mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress anti-spoof: the vm test names drop as explicit, and the log default waits for the stale-delete lines

Browse source
This commit is contained in:
atlas 2026-11-15 01:21:31 +01:00 • committed by mara
commit a812e4dd21
1 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

3
nix/host-modules/hive-egress.nix
View file

@ -360,7 +360,8 @@ in
- `log` (the default): the same lines and counters, and the frame goes
through. For finding out why a legitimate container is refused on a
live hive. It is the default because the lease set does not yet survive
a host suspend/resume; `drop` returns once a resume test proves it.
a host suspend/resume; `drop` returns once a resume test proves it and the
`egress-lease: … skipped (stale)` lines confirm the renewal fix on a live hive.
With `log`, the identity squid takes from the source of an intercepted
flow (`egress.intercept`) can be spoofed: use it to diagnose, not to run.