From 4570d9f8af496433eff9cd14f3b27c80282e1cb0 Mon Sep 17 00:00:00 2001 From: Markus Hilger Date: Wed, 5 Aug 2026 03:42:22 +0200 Subject: [PATCH] Throttle the insecure mode boot refusal log reply_dhcp4 logs the insecure mode remediation hint on every DHCP discover it refuses. A node in this state never receives a reply, so it retries for as long as it is powered on and the same message repeats every few seconds. Rate limit it per hardware address the way the neighbouring boot attempt messages already do, reusing the ignoremacs window that check_reply uses for the missing profile hint. --- confluent_server/confluent/discovery/protocols/pxe.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/confluent_server/confluent/discovery/protocols/pxe.py b/confluent_server/confluent/discovery/protocols/pxe.py index ed962c02..db640bf3 100644 --- a/confluent_server/confluent/discovery/protocols/pxe.py +++ b/confluent_server/confluent/discovery/protocols/pxe.py @@ -715,7 +715,9 @@ async def reply_dhcp4(node, info, packet, cfg, reqview, httpboot, cfd, profile, if not insecuremode: insecuremode = 'never' if insecuremode == 'never' and not httpboot: - if rqtype == 1 and info.get('architecture', None): + if (rqtype == 1 and info.get('architecture', None) + and time.time() > ignoremacs.get(info['hwaddr'], 0) + 90): + ignoremacs[info['hwaddr']] = time.time() log.log( {'info': 'Boot attempt by {0} detected in insecure mode, but ' 'insecure mode is disabled. Set the attribute '