mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Origami74andJohnathan Corgan
1e4f375dcc
Add fips-gateway binary to CI artifact and Docker build. Systemd service unit with After=fips.service dependency and security hardening. Debian and AUR package entries. OpenWrt packaging: procd init script managing dnsmasq forwarding, proxy NDP, RA route advertisements for the virtual IP pool, and a global IPv6 prefix on br-lan to work around Android suppressing AAAA queries on ULA-only networks. Sysctl config for IPv6 forwarding. Gateway enabled by default in OpenWrt config. Ethernet transport enabled by default. Default gateway config section (commented out) in common fips.yaml.
88 lines
3.6 KiB
Bash
88 lines
3.6 KiB
Bash
#!/bin/sh
|
|
# FIPS first-boot setup — runs once after package installation.
|
|
# Configures the firewall and kernel modules for FIPS operation.
|
|
# This script is executed by /etc/rc.d/S19sysctl on first boot and
|
|
# then deleted by the UCI defaults mechanism.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 1. Kernel modules
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# kmod-tun is listed as a package dependency, but ensure the module is loaded.
|
|
modprobe tun 2>/dev/null || true
|
|
echo "tun" > /etc/modules.d/tun
|
|
|
|
# kmod-br-netfilter makes AF_PACKET visible on bridge member ports.
|
|
modprobe br_netfilter 2>/dev/null || true
|
|
echo "br_netfilter" > /etc/modules.d/br-netfilter
|
|
|
|
# Apply the sysctl settings shipped in /etc/sysctl.d/fips-bridge.conf now
|
|
# (the file will be applied automatically on subsequent boots).
|
|
sysctl -p /etc/sysctl.d/fips-bridge.conf 2>/dev/null || true
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 2. Firewall — add fips0 to the lan zone (fw4 / UCI)
|
|
# ---------------------------------------------------------------------------
|
|
# fw4 (nftables) matches zones by device name, so adding fips0 as a 'device'
|
|
# to the lan zone makes all traffic on the TUN interface accepted without
|
|
# needing raw nft rules in the base chains.
|
|
|
|
z=0
|
|
while uci -q get "firewall.@zone[$z]" >/dev/null 2>&1; do
|
|
if [ "$(uci -q get "firewall.@zone[$z].name" 2>/dev/null)" = "lan" ]; then
|
|
uci -q del_list "firewall.@zone[$z].device=fips0" 2>/dev/null || true
|
|
uci add_list "firewall.@zone[$z].device=fips0"
|
|
break
|
|
fi
|
|
z=$((z + 1))
|
|
done
|
|
|
|
# Install a firewall include so /etc/fips/firewall.sh is re-applied on every
|
|
# firewall reload (belt-and-suspenders for iptables-based OpenWrt builds).
|
|
FOUND=0
|
|
j=0
|
|
while uci -q get "firewall.@include[$j]" >/dev/null 2>&1; do
|
|
if [ "$(uci -q get "firewall.@include[$j].path" 2>/dev/null)" = "/etc/fips/firewall.sh" ]; then
|
|
FOUND=1
|
|
break
|
|
fi
|
|
j=$((j + 1))
|
|
done
|
|
if [ "$FOUND" = "0" ]; then
|
|
uci add firewall include
|
|
uci set "firewall.@include[-1].path=/etc/fips/firewall.sh"
|
|
uci set "firewall.@include[-1].reload=1"
|
|
fi
|
|
|
|
uci commit firewall
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 3. dnsmasq UCI registration
|
|
# ---------------------------------------------------------------------------
|
|
# /etc/dnsmasq.d/fips.conf already handles runtime forwarding.
|
|
# Register via UCI as well so the settings survive a full dnsmasq config
|
|
# regeneration (e.g. after a firmware upgrade that rebuilds dnsmasq.conf).
|
|
|
|
uci -q del_list dhcp.@dnsmasq[0].server="/fips/127.0.0.1#5354" 2>/dev/null || true
|
|
uci -q del_list dhcp.@dnsmasq[0].server="/fips/::1#5354" 2>/dev/null || true
|
|
uci add_list dhcp.@dnsmasq[0].server="/fips/::1#5354"
|
|
uci -q del_list dhcp.@dnsmasq[0].rebind_domain="fips" 2>/dev/null || true
|
|
uci add_list dhcp.@dnsmasq[0].rebind_domain="fips"
|
|
uci commit dhcp
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 4. Gateway prerequisites
|
|
# ---------------------------------------------------------------------------
|
|
# Load conntrack module (needed for /proc/net/nf_conntrack session counting).
|
|
modprobe nf_conntrack 2>/dev/null || true
|
|
grep -qxF 'nf_conntrack' /etc/modules.d/nf-conntrack 2>/dev/null || \
|
|
echo "nf_conntrack" > /etc/modules.d/nf-conntrack
|
|
|
|
# Apply gateway sysctls (proxy_ndp + IPv6 forwarding).
|
|
# These are harmless even if the gateway is not enabled — forwarding is
|
|
# typically already on for a router, and proxy_ndp has no effect until
|
|
# proxy NDP entries are actually added.
|
|
sysctl -p /etc/sysctl.d/fips-gateway.conf 2>/dev/null || true
|
|
|
|
exit 0
|