Commit Graph

13 Commits

Author SHA1 Message Date
Fabian Bläse 1677a35624 fff-layer3-config: bump config_version
With OpenWrt 23.05 a few more devices have been migrated to DSA. Bump
the config_version of layer3-config to reflect the necessary migration.

Signed-off-by: Fabian Bläse <fabian@blaese.de>
2024-02-16 22:54:44 +01:00
Johannes Kimmel 53ac7cc6b5 layer3: add option to enable stateful firewall on client network
ci/woodpecker/push/woodpecker Pipeline failed Details
Add the following option to the client config section in
`/etc/config/gateway` to enable a basic stateful firewall:

```
config client
    option stateful_firewall '1'
```

The firewall will forward icmp mesages and allow any outbound client
traffic and related inbound traffic.

Acked-by: Fabian Bläse <fabian@blaese.de>
2023-12-26 18:53:36 +01:00
Fabian Bläse 57408f5dfb fff-layer3-config: show uci syntax errors
ci/woodpecker/push/woodpecker Pipeline was successful Details
Do not hide uci errors when checking if gateway config exists, so an
appropriate uci error message is displayed. This can be helpful to find
syntax errors.

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2022-04-05 21:25:33 +02:00
Fabian Bläse 17bc1a7e62 fff-layer3-config: Always clear client interface list completely
Previously, some interfaces in the client ifname list have been kept.
The actual reason for this is unknown, it might have been used for the
bat0 interfaces.

Filtering the interface list in this way might lead to interfaces being
retained unintentionally, especially with the diverse naming of DSA
interfaces.

As it is not required anymore, remove the retention of some interfaces
completely.

Fixes: #207

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Johannes Kimmel <fff@bareminimum.eu>
2022-03-05 18:19:02 +01:00
Johannes Kimmel 9d745d0d5c fff-layer3-config: add missing -q option for uci get
Suppresses the unhelpful "uci: Entry not found" message when running
configure-layer3 -c in case there is no `ip6addr` set on the client
interface.

Signed-off-by: Johannes Kimmel <fff@bareminimum.eu>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-12-30 16:01:44 +01:00
Johannes Kimmel 450312e237 fff-layer3-config: add rules for router_ip
If the router_ips don't happen to be included in the client network's
subnet, the decision defaults to a main table lookup. This causes
packets to choose the wrong interface.

This patch forces packets from a router_ip to be routed via the fff table.

Fixes: #175

Signed-off-by: Johannes Kimmel <fff@bareminimum.eu>
Reviewed-by: Fabian Bläse <fabian@blaese.de>
2021-12-01 00:06:08 +01:00
Fabian Bläse 341d215cf2 layer3-config: Bump required config_version
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Tested-by: Fabian Bläse <fabian@blaese.de>
2021-11-10 13:28:05 +01:00
Fabian Bläse e07f6121cc fff-layer3-config: add router_ip option
For some purposes (e.g. SNAT, vxlan) it might be necessary to have an
additional address just for the router which is not attached to any
interfaces. Addresses like this are typically added to the loopback
interface.

The new options "router_ip" and "router_ip6" are added to the gateway
config to allow the user to configure such addresses. It is possible to
both specify the address with or without a subnet size.

The default configuration contains the IPv4 loopback address
(127.0.0.1/8) explicitly, but this is not necessary. These addresses are
configured automatically, even if they are not present in the
configuration, so they can safely be removed, if present.

The filters of our routing daemon babeld are adjusted accordingly, so
the newly added addresses are announced correctly.

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Johannes Kimmel <fff@bareminimum.eu>
2021-09-02 17:05:32 +02:00
Fabian Bläse 15d259b98a fff-network: add support for DSA switch configuration
Starting with OpenWrt 21.02 some devices now use upstream kernel drivers
for the built-in switch instead of relying on OpenWrt's swconfig driver.

The upstream kernel drivers use the Distributed Switch Architecture
(DSA) for configuration of the switch. Instead of explicitly configuring
the hardware switch, all ports appear as distinct interfaces and linux
bridges are offloaded to the hardware switch if possible.

To keep changes small, this patch adds support for DSA devices by
setting up a linux bridge, which is then treated just like the
cpuport-interface of the swconfig driver.

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Tested-by: Fabian Bläse <fabian@blaese.de>
2021-08-05 17:49:39 +02:00
Fabian Bläse 31866435a1 fff-layer3-config: Add script to set wan vlan/interface
Allow setting WAN vlan/interface from gateway config.
A configuration without explicit definition of a WAN interface is
valid at the moment and results in the default configuration from
fff-network being used.

Originally, it was intended to automatically set WAN to vlan 2, if nothing was
specified. As this would break devices, which don't use swconfig for
WAN, the already configured WAN interface is left untouched.

Fixes: #85 (gitea)
Signed-off-by: Fabian Bläse <fabian@blaese.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-02-09 22:46:58 +01:00
Adrian Schmutzler 6ff350fcf9 fff-network: wrap CPUPORT into a function
Instead of exposing the CPUPORT variable to the calling script
directly, wrap it into a function which can be called there.

Fixes: #52 (gitea)

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2021-02-09 22:38:55 +01:00
Adrian Schmutzler 3214388680 treewide: rename br-mesh to br-client
The name br-mesh is actually quite misleading, since the bridge
actually includes the "client" interfaces. In order to make this
obvious, and to prevent confusion with the properly named wXmesh
interfaces, rename them to br-client.

Note that br-mesh is also particularly disturbing for the layer 3
firmware without batman-adv.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Acked-by: Fabian Bläse <fabian@blaese.de>
Acked-by: Christian Dresel <freifunk@dresel.systems>
Reviewed-by: Robert Langhammer <rlanghammer@web.de>
2020-12-22 13:41:44 +01:00
Adrian Schmutzler f9a68be465 packages/fff: move config scripts to fff-layer3-config
configuregateway and it's gateway.d files represent a specific
functionality that other packages depend on. Thus, it is put into
a package of its own so dependencies can be expressed more properly.

While at, use the chance to get rid of the ambiguous term "gateway"
and rename the script to configure-layer3 and the folders to layer3.d.

Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Reviewed-by: Christian Dresel <freifunk@dresel.systems>
2020-12-17 15:38:20 +01:00