diff --git a/package/gluon-ebtables-filter-multicast/Makefile b/package/gluon-ebtables-filter-multicast/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..93b7f9a556bc7d3e4c7f9d064057d6815f7bb821 --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/Makefile @@ -0,0 +1,40 @@ +include $(TOPDIR)/rules.mk + +PKG_NAME:=gluon-ebtables-filter-multicast +PKG_VERSION:=1 +PKG_RELEASE:=1 + +PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME) + +include $(INCLUDE_DIR)/package.mk + +define Package/gluon-ebtables-filter-multicast + SECTION:=gluon + CATEGORY:=Gluon + TITLE:=Ebtables filters for multicast packets + DEPENDS:=+gluon-core +gluon-ebtables +endef + +define Package/gluon-ebtables-filter-multicast/description + Gluon community wifi mesh firmware framework: Ebtables filters for multicast packets + + These filters drop non-essential multicast traffic before it enters the mesh. + + Allowed protocols are: DHCP, DHCPv6, ARP, ICMP, ICMPv6, BitTorrent local peer discovery, BABEL and OSPF +endef + +define Build/Prepare + mkdir -p $(PKG_BUILD_DIR) +endef + +define Build/Configure +endef + +define Build/Compile +endef + +define Package/gluon-ebtables-filter-multicast/install + $(CP) ./files/* $(1)/ +endef + +$(eval $(call BuildPackage,gluon-ebtables-filter-multicast)) diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/100-mcast-chain b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/100-mcast-chain new file mode 100644 index 0000000000000000000000000000000000000000..93382f309ed27070e6bd468aa279c1f032a143c9 --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/100-mcast-chain @@ -0,0 +1 @@ +chain MULTICAST_OUT DROP diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-arp b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-arp new file mode 100644 index 0000000000000000000000000000000000000000..fdb20b1f63a8191e9f14470f0272e98c2f522c1a --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-arp @@ -0,0 +1 @@ +rule MULTICAST_OUT -p ARP -j RETURN diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-babel b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-babel new file mode 100644 index 0000000000000000000000000000000000000000..096ae50eee091a3545ce32f48303d90df2bd6abf --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-babel @@ -0,0 +1 @@ +rule MULTICAST_OUT -p IPv6 --ip6-protocol udp --ip6-destination-port 6696 -j RETURN diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-btlpd b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-btlpd new file mode 100644 index 0000000000000000000000000000000000000000..9776157af94037d01f4f65e593be43158f551557 --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-btlpd @@ -0,0 +1 @@ +rule MULTICAST_OUT -p IPv4 --ip-destination 239.192.152.143 --ip-protocol udp --ip-destination-port 6771 -j RETURN diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv4 b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv4 new file mode 100644 index 0000000000000000000000000000000000000000..440107a97c5a39754e8f8758c2f4981174d96966 --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv4 @@ -0,0 +1 @@ +rule MULTICAST_OUT -p IPv4 --ip-protocol udp --ip-destination-port 67 -j RETURN diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv6 b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv6 new file mode 100644 index 0000000000000000000000000000000000000000..1b523ec40732069f1355d1ad6ce011861344e373 --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv6 @@ -0,0 +1 @@ +rule MULTICAST_OUT -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j RETURN diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmp b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmp new file mode 100644 index 0000000000000000000000000000000000000000..e52e5c7889f6fb5bc84dfaf94a4f08adf25d6ae8 --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmp @@ -0,0 +1 @@ +rule MULTICAST_OUT -p IPv4 --ip-protocol icmp -j RETURN diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmpv6 b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmpv6 new file mode 100644 index 0000000000000000000000000000000000000000..7c50ff5eeb2f20046d9c60ef1deb5caacf764fac --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmpv6 @@ -0,0 +1 @@ +rule MULTICAST_OUT -p IPv6 --ip6-protocol ipv6-icmp -j RETURN diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-igmp b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-igmp new file mode 100644 index 0000000000000000000000000000000000000000..521af563272bb5f5d372eb089b4100d75743d9d3 --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-igmp @@ -0,0 +1 @@ +rule MULTICAST_OUT -p IPv4 --ip-protocol igmp -j RETURN diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-ospf b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-ospf new file mode 100644 index 0000000000000000000000000000000000000000..6e540751d7f0ddada635f9fbb0c851d582834255 --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-ospf @@ -0,0 +1,2 @@ +rule MULTICAST_OUT -p IPv4 --ip-protocol ospf -j RETURN +rule MULTICAST_OUT -p IPv6 --ip6-protocol ospf -j RETURN diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/300-mcast b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/300-mcast new file mode 100644 index 0000000000000000000000000000000000000000..00ff642c65022af93880a90eb38fcf507ac64ba6 --- /dev/null +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/300-mcast @@ -0,0 +1,2 @@ +rule FORWARD --logical-out br-freifunk -o bat0 -d Multicast -j MULTICAST_OUT +rule OUTPUT --logical-out br-freifunk -o bat0 -d Multicast -j MULTICAST_OUT diff --git a/package/gluon-ebtables-filter-ra-dhcp/Makefile b/package/gluon-ebtables-filter-ra-dhcp/Makefile new file mode 100644 index 0000000000000000000000000000000000000000..ea6a737d41dc35b50ad8eece7d7efb87155953bf --- /dev/null +++ b/package/gluon-ebtables-filter-ra-dhcp/Makefile @@ -0,0 +1,39 @@ +include $(TOPDIR)/rules.mk + +PKG_NAME:=gluon-ebtables-filter-ra-dhcp +PKG_VERSION:=1 +PKG_RELEASE:=1 + +PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME) + +include $(INCLUDE_DIR)/package.mk + +define Package/gluon-ebtables-filter-ra-dhcp + SECTION:=gluon + CATEGORY:=Gluon + TITLE:=Ebtables filters for Router Advertisement and DHCP packets + DEPENDS:=+gluon-core +gluon-ebtables +endef + +define Package/gluon-ebtables-filter-ra-dhcp/description + Gluon community wifi mesh firmware framework: Ebtables filters for Router Advertisement and DHCP packets + + These filters ensure that RA and DHCP packets are only forwarded from the mesh into the + client network, and not vice-versa. +endef + +define Build/Prepare + mkdir -p $(PKG_BUILD_DIR) +endef + +define Build/Configure +endef + +define Build/Compile +endef + +define Package/gluon-ebtables-filter-ra-dhcp/install + $(CP) ./files/* $(1)/ +endef + +$(eval $(call BuildPackage,gluon-ebtables-filter-ra-dhcp)) diff --git a/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv4 b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv4 new file mode 100644 index 0000000000000000000000000000000000000000..8771ee157f929dbe17729e1f6f94e3115d2f55da --- /dev/null +++ b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv4 @@ -0,0 +1,5 @@ +rule FORWARD -p IPv4 --ip-protocol udp --ip-destination-port 67 -j OUT_ONLY +rule OUTPUT -p IPv4 --ip-protocol udp --ip-destination-port 67 -j OUT_ONLY + +rule FORWARD -p IPv4 --ip-protocol udp --ip-destination-port 68 -j IN_ONLY +rule INPUT -p IPv4 --ip-protocol udp --ip-destination-port 68 -j IN_ONLY diff --git a/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv6 b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv6 new file mode 100644 index 0000000000000000000000000000000000000000..234e54e54d03f8bb54835a1cf08542bc9ed3fad9 --- /dev/null +++ b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv6 @@ -0,0 +1,5 @@ +rule FORWARD -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j OUT_ONLY +rule OUTPUT -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j OUT_ONLY + +rule FORWARD -p IPv6 --ip6-protocol udp --ip6-destination-port 547 -j IN_ONLY +rule INPUT -p IPv6 --ip6-protocol udp --ip6-destination-port 547 -j IN_ONLY diff --git a/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-radv b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-radv new file mode 100644 index 0000000000000000000000000000000000000000..c7257032bfcc4de51eaa87c4ce591fd9c5ef11c7 --- /dev/null +++ b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-radv @@ -0,0 +1,5 @@ +rule FORWARD -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY +rule OUTPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY + +rule FORWARD -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY +rule INPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY diff --git a/package/gluon-ebtables/files/lib/gluon/ebtables/.keep b/package/gluon-ebtables/files/lib/gluon/ebtables/.keep deleted file mode 100644 index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..0000000000000000000000000000000000000000 diff --git a/package/gluon-ebtables/files/lib/gluon/ebtables/100-dir-chain b/package/gluon-ebtables/files/lib/gluon/ebtables/100-dir-chain new file mode 100644 index 0000000000000000000000000000000000000000..99908dc42e3e26a04559f725538a096368520c2a --- /dev/null +++ b/package/gluon-ebtables/files/lib/gluon/ebtables/100-dir-chain @@ -0,0 +1,2 @@ +chain IN_ONLY RETURN +chain OUT_ONLY RETURN diff --git a/package/gluon-ebtables/files/lib/gluon/ebtables/101-dir-rules b/package/gluon-ebtables/files/lib/gluon/ebtables/101-dir-rules new file mode 100644 index 0000000000000000000000000000000000000000..6c8f44cc814ec4debc39281d4af9f3e135d471ac --- /dev/null +++ b/package/gluon-ebtables/files/lib/gluon/ebtables/101-dir-rules @@ -0,0 +1,2 @@ +rule IN_ONLY --logical-in br-client -i ! bat0 -j DROP +rule OUT_ONLY --logical-out br-client -o ! bat0 -j DROP