mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 15:48:34 +00:00
Johnathan Corgan
5510c14688
fips0 was a member of the lan zone, and an include inserted head-of-chain accepts for it, so every FIPS peer could reach the router's own services such as LuCI, SSH and DNS. fips0 now has a zone of its own, fips, that admits only replies, ping and fips-gateway's port forwards, with a forwarding from lan for the gateway's path into the mesh. A second fw4 include refuses ICMPv6 from wan into fips0, which OpenWrt's stock Allow-ICMPv6-Forward rule would otherwise forward into the mesh. Upgrades move fips0 out of lan, remove the old include, script and hotplug hook, and reload the firewall. The reload's exit status does not show whether fw4 loaded the new ruleset, so the setup checks the loaded ruleset. If the load failed or cannot be checked, or the firewall configuration cannot be saved, including a save that a full overlay cut short, new connections from fips0 are blocked in the running ruleset until the firewall next reloads, and the upgrade says why and how to clear it. A configuration that could not be saved is migrated again at the next boot. When fips0 stays exposed (in lan through a network interface, in a zone that accepts input, or in no zone under an accepting default), or sits in an operator's own zone that now needs its own port-forward and forwarding rules, the upgrade prints a line saying so. The new firewall scenarios run the setup against the real uci, fw4 and nft in four OpenWrt rootfs images, and the package checks cover the includes and the removed files.
9 lines
292 B
Bash
9 lines
292 B
Bash
#!/bin/sh
|
|
# FIPS hotplug — apply firewall rules when the FIPS TUN interface comes up.
|
|
# The kernel fires net hotplug events for every interface including TUN devices.
|
|
|
|
[ "$INTERFACE" = "fips0" ] || exit 0
|
|
[ "$ACTION" = "add" ] || [ "$ACTION" = "register" ] || exit 0
|
|
|
|
/etc/fips/firewall.sh
|