Add ffbs-mesh-vpn-parker #142

SmithChart · 2024-11-06T20:54:06Z

This is the core package of gluon-parker,
a Gluon fork that uses routing between the nodes
(aka. Router devices) and the infrastructure.
It is currently in use at Freifunk Braunschweig.
Other communities are interested in adopting it as well.

This package installs the nodeconfig and noderoute services together
with a set of new firewall-rules.

SmithChart · 2024-11-07T06:49:23Z

Well, some of the shellcheck messages for files in /etc/init.d look fun. Will look into that later on..

SmithChart · 2024-11-07T14:01:13Z

FTR: @maurerle provided some changes to this package we are currently discussing here. Will un-draft once I have an updated package.

grische

some comments on the shell code

grische · 2024-11-08T14:13:12Z

ffbs-parker-nodeconfig/files/lib/gluon/upgrade/906-parker-nodeconfig

+site_config_server = site.parker.config_server()
+uci:section('parker', 'nodeconfig', 'nodeconfig',
+    { config_server = site_config_server }
+)
+uci:save('parker')
+
+site_config_pubkey = site.parker.config_pubkey()


it would be nice, if we can also add the pubkey to uci so that it's easier to override it on-demand.

Suggested change

site_config_server = site.parker.config_server()

uci:section('parker', 'nodeconfig', 'nodeconfig',

{ config_server = site_config_server }

)

uci:save('parker')

site_config_pubkey = site.parker.config_pubkey()

local site_config_server = site.parker.config_server()

local site_config_pubkey = site.parker.config_pubkey()

uci:section('parker', 'nodeconfig', 'nodeconfig',

{

config_server = site_config_server,

config_pubkey = site_config_pubkey

}

)

uci:save('parker')

and you can delete the lines that write the file to disk afterwards.

See SmithChart#5

@grische can you verify that this has been resolved by SmithChart#5 ?

grische · 2024-11-08T14:14:30Z

ffbs-parker-nodeconfig/files/etc/config/parker

+config nodeconfig 'example'
+	option config_server 'config.community.example'


I think this should be

Suggested change

config nodeconfig 'example'

option config_server 'config.community.example'

config nodeconfig 'nodeconfig'

option config_server 'config.community.example'

See SmithChart#6

@grische can you verify that this has been resolved by SmithChart#6 ?

grische · 2024-11-08T14:20:12Z

ffbs-parker-nodeconfig/files/usr/sbin/nodeconfig.sh

+fi
+
+pubkey=$(sed 's/+/%2B/g' /etc/parker/wg-pubkey)
+


follow-up of the above suggested change to move the pubkey to uci

Suggested change

if ! { echo "untrusted comment: signify public key" && uci -q get parker.nodeconfig.config_pubkey; } > "${SIGN_PUB_KEY}"; then

$LOGGER unable to read or write pubkey from uci

fi

Or maybe something more elegant 😉

I would probably also move the file from flash /etc to ram /tmp instead if it's being written on every service start.

See SmithChart#5

@grische can you verify that this has been resolved by SmithChart#5 ?

grische · 2024-11-08T14:23:21Z

ffbs-parker-nodeconfig/files/usr/sbin/nodeconfig.sh

+        continue;
+    fi
+
+    config_server=$(uci get parker.nodeconfig.config_server)


It would be nice if we can add a check here if this config exists, to transparently send a log message in case someone broke their UCI config.

Something like

Suggested change

config_server=$(uci get parker.nodeconfig.config_server)

if ! config_server=$(uci get parker.nodeconfig.config_server); then

$LOGGER unable to get config_server from uci

continue

fi

See SmithChart#7

@grische can you verify that this has been resolved by SmithChart#7 ?

grische · 2024-11-08T14:31:41Z

ffbs-parker-nodeconfig/files/usr/sbin/noderoute.sh

+
+check_batman() {
+    # check if we have a functional batman-setup
+    if ip l | grep -q "bat0:"; then


For style, I would prefer having an early exit here instead of nesting the if's.

Suggested change

if ip l | grep -q "bat0:"; then

if ! ip l | grep -q "bat0:"; then

$LOGGER ERROR: No BATMAN-interface found

return 1

fi

remove the neting and remove lines 23-26 (they have been moved up).

See SmithChart#8

@grische can you verify that this has been resolved by SmithChart#8 ?

blocktrron · 2024-11-14T02:18:09Z

Please see #139 (comment)

This adds ffbs-parker-nodeconfig - a package of the *parker*-flavor of Gluon. Previously this package has been managed in https://gitli.stratum0.org/ffbs/ffbs-packages under the name `gluon-ffbsnext-nodeconfig`. Last commit-id: 4f83ee2f2571a2baa5493038da7c6fb3cc0b8016

This removes a hard-coded value. Previously, this scripts have only been used by Freifunk Braunschweig. There hard-coding was no issue. Now, with more communities wanting to try parker out, we have to fix those. The `ntp_servers` list has already been introduced by Gluon upstream. With this change we re-use this value here. This also means that the NTP-server for the nodes should be accessible for the clients as well.

This firewall rules make sure, that respondd is only accessible from inside the Freifunk network (client network or VPN) - but not from other interfaces (e.g. `br-wan`). While we were only using it for Freifunk Braunschweig the `src_ip` limitation did not really matter: Per definition these are the only IPv6 addresses on these interfaces anyway. But while preparing this tooling for a wider use we should rethink this decision. There is no need to limit access to a specific IPv6 range, as long as the requests are still coming from the inside.

This check was intended to check if the IPv6 address/routing configuration is sane. But it currently relies on a hard-coded value for ffbs, so it does not make sense to have it for all communities. Lately we did not see this diagnosis trigger, so it's probably safe to remove anyway. If we encounter problems later on we can still add a generic check.

SmithChart · 2024-11-20T19:28:25Z

FTR: Appended commits from SmithChart#1 . Thx @maurerle

Also added one change from me while I was on it.

maurerle · 2024-11-20T22:51:47Z

Wouldn't it be useful to also add the additional uci settings required for parker to one of the packages?

Specifically:

and adding

uci:delete_all('firewall', 'rule', function(rule)
	return rule['.name']:find('^mesh_respondd_siteprefix')
end)

instead of having this here:
ffbs/gluon-parker@2e53380#diff-70c0178fef0afe6aa581fdd24bcd19c5ad4f04874648698469f5f5896dc1b500

This would further reduce the required delta of gluon.

Co-Authored-By: Jan Luebbe <[email protected]>

ffbs-mesh-vpn-parker: reduce nesting in noderoute

ffbs-mesh-vpn-parker: check uci for config_server

ffbs-mesh-vpn-parker: fix default parker config

ffbs-mesh-vpn-parker: make sure wg-pubkey exists

ffbs-mesh-vpn-parker: move parker network rules into package

The mesh_respondd_siteprefix and mesh_respondd_extraprefix[0-9]+ rules do not make sense in the context of parker as there are no prefix4 and prefix6 attributes anymore. Based on ffbs/gluon-parker@2e53380#diff-70c0178fef0afe6aa581fdd24bcd19c5ad4f04874648698469f5f5896dc1b500L36-L43

Also moving the pubkey file to /tmp/ as it will be written every time that nodeconfig is run.

ffbs-mesh-vpn-parker: move parker pubkey to uci

ffbs-mesh-vpn-parker: delete firewall rules for the prefix6 site config

SmithChart · 2024-12-15T12:02:40Z

Wouldn't it be useful to also add the additional uci settings required for parker to one of the packages?

Specifically:
* [ffbs/gluon-parker@1722bc5](https://github.com/ffbs/gluon-parker/commit/1722bc53f5b6612927ee6f49d6c4713321003c63)

* and [ffbs/gluon-parker@42987a0](https://github.com/ffbs/gluon-parker/commit/42987a057518d9b409cd502e37145ae1b8c30e0a)
and adding
uci:delete_all('firewall', 'rule', function(rule)
	return rule['.name']:find('^mesh_respondd_siteprefix')
end)
instead of having this here: ffbs/gluon-parker@2e53380#diff-70c0178fef0afe6aa581fdd24bcd19c5ad4f04874648698469f5f5896dc1b500

This would further reduce the required delta of gluon.

Do not get me wrong: This suggestion is totally right, but I would like to get forward to get this PR ready to merge at the moment.

I would suggest to open an issue against https://github.com/ffbs/gluon-parker/issues and track this suggestion there. After we have got this merged once we can continue to work on reducing the delta of gluon-parker against upstream gluon.

grische · 2024-12-15T12:15:06Z

@SmithChart the suggestions should have been implemented already with the two PRs you merged today

The name of the dependency has been changed during cleanup. So let's change the dependency here, too.

maurerle · 2024-12-15T14:09:40Z

I think if we test the current packages with the latest https://github.com/ffbs/gluon-parker
and it works on your side, we can merge the related packages and this :)

SmithChart · 2024-12-15T15:50:52Z

@maurerle For now it does not work on our side. It is building - but the firmware on the nodes does not work.
My investigation is based on Gluon + site.

On the bright side: The problem seems trivial:
In production mode br-wan is not in table 1. We are missing a network.wan.ip4table='1'.

(On the other hand my automated tests are broken due to the changes in handling of the wg-key. So more error reports are to expect.)

SmithChart requested a review from grische November 6, 2024 20:54

SmithChart marked this pull request as draft November 7, 2024 06:49

This was referenced Nov 8, 2024

Add ffbs-parker-nextnode #139

Draft

Add ffbs-parker-respondd #140

Draft

grische reviewed Nov 8, 2024

View reviewed changes

SmithChart and others added 10 commits November 20, 2024 20:22

add parker provider to ffbs-parker-nodeconfig

537609b

rename ffbs-parker-nodeconfig to ffbs-mesh-vpn-parker

c8460a6

make backwards compatible by providing former package name

ca7eea1

fix duplicate dependency

2f4d446

move luasrc around, fix wrong provider folder location

ca674f5

fixes for luacheck

b4f01b6

SmithChart force-pushed the ffbs-parker-nodeconfig branch from db1097b to 35b7dc7 Compare November 20, 2024 19:25

SmithChart changed the title ~~Add ffbs-parker-nodeconfig~~ Add ffbs-mesh-vpn-parker Nov 20, 2024

grische mentioned this pull request Nov 27, 2024

ffbs-mesh-vpn-parker: delete firewall rules for the prefix6 site config SmithChart/community-packages#2

Merged

ffbs-mesh-vpn-parker: configure unreachable routes

6825d66

Co-Authored-By: Jan Luebbe <[email protected]>

grische mentioned this pull request Nov 27, 2024

ffbs-mesh-vpn-parker: move parker network rules into package SmithChart/community-packages#3

Merged

grische and others added 5 commits November 27, 2024 11:37

ffbs-mesh-vpn-parker: place ipv4 wan routes into table 1

8eeb5c1

Co-Authored-By: Jan Luebbe <[email protected]>

ffbs-mesh-vpn-parker: make sure wg-pubkey exists

eb70e5d

ffbs-mesh-vpn-parker: fix default parker config

80497b4

ffbs-mesh-vpn-parker: check uci for config_server

77a8e70

ffbs-mesh-vpn-parker: reduce nesting in noderoute

d77cc2d

SmithChart and others added 9 commits November 27, 2024 20:54

Merge pull request #8 from grische/reduce-nesting-check_batman

3cefe3c

ffbs-mesh-vpn-parker: reduce nesting in noderoute

Merge pull request #7 from grische/check-for-config-server

fd33d3d

ffbs-mesh-vpn-parker: check uci for config_server

Merge pull request #6 from grische/fix-default-parker-config

b0f041d

ffbs-mesh-vpn-parker: fix default parker config

Merge pull request #4 from grische/ensure-pubkey-generation

240cd66

ffbs-mesh-vpn-parker: make sure wg-pubkey exists

Merge pull request #3 from grische/migrate/configure-unreachable-routes

9884bf7

ffbs-mesh-vpn-parker: move parker network rules into package

ffbs-mesh-vpn-parker: move parker pubkey to uci

961cb0b

Also moving the pubkey file to /tmp/ as it will be written every time that nodeconfig is run.

Merge pull request #5 from grische/make-pubkey-configureable

12231d0

ffbs-mesh-vpn-parker: move parker pubkey to uci

Merge pull request #2 from grische/migrate/remove-prefix6-prefix4

e6e5ca6

ffbs-mesh-vpn-parker: delete firewall rules for the prefix6 site config

ffbs-mesh-vpn-parker: Rename respondd-dependency

0de5c33

The name of the dependency has been changed during cleanup. So let's change the dependency here, too.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ffbs-mesh-vpn-parker #142

Add ffbs-mesh-vpn-parker #142

SmithChart commented Nov 6, 2024

SmithChart commented Nov 7, 2024

SmithChart commented Nov 7, 2024

grische left a comment

grische Nov 8, 2024 •

edited

Loading

grische Nov 27, 2024

SmithChart Dec 15, 2024

grische Nov 8, 2024

grische Nov 27, 2024

SmithChart Dec 15, 2024

grische Nov 8, 2024 •

edited

Loading

grische Nov 27, 2024

SmithChart Dec 15, 2024

grische Nov 8, 2024

grische Nov 27, 2024

SmithChart Dec 15, 2024

grische Nov 8, 2024

grische Nov 27, 2024

SmithChart Dec 15, 2024

blocktrron commented Nov 14, 2024

SmithChart commented Nov 20, 2024

maurerle commented Nov 20, 2024

SmithChart commented Dec 15, 2024

grische commented Dec 15, 2024

maurerle commented Dec 15, 2024

SmithChart commented Dec 15, 2024

		config nodeconfig 'example'
		option config_server 'config.community.example'

+if ! { echo "untrusted comment: signify public key" && uci -q get parker.nodeconfig.config_pubkey; } > "${SIGN_PUB_KEY}"; then
+    $LOGGER unable to read or write pubkey from uci
+fi

-    if ip l | grep -q "bat0:"; then
+    if ! ip l | grep -q "bat0:"; then
+        $LOGGER ERROR: No BATMAN-interface found
+        return 1
+    fi

Add ffbs-mesh-vpn-parker #142

Are you sure you want to change the base?

Add ffbs-mesh-vpn-parker #142

Conversation

SmithChart commented Nov 6, 2024

SmithChart commented Nov 7, 2024

SmithChart commented Nov 7, 2024

grische left a comment

Choose a reason for hiding this comment

grische Nov 8, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

grische Nov 8, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

blocktrron commented Nov 14, 2024

SmithChart commented Nov 20, 2024

maurerle commented Nov 20, 2024

SmithChart commented Dec 15, 2024

grische commented Dec 15, 2024

maurerle commented Dec 15, 2024

SmithChart commented Dec 15, 2024

grische Nov 8, 2024 •

edited

Loading

grische Nov 8, 2024 •

edited

Loading