Tags: nccgroup/phantap
Tags
Forward 01:80:C2:00:00:0{1,2} using nftables
We were blocking pause frame, which is likely fine,
and LACP / Ethernet OAM Protocol which might be a problem.
This adds rules like
```
table netdev phantap {
chain eth0 {
type filter hook ingress device "eth0" priority filter; policy accept;
ether daddr 01:80:c2:00:00:01-01:80:c2:00:00:02 dup to "eth1"
}
chain eth1 {
type filter hook ingress device "eth1" priority filter; policy accept;
ether daddr 01:80:c2:00:00:01-01:80:c2:00:00:02 dup to "eth0"
}
}
```
This requires kmod-nft-netdev.
Remove disable_eap_hack This OpenWrt hack was recently removed https://git.openwrt.org/56256259a1b970db23411af73875b87850750e50 Signed-off-by: Etienne Champetier <[email protected]>
Switch from ifname to device Signed-off-by: Etienne Champetier <[email protected]>
Split out ebtables anti-leak rules in phantap-early, improve logs At START=01 "log" is not started yet so failsafe warning was not working. Also uci defaults are applied at START=10 in "boot", so setup() was overidden on first boot. The anti-leak rules do need to run really early, so move them to phantap-early, and set START=90 in phantap. Signed-off-by: Etienne Champetier <[email protected]>
phantap-learn: Add another way to detect the victim We already have: DHCP, DNS(responses), NTP(responses) for detecting the victim. This commit adds Internet(responses).
Fix EAP (802.1x) passthrough Now that our disable_eap_hack sysfs config is merged in OpenWrt, use it https://git.openwrt.org/?p=openwrt/openwrt.git;a=commitdiff;h=7d542dc8047d276517b296132926e722004065e0 Fix #2 Signed-off-by: Etienne Champetier <[email protected]>
Replace phantap (script) with phantap-learn (C) move the firewall / dns configuration part to the init.d script all the detection bits are in phantap-learn now Reviewed-by: Diana Dragusin <[email protected]> Signed-off-by: Etienne Champetier <[email protected]>
phantap: do not capture vlans Signed-off-by: Etienne Champetier <[email protected]>
phantap-learn: do not use proto for ip neigh This was only introduced in Linux 5.0 torvalds/linux@df9b0e3 Signed-off-by: Etienne Champetier <[email protected]>