From c3f5479ca8f79b12c722ad7d7fec58e76834b1c0 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 16 Sep 2026 19:54:41 +0200 Subject: [PATCH] agent-modules/network: accept unicast DHCP renewal replies unconditionally MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A unicast DHCP renewal reply currently reaches dhcpcd only by matching the firewall's ESTABLISHED,RELATED conntrack rule against the outbound request. When that conntrack entry has already expired the reply is dropped silently, with no log line anywhere. The client's broadcast paths (DISCOVER, rebind) bypass netfilter entirely via a raw BPF socket and never depend on this state — only the unicast renewal path does. This removes that dependency by accepting DHCP client traffic unconditionally, gated on the firewall being enabled at all. It does not identify or claim to fix the cause of any particular observed renewal failure. Refs #3389 --- nix/agent-modules/network.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/nix/agent-modules/network.nix b/nix/agent-modules/network.nix index e51909e0..64adf66b 100644 --- a/nix/agent-modules/network.nix +++ b/nix/agent-modules/network.nix @@ -2,6 +2,7 @@ # taken out of the loop, and the oneshot that points resolv.conf at # the hive bridge resolver. { + config, pkgs, lib, ... @@ -26,6 +27,15 @@ networking.resolvconf.enable = false; networking.dhcpcd.extraConfig = "nohook resolv.conf"; + # A unicast DHCP renewal reply otherwise reaches dhcpcd only by + # matching the firewall's ESTABLISHED,RELATED conntrack rule against + # the outbound request; when that conntrack entry has already expired + # the reply is dropped with no log line anywhere. Accept it + # unconditionally instead, removing that dependency. Not a fix for any + # particular observed failure — the reply path just shouldn't depend + # on conntrack state in the first place. + networking.firewall.allowedUDPPorts = lib.mkIf config.networking.firewall.enable [ 68 ]; + # Point resolv.conf at the hive bridge resolver when the container is # network-isolated. nixos-container copies the *host's* /etc/resolv.conf # into the container at every start — but the host resolver (e.g.