From bbe6f11cb994de9e50351dd00493f1f6bf38a29e Mon Sep 17 00:00:00 2001 From: atlas Date: Sat, 14 Nov 2026 23:25:09 +0100 Subject: [PATCH] egress anti-spoof: the drop description no longer says a leased container is never affected --- nix/host-modules/hive-egress.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nix/host-modules/hive-egress.nix b/nix/host-modules/hive-egress.nix index aa8cd91f6..1a83942ad 100644 --- a/nix/host-modules/hive-egress.nix +++ b/nix/host-modules/hive-egress.nix @@ -354,7 +354,9 @@ in `hive-egress-spoof `, rate limited per port. A packet the per-port limit cannot log gets a line with the prefix `hive-egress-spoof-unmetered ` from a limit shared by all ports. A container sending from its leased - address is never affected, so nothing legitimate breaks. + address is unaffected while its (MAC, IP) pair is in the lease set; a + lost pair, as after a host suspend/resume, cuts the container off until + it leases again. - `log` (the default): the same lines and counters, and the frame goes through. For finding out why a legitimate container is refused on a live hive. It is the default because the lease set does not yet survive