mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress anti-spoof: the vm test names drop as explicit, and the log default waits for the stale-delete lines

Browse source
This commit is contained in:
atlas 2026-11-15 01:21:31 +01:00 • committed by mara
commit a812e4dd21
3 changed files with 7 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/4-implementation/networking/network.md
View file

@ -876,7 +876,8 @@ source check lives in that table and the host-side filtering stays in
and its own MAC is never refused by `drop`, but only while the pair stays in and its own MAC is never refused by `drop`, but only while the pair stays in
the table, and a host suspend/resume empties it. `log` keeps the lines and the table, and a host suspend/resume empties it. `log` keeps the lines and
the counters and blocks nothing; `drop` returns once a resume test proves the the counters and blocks nothing; `drop` returns once a resume test proves the
lease set survives it. `drop` lease set survives it and the `egress-lease: … skipped (stale)` lines confirm
the renewal fix on a live hive. `drop`
is what the table is for: without it the egress log can't tell agents apart. is what the table is for: without it the egress log can't tell agents apart.
A binding that failed shows as `hive-egress-pin` errors in the journal and A binding that failed shows as `hive-egress-pin` errors in the journal and
`IN=` lines for that port. `IN=` lines for that port.

3
nix/host-modules/hive-egress.nix
View file

@ -360,7 +360,8 @@ in
- `log` (the default): the same lines and counters, and the frame goes - `log` (the default): the same lines and counters, and the frame goes
through. For finding out why a legitimate container is refused on a through. For finding out why a legitimate container is refused on a
live hive. It is the default because the lease set does not yet survive live hive. It is the default because the lease set does not yet survive
a host suspend/resume; `drop` returns once a resume test proves it. a host suspend/resume; `drop` returns once a resume test proves it and the
`egress-lease: … skipped (stale)` lines confirm the renewal fix on a live hive.
With `log`, the identity squid takes from the source of an intercepted With `log`, the identity squid takes from the source of an intercepted
flow (`egress.intercept`) can be spoofed: use it to diagnose, not to run. flow (`egress.intercept`) can be spoofed: use it to diagnose, not to run.

6
nix/vm-tests/hive-egress-antispoof.nix
View file

@ -221,9 +221,9 @@ pkgs.testers.runNixOSTest {
host.wait_for_unit("multi-user.target") host.wait_for_unit("multi-user.target")
host.wait_for_unit("dnsmasq.service") host.wait_for_unit("dnsmasq.service")
host.wait_for_unit("hive-egress.service") host.wait_for_unit("hive-egress.service")
# The default verdict, loaded before either container exists: the first # `drop` is set explicitly on the host above, loaded before either container
# lease of each container below is taken with the drop rule in place. # exists: the first lease of each container below is taken with it in place.
assert "counter drop" in host.succeed(f"nft list chain {TABLE} spoof"), "the default is drop" assert "counter drop" in host.succeed(f"nft list chain {TABLE} spoof"), "antiSpoof = drop is loaded"
for name in ("a", "b"): for name in ("a", "b"):
host.wait_for_unit(f"container@{name}.service") host.wait_for_unit(f"container@{name}.service")
host.wait_until_succeeds( host.wait_until_succeeds(