fips/packaging/openwrt-ipk/files/etc/init.d/fips-gateway

#!/bin/sh /etc/rc.common
# FIPS outbound LAN gateway — procd init script for OpenWrt
#
# Not enabled by default. Enable with:
#   service fips-gateway enable
#   service fips-gateway start
#
# Requires: fips daemon running, gateway section in /etc/fips/fips.yaml,
# IPv6 forwarding enabled.

USE_PROCD=1
START=96
STOP=09

# procd runs "supervise" (below) rather than the gateway itself.
EXTRA_COMMANDS="supervise"
EXTRA_HELP="\tsupervise       Run the gateway, pointing dnsmasq at it while it listens (run by procd)\n"

PROG=/usr/bin/fips-gateway
CONFIG=/etc/fips/fips.yaml

# Port the gateway DNS listens on when gateway.dns.listen is not set. Must
# match DEFAULT_DNS_LISTEN in the gateway's source; the scenario harness checks
# the two agree. The port actually used comes from gateway_dns_port.
GW_DNS_DEFAULT=5365
# Port the FIPS daemon DNS listens on.
DAEMON_DNS_PORT=5354
# Held while dnsmasq's .fips upstream is changed, so a stopping gateway's swap
# back to the daemon and a starting gateway's swap to itself cannot interleave.
DNS_LOCK=/var/lock/fips-gateway-dns.lock
# The pid of the gateway the current supervise runs, so an exiting instance
# can tell its successor's socket from anything else holding the port.
GW_PIDFILE=/var/run/fips-gateway.pid
# Seconds a stopping gateway gets after SIGTERM before it is killed; under
# procd's own 5 s, after which procd kills only the supervise shell.
GW_KILL_AFTER=3
# Left by the package's preinst when the gateway is not enabled; see below.
INSTALL_HOLD=/var/run/fips-gateway-install-hold
# Seconds supervise waits for the daemon's fips0 before starting the gateway,
# which exits when fips0 is missing; 30 as in the Debian unit. Overridable
# from the environment for the init script scenarios.
FIPS0_WAIT="${FIPS0_WAIT:-30}"

# Global-scope IPv6 prefix assigned to br-lan so Android/Chrome clients
# believe they have full IPv6 and actually send AAAA queries. An unassigned
# address in IANA's 2001::/23 IETF protocol assignments block, not routed on
# the internet. (It is not RFC 5180 benchmarking space, which is 2001:2::/48.)
#
# Set by the first start and kept across stops and restarts while the service
# is enabled: changing it reloads the network, which on OpenWrt 25.12 recreates
# br-lan and drops the LAN for a few seconds. Turning the gateway off deletes
# it: disable (below), a stop of a disabled service (stop_service), a start
# with the gateway turned off in fips.yaml, and package removal, whose prerm
# runs disable.
GLOBAL_PREFIX="2001:2:f1b5::1/64"

start_service() {
	# OpenWrt's generic postinst enables and starts every init script a
	# package ships. A package built from the SDK feed Makefile runs it, and
	# its preinst leaves this hold unless the gateway was enabled, so that
	# installing or upgrading the package does not switch the gateway on.
	# Honoured once.
	if [ -e "$INSTALL_HOLD" ]; then
		rm -f "$INSTALL_HOLD"
		disable
		logger -t fips-gateway "left disabled and stopped by the package installation"
		return 0
	fi

	# The gateway daemon exits when gateway.enabled is not true, so without
	# this check starting a disabled gateway would still take dnsmasq's .fips
	# upstream away from the daemon and point it at a port nothing listens on.
	if [ "$(gateway_config_enabled)" != "true" ]; then
		logger -t fips-gateway "gateway.enabled is not true in $CONFIG; not starting"
		# A gateway turned off in its config gives the LAN prefix back.
		prefix_remove
		return 1
	fi

	# Apply gateway sysctls (proxy_ndp, IPv6 forwarding).
	sysctl -p /etc/sysctl.d/fips-gateway.conf 2>/dev/null || true

	# Load conntrack module for /proc/net/nf_conntrack.
	modprobe nf_conntrack 2>/dev/null || true

	# Add a global-scope IPv6 prefix to br-lan so Android/Chrome clients
	# send AAAA queries (they suppress AAAA when only ULA addresses exist).
	# Also set ra_default=2 so odhcpd advertises a default route even
	# without upstream IPv6 — needed for clients to accept the prefix.
	gateway_add_global_prefix

	# Advertise the virtual IP pool via Router Advertisement so LAN clients
	# learn a route to the pool automatically.
	gateway_add_ra_route

	# dnsmasq's .fips forwarding moves to the gateway only once the gateway
	# holds its DNS port, and back to the daemon (5354) whenever the gateway
	# exits, so a gateway that fails to start, before or after binding, does
	# not leave LAN clients' .fips lookups going to a dead port. See supervise.
	procd_open_instance
	procd_set_param command /etc/init.d/fips-gateway supervise
	# Respawn 5 s after every exit, without giving up (see /etc/init.d/fips).
	procd_set_param respawn 3600 5 0
	procd_set_param stdout 1
	procd_set_param stderr 1
	procd_close_instance
}

stop_service() {
	# Restore dnsmasq .fips forwarding back to the daemon.
	dns_locked dnsmasq_swap_fips_upstream "$DAEMON_DNS_PORT"

	# Remove the RA route for the virtual IP pool.
	gateway_remove_ra_route

	# The LAN prefix stays; see GLOBAL_PREFIX. The ra_default override goes,
	# which needs only an odhcpd restart.
	ra_restore

	# A stop of a disabled service is the gateway being turned off: disable
	# keeps the prefix while the gateway runs, so in the order disable then
	# stop it goes here. Only for the stop action itself: rc.common's restart
	# runs this with action "restart" and its shutdown with "shutdown", and
	# neither turns the gateway off.
	if [ "${action:-}" = stop ] && ! enabled; then
		prefix_remove
	fi
	return 0
}

# rc.common's disable, which this replaces: remove the boot links.
# Disabling also turns the gateway off, so the LAN prefix is deleted too,
# except in an image build (IPKG_INSTROOT names the image's root, and the
# build host's uci must not be touched) and while procd still runs the
# gateway, which must keep its prefix; its stop deletes it then.
# shellcheck disable=SC2154 # rc.common sets initscript before sourcing this
disable() {
	name="$(basename "${initscript}")"
	rm -f "$IPKG_INSTROOT"/etc/rc.d/S??"$name"
	rm -f "$IPKG_INSTROOT"/etc/rc.d/K??"$name"

	[ -n "${IPKG_INSTROOT:-}" ] && return 0
	procd_running "$name" && return 0
	prefix_remove
	return 0
}

reload_service() {
	restart
}

# Run the gateway as procd's instance. dnsmasq's .fips upstream is pointed at
# the gateway's DNS port once the gateway itself has that port bound, and back
# at the daemon's port when the gateway exits for any reason: a config it
# cannot parse, a port it cannot bind, a failure after binding, a crash, or the
# SIGTERM procd sends to stop it. That SIGTERM is passed on so the gateway can
# remove its NAT table and routes, and a gateway still running $GW_KILL_AFTER
# seconds later is killed, because procd kills only this shell. The exit
# status is the gateway's, so procd's respawn sees the gateway's failures.
supervise() {
	local port pid="" watcher rc stopping="" killer="" waited=0

	# rc.common took procd's service lock on fd 1000 when it sourced
	# procd.sh. Held for the gateway's lifetime, it would make every later
	# stop, restart and reload of the service wait on it forever. ash takes
	# descriptors above 9, and procd.sh has used 1000 since at least 22.03.
	# shellcheck disable=SC3023
	exec 1000>&-

	port="$(gateway_dns_port)"
	# Set before the gateway starts, so a stop that arrives first still
	# reaches it.
	trap 'stopping=1; gateway_stop' TERM INT

	# An upgrade restarts fips and this service together, so the daemon may
	# not have created fips0 yet. The wait is here rather than in
	# start_service, which runs under procd's service lock. When it runs out
	# the gateway starts anyway, reports the missing fips0 itself, and
	# procd's respawn takes over.
	while [ -z "$stopping" ] && ! ip link show fips0 >/dev/null 2>&1; do
		if [ "$waited" -ge "$FIPS0_WAIT" ]; then
			logger -t fips-gateway "fips0 did not appear within ${FIPS0_WAIT}s; starting the gateway anyway"
			break
		fi
		sleep 1
		waited=$((waited + 1))
	done
	# Stopped while waiting: nothing was started and dnsmasq was not touched.
	[ -n "$stopping" ] && return 0

	"$PROG" --config "$CONFIG" &
	pid=$!
	mkdir -p "${GW_PIDFILE%/*}" 2>/dev/null
	echo "$pid" > "$GW_PIDFILE"
	[ -n "$stopping" ] && gateway_stop

	# Polled from a child of its own so this shell sits in wait and reaps the
	# gateway the moment it exits; a polling loop here would see an unreaped
	# gateway as still alive.
	(
		while kill -0 "$pid" 2>/dev/null; do
			dns_locked gateway_dns_claim "$port" "$pid" && exit 0
			sleep 1
		done
		exit 0
	) &
	watcher=$!

	# A trapped signal ends wait early, so wait until the gateway is gone.
	rc=0
	wait "$pid" || rc=$?
	while kill -0 "$pid" 2>/dev/null; do
		rc=0
		wait "$pid" || rc=$?
	done
	[ -n "$killer" ] && kill "$killer" 2>/dev/null
	# The watcher has nothing left to do, and would otherwise sleep out its
	# poll; any change it is part way through finishes under the lock first.
	kill "$watcher" 2>/dev/null
	wait "$watcher"

	dns_locked gateway_dns_release "$port" "$pid"
	[ "$(cat "$GW_PIDFILE" 2>/dev/null)" = "$pid" ] && rm -f "$GW_PIDFILE"
	logger -t fips-gateway "gateway exited with status $rc"
	return "$rc"
}

# supervise's stop: SIGTERM to the gateway now, SIGKILL if it is still running
# $GW_KILL_AFTER seconds later. Reads and sets supervise's pid and killer.
gateway_stop() {
	[ -n "$pid" ] || return 0
	kill -TERM "$pid" 2>/dev/null
	if [ -z "$killer" ]; then
		( sleep "$GW_KILL_AFTER"; kill -KILL "$pid" 2>/dev/null ) &
		killer=$!
	fi
	return 0
}

# Run "$@" holding $DNS_LOCK. The lock is released when the subshell, and
# every process that inherited its descriptor, has exited.
dns_locked() {
	mkdir -p "${DNS_LOCK%/*}" 2>/dev/null
	(
		flock 9 || logger -t fips-gateway "could not lock $DNS_LOCK; changing dnsmasq anyway"
		"$@"
	) 9>"$DNS_LOCK"
}

# Succeed when process $2 itself holds a UDP socket bound to port $1, on any
# address, IPv4 or IPv6: a socket inode from /proc/net/udp{,6} for that port
# is among the process's open descriptors. Another process holding the port,
# such as an mDNS responder on 5353, does not count.
gateway_dns_held_by() {
	local hex inodes inode fd
	[ -n "$2" ] || return 1
	hex="$(printf '%04X' "$1")"
	# cat rather than awk's own file arguments: busybox awk gives up on a
	# missing /proc/net/udp6. A while-read loop on the pipe would run in a
	# subshell under ash, where the return below could not leave this function.
	inodes="$(cat /proc/net/udp /proc/net/udp6 2>/dev/null |
		awk -v want=":$hex" 'substr($2, length($2) - 4) == want { print $10 }')"
	for inode in $inodes; do
		for fd in /proc/"$2"/fd/*; do
			[ "$(readlink "$fd" 2>/dev/null)" = "socket:[$inode]" ] && return 0
		done
	done
	return 1
}

# Point dnsmasq at the gateway's port $1 once gateway $2 holds it. Fails,
# changing nothing, until then.
gateway_dns_claim() {
	gateway_dns_held_by "$1" "$2" || return 1
	dnsmasq_swap_fips_upstream "$1"
	logger -t fips-gateway "gateway DNS is listening on port $1; dnsmasq forwards .fips to it"
	return 0
}

# Point dnsmasq back at the daemon after gateway $2 on port $1 has exited,
# unless the gateway procd started in its place (the pid in $GW_PIDFILE) holds
# the port already; that one claims dnsmasq itself.
gateway_dns_release() {
	local next
	next="$(cat "$GW_PIDFILE" 2>/dev/null)"
	if [ -n "$next" ] && [ "$next" != "$2" ] && gateway_dns_held_by "$1" "$next"; then
		return 0
	fi
	dnsmasq_swap_fips_upstream "$DAEMON_DNS_PORT"
	return 0
}

# Extract the gateway "enabled" flag from fips.yaml.
# Prints the value indented under the top-level "gateway:" block, or nothing
# when there is no such block.
gateway_config_enabled() {
	awk '/^gateway:/{found=1; next} found && /^[^ ]/{found=0} found && /enabled:/{gsub(/.*enabled:[[:space:]]*/, ""); gsub(/["'"'"']/, ""); print; exit}' "$CONFIG"
}

# Print the port the gateway's DNS listener will bind: the digits after the
# last ":" of the "listen:" value inside the top-level "gateway:" block of
# fips.yaml, or $GW_DNS_DEFAULT when there is no such line or its value does
# not end in a port. Commented lines are skipped, and "listen_port:" (a port
# forward key) does not match.
#
# Block-style YAML only: a flow-style "dns: {listen: ...}" reads as the
# default. The dnsmasq entry this port feeds is always ::1#<port>, so a
# gateway listening only on 127.0.0.1 is still not reachable through it.
gateway_dns_port() {
	local port
	port="$(awk '
		/^[A-Za-z_]/ { top = $1 }
		top != "gateway:" { next }
		/^[[:space:]]*#/ { next }
		/^[[:space:]]+listen:/ {
			v = $0
			sub(/^[[:space:]]+listen:[[:space:]]*/, "", v)
			sub(/[[:space:]]+#.*$/, "", v)
			gsub(/["'"'"']/, "", v)
			sub(/[[:space:]]+$/, "", v)
			n = split(v, part, ":")
			if (n > 1 && part[n] ~ /^[0-9]+$/) print part[n]
			exit
		}
	' "$CONFIG" 2>/dev/null)"
	echo "${port:-$GW_DNS_DEFAULT}"
}

# Extract the gateway pool CIDR from fips.yaml.
# Looks for "pool:" indented under the top-level "gateway:" block.
gateway_pool_cidr() {
	awk '/^gateway:/{found=1; next} found && /^[^ ]/{found=0} found && /pool:/{gsub(/.*pool:[[:space:]]*/, ""); gsub(/["'"'"']/, ""); print; exit}' "$CONFIG"
}

# Add an RA-advertised route for the virtual IP pool so LAN clients
# automatically learn how to reach virtual IPs.
gateway_add_ra_route() {
	local pool
	pool="$(gateway_pool_cidr)"
	[ -z "$pool" ] && return 0

	# Add a kernel route on br-lan (needed for RA to advertise it).
	ip -6 route replace "$pool" dev br-lan proto static 2>/dev/null || true

	# Add a UCI route6 entry for odhcpd to include in Router Advertisements.
	# Remove any stale entry first.
	gateway_remove_ra_route_uci
	uci add dhcp route6 >/dev/null
	uci set dhcp.@route6[-1].interface='lan'
	uci set dhcp.@route6[-1].target="$pool"
	uci commit dhcp
	/etc/init.d/odhcpd restart 2>/dev/null || true
}

# Remove the RA route.
gateway_remove_ra_route() {
	local pool
	pool="$(gateway_pool_cidr)"
	[ -z "$pool" ] && return 0

	ip -6 route del "$pool" dev br-lan proto static 2>/dev/null || true
	gateway_remove_ra_route_uci
	/etc/init.d/odhcpd restart 2>/dev/null || true
}

# Remove any existing UCI route6 entries for the pool.
gateway_remove_ra_route_uci() {
	local i=0
	while uci -q get "dhcp.@route6[$i]" >/dev/null 2>&1; do
		if [ "$(uci -q get "dhcp.@route6[$i].target")" = "$(gateway_pool_cidr)" ]; then
			uci delete "dhcp.@route6[$i]"
			uci commit dhcp
			return 0
		fi
		i=$((i + 1))
	done
}

# Add a global-scope IPv6 prefix to br-lan and enable RA default route.
gateway_add_global_prefix() {
	local current changed=""
	current="$(uci -q get network.lan.ip6addr 2>/dev/null || echo "")"
	if [ "$current" != "$GLOBAL_PREFIX" ]; then
		uci set network.lan.ip6addr="$GLOBAL_PREFIX"
		uci commit network
		changed=1
	fi

	# Force odhcpd to advertise a default route even without upstream IPv6.
	local ra_default
	ra_default="$(uci -q get dhcp.lan.ra_default 2>/dev/null || echo "")"
	if [ "$ra_default" != "2" ]; then
		uci set dhcp.lan.ra_default='2'
		uci commit dhcp
	fi

	# Apply a changed prefix now. Only when it changed: a reload recreates
	# br-lan on OpenWrt 25.12. The ra_default change reaches odhcpd through
	# the restart in gateway_add_ra_route.
	[ -n "$changed" ] && /etc/init.d/network reload 2>/dev/null
	return 0
}

# Delete the LAN prefix when it is the one this script sets, and apply that.
# An address the operator set is left alone.
prefix_remove() {
	[ "$(uci -q get network.lan.ip6addr 2>/dev/null)" = "$GLOBAL_PREFIX" ] || return 0
	uci delete network.lan.ip6addr
	uci commit network
	/etc/init.d/network reload 2>/dev/null || true
}

# Remove the ra_default override.
ra_restore() {
	uci -q delete dhcp.lan.ra_default 2>/dev/null || true
	uci commit dhcp
	/etc/init.d/odhcpd restart 2>/dev/null || true
}

# Point dnsmasq's .fips forward at a loopback port via UCI and restart
# dnsmasq, only when that changes the forward.
# $1 = target port number
dnsmasq_swap_fips_upstream() {
	local port="$1"
	local server loopback=""

	# Every loopback .fips forward: the daemon's port, this gateway's, and a
	# stale entry for any other local port, such as the old default 5353 or a
	# changed gateway.dns.listen. A .fips forward to another host and servers
	# for other domains are kept. uci prints a list on one line separated by
	# spaces.
	for server in $(uci -q get 'dhcp.@dnsmasq[0].server' 2>/dev/null); do
		case "$server" in
		"/fips/::1#"* | "/fips/127.0.0.1#"*)
			loopback="$loopback $server"
			;;
		esac
	done

	# Already forwarding to $port and nowhere else on loopback: change nothing.
	# A gateway that cannot start exits after every respawn, so committing
	# /etc/config/dhcp and restarting dnsmasq here each time would cut LAN DNS
	# and DHCP every time procd starts it again.
	[ "$loopback" = " /fips/::1#${port}" ] && return 0

	for server in $loopback; do
		uci -q del_list dhcp.@dnsmasq[0].server="$server" 2>/dev/null
	done
	uci add_list dhcp.@dnsmasq[0].server="/fips/::1#${port}"
	uci commit dhcp

	# Restart dnsmasq to pick up the change.
	/etc/init.d/dnsmasq restart 2>/dev/null || true
}