mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
4ba275a90a
fips-mesh-setup creates an 802.11s mesh interface that is open at the radio layer, unmanaged, and in no firewall zone. Its input therefore met the router's default input policy, which is ACCEPT on OpenWrt 22.03, so any station in radio range could join the mesh and reach router services such as LuCI, dropbear and dnsmasq at the interface's link-local address. Each mesh interface now goes into a zone of its own, fips_mesh, with input and forward REJECT, output ACCEPT and auto_helper 0. The zone holds the interface by device name, so it is in the ruleset from the moment the firewall loads and does not wait for netifd. FIPS UDP and mDNS on the mesh are rejected with everything else; FIPS peers over the mesh use the Ethernet transport, which is not IP and does not pass the firewall. On add, the firewall is configured, saved and reloaded before the radio comes up. The save is checked by exporting the configuration before and after the commit, since a full overlay can make uci commit succeed with a truncated or empty file; on a failed save the mesh is not created, and a damaged file is reported with the copy to restore. The reload's exit status says nothing about whether the ruleset loaded, so the loaded input and forward chains are read instead; when the zone is not loaded, IP traffic arriving on the interface is dropped at the head of both chains until the firewall reloads cleanly. Changes left staged by an earlier failed save count as something to save, and a run with nothing to save still checks the loaded ruleset and reloads only when that check fails. An interface already held by another zone, by device, wildcard or network, is left there with a warning naming that zone, as the package leaves fips0 in a zone the operator chose. The zone is created once and its options are the operator's from then on; an ACCEPT input or a disabled zone is reported. Remove takes each interface out of the zone once it is gone, and deletes the zone with the last one, so add followed by remove leaves the firewall configuration as it was. A new zone subcommand adds existing mesh interfaces to the zone, and the package setup runs it at upgrade and at the first boot after a sysupgrade, so routers that ran an earlier package are closed too. It runs only when the setup's own firewall save succeeded; otherwise the new close subcommand drops IP traffic arriving on the mesh interfaces in the loaded ruleset without touching the configuration, and the setup is kept to run again at the next boot. The OpenWrt firewall scenarios gain cases for the add, remove, upgrade, failed reload, failed save and other-zone paths, run against the real uci, fw4 and nft in the four pinned OpenWrt images.