This package adds filters to limit the amount of ARP Requests
devices are allowed to send into the mesh. The limits are 6 packets
per minute per client device, by MAC address, and 1 per second per
node in total.
A burst of up to 50 ARP Requests is allowed until the rate-limiting
takes effect (see --limit-burst in the ebtables manpage).
Furthermore, ARP Requests with a target IP already present in the
batman-adv DAT Cache are excluded from the rate-limiting,
both regarding counting and filtering, as batman-adv will respond
locally with no burden for the mesh. Therefore, this limiter
should not affect popular target IPs, like gateways.
However it should mitigate the problem of curious people or
smart devices scanning the whole IP range. Which could create
a significant amount of overhead for all participants so far.
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
This is needed for the Gluon ARP limiter to work without hiccups in
traffic.
Link: https://patchwork.ozlabs.org/patch/841210/
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Both gluon.sysconfig and libgluonutil already remove the trailing newline
if it exists. It's nicer to avoid files without a trailing newline, e.g.
for printing the file contents in a terminal.
This is currently only implemented in the gluon-mesh-vpn-fastd
package.
Advertising the public key may be deemed problematic when
your threat-model involves protecting the nodes privacy
from tunnel traffic correlation by onlink observers.
It can be enabled by setting site.mesh_vpn.fastd.pubkey_privacy
to `false`.
b1205a9211 ar71xx: /lib/ar71xx.sh: add model detection for TP-Link TL-WR810N
fbeae9d891 iptables: make kmod-ipt-debug part of default ALL build
6ea9a702c5 iptables: Fix target TRACE issue
00fa1e4108 curl: fix libcurl/mbedtls async interface
d5278cc48b kernel: bump 4.4 to 4.4.112 for 17.01
2ae0741f3b dnsmasq: backport validation fix in dnssec security fix
58d60bd283 dnsmasq: backport dnssec security fix for 17.01
d626aa005b mountd: bump to git HEAD version
f0336975be kernel: bump 4.4 to 4.4.111 for 17.01
fb6f21c657 kmod-sched-cake: bump to latest cake bake for 17.01
2e8a3bb35f ar71xx: Netgear WNR2000v4: do not include USB packages [17.01]
3fa86282fa build: fix restoring /etc/opkg with PER_DEVICE_ROOTFS
987a7e3175 ramips: fix lenovo newifi-y1 switch and LED config
dbb5ffaed5 ramips: firewrt: indicate boot status via LED
If a value is unset or optional, an empty choice is added to the selection.
This empty choice will be marked as invalid if the value is not optional.
This is properly supported for the 'select' widget only for now, and not
for 'radio'.
This package drops all incoming router advertisements except for the
default router with the best metric according to B.A.T.M.A.N. advanced.
Note that advertisements originating from the node itself (for example
via gluon-radvd) are not affected.
Also disabling TX checksums and not only allowing incoming packets without
checksum will provide another small speedup. As doing so would break wired
meshing with VXLAN-enabled nodes that require non-zero checksums, we will
wait a few days before this step.
