Commit Graph

11 Commits

Author SHA1 Message Date
Matthias Schiffer
ecc8ebc8ed
treewide: move ebtables filter definitions from files to luasrc 2019-06-18 19:52:33 +02:00
Matthias Schiffer
8e5abf02ae
treewide: switch to ebtables-tiny 2018-04-13 16:00:58 +02:00
Matthias Schiffer
17370d8462
gluon-ebtables: unconditionally segment IGMP/MLD
We must ensure that each node becomes IGMP/MLD querier for its local
clients; having only a single querier for the whole mesh is generally
unreliable, leading to frequent "IGMP/MLD querier appeared/disappeared"
messages from batman-adv and unreliable snooping.

In smaller meshes it might be interesting only segment querier domains, but
allow membership reports to pass through the mesh, in order to support
snooping switches outside the mesh without special configuration. A
site.conf switch is provided to control this behaviour.

Fixes #1320
2018-03-07 08:12:30 +01:00
Linus Lüssing
4911da56e1
gluon-ebtables: Enable concurrent ebtables updates
This enables the ebtables internal locking mechanism which
will avoid race conditions between multiple, concurrent
ebtables calls.

This is a preparation for the upcoming gluon-arp-limiter
daemon, to avoid issues if upon restarting gluon-ebtables
the gluon-arp-limiter daemon tries to modify the tables.

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
2018-01-03 19:58:53 +01:00
Matthias Schiffer
f238b01173
gluon-client-bridge: use a veth pair instead of macvlan to connect local-node to br-client
macvlan interfaces never directly exchange traffic with the underlying
interface, but only with other hosts behind the interface. In consequence,
router advertisements from the uradvd running on br-client could never
reach local-node, preventing it from getting an IPv6 address without RAs
from an external radvd. Fix this be replacing the macvlan interface with
a veth pair (with the peer interface in br-client).

As a side effect, this saves about 5KB of flash, as the veth module is
simpler than macvlan.
2017-02-10 10:21:38 +01:00
Linus Lüssing
4199b216c6 ebtables-segment-mld: Segment IGMP/MLD domain
This patch adds a new gluon-ebtables package to filter IGMP/MLD messages
via ebtables.

For one thing this reduces multicast overhead: About one third of all
ICMPv6 multicast traffic in Lübeck or Hamburg is MLD.

Furthermore it removes a potential Distributed Denial-of-Service vector
(see Gluon ticket #553).

Finally, it is a prerequisite for enabling bridge multicast snooping in
a decentral and robust fashion.

Note that IGMP/MLD are filtered for multicast traffic coming from
the mesh, too (new MULTICAST_IN), as unfortunately there seem to
be other queriers somewhere in the mesh at least for Freifunk
Lübeck. Also adding these rules to be prepared to anyone intentionally
or unintentionally disabling these filters on his/her node.

Node operators not running Gluon (for instance gateway nodes) should
make sure to either enable multicast_router towards bat0 or disable
multicast snooping entirely if they have a bridge on top of bat0.

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
2016-05-20 22:59:31 +02:00
Matthias Schiffer
0953c9befb gluon-ebtables: use Lua instead of sh for the rule DSL to increase flexibility 2014-05-14 15:02:57 +02:00
Matthias Schiffer
d204b0e24f Remove initscript enable/disable hacks
Better configure these properly.
2014-01-13 18:29:00 +01:00
Matthias Schiffer
f8cdeaefd9 Add ebtables filters from the legacy firmware 2014-01-10 21:49:18 +01:00
Matthias Schiffer
9c0db9e291 gluon-ebtables: always enable ebtables when they are installed 2013-10-02 20:33:32 +02:00
Matthias Schiffer
8f20b25632 Add ebtables package 2013-09-28 22:03:20 +02:00