Author	SHA1	Message	Date
atlas	fbfc6f392a	egress anti-spoof: the vm test pins drop under the new option path	2026-11-15 01:43:50 +01:00
atlas	a812e4dd21	egress anti-spoof: the vm test names drop as explicit, and the log default waits for the stale-delete lines	2026-11-15 01:43:50 +01:00
damocles	7468aa4cff	nix: move the egress firewall options under deploy.hive-controller.egress	2026-11-15 01:22:35 +01:00
atlas	1cef99e992	egress anti-spoof: renewals from the leased address pass, a stale lease delete is skipped	2026-11-15 01:20:41 +01:00
atlas	60aede950b	egress anti-spoof: drop by default again	2026-11-14 13:27:13 +01:00
atlas	5189e8fb4b	egress: refresh a leased pair on dhcp renewal and default anti-spoof to log ... dnsmasq runs the dhcp-script on a renewal only with script-on-renewal, so a pair loaded at the first lease timed out while the lease kept renewing and the bridge table dropped the container's traffic. Set script-on-renewal, time pairs out remaining + 300s, default antiSpoof to log, and run the vm test through renewals with drop.	2026-11-13 23:55:12 +01:00
atlas	70179b6c1f	egress anti-spoofing: keep established bindings, load tables with bindings and leases in one transaction	2026-11-13 08:53:23 +01:00
atlas	c4ac01ef88	agent bridge: drop frames whose source MAC or address isn't the container's own (egress.antiSpoof)	2026-11-13 08:53:23 +01:00