vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

agent-modules/network: accept unicast DHCP renewal replies unconditionally

Browse source 
A unicast DHCP renewal reply currently reaches dhcpcd only by matching
the firewall's ESTABLISHED,RELATED conntrack rule against the outbound
request. When that conntrack entry has already expired the reply is
dropped silently, with no log line anywhere. The client's broadcast
paths (DISCOVER, rebind) bypass netfilter entirely via a raw BPF
socket and never depend on this state — only the unicast renewal path
does.

This removes that dependency by accepting DHCP client traffic
unconditionally, gated on the firewall being enabled at all. It does
not identify or claim to fix the cause of any particular observed
renewal failure.

Refs #3389
This commit is contained in:
atlas 2026-09-16 19:54:41 +02:00
commit c3f5479ca8
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/agent-modules/network.nix
View file

@ -2,6 +2,7 @@
# taken out of the loop, and the oneshot that points resolv.conf at
# the hive bridge resolver.
{
config,
pkgs,
lib,
...
@ -26,6 +27,15 @@
networking.resolvconf.enable = false;
networking.dhcpcd.extraConfig = "nohook resolv.conf";
# A unicast DHCP renewal reply otherwise reaches dhcpcd only by
# matching the firewall's ESTABLISHED,RELATED conntrack rule against
# the outbound request; when that conntrack entry has already expired
# the reply is dropped with no log line anywhere. Accept it
# unconditionally instead, removing that dependency. Not a fix for any
# particular observed failure — the reply path just shouldn't depend
# on conntrack state in the first place.
networking.firewall.allowedUDPPorts = lib.mkIf config.networking.firewall.enable [ 68 ];
# Point resolv.conf at the hive bridge resolver when the container is
# network-isolated. nixos-container copies the *host's* /etc/resolv.conf
# into the container at every start — but the host resolver (e.g.