gluon-radv-filterd: migrate to nftables

freifunk-gluon · May 1, 2023 · 22282cd · 22282cd
1 parent d26d3f9
commit 22282cd
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 4 deletions.
diff --git a/package/gluon-radv-filterd/Makefile b/package/gluon-radv-filterd/Makefile
@@ -6,7 +6,7 @@ include ../gluon.mk
 
 define Package/gluon-radv-filterd
   TITLE:=Filter IPv6 router advertisements
-  DEPENDS:=+gluon-ebtables +libgluonutil +libbatadv +libnl-tiny
+  DEPENDS:=+gluon-nftables +libgluonutil +libbatadv +libnl-tiny
 endef
 
 MAKE_VARS += \

diff --git a/package/gluon-radv-filterd/luasrc/lib/gluon/ebtables/400-radv-filterd b/package/gluon-radv-filterd/luasrc/lib/gluon/ebtables/400-radv-filterd
diff --git a/package/gluon-radv-filterd/luasrc/lib/gluon/nftables/400-radv-filterd.lua b/package/gluon-radv-filterd/luasrc/lib/gluon/nftables/400-radv-filterd.lua
@@ -0,0 +1,15 @@
+bridge_table('pre', [[set radv_allow {
+  type ether_addr
+}
+
+set radv_filter {
+  type ether_addr
+}
+]])
+
+-- This rule starts filtering once the address is in radv_filter
+
+-- Daemon adds 00:00:../ff:ff:.. to radv_filter so everything gets picked up,
+-- effectivly turning radv_filter into a bool
+
+bridge_rule('FORWARD', 'ether saddr @radv_filter iifname "bat0" icmpv6 type nd-router-advert ether saddr != @radv_allow drop')