mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress anti-spoof: back to log by default; the lease set does not survive a suspend/resume

Browse source
This commit is contained in:
atlas 2026-11-14 18:12:20 +01:00 • committed by mara
commit b8098686c4
1 changed files with 27 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/4-implementation/networking/network.md
View file

@ -803,7 +803,7 @@ Every container on the agent bridge is root in its own network namespace and
shares one L2 segment with the others, so it can send with another container's
MAC or address. `services.hyperhive.deploy.hive-controller.egress.antiSpoof` sets what the
`bridge hive_egress` table (`nix/host-modules/hive-egress.nix`) does about it. It
takes `drop` (the default) or `log`. Two tables, not one: the bridge carries traffic between two
takes `drop` or `log` (the default, until the lease set survives a host suspend/resume). Two tables, not one: the bridge carries traffic between two
ports, and the `inet` hooks never see it as coming from a port. Only a
`bridge`-family hook at `prerouting` sees which veth a frame came in on, so the
source check lives in that table and the host-side filtering stays in
@ -872,14 +872,12 @@ source check lives in that table and the host-side filtering stays in
sent; the port names the sender, because a bound port sends only its own MAC.
The counters in `nft list chain bridge hive_egress spoof` count every refused
frame.
- **Reading the log.** A container that sends from its leased address and its
own MAC never gets a line, so a line is a frame to look at. A container that
has no lease yet logs a few lines in its first seconds: DNS queries from
`0.0.0.0`, and the DHCP replies and ICMP redirects its own stack reflects
while the address isn't configured. They stop at the first lease, and `drop`
loses nothing by refusing them. Set `antiSpoof = "log"` to let the frames
through while you check whether a refusal is a false positive. `drop` is what
the table is for: without it the egress log can't tell agents apart.
- **Why `log` is the default.** A container that sends from its leased address
and its own MAC is never refused by `drop`, but only while the pair stays in
the table, and a host suspend/resume empties it. `log` keeps the lines and
the counters and blocks nothing; `drop` returns once a resume test proves the
lease set survives it. `drop`
is what the table is for: without it the egress log can't tell agents apart.
A binding that failed shows as `hive-egress-pin` errors in the journal and
`IN=` lines for that port.
- **What it doesn't cover.** A container can still send from any IPv6