mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

load the agent-bridge to loopback drop in its own nft table

Browse source
This commit is contained in:
atlas 2026-11-11 15:45:56 +01:00 • committed by mara
commit eb39a90057
1 changed files with 186 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

34
nix/module-eval/core-toggle.nix
View file

@ -63,6 +63,13 @@ let
inherit (shared) forgeHere;
# A host that turns `route_localnet` on, for the assertion in
# ../host-modules/hive-egress.nix: the kernel then routes a bridge packet
# for 127.0.0.0/8 instead of dropping it, so the config is refused.
routeLocalnetOn = hiveWith [
{ boot.kernel.sysctl."net.ipv4.conf.all.route_localnet" = 1; }
] { network.enable = true; };
# Every hive defaults the agents' queue address to the queue's name, so the
# only hive without one is a hive told to have none. Also the host still
# setting the four removed host options; no case on its queue reads them.
@ -1497,6 +1504,33 @@ let
&& bare.services.dnsmasq.enable
&& bare.networking.bridges ? hive-br0;
}
{
# The bridge→loopback drop is a unit of its own that loads its own nft
# table, so it does not depend on which firewall backend the host runs.
# `bare` is the presence arm; the firewall option the old rule used
# stays empty, so the rule has one home.
name = "the bridge to loopback drop is its own unit where the bridge is up and absent elsewhere";
ok =
let
unit = bare.systemd.services.hive-egress or null;
in
unit != null
&& unit.serviceConfig.Type == "oneshot"
&& lib.hasInfix "hive-egress.nft" unit.serviceConfig.ExecStart
&& lib.hasInfix "delete table inet hive_egress" unit.serviceConfig.ExecStop
&& bare.networking.firewall.extraInputRules == ""
&& !(centralToggleOff.systemd.services ? hive-egress);
}
{
# The host that turns `route_localnet` on is refused by an assertion
# naming it; the ordinary host, which leaves it alone, is not.
name = "route_localnet on the sysctl is refused on a host with the bridge up";
ok =
let
refused = m: lib.any (a: !a.assertion && lib.hasInfix "route_localnet" a.message) m.assertions;
in
refused routeLocalnetOn && !(refused bare);
}
{
# Refused where a hive runs and nowhere else. A name is an identifier
# only for a hive; the hive host is the control that the lookup finds the