mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-05 11:08:25 +00:00
Stop shipping the OpenWrt dnsmasq drop-in nothing reads
Both OpenWrt packages and the SDK feed Makefile installed /etc/dnsmasq.d/fips.conf. As shipped it forwarded .fips to 127.0.0.1#5354, an address the daemon's DNS responder does not listen on, since it binds ::1. On a device that has ever run the gateway the file says something else: the gateway init script rewrote its server line to ::1#5353 on every start and left the comments above it naming 127.0.0.1:5354. Neither version was ever read, because OpenWrt's dnsmasq init script builds its config from UCI and never loads that directory. What forwards .fips is the UCI server entry. 90-fips-setup adds it pointing at the daemon on ::1#5354, and the gateway init script points it at the gateway on ::1#5353 when the gateway starts and back at the daemon when it stops. This change leaves both writers of that entry alone; which port it should name while the gateway runs is a separate question. The drop-in is removed from the payload, the builders, the Makefile, the README and the packaging workflow's path lists. fips-gateway no longer rewrites it on every start and stop. The 90-fips-setup comment now says that the UCI entry is the forwarding path and that the gateway repoints it, and the shipped fips.yaml comment on the gateway, which said the fips init script configures that forwarding, now names the fips-gateway init script. An opkg upgrade removes the old file; an apk upgrade keeps it only if it was modified, as it is on a device that ran the gateway. Either way nothing reads it. package-test.sh now also builds the .ipk and checks that neither package installs anything under /etc/dnsmasq.d, with a positive control on files both packages must ship, and that no OpenWrt packaging file still names the drop-in, which is the only check covering the SDK Makefile.
This commit is contained in:
Johnathan Corgan
@@ -489,7 +489,6 @@ jobs:
|
||||
./etc/init.d/fips-gateway
|
||||
./etc/fips/fips.yaml
|
||||
./etc/fips/firewall.sh
|
||||
./etc/dnsmasq.d/fips.conf
|
||||
./etc/sysctl.d/fips-gateway.conf
|
||||
./etc/sysctl.d/fips-bridge.conf
|
||||
./etc/hotplug.d/net/99-fips
|
||||
@@ -830,7 +829,7 @@ jobs:
|
||||
usr/bin/fips usr/bin/fipsctl usr/bin/fipstop usr/bin/fips-gateway \
|
||||
usr/bin/fips-mesh-setup usr/bin/fips-ap-setup \
|
||||
etc/init.d/fips etc/init.d/fips-gateway \
|
||||
etc/fips/fips.yaml etc/fips/firewall.sh etc/dnsmasq.d/fips.conf \
|
||||
etc/fips/fips.yaml etc/fips/firewall.sh \
|
||||
etc/sysctl.d/fips-gateway.conf etc/sysctl.d/fips-bridge.conf \
|
||||
etc/hotplug.d/net/99-fips etc/uci-defaults/90-fips-setup \
|
||||
lib/upgrade/keep.d/fips; do
|
||||
|
||||
@@ -201,9 +201,6 @@ install -m 0755 "$FILES_DIR/etc/fips/firewall.sh" "$STAGE_DIR/etc/fips/firewall.
|
||||
# of the file; operators can still edit /etc/fips/fips.yaml for non-standard boards.
|
||||
sed -i 's|interface: "eth0"|interface: "wan"|' "$STAGE_DIR/etc/fips/fips.yaml"
|
||||
|
||||
install -d "$STAGE_DIR/etc/dnsmasq.d"
|
||||
install -m 0644 "$FILES_DIR/etc/dnsmasq.d/fips.conf" "$STAGE_DIR/etc/dnsmasq.d/fips.conf"
|
||||
|
||||
install -d "$STAGE_DIR/etc/sysctl.d"
|
||||
install -m 0644 "$FILES_DIR/etc/sysctl.d/fips-bridge.conf" "$STAGE_DIR/etc/sysctl.d/fips-bridge.conf"
|
||||
install -m 0644 "$FILES_DIR/etc/sysctl.d/fips-gateway.conf" "$STAGE_DIR/etc/sysctl.d/fips-gateway.conf"
|
||||
|
||||
@@ -114,10 +114,6 @@ define Package/fips/install
|
||||
# Firewall helper script (called by UCI include and hotplug)
|
||||
$(INSTALL_BIN) $(CURDIR)/files/etc/fips/firewall.sh $(1)/etc/fips/firewall.sh
|
||||
|
||||
# dnsmasq drop-in: forward .fips queries to the FIPS DNS responder
|
||||
$(INSTALL_DIR) $(1)/etc/dnsmasq.d
|
||||
$(INSTALL_DATA) $(CURDIR)/files/etc/dnsmasq.d/fips.conf $(1)/etc/dnsmasq.d/fips.conf
|
||||
|
||||
# sysctl: enable br_netfilter so AF_PACKET sees frames on bridge member ports
|
||||
$(INSTALL_DIR) $(1)/etc/sysctl.d
|
||||
$(INSTALL_DATA) $(CURDIR)/files/etc/sysctl.d/fips-bridge.conf $(1)/etc/sysctl.d/fips-bridge.conf
|
||||
|
||||
@@ -17,11 +17,10 @@ OpenWrt 22.03+ router via the standard `opkg` package system.
|
||||
| `/etc/init.d/fips-gateway` | procd service for the gateway (disabled by default) |
|
||||
| `/etc/fips/fips.yaml` | Node configuration (edit before first start) |
|
||||
| `/etc/fips/firewall.sh` | Firewall helper — accepts traffic on `fips0` |
|
||||
| `/etc/dnsmasq.d/fips.conf` | Forwards `.fips` DNS queries to the daemon |
|
||||
| `/etc/sysctl.d/fips-bridge.conf` | `br_netfilter` settings for Ethernet transport |
|
||||
| `/etc/sysctl.d/fips-gateway.conf` | `proxy_ndp` and IPv6 forwarding for the gateway |
|
||||
| `/etc/hotplug.d/net/99-fips` | Applies firewall rules when `fips0` comes up |
|
||||
| `/etc/uci-defaults/90-fips-setup` | First-boot kernel module and firewall setup |
|
||||
| `/etc/uci-defaults/90-fips-setup` | First-boot kernel module, firewall and dnsmasq `.fips` forwarding setup |
|
||||
| `/lib/upgrade/keep.d/fips` | Preserves `/etc/fips/` across `sysupgrade` |
|
||||
|
||||
## Requirements
|
||||
|
||||
@@ -173,9 +173,6 @@ install -d "$DATA_DIR/etc/fips"
|
||||
install -m 0600 "$FILES_DIR/etc/fips/fips.yaml" "$DATA_DIR/etc/fips/fips.yaml"
|
||||
install -m 0755 "$FILES_DIR/etc/fips/firewall.sh" "$DATA_DIR/etc/fips/firewall.sh"
|
||||
|
||||
install -d "$DATA_DIR/etc/dnsmasq.d"
|
||||
install -m 0644 "$FILES_DIR/etc/dnsmasq.d/fips.conf" "$DATA_DIR/etc/dnsmasq.d/fips.conf"
|
||||
|
||||
install -d "$DATA_DIR/etc/sysctl.d"
|
||||
install -m 0644 "$FILES_DIR/etc/sysctl.d/fips-bridge.conf" "$DATA_DIR/etc/sysctl.d/fips-bridge.conf"
|
||||
install -m 0644 "$FILES_DIR/etc/sysctl.d/fips-gateway.conf" "$DATA_DIR/etc/sysctl.d/fips-gateway.conf"
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
# FIPS mesh DNS — forward .fips queries to the local FIPS DNS responder.
|
||||
#
|
||||
# server= forward all .fips queries to 127.0.0.1:5354
|
||||
# rebind-domain-ok= disable DNS-rebind protection for .fips; FIPS node
|
||||
# addresses live in fd00::/8 (ULA), which dnsmasq blocks by
|
||||
# default as a rebind-attack countermeasure.
|
||||
#
|
||||
# If your fips.yaml sets dns.port to something other than 5354, update the
|
||||
# port number below to match.
|
||||
server=/fips/127.0.0.1#5354
|
||||
rebind-domain-ok=/fips/
|
||||
@@ -172,7 +172,8 @@ transports:
|
||||
# accept_connections: true
|
||||
|
||||
# Outbound LAN gateway. dnsmasq forwards .fips queries to listen=[::1]:5353
|
||||
# (configured by the fips init script). Requires IPv6 forwarding enabled.
|
||||
# while it runs (configured by the fips-gateway init script). Requires IPv6
|
||||
# forwarding enabled.
|
||||
gateway:
|
||||
enabled: true
|
||||
pool: "fd01::/112"
|
||||
|
||||
@@ -189,11 +189,6 @@ dnsmasq_swap_fips_upstream() {
|
||||
uci add_list dhcp.@dnsmasq[0].server="/fips/::1#${port}"
|
||||
uci commit dhcp
|
||||
|
||||
# Update the drop-in config file as well (belt-and-suspenders).
|
||||
if [ -f /etc/dnsmasq.d/fips.conf ]; then
|
||||
sed -i "s|^server=/fips/.*|server=/fips/::1#${port}|" /etc/dnsmasq.d/fips.conf
|
||||
fi
|
||||
|
||||
# Restart dnsmasq to pick up the change.
|
||||
/etc/init.d/dnsmasq restart 2>/dev/null || true
|
||||
}
|
||||
|
||||
@@ -59,9 +59,11 @@ uci commit firewall
|
||||
# ---------------------------------------------------------------------------
|
||||
# 3. dnsmasq UCI registration
|
||||
# ---------------------------------------------------------------------------
|
||||
# /etc/dnsmasq.d/fips.conf already handles runtime forwarding.
|
||||
# Register via UCI as well so the settings survive a full dnsmasq config
|
||||
# regeneration (e.g. after a firmware upgrade that rebuilds dnsmasq.conf).
|
||||
# This UCI entry is what forwards .fips queries to the daemon: OpenWrt's
|
||||
# dnsmasq init script builds its config from UCI and loads no directory under
|
||||
# /etc. The daemon's DNS responder binds ::1. The 127.0.0.1 del_list removes
|
||||
# the entry older packages added. While fips-gateway runs, its init script
|
||||
# points this entry at the gateway's DNS port instead.
|
||||
|
||||
uci -q del_list dhcp.@dnsmasq[0].server="/fips/127.0.0.1#5354" 2>/dev/null || true
|
||||
uci -q del_list dhcp.@dnsmasq[0].server="/fips/::1#5354" 2>/dev/null || true
|
||||
|
||||
@@ -7,8 +7,10 @@
|
||||
# What it checks is which maintainer scripts the .apk registers and what each
|
||||
# one does with apk's upgrade arguments and environment (apk-tools v3 passes
|
||||
# "<new-version> <old-version>" and a PATH-only environment to pre-upgrade and
|
||||
# post-upgrade). Whether a real `apk mkpkg` accepts the result is left to the
|
||||
# GitHub packaging workflow, which builds with the real tool.
|
||||
# post-upgrade), and which files the .apk and the .ipk install. The .ipk is
|
||||
# built for real by build-ipk.sh, which needs only tar. Whether a real
|
||||
# `apk mkpkg` accepts the result is left to the GitHub packaging workflow,
|
||||
# which builds with the real tool.
|
||||
#
|
||||
# Usage: package-test.sh [--keep <dir>]
|
||||
# --keep <dir> copy the captured apk scripts into <dir> as post-install,
|
||||
@@ -222,6 +224,83 @@ for pair in pre-upgrade:prerm post-upgrade:postinst; do
|
||||
esac
|
||||
done
|
||||
|
||||
# ── Build the .ipk ──────────────────────────────────────────────────────────
|
||||
|
||||
echo "==> build-ipk.sh"
|
||||
if ! PKG_VERSION="$PKG_VERSION" \
|
||||
bash "$PROJECT_ROOT/packaging/openwrt-ipk/build-ipk.sh" --arch x86_64 --bin-dir "$BINS" \
|
||||
> "$TMP/build-ipk.log" 2>&1; then
|
||||
cat "$TMP/build-ipk.log" >&2
|
||||
harness_fail "build-ipk.sh failed, so the .ipk was not checked"
|
||||
fi
|
||||
IPK="$PROJECT_ROOT/dist/fips_${PKG_VERSION}_x86_64.ipk"
|
||||
[[ -f "$IPK" ]] || harness_fail "build-ipk.sh exited 0 but wrote no $IPK"
|
||||
tar -xzf "$IPK" -O ./data.tar.gz | tar -tzf - > "$TMP/ipk-data" \
|
||||
|| harness_fail "cannot list data.tar.gz in $IPK"
|
||||
tar -xzf "$IPK" -O ./control.tar.gz | tar -tzf - > "$TMP/ipk-control" \
|
||||
|| harness_fail "cannot list control.tar.gz in $IPK"
|
||||
|
||||
# ── P1 and P2. Neither package ships the dnsmasq drop-in ────────────────────
|
||||
# OpenWrt's dnsmasq builds its config from UCI and reads no directory under
|
||||
# /etc, so .fips forwarding comes from the UCI entry 90-fips-setup adds. The
|
||||
# match is on the directory prefix: tar lists the directory with a trailing
|
||||
# slash and the stub's find without one.
|
||||
for pair in "P1:apk:$CAPTURE/payload" "P2:ipk:$TMP/ipk-data"; do
|
||||
id="${pair%%:*}"
|
||||
rest="${pair#*:}"
|
||||
kind="${rest%%:*}"
|
||||
listing="${rest#*:}"
|
||||
hits="$(grep -F './etc/dnsmasq.d' "$listing" | tr '\n' ' ')"
|
||||
if [[ -z "$hits" ]]; then
|
||||
ok "$id the .$kind installs nothing under /etc/dnsmasq.d"
|
||||
else
|
||||
bad "$id the .$kind still installs: $hits"
|
||||
fi
|
||||
done
|
||||
|
||||
# ── P3. Positive control for P1 and P2 ──────────────────────────────────────
|
||||
# An empty or unreadable listing would pass P1 and P2, so each listing must
|
||||
# show files that are known to ship.
|
||||
for pair in "apk:$CAPTURE/payload" "ipk:$TMP/ipk-data"; do
|
||||
kind="${pair%%:*}"
|
||||
listing="${pair#*:}"
|
||||
for path in ./etc/init.d/fips-gateway ./etc/uci-defaults/90-fips-setup; do
|
||||
if grep -qxF "$path" "$listing"; then
|
||||
ok "P3 the .$kind payload lists $path"
|
||||
else
|
||||
bad "P3 the .$kind payload does not list $path, so P1/P2 saw no real listing"
|
||||
fi
|
||||
done
|
||||
done
|
||||
for path in ./postinst ./prerm; do
|
||||
if grep -qxF "$path" "$TMP/ipk-control"; then
|
||||
ok "P3 the .ipk control archive lists $path"
|
||||
else
|
||||
bad "P3 the .ipk control archive does not list $path"
|
||||
fi
|
||||
done
|
||||
|
||||
# ── P4. No source still names the drop-in ───────────────────────────────────
|
||||
# This is the only check on the SDK feed Makefile, which nothing here builds.
|
||||
# grep exits 1 when nothing matches and 2 when it could not read a path; only
|
||||
# the first is a pass.
|
||||
(cd "$PROJECT_ROOT" && grep -rlF 'dnsmasq.d/fips.conf' \
|
||||
packaging/openwrt-ipk packaging/openwrt-apk .github/workflows/package-openwrt.yml) \
|
||||
> "$TMP/refs"
|
||||
rc=$?
|
||||
[[ $rc -le 1 ]] || harness_fail "the drop-in reference search failed (grep exit $rc)"
|
||||
refs="$(tr '\n' ' ' < "$TMP/refs")"
|
||||
if [[ -z "$refs" ]]; then
|
||||
ok "P4 no OpenWrt packaging file names the dnsmasq drop-in"
|
||||
else
|
||||
bad "P4 the dnsmasq drop-in is still named in: $refs"
|
||||
fi
|
||||
if [[ -e "$PROJECT_ROOT/packaging/openwrt-ipk/files/etc/dnsmasq.d/fips.conf" ]]; then
|
||||
bad "P4 packaging/openwrt-ipk/files/etc/dnsmasq.d/fips.conf still exists"
|
||||
else
|
||||
ok "P4 the drop-in source file is gone"
|
||||
fi
|
||||
|
||||
# ── Hand the scripts to the ash scenarios ───────────────────────────────────
|
||||
if [[ -n "$KEEP" ]]; then
|
||||
for phase in $WANT_PHASES; do
|
||||
|
||||
Reference in New Issue
Block a user