mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-29 23:27:37 +00:00
Johnathan Corgan
88c7974d25
The daemon names its TUN from tun.name, but fips-gateway looked for fips0: with any other name it exited at start saying fips0 was missing, and had it started, its NAT, forward and raw rules would have matched an interface that is not the mesh, and its DNS listener would have answered queries arriving from the mesh. The gateway now reads tun.name from the configuration it already loads and uses it for its start-up check, for every nftables match on the TUN, and for the DNS listener's mesh-interface filter. The packaged systemd units and the NixOS module waited for fips0 with a shell loop before starting the gateway, and failed with any other name. The gateway now does that wait itself, for up to 30 seconds, for the interface tun.name names, and exits at once on a stop during it, so the loops are gone. On OpenWrt the init script's wait reads tun.name. The gateway answers LAN hosts' neighbor solicitations for pool addresses with proxy NDP entries, which the kernel ignores unless proxy_ndp is set for all interfaces or for the LAN interface. The gateway checked IPv6 forwarding at start but not proxy_ndp, so on a host without it, LAN hosts that resolve pool addresses on-link got no answer and nothing said why. Only the OpenWrt package sets it. The gateway now warns at start when neither net.ipv6.conf.all.proxy_ndp nor the LAN interface's own proxy_ndp is set. It does not stop: a LAN that reaches the pool through a route to the gateway does not need it. Starting the OpenWrt gateway replaced any IPv6 address the operator had set on the LAN with its own prefix, and stopping it deleted the LAN's ra_default whatever it had been before, so both were lost after one start and stop. The pool route and its router advertisement were always put on br-lan and the lan interface, whatever gateway.lan_interface said. A start now leaves an address the operator set in place and adds its prefix only to a LAN with none. It keeps the ra_default it replaces in /etc/fips/gateway-ra-default.saved and a stop puts it back, also after a power loss between the two. A stop with nothing saved, as every package upgrade and removal makes whether or not the gateway ran, leaves ra_default alone unless it is 2, the value an older package's start left. The pool route, its advertisement, the prefix and ra_default follow gateway.lan_interface and the network interface whose device it is, with br-lan and lan still the defaults. The README also said the gateway prefix could take over as a LAN client's source address only for 2001::/16 destinations; it can for any destination that shares more leading bits with it than with the client's upstream address, which with a 2a00::/7 upstream is all of 2000::/5.