B4L/cnx-network-clan
5
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

router: optional Wi-Fi access point, enforce allowWan

Browse Source 
wifi.* settings turn the gateway's own radios into the site AP (hostapd):
SSIDs are defined once in wifi.networks and act as untagged access ports of
their VLAN (each BSS joins br0 with the VLAN's PVID), radios pick what they
broadcast, passphrases are vars prompts. Extra SSIDs on a radio get BSSIDs
derived from its hardware address. A udev rule puts configured radios in AP
mode on appearance, since networkd cannot bridge a station-mode interface
and gives up before hostapd switches it. wifi.enable gates all of it.

The VM test grows a hwsim radio with two SSIDs and a WPA3 station in its
own netns that must get a Kea lease on the SSID's VLAN. Making the client
deterministic (route metrics, loose rp-filter, a guard against a vacuous
negative check) exposed that allowWan was never enforced: networking.nat
opens forward-to-WAN for all of its internalInterfaces, which listed every
VLAN. It now lists only the allowWan VLANs; the duplicate custom rule is
gone. No behavioural change on gw-cnx-1 (all its VLANs allow WAN).
This commit is contained in:
kurogeek
2026-09-09 09:24:34 +00:00
parent a3705e7a93
commit 63e8b6252c
7 changed files with 474 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/clan/router/tests/vm/default.nix
+97
View File
@@ -68,6 +68,29 @@ in
allowWan = false;
};
};
# Access point on the simulated radio wlan0 (mac80211_hwsim, address
# 02:00:00:00:00:00): two SSIDs, one per VLAN.
wifi = {
enable = true;
countryCode = "US";
networks = {
home.vlan = "lan";
things = {
vlan = "iot";
security = "wpa2";
hidden = true;
isolateClients = true;
};
};
radios.wlan0 = {
channel = 6;
macAddress = "02:00:00:00:00:00";
networks = [
"home"
"things"
];
};
};
};
};
};
@@ -102,6 +125,54 @@ in
];
services.crowdsec.enable = lib.mkForce false;
services.crowdsec-firewall-bouncer.enable = lib.mkForce false;
# Two simulated radios: wlan0 is the AP (settings above), wlan1 plays a
# wireless client. It lives in its own network namespace, like the
# separate host it stands in for — otherwise its lease would add a
# second 10.9.20.0/24 route to the router's own table. Its DHCP lease
# must come from Kea on the SSID's VLAN: wlan1 -> air -> wlan0 -> br0 ->
# vlan-lan. The mock passphrase is what the vars mock fed into the
# wifi-home-passphrase generator.
boot.kernelModules = [ "mac80211_hwsim" ];
systemd.services.wifi-station = {
wantedBy = [ "multi-user.target" ];
# No BindsTo: the device unit vanishes once wlan1 moves into the netns.
after = [ "sys-subsystem-net-devices-wlan1.device" ];
path = [
pkgs.iproute2
pkgs.iw
];
preStart = ''
ip netns add sta
iw phy phy1 set netns name sta
ip netns exec sta ip link set lo up
mkdir -p /run/wpa_supplicant/client # nixpkgs' wpa_cli keeps its sockets here
'';
serviceConfig.ExecStart =
"${pkgs.iproute2}/bin/ip netns exec sta ${pkgs.wpa_supplicant}/bin/wpa_supplicant -i wlan1 -c "
+ pkgs.writeText "sta.conf" ''
ctrl_interface=/run/wpa_supplicant/control
network={
ssid="home"
key_mgmt=SAE
sae_password="mock-prompt-value-passphrase"
ieee80211w=2
scan_freq=2437
}
'';
};
environment.systemPackages = [
pkgs.wpa_supplicant
(pkgs.writeShellScriptBin "sta-dhcp" ''
# One DHCP round on the station, applying the offered address.
exec ${pkgs.iproute2}/bin/ip netns exec sta ${pkgs.busybox}/bin/udhcpc -i wlan1 -n -q -f \
-s ${pkgs.writeShellScript "udhcpc-apply" ''
case "$1" in
bound|renew) ${pkgs.iproute2}/bin/ip addr replace "$ip/$mask" dev "$interface" ;;
esac
''}
'')
];
};
isp = {
@@ -155,6 +226,13 @@ in
macAddress = clientMac;
};
networking.interfaces.iot0.useDHCP = true;
# Dual-homed on purpose (lan + iot). Both leases bring a default route:
# prefer lan0 so replies to other VLANs and the WAN leave where the
# router expects them (its rp-filter would drop them on vlan-iot), and
# loosen this client's own rp-filter so a WAN reply on iot0 would be
# seen — the negative allowWan check must fail at the router, not here.
systemd.network.networks."40-iot0".dhcpV4Config.RouteMetric = 2048;
networking.firewall.checkReversePath = "loose";
environment.systemPackages = [
pkgs.dnsutils
pkgs.netcat
@@ -195,6 +273,8 @@ in
with subtest("NAT to the WAN only for VLANs with allowWan"):
client.wait_until_succeeds("ping -c1 -W1 -I lan0 ${ispAddress}")
# iot has a route to the WAN; the router is what refuses to forward.
client.succeed("ip route show dev iot0 | grep -q ^default")
client.fail("ping -c1 -W2 -I iot0 ${ispAddress}")
with subtest("mgmt reaches other VLANs, other VLANs do not"):
@@ -205,5 +285,22 @@ in
gw.wait_for_open_port(22)
admin.succeed("nc -z -w2 10.9.10.1 22")
client.fail("nc -z -w2 10.9.20.1 22")
with subtest("Wireless SSIDs are bridge access ports of their VLAN"):
gw.wait_for_unit("hostapd.service")
# Second SSID: derived BSSID, hidden, bridged into the iot VLAN.
gw.wait_until_succeeds("ip link show wlan0-1 | grep -q '06:00:00:00:00:00'")
gw.wait_until_succeeds("bridge vlan show dev wlan0-1 | grep -q '40 PVID Egress Untagged'")
gw.succeed("hostapd_cli -i wlan0-1 get_config | grep -q '^ssid=things'")
# The second BSS section of the rendered config carries hidden + isolation.
things = gw.succeed("sed -n '/^bss=wlan0-1/,$p' /run/hostapd/wlan0.hostapd.conf")
assert "ignore_broadcast_ssid=1" in things and "ap_isolate=1" in things, things
assert "sae_password=mock-prompt-value-passphrase" not in things, "wpa2 SSID must not carry SAE entries"
# A WPA3 (SAE) station on the first SSID authenticates with the vars
# passphrase and gets its lease from Kea on the lan VLAN, through the bridge.
gw.wait_for_unit("wifi-station.service")
gw.wait_until_succeeds("ip netns exec sta wpa_cli -i wlan1 status | grep -q wpa_state=COMPLETED")
gw.succeed("timeout 60 sta-dhcp")
gw.succeed("ip netns exec sta ip -4 addr show wlan1 | grep -q 'inet 10.9.20.1[0-9][0-9]/24'")
'';
}