Malar Invention
eb04a2597d
Adds the luci-app-zt-gateway package: a LuCI app + rpcd/ucode backend +
shell switch script that reconfigures which remote ZeroTier node acts as
the internet exit gateway for WIBLAN clients (10.11.13.0/24).
- Makefile (luci.mk, arch-independent)
- UCI config skeleton with three sample gateways
- rpcd ACL + menu entry
- zt-gateway.uc rpcd backend exposing status / switch / health /
drain_status / cancel_drain ubus methods
- zt-gateway-switch shell script implementing force + graceful modes:
* force: pre-flight ping, atomic route replace, conntrack flush,
UCI/hotplug/rc.local persistence
* graceful: dual-table drain using CONNMARK fwmark 0x100 at
priority 99, background drain monitor with two-consecutive-zero
completion and timeout-forced fallback to force
- LuCI overview.js: gateway radio list, mode select, drain progress
panel, cancel-drain button, health polling
- Docker test harness (docker-compose + Dockerfile.router +
router/gw entrypoints) exercising the switch script against real
iproute2/iptables/conntrack on two simulated exit nodes
Verified against the harness: force switch, graceful drain to natural
completion, pre-flight blocking of unreachable gateways (force + graceful),
and drain-timeout forced fallback.
57 lines
1.8 KiB
Bash
Executable File
57 lines
1.8 KiB
Bash
Executable File
#!/bin/sh
|
|
# router-entrypoint.sh
|
|
#
|
|
# Brings up the simulated br-zt bridge that mirrors production: the
|
|
# ZeroTier member interface (here, the container's interface on
|
|
# zt-exit-net) is enslaved to br-zt and its IP is moved onto br-zt. This
|
|
# makes 'ip route ... dev br-zt' actually reach 10.99.12.0/24.
|
|
set -eu
|
|
|
|
WIBLAN_CIDR="${ZTG_WIBLAN_CIDR:-10.99.13.0/24}"
|
|
|
|
echo "[entrypoint] bringing up br-zt bridge"
|
|
|
|
# Find the interface holding 10.99.12.x.
|
|
ZT_IFACE=$(ip -o -4 addr show \
|
|
| awk '$4 ~ /^10\.99\.12\./ {print $2; exit}')
|
|
if [ -z "$ZT_IFACE" ]; then
|
|
echo "[entrypoint] WARNING: no interface in 10.99.12.0/24; tests will fail" >&2
|
|
ZT_IFACE=eth1
|
|
fi
|
|
echo "[entrypoint] ZT-side interface: $ZT_IFACE"
|
|
|
|
ip link add name br-zt type bridge 2>/dev/null || true
|
|
ip link set br-zt up
|
|
|
|
if [ "$ZT_IFACE" != "br-zt" ]; then
|
|
ADDR=$(ip -o -4 addr show dev "$ZT_IFACE" \
|
|
| awk '$4 ~ /^10\.99\.12\./ {print $4; exit}')
|
|
if [ -n "$ADDR" ]; then
|
|
ip addr del "$ADDR" dev "$ZT_IFACE" 2>/dev/null || true
|
|
ip addr add "$ADDR" dev br-zt
|
|
fi
|
|
ip link set "$ZT_IFACE" master br-zt
|
|
fi
|
|
|
|
echo 1 > /proc/sys/net/ipv4/ip_forward
|
|
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects 2>/dev/null || true
|
|
|
|
# Seed the baseline policy routing the production router boots with.
|
|
ip rule del from "$WIBLAN_CIDR" table 100 2>/dev/null || true
|
|
ip rule add from "$WIBLAN_CIDR" table 100 priority 100
|
|
|
|
# Seed the current gateway's host route + table 100 default. These mirror
|
|
# what /etc/rc.local installs on boot in production.
|
|
ip route replace 10.99.12.3 dev br-zt
|
|
ip route replace default via 10.99.12.3 dev br-zt table 100
|
|
ip route replace "$WIBLAN_CIDR" dev br-zt table 1
|
|
|
|
echo "[entrypoint] baseline state:"
|
|
ip -o -4 addr show dev br-zt
|
|
echo "--- table 100:"
|
|
ip route show table 100
|
|
echo "--- rule:"
|
|
ip rule show
|
|
|
|
exec "$@"
|