mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress anti-spoof: back to log by default; the lease set does not survive a suspend/resume

Browse source
This commit is contained in:
atlas 2026-11-14 18:12:20 +01:00 • committed by mara
commit b8098686c4
1 changed files with 27 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/host-modules/hive-egress.nix
View file

@ -339,7 +339,7 @@ in
"drop"
"log"
];
default = "drop";
default = "log";
description = ''
What the `bridge hive_egress` table does with a frame whose source is not
the sending container's own. Every port of the agent bridge is checked:
@ -350,13 +350,15 @@ in
address whose `chaddr` is the port's MAC, ARP probes, and IPv6 link-local
sources (and `::` in neighbour discovery and listener reports).
- `drop` (the default): the frame is dropped and logged with the prefix
- `drop`: the frame is dropped and logged with the prefix
`hive-egress-spoof `, rate limited per port. A packet the per-port limit
cannot log gets a line with the prefix `hive-egress-spoof-unmetered `
from a limit shared by all ports. A container sending from its leased
address is never affected, so nothing legitimate breaks.
- `log`: the same lines and counters, and the frame goes through. For
finding out whether a suspected false positive of `drop` is one.
- `log` (the default): the same lines and counters, and the frame goes
through. For finding out why a legitimate container is refused on a
live hive. It is the default because the lease set does not yet survive
a host suspend/resume; `drop` returns once a resume test proves it.
With `log`, the identity squid takes from the source of an intercepted
flow (`egress.intercept`) can be spoofed: use it to diagnose, not to run.