mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
c86f0ad1c6
The gateway's init script gives br-lan a global-scope address, 2001:2:f1b5::1/64, so Android and Chrome clients send AAAA queries. It set the address on every start, reloading the network each time whether or not it changed, and deleted it on every stop with another reload. On OpenWrt 25.12 netifd recreates br-lan when its address changes, so every stop, restart and later start dropped the LAN for a few seconds and gave br-lan a new ifindex. The address is now set, and the network reloaded, only when it is not already in place, and it stays across stops and restarts while the service is enabled. It is deleted, with one reload, when the gateway is turned off: on `disable` of a stopped gateway (the script now overrides rc.common's disable, keeping its link removal), on a `stop` of a disabled one, so `stop` and `disable` work in either order, on a start with gateway.enabled not true in fips.yaml, and on package removal, whose prerm runs stop and then disable. disable leaves the address alone in an image build and while procd still runs the gateway, and a restart of a disabled gateway does not delete it. Turning the gateway off never deletes an address the operator set in network.lan.ip6addr; a start still replaces it, as before. A stop still removes the ra_default override, which needs only an odhcpd restart. The comment that called the prefix RFC 5180 benchmarking space is corrected: it is an unassigned, unrouted part of IANA's 2001::/23 block. The README and the deployment tutorial describe when the address is present, how to delete it by hand after a sysupgrade that drops the package, that a gateway disabled while running and then rebooted needs one stop to delete it, and that on a router with upstream IPv6 clients may source connections to 2001::/16 from it while it is present. The first upgrade onto this version still deletes and re-adds the address once, because the outgoing package's prerm runs its own stop.
423 lines
15 KiB
Bash
Executable File
423 lines
15 KiB
Bash
Executable File
#!/bin/sh /etc/rc.common
|
|
# FIPS outbound LAN gateway — procd init script for OpenWrt
|
|
#
|
|
# Not enabled by default. Enable with:
|
|
# service fips-gateway enable
|
|
# service fips-gateway start
|
|
#
|
|
# Requires: fips daemon running, gateway section in /etc/fips/fips.yaml,
|
|
# IPv6 forwarding enabled.
|
|
|
|
USE_PROCD=1
|
|
START=96
|
|
STOP=09
|
|
|
|
# procd runs "supervise" (below) rather than the gateway itself.
|
|
EXTRA_COMMANDS="supervise"
|
|
EXTRA_HELP="\tsupervise Run the gateway, pointing dnsmasq at it while it listens (run by procd)\n"
|
|
|
|
PROG=/usr/bin/fips-gateway
|
|
CONFIG=/etc/fips/fips.yaml
|
|
|
|
# Port the gateway DNS listens on when gateway.dns.listen is not set. Must
|
|
# match DEFAULT_DNS_LISTEN in the gateway's source; the scenario harness checks
|
|
# the two agree. The port actually used comes from gateway_dns_port.
|
|
GW_DNS_DEFAULT=5365
|
|
# Port the FIPS daemon DNS listens on.
|
|
DAEMON_DNS_PORT=5354
|
|
# Held while dnsmasq's .fips upstream is changed, so a stopping gateway's swap
|
|
# back to the daemon and a starting gateway's swap to itself cannot interleave.
|
|
DNS_LOCK=/var/lock/fips-gateway-dns.lock
|
|
# The pid of the gateway the current supervise runs, so an exiting instance
|
|
# can tell its successor's socket from anything else holding the port.
|
|
GW_PIDFILE=/var/run/fips-gateway.pid
|
|
# Seconds a stopping gateway gets after SIGTERM before it is killed; under
|
|
# procd's own 5 s, after which procd kills only the supervise shell.
|
|
GW_KILL_AFTER=3
|
|
# Left by the package's preinst when the gateway is not enabled; see below.
|
|
INSTALL_HOLD=/var/run/fips-gateway-install-hold
|
|
|
|
# Global-scope IPv6 prefix assigned to br-lan so Android/Chrome clients
|
|
# believe they have full IPv6 and actually send AAAA queries. An unassigned
|
|
# address in IANA's 2001::/23 IETF protocol assignments block, not routed on
|
|
# the internet. (It is not RFC 5180 benchmarking space, which is 2001:2::/48.)
|
|
#
|
|
# Set by the first start and kept across stops and restarts while the service
|
|
# is enabled: changing it reloads the network, which on OpenWrt 25.12 recreates
|
|
# br-lan and drops the LAN for a few seconds. Turning the gateway off deletes
|
|
# it: disable (below), a stop of a disabled service (stop_service), a start
|
|
# with the gateway turned off in fips.yaml, and package removal, whose prerm
|
|
# runs disable.
|
|
GLOBAL_PREFIX="2001:2:f1b5::1/64"
|
|
|
|
start_service() {
|
|
# OpenWrt's generic postinst enables and starts every init script a
|
|
# package ships. A package built from the SDK feed Makefile runs it, and
|
|
# its preinst leaves this hold unless the gateway was enabled, so that
|
|
# installing or upgrading the package does not switch the gateway on.
|
|
# Honoured once.
|
|
if [ -e "$INSTALL_HOLD" ]; then
|
|
rm -f "$INSTALL_HOLD"
|
|
disable
|
|
logger -t fips-gateway "left disabled and stopped by the package installation"
|
|
return 0
|
|
fi
|
|
|
|
# The gateway daemon exits when gateway.enabled is not true, so without
|
|
# this check starting a disabled gateway would still take dnsmasq's .fips
|
|
# upstream away from the daemon and point it at a port nothing listens on.
|
|
if [ "$(gateway_config_enabled)" != "true" ]; then
|
|
logger -t fips-gateway "gateway.enabled is not true in $CONFIG; not starting"
|
|
# A gateway turned off in its config gives the LAN prefix back.
|
|
prefix_remove
|
|
return 1
|
|
fi
|
|
|
|
# Apply gateway sysctls (proxy_ndp, IPv6 forwarding).
|
|
sysctl -p /etc/sysctl.d/fips-gateway.conf 2>/dev/null || true
|
|
|
|
# Load conntrack module for /proc/net/nf_conntrack.
|
|
modprobe nf_conntrack 2>/dev/null || true
|
|
|
|
# Add a global-scope IPv6 prefix to br-lan so Android/Chrome clients
|
|
# send AAAA queries (they suppress AAAA when only ULA addresses exist).
|
|
# Also set ra_default=2 so odhcpd advertises a default route even
|
|
# without upstream IPv6 — needed for clients to accept the prefix.
|
|
gateway_add_global_prefix
|
|
|
|
# Advertise the virtual IP pool via Router Advertisement so LAN clients
|
|
# learn a route to the pool automatically.
|
|
gateway_add_ra_route
|
|
|
|
# dnsmasq's .fips forwarding moves to the gateway only once the gateway
|
|
# holds its DNS port, and back to the daemon (5354) whenever the gateway
|
|
# exits, so a gateway that fails to start, before or after binding, does
|
|
# not leave LAN clients' .fips lookups going to a dead port. See supervise.
|
|
procd_open_instance
|
|
procd_set_param command /etc/init.d/fips-gateway supervise
|
|
procd_set_param respawn 3600 5 5
|
|
procd_set_param stdout 1
|
|
procd_set_param stderr 1
|
|
procd_close_instance
|
|
}
|
|
|
|
stop_service() {
|
|
# Restore dnsmasq .fips forwarding back to the daemon.
|
|
dns_locked dnsmasq_swap_fips_upstream "$DAEMON_DNS_PORT"
|
|
|
|
# Remove the RA route for the virtual IP pool.
|
|
gateway_remove_ra_route
|
|
|
|
# The LAN prefix stays; see GLOBAL_PREFIX. The ra_default override goes,
|
|
# which needs only an odhcpd restart.
|
|
ra_restore
|
|
|
|
# A stop of a disabled service is the gateway being turned off: disable
|
|
# keeps the prefix while the gateway runs, so in the order disable then
|
|
# stop it goes here. Only for the stop action itself: rc.common's restart
|
|
# runs this with action "restart" and its shutdown with "shutdown", and
|
|
# neither turns the gateway off.
|
|
if [ "${action:-}" = stop ] && ! enabled; then
|
|
prefix_remove
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
# rc.common's disable, which this replaces: remove the boot links.
|
|
# Disabling also turns the gateway off, so the LAN prefix is deleted too,
|
|
# except in an image build (IPKG_INSTROOT names the image's root, and the
|
|
# build host's uci must not be touched) and while procd still runs the
|
|
# gateway, which must keep its prefix; its stop deletes it then.
|
|
# shellcheck disable=SC2154 # rc.common sets initscript before sourcing this
|
|
disable() {
|
|
name="$(basename "${initscript}")"
|
|
rm -f "$IPKG_INSTROOT"/etc/rc.d/S??"$name"
|
|
rm -f "$IPKG_INSTROOT"/etc/rc.d/K??"$name"
|
|
|
|
[ -n "${IPKG_INSTROOT:-}" ] && return 0
|
|
procd_running "$name" && return 0
|
|
prefix_remove
|
|
return 0
|
|
}
|
|
|
|
reload_service() {
|
|
restart
|
|
}
|
|
|
|
# Run the gateway as procd's instance. dnsmasq's .fips upstream is pointed at
|
|
# the gateway's DNS port once the gateway itself has that port bound, and back
|
|
# at the daemon's port when the gateway exits for any reason: a config it
|
|
# cannot parse, a port it cannot bind, a failure after binding, a crash, or the
|
|
# SIGTERM procd sends to stop it. That SIGTERM is passed on so the gateway can
|
|
# remove its NAT table and routes, and a gateway still running $GW_KILL_AFTER
|
|
# seconds later is killed, because procd kills only this shell. The exit
|
|
# status is the gateway's, so procd's respawn sees the gateway's failures.
|
|
supervise() {
|
|
local port pid="" watcher rc stopping="" killer=""
|
|
|
|
# rc.common took procd's service lock on fd 1000 when it sourced
|
|
# procd.sh. Held for the gateway's lifetime, it would make every later
|
|
# stop, restart and reload of the service wait on it forever. ash takes
|
|
# descriptors above 9, and procd.sh has used 1000 since at least 22.03.
|
|
# shellcheck disable=SC3023
|
|
exec 1000>&-
|
|
|
|
port="$(gateway_dns_port)"
|
|
# Set before the gateway starts, so a stop that arrives first still
|
|
# reaches it.
|
|
trap 'stopping=1; gateway_stop' TERM INT
|
|
"$PROG" --config "$CONFIG" &
|
|
pid=$!
|
|
mkdir -p "${GW_PIDFILE%/*}" 2>/dev/null
|
|
echo "$pid" > "$GW_PIDFILE"
|
|
[ -n "$stopping" ] && gateway_stop
|
|
|
|
# Polled from a child of its own so this shell sits in wait and reaps the
|
|
# gateway the moment it exits; a polling loop here would see an unreaped
|
|
# gateway as still alive.
|
|
(
|
|
while kill -0 "$pid" 2>/dev/null; do
|
|
dns_locked gateway_dns_claim "$port" "$pid" && exit 0
|
|
sleep 1
|
|
done
|
|
exit 0
|
|
) &
|
|
watcher=$!
|
|
|
|
# A trapped signal ends wait early, so wait until the gateway is gone.
|
|
rc=0
|
|
wait "$pid" || rc=$?
|
|
while kill -0 "$pid" 2>/dev/null; do
|
|
rc=0
|
|
wait "$pid" || rc=$?
|
|
done
|
|
[ -n "$killer" ] && kill "$killer" 2>/dev/null
|
|
# The watcher has nothing left to do, and would otherwise sleep out its
|
|
# poll; any change it is part way through finishes under the lock first.
|
|
kill "$watcher" 2>/dev/null
|
|
wait "$watcher"
|
|
|
|
dns_locked gateway_dns_release "$port" "$pid"
|
|
[ "$(cat "$GW_PIDFILE" 2>/dev/null)" = "$pid" ] && rm -f "$GW_PIDFILE"
|
|
logger -t fips-gateway "gateway exited with status $rc"
|
|
return "$rc"
|
|
}
|
|
|
|
# supervise's stop: SIGTERM to the gateway now, SIGKILL if it is still running
|
|
# $GW_KILL_AFTER seconds later. Reads and sets supervise's pid and killer.
|
|
gateway_stop() {
|
|
[ -n "$pid" ] || return 0
|
|
kill -TERM "$pid" 2>/dev/null
|
|
if [ -z "$killer" ]; then
|
|
( sleep "$GW_KILL_AFTER"; kill -KILL "$pid" 2>/dev/null ) &
|
|
killer=$!
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
# Run "$@" holding $DNS_LOCK. The lock is released when the subshell, and
|
|
# every process that inherited its descriptor, has exited.
|
|
dns_locked() {
|
|
mkdir -p "${DNS_LOCK%/*}" 2>/dev/null
|
|
(
|
|
flock 9 || logger -t fips-gateway "could not lock $DNS_LOCK; changing dnsmasq anyway"
|
|
"$@"
|
|
) 9>"$DNS_LOCK"
|
|
}
|
|
|
|
# Succeed when process $2 itself holds a UDP socket bound to port $1, on any
|
|
# address, IPv4 or IPv6: a socket inode from /proc/net/udp{,6} for that port
|
|
# is among the process's open descriptors. Another process holding the port,
|
|
# such as an mDNS responder on 5353, does not count.
|
|
gateway_dns_held_by() {
|
|
local hex inodes inode fd
|
|
[ -n "$2" ] || return 1
|
|
hex="$(printf '%04X' "$1")"
|
|
# cat rather than awk's own file arguments: busybox awk gives up on a
|
|
# missing /proc/net/udp6. A while-read loop on the pipe would run in a
|
|
# subshell under ash, where the return below could not leave this function.
|
|
inodes="$(cat /proc/net/udp /proc/net/udp6 2>/dev/null |
|
|
awk -v want=":$hex" 'substr($2, length($2) - 4) == want { print $10 }')"
|
|
for inode in $inodes; do
|
|
for fd in /proc/"$2"/fd/*; do
|
|
[ "$(readlink "$fd" 2>/dev/null)" = "socket:[$inode]" ] && return 0
|
|
done
|
|
done
|
|
return 1
|
|
}
|
|
|
|
# Point dnsmasq at the gateway's port $1 once gateway $2 holds it. Fails,
|
|
# changing nothing, until then.
|
|
gateway_dns_claim() {
|
|
gateway_dns_held_by "$1" "$2" || return 1
|
|
dnsmasq_swap_fips_upstream "$1"
|
|
logger -t fips-gateway "gateway DNS is listening on port $1; dnsmasq forwards .fips to it"
|
|
return 0
|
|
}
|
|
|
|
# Point dnsmasq back at the daemon after gateway $2 on port $1 has exited,
|
|
# unless the gateway procd started in its place (the pid in $GW_PIDFILE) holds
|
|
# the port already; that one claims dnsmasq itself.
|
|
gateway_dns_release() {
|
|
local next
|
|
next="$(cat "$GW_PIDFILE" 2>/dev/null)"
|
|
if [ -n "$next" ] && [ "$next" != "$2" ] && gateway_dns_held_by "$1" "$next"; then
|
|
return 0
|
|
fi
|
|
dnsmasq_swap_fips_upstream "$DAEMON_DNS_PORT"
|
|
return 0
|
|
}
|
|
|
|
# Extract the gateway "enabled" flag from fips.yaml.
|
|
# Prints the value indented under the top-level "gateway:" block, or nothing
|
|
# when there is no such block.
|
|
gateway_config_enabled() {
|
|
awk '/^gateway:/{found=1; next} found && /^[^ ]/{found=0} found && /enabled:/{gsub(/.*enabled:[[:space:]]*/, ""); gsub(/["'"'"']/, ""); print; exit}' "$CONFIG"
|
|
}
|
|
|
|
# Print the port the gateway's DNS listener will bind: the digits after the
|
|
# last ":" of the "listen:" value inside the top-level "gateway:" block of
|
|
# fips.yaml, or $GW_DNS_DEFAULT when there is no such line or its value does
|
|
# not end in a port. Commented lines are skipped, and "listen_port:" (a port
|
|
# forward key) does not match.
|
|
#
|
|
# Block-style YAML only: a flow-style "dns: {listen: ...}" reads as the
|
|
# default. The dnsmasq entry this port feeds is always ::1#<port>, so a
|
|
# gateway listening only on 127.0.0.1 is still not reachable through it.
|
|
gateway_dns_port() {
|
|
local port
|
|
port="$(awk '
|
|
/^[A-Za-z_]/ { top = $1 }
|
|
top != "gateway:" { next }
|
|
/^[[:space:]]*#/ { next }
|
|
/^[[:space:]]+listen:/ {
|
|
v = $0
|
|
sub(/^[[:space:]]+listen:[[:space:]]*/, "", v)
|
|
sub(/[[:space:]]+#.*$/, "", v)
|
|
gsub(/["'"'"']/, "", v)
|
|
sub(/[[:space:]]+$/, "", v)
|
|
n = split(v, part, ":")
|
|
if (n > 1 && part[n] ~ /^[0-9]+$/) print part[n]
|
|
exit
|
|
}
|
|
' "$CONFIG" 2>/dev/null)"
|
|
echo "${port:-$GW_DNS_DEFAULT}"
|
|
}
|
|
|
|
# Extract the gateway pool CIDR from fips.yaml.
|
|
# Looks for "pool:" indented under the top-level "gateway:" block.
|
|
gateway_pool_cidr() {
|
|
awk '/^gateway:/{found=1; next} found && /^[^ ]/{found=0} found && /pool:/{gsub(/.*pool:[[:space:]]*/, ""); gsub(/["'"'"']/, ""); print; exit}' "$CONFIG"
|
|
}
|
|
|
|
# Add an RA-advertised route for the virtual IP pool so LAN clients
|
|
# automatically learn how to reach virtual IPs.
|
|
gateway_add_ra_route() {
|
|
local pool
|
|
pool="$(gateway_pool_cidr)"
|
|
[ -z "$pool" ] && return 0
|
|
|
|
# Add a kernel route on br-lan (needed for RA to advertise it).
|
|
ip -6 route replace "$pool" dev br-lan proto static 2>/dev/null || true
|
|
|
|
# Add a UCI route6 entry for odhcpd to include in Router Advertisements.
|
|
# Remove any stale entry first.
|
|
gateway_remove_ra_route_uci
|
|
uci add dhcp route6 >/dev/null
|
|
uci set dhcp.@route6[-1].interface='lan'
|
|
uci set dhcp.@route6[-1].target="$pool"
|
|
uci commit dhcp
|
|
/etc/init.d/odhcpd restart 2>/dev/null || true
|
|
}
|
|
|
|
# Remove the RA route.
|
|
gateway_remove_ra_route() {
|
|
local pool
|
|
pool="$(gateway_pool_cidr)"
|
|
[ -z "$pool" ] && return 0
|
|
|
|
ip -6 route del "$pool" dev br-lan proto static 2>/dev/null || true
|
|
gateway_remove_ra_route_uci
|
|
/etc/init.d/odhcpd restart 2>/dev/null || true
|
|
}
|
|
|
|
# Remove any existing UCI route6 entries for the pool.
|
|
gateway_remove_ra_route_uci() {
|
|
local i=0
|
|
while uci -q get "dhcp.@route6[$i]" >/dev/null 2>&1; do
|
|
if [ "$(uci -q get "dhcp.@route6[$i].target")" = "$(gateway_pool_cidr)" ]; then
|
|
uci delete "dhcp.@route6[$i]"
|
|
uci commit dhcp
|
|
return 0
|
|
fi
|
|
i=$((i + 1))
|
|
done
|
|
}
|
|
|
|
# Add a global-scope IPv6 prefix to br-lan and enable RA default route.
|
|
gateway_add_global_prefix() {
|
|
local current changed=""
|
|
current="$(uci -q get network.lan.ip6addr 2>/dev/null || echo "")"
|
|
if [ "$current" != "$GLOBAL_PREFIX" ]; then
|
|
uci set network.lan.ip6addr="$GLOBAL_PREFIX"
|
|
uci commit network
|
|
changed=1
|
|
fi
|
|
|
|
# Force odhcpd to advertise a default route even without upstream IPv6.
|
|
local ra_default
|
|
ra_default="$(uci -q get dhcp.lan.ra_default 2>/dev/null || echo "")"
|
|
if [ "$ra_default" != "2" ]; then
|
|
uci set dhcp.lan.ra_default='2'
|
|
uci commit dhcp
|
|
fi
|
|
|
|
# Apply a changed prefix now. Only when it changed: a reload recreates
|
|
# br-lan on OpenWrt 25.12. The ra_default change reaches odhcpd through
|
|
# the restart in gateway_add_ra_route.
|
|
[ -n "$changed" ] && /etc/init.d/network reload 2>/dev/null
|
|
return 0
|
|
}
|
|
|
|
# Delete the LAN prefix when it is the one this script sets, and apply that.
|
|
# An address the operator set is left alone.
|
|
prefix_remove() {
|
|
[ "$(uci -q get network.lan.ip6addr 2>/dev/null)" = "$GLOBAL_PREFIX" ] || return 0
|
|
uci delete network.lan.ip6addr
|
|
uci commit network
|
|
/etc/init.d/network reload 2>/dev/null || true
|
|
}
|
|
|
|
# Remove the ra_default override.
|
|
ra_restore() {
|
|
uci -q delete dhcp.lan.ra_default 2>/dev/null || true
|
|
uci commit dhcp
|
|
/etc/init.d/odhcpd restart 2>/dev/null || true
|
|
}
|
|
|
|
# Swap the dnsmasq .fips forwarding port via UCI and restart dnsmasq.
|
|
# $1 = target port number
|
|
dnsmasq_swap_fips_upstream() {
|
|
local port="$1"
|
|
local server
|
|
|
|
# Remove every loopback .fips forward, then add the one for $port. That
|
|
# covers the daemon's port, this gateway's, and a stale entry for any other
|
|
# local port, such as the old default 5353 or a changed gateway.dns.listen.
|
|
# A .fips forward to another host and servers for other domains are kept.
|
|
# uci prints a list on one line separated by spaces.
|
|
for server in $(uci -q get 'dhcp.@dnsmasq[0].server' 2>/dev/null); do
|
|
case "$server" in
|
|
"/fips/::1#"* | "/fips/127.0.0.1#"*)
|
|
uci -q del_list dhcp.@dnsmasq[0].server="$server" 2>/dev/null
|
|
;;
|
|
esac
|
|
done
|
|
|
|
uci add_list dhcp.@dnsmasq[0].server="/fips/::1#${port}"
|
|
uci commit dhcp
|
|
|
|
# Restart dnsmasq to pick up the change.
|
|
/etc/init.d/dnsmasq restart 2>/dev/null || true
|
|
}
|