mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

egress anti-spoof: the drop description no longer says a leased container is never affected

Browse source
This commit is contained in:
atlas 2026-11-14 23:25:09 +01:00 • committed by mara
commit bbe6f11cb9
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nix/host-modules/hive-egress.nix
View file

@ -354,7 +354,9 @@ in
`hive-egress-spoof `, rate limited per port. A packet the per-port limit
cannot log gets a line with the prefix `hive-egress-spoof-unmetered `
from a limit shared by all ports. A container sending from its leased
address is never affected, so nothing legitimate breaks.
address is unaffected while its (MAC, IP) pair is in the lease set; a
lost pair, as after a host suspend/resume, cuts the container off until
it leases again.
- `log` (the default): the same lines and counters, and the frame goes
through. For finding out why a legitimate container is refused on a
live hive. It is the default because the lease set does not yet survive