.succeed(f"nft list chain {TABLE} spoof"), "the default is drop" + # `drop` is set explicitly on the host above, loaded before either container + # exists: the first lease of each container below is taken with it in place. + assert "counter drop" in host.succeed(f"nft list chain {TABLE} spoof"), "antiSpoof = drop is loaded" for name in ("a", "b"): host.wait_for_unit(f"container@{name}.service") host.wait_until_succeeds(