mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
9a3c8e77be
Three fixes for an interface or route that appears or disappears while the node runs. Wait for fips0 before starting fips-gateway. A package upgrade restarts fips and fips-gateway at the same moment. The gateway exits when fips0 does not exist yet, so its first start after an upgrade (and likely at boot) failed, logged an error, and the gateway was down until procd respawned it five seconds later. The init script's supervise command now waits up to 30 seconds for fips0 before starting the gateway, as the Debian and systemd units already do. A stop that arrives during the wait ends it without starting the gateway. If fips0 never appears, the timeout is logged and the gateway is started anyway, so its own error and procd's respawn behave as before. The wait is in supervise rather than start_service, which runs under procd's service lock during the package's postinst. The init script scenarios gain a stub ip that reports fips0 present only while a marker file exists, and three cases: the gateway is not started until fips0 appears, a stop during the wait starts nothing, and the gateway is started with a logged timeout once the wait runs out. The busybox supervise scenarios report fips0 present. Remove the fd00::/8 policy rule at stop and make a leftover harmless. On Linux, startup adds the IPv6 policy rule "to fd00::/8 lookup main priority 5265" beside the TUN's fd00::/8 route, and nothing ever removed it: both teardown paths deleted only the link. After a stop, and after any crash, the rule outlived the TUN, and any fd00::/8 destination another routing table owns (Tailscale's fd7a:115c:a1e0::/48 in table 52 is the common case) was looked up in main first and sent out main's default route instead. The rule is now added with suppress_prefixlength 0, so main's default route never answers through it. While the node runs, fd00::/8 still goes to the TUN through its own route; a rule left behind by a crash sends other ULA traffic on to the table that owns it. Stopping the node, through either teardown path, removes the rule, and does so even when the link itself cannot be found or deleted. Startup deletes any existing rule of either shape before adding its own, so a host upgraded from an older version ends with one rule rather than two. The delete happens after the fd00::/8 route add, so a start that fails there because another node's TUN already owns the route leaves that node's rule alone. A rule add that fails is now logged as a warning, since the node then runs without the rule; a kernel without IPv6 policy routing (EAFNOSUPPORT or EOPNOTSUPP) still logs at debug. Four root network-namespace tests cover the two teardown paths, the rule left by an exit without stop, and the upgrade from the older rule. Like the other namespace tests they are ignored by default and run by hand under sudo. Rebind the transport when its interface is recreated. An Ethernet transport opens one socket bound to its interface's index and shares it between the receive loop, the beacon sender and sends. When the interface is deleted and recreated, as an OpenWrt network or wifi reload does to br-lan or a mesh interface, the new interface has a new index and the old socket is unhooked from it. Only the beacon sender noticed: after three failed sends it opened a socket of its own. The receive loop kept the dead socket and sends kept using the stale index, so the node went on beaconing, peers kept trying to connect, and no link formed until fips was restarted. With announce off nothing reopened at all. The receive loop now owns rebinding for the whole transport. Every five seconds it compares the interface's current index with the socket's, and when they differ it opens a new socket with the same buffer sizes and replaces the one shared by sending, beaconing and receiving, then logs the interface, new index and MAC. An interface that is absent is checked again later, and a failed open is retried. The beacon sender's own reopen is removed; it sends on the current socket each time. A recreated interface with a smaller MTU than the transport advertises is warned about. Two root network-namespace tests recreate the node's veth on a bridge and check that beacons resume and frames are received, and that with beacons off the node still sends and receives. Like the other namespace tests they are ignored by default and run by hand under sudo. The OpenWrt README and the 802.11s how-to no longer say a running fips needs a restart to use a recreated interface, except for 0.5.3 and earlier.