mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress anti-spoof: back to log by default; the lease set does not survive a suspend/resume

Browse source
This commit is contained in:
atlas 2026-11-14 18:12:20 +01:00 • committed by mara
commit b8098686c4
1 changed files with 27 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

28
nix/module-eval/core-toggle.nix
View file

@ -73,19 +73,19 @@ let
# The two settings of `egress.forward` the ordinary host (`log`) does not
# render, for ../host-modules/hive-egress.nix: `accept` leaves the table
# without a forward chain, `reject` renders the chain that refuses. The
# `accept` host also sets `egress.antiSpoof = "log"`, the one setting the
# ordinary host (`drop`) does not render.
# `accept` host also sets `egress.antiSpoof = "drop"`, the one setting the
# ordinary host (`log`) does not render.
egressForwardAccept = hive {
network.enable = true;
deploy.hive-controller.egress.forward = "accept";
deploy.hive-controller.egress.antiSpoof = "log";
deploy.hive-controller.egress.antiSpoof = "drop";
};
# The same two settings under their old names, `network.egress.*`, which
# `deploy.nix` still renames.
egressForwardAcceptLegacy = hive {
network.enable = true;
network.egress.forward = "accept";
network.egress.antiSpoof = "log";
network.egress.antiSpoof = "drop";
};
egressForwardReject = hiveWithController {
deploy.hive-controller.egress.forward = "reject";
@ -1639,17 +1639,17 @@ let
# its own, and logs it. The ruleset is read as text: the spoof chain
# ends every path in `drop`, and the accepts that remain are the ones that
# let the leased source through, which is the presence arm.
name = "egress.antiSpoof defaults to drop and renders the bridge table that drops frames whose source is not the port's own";
name = "egress.antiSpoof drop renders the bridge table that drops frames whose source is not the port's own";
ok =
let
text = bare.services.hyperhive.network.egress.ruleset;
text = egressForwardAccept.services.hyperhive.network.egress.ruleset;
bridgeText = lib.last (lib.splitString "table bridge hive_egress" text);
section =
name: lib.head (lib.splitString "chain" (lib.last (lib.splitString "chain ${name} {" bridgeText)));
spoof = lib.filter (l: l != "" && l != "}") (map lib.trim (lib.splitString "\n" (section "spoof")));
ip4 = section "l3_v4";
in
bare.services.hyperhive.deploy.hive-controller.egress.antiSpoof == "drop"
egressForwardAccept.services.hyperhive.deploy.hive-controller.egress.antiSpoof == "drop"
&& lib.hasInfix "hook prerouting priority -300" bridgeText
&& lib.hasInfix ''meta ibrname != "hive-br0" accept'' bridgeText
&& lib.hasInfix "iifname . ether saddr != @port_mac goto spoof" bridgeText
@ -1666,10 +1666,10 @@ let
&& lib.hasInfix "goto spoof" ip4;
}
{
# `log` renders the same chains with `accept` where `drop`
# `log`, the default, renders the same chains with `accept` where `drop`
# was: the lines and counters stay, the frame goes through. The `accept`
# host sets `log` and `bare` is the control that the two differ.
name = "egress.antiSpoof log renders the spoof chain with accept and no drop";
# host sets `drop` and is the control that the two differ.
name = "egress.antiSpoof defaults to log and renders the spoof chain with accept and no drop";
ok =
let
textOf = m: m.services.hyperhive.network.egress.ruleset;
@ -1681,14 +1681,14 @@ let
lib.filter (l: l != "" && l != "}") (
map lib.trim (lib.splitString "\n" (lib.head (lib.splitString "chain" t)))
);
logged = spoofOf egressForwardAccept;
logged = spoofOf bare;
in
egressForwardAccept.services.hyperhive.deploy.hive-controller.egress.antiSpoof == "log"
bare.services.hyperhive.deploy.hive-controller.egress.antiSpoof == "log"
&& lib.length logged == 3
&& lib.all (l: lib.hasSuffix " accept" l) logged
&& lib.hasInfix ''log prefix "hive-egress-spoof "'' (textOf egressForwardAccept)
&& lib.hasInfix ''log prefix "hive-egress-spoof "'' (textOf bare)
&& !(lib.any (l: lib.hasSuffix " drop" l) logged)
&& lib.all (l: lib.hasSuffix " drop" l) (spoofOf bare);
&& lib.all (l: lib.hasSuffix " drop" l) (spoofOf egressForwardAccept);
}
{
# The sets are filled at run time, from four places: the unit at start and