lordwelch/router7
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
388 Commits 4 Branches 24 Tags
master
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Stapelberg acdc5313ee netconfig: create bridge with future MAC address to avoid temporary 
On one of my router7 installations, I’m using a bridge for uplink0
(so that I can use the built-in SFP interface, or fall back
to an external media converter in case of trouble without reconfig).

On that installation, I have observed the following bug:

  1. System boots, netconfig creates uplink0.
  2. The Linux kernel assigns a MAC address (e.g. ce:fa:ba:3c:66:84).
  3. Netconfig cannot add the interfaces to the bridge yet,
     presumably because they are not created yet.
  4. The dhcp4 program starts and reads the MAC address.
  5. Netconfig adds the interfaces to the bridge, the MAC changes.
  6. dhcp4 still has the old (incorrect) MAC address.
  7. dhcp4 never obtains a lease, the router never becomes healthy,
     you’re stuck in this state.

This will be prevented by not letting the kernel assign a MAC address,
but instead determining the future MAC address (in our case:
we just use the first configured MAC address) and creating the bridge
interface correctly configured to begin with, thereby eliminating
the race condition entirely.
 2025-12-14 08:19:36 +01:00
Michael Stapelberg 2189376204 dhcp: clone hardware addresses throughout 
I still noticed DHCP requests with incorrect MAC source addresses.
Turns out there were still a number of incorrect HardwareAddr usages.
 2025-10-16 11:23:58 +02:00
Michael Stapelberg e2d4de4768 diagd: log error message when reporting unhealthy 
I noticed that there seem to be transient periods of unhealthiness,
so let’s figure out which particular check is failing.
 2025-09-14 11:48:36 +02:00
Michael Stapelberg 128a7e98ef diagd: export healthiness as prometheus metric (for monitoring) 2025-09-11 08:21:10 +02:00
Michael Stapelberg 0b9afc9273 dhcp4: clone HardwareAddr bytes defensively 
I suspect that Go’s net package reuses its buffers and these bytes don’t remain
valid forever (perhaps only if the network interfaces of the machine change?).

At least that would explain why my DHCP client sent requests with a wrong address.
 2025-08-15 08:29:33 +02:00
Michael Stapelberg 35fcfc15c8 GitHub Actions: run tests in nix-shell, not Docker 
For some reason, the MAC address reported by dnsmasq in Docker on GitHub Actions
no longer matches the address expected by the test. With Nix, it works.
 2025-07-20 22:57:13 +02:00
Michael Stapelberg 2e5277d689 internal/dns: retry over TCP upon truncated response 
This fixes resolving login.tailscale.com as of the time of writing,
the first DNS name for which I noticed an error in 7 years of router7.
 2025-07-20 18:31:45 +02:00
Michael Stapelberg 6e73981e36 add push script to publish self-hosted website (from docs/) 2025-03-20 08:48:57 +01:00
Michael Stapelberg 58fa19ba32 go.{mod,sum}: pull in latest x/ packages 2025-03-13 08:42:32 +01:00
Michael Stapelberg ea317e0e7a go.{mod,sum}: pull in latest gokrazy/rsync 2025-03-13 08:42:10 +01:00
Michael Stapelberg e9cfa01d4a dyndns: fix updating the root record of a zone 
(Required for self-hosting gokrazy.org.)
 2025-03-07 17:47:26 +01:00
Michael Stapelberg 4ca26a5a32 GitHub Actions: update action versions 2025-02-24 06:50:25 +01:00
Michael Stapelberg 3fbc5260b3 Dockerfile: dnsutils is now bind9-dnsutils (for dig) 2025-02-24 06:47:27 +01:00
Michael Stapelberg 20840d4904 fix example: func Example() must be niladic 2025-02-24 06:42:48 +01:00
Michael Stapelberg 13e1c1bbb4 netconfig: move /tmp/resolv.conf symlink out of the way 
Commit 0f75b1cbef was incomplete.
 2025-01-27 08:26:03 +01:00
Michael Stapelberg 0f75b1cbef netconfigd: write /tmp/resolv.conf only once, do not clobber 
This fixes tailscale name resolution breaking again and again.
 2025-01-26 10:16:38 +01:00
Michael Stapelberg 07325dde93 netconfigd: do not hardcode 10.0.0.0/24 netmask for hairpinning 
related to https://github.com/rtr7/router7/issues/53
 2025-01-12 10:29:42 +01:00
Michael Stapelberg af27264a03 dhcp4: drop expired lease on server error (faster time to recovery) 
netconfigd still keeps the address configured for as long as possible,
but dhcp4 now more quickly returns to a from-scratch DHCP exchange.
 2024-12-21 16:07:56 +01:00
Michael Stapelberg fe0c57fc09 dhcp4: fix drop-lease-and-restart logic 
The code should immediately attempt obtaining a lease from scratch instead of
remaining stuck in the wait-until-renew loop.
 2024-09-27 17:11:50 +02:00
Michael Stapelberg f835cdf1d6 netconfig: do not re-create nftables ruleset from scratch 
The current behavior stomps on the rules that programs like
podman or tailscale set up for port forwarding.

With this change, we split port forwardings into a separate chain,
which allows us to create the ruleset once at startup and then only
update the port forwardings specifically (the only dynamic part
of router7’s nftables ruleset).
 2024-05-09 10:06:23 +02:00
Michael Stapelberg ac71701d8c update go.{mod,sum} 2024-05-09 09:55:27 +02:00
Michael Stapelberg 05a7b11ba6 diagd: allow disabling ipv6 connectivity check in health.json 
This makes rtr7-safe-update work in environments without IPv6.
 2023-08-12 16:14:13 +02:00
Michael Stapelberg 681ccd815c go.mod: bump to go1.20 2023-03-12 09:06:35 +01:00
Michael Stapelberg 0b55d8980c pull in latest mdlayher/packet to fix tests 2023-03-12 09:06:23 +01:00
Michael Stapelberg b2db10d68b dhcp4d: allow handing out static leases outside of the pool 2023-03-12 09:06:02 +01:00
Michael Stapelberg 92f746b23a website: update docs for gokrazy instance config 2023-01-15 13:58:20 +01:00
Michael Stapelberg 7bc59a8b27 Makefile: update rtr7-recover invocation 
based on what I last used successfully
 2023-01-13 00:04:24 +01:00
Michael Stapelberg 7cda93aeb3 Makefile: qemu: document chown 2023-01-11 17:56:00 +01:00
Michael Stapelberg c84c18cebf Makefile: qemu: mkdir -p 2023-01-11 17:55:50 +01:00
Michael Stapelberg d8992e4412 Makefile: qemu: -bios flag 2023-01-11 17:55:13 +01:00
Michael Stapelberg d30f613622 Makefile: update: remove hard-coded directory 2023-01-11 17:54:53 +01:00
Michael Stapelberg 86f32dc7d9 115200 is enough, n8 is implied 2023-01-11 17:54:35 +01:00
Michael Stapelberg 32f37d97d7 Makefile: update package list in git 
I neglected to commit changes to the packages list for quite a while.
 2023-01-11 17:53:25 +01:00
Michael Stapelberg b39b137e20 re-generate website to pick up fixes 2022-10-17 17:52:15 +02:00
Michael Stapelberg a8a12cafc9 diagd: remove ping4/ping6 to external targets in favor of tcp4/tcp6 
External ICMP does not necessarily work.
It typically does, but not always.
Last week, for a day or two, ICMP traffic was dropped by Google.

So now we use ICMP only for network equipment targets (default gateway),
and instead use TCP for external connectivity checks.

fixes #77
 2022-09-28 22:39:20 +02:00
Michael Stapelberg c97c321740 go mod tidy 2022-09-04 18:44:08 +02:00
Michael Stapelberg 196e3f9fd7 netconfig: make forward error correction (FEC) configurable 2022-08-30 21:58:55 +02:00
Michael Stapelberg db15477448 disable icmp ratelimit 
Otherwise, traceroute mysteriously times out sometimes.

https://twitter.com/zekjur/status/924248132837347330
 2022-06-21 18:30:53 +02:00
Michael Stapelberg ce66287189 netconfig: make the MTU configurable 
Just in case we need to set it on an uplink0 interface at some point, for example.
 2022-06-15 23:19:43 +02:00
Michael Stapelberg fb08bb280c go.mod: bump wireguard, go mod tidy 
related to #76
 2022-06-12 23:07:56 +02:00
Michael Stapelberg e17be63d46 make test: disable -buildvcs to make sudo work 2022-06-12 23:07:36 +02:00
Michael Stapelberg ff0020b47b go.mod: bump minimum language version to go 1.17 2022-06-12 23:04:49 +02:00
Michael Stapelberg b1ba13419d Makefile: fix test target by setting -mod=mod 2022-06-12 23:02:45 +02:00
Michael Stapelberg b1e9f5824b Makefile: fix recover target by using two separate go install calls 2022-06-12 23:02:28 +02:00
Michael Stapelberg 225c8e6abd radvd: ignore requests from other interfaces than the configured one 
Announcing networks into uplinks is never a good idea 🙈
 2022-06-08 17:42:55 +02:00
Michael Stapelberg f4dd972e54 netconfig: WireGuard: set up host routes instead of DHCP default 
related to https://github.com/rtr7/router7/issues/52
 2022-06-07 23:22:08 +02:00
Michael Stapelberg 7d936f4844 allow configuring extra routes 
Useful for routing IPv6 subnets through a WireGuard tunnel.

related to https://github.com/rtr7/router7/issues/52
 2022-06-06 14:25:25 +02:00
Michael Stapelberg f52deeed03 allow configuring extra addresses on interfaces 
Useful when you need IPv6 and IPv4 addresses on a WireGuard tunnel.
 2022-06-06 14:25:25 +02:00
Michael Stapelberg 40f8eb5b1b fix wireguard availability test 2022-06-06 14:25:25 +02:00
Michael Stapelberg e8a78c2eaa GitHub Actions: switch to Go 1.18 2022-03-25 09:12:16 +01:00
Michael Stapelberg ef7089dc61 radvd: switch to netip package for mdlayher/ndp 2022-03-25 09:09:26 +01:00
Michael Stapelberg 2014da4ca3 dhcp4d: display active devices based on LastACK 
This has the advantage that it also works for static DHCP leases,
provided the device obtains a DHCP lease at all (and isn’t configured with a
static IP address, like the shelly motion sensors for example).
 2022-03-12 17:38:16 +01:00
Michael Stapelberg 593cd8c12d export input/output nftables counters as well as forwarded 
Thus far, we have only had forwarded bytes metrics.

Notably, forwarded bytes does not include bytes that were sent by the router
itself, e.g. by the webserver or rsync server running on the machine.

fixes https://github.com/rtr7/router7/issues/71
 2022-03-08 22:47:18 +01:00
Michael Stapelberg 8dc93c66c4 netconfig: enable NAT hairpinning for port forwardings 
fixes https://github.com/rtr7/router7/issues/53
 2022-03-08 09:32:09 +01:00
Michael Stapelberg d57b44ab51 README: swap travis badge with GitHub Actions badge 2021-09-19 11:47:51 +02:00
Michael Stapelberg 3ad9d03460 gofmt for go:build 2021-09-19 11:46:57 +02:00
Michael Stapelberg e07002721d teelogger: make writes to /dev/console non-blocking 
fixes https://github.com/rtr7/router7/issues/68
 2021-09-19 11:45:19 +02:00
Michael Stapelberg a5a012dd96 dhcp4: increase number of unhealthy cycles 2021-09-19 11:45:04 +02:00
Michael Stapelberg 575a14c394 dyndns: add zone to record name 
Otherwise, already existing records are not recognized correctly.
 2021-09-01 09:37:12 +02:00
Michael Stapelberg 20dd872fbe backup: skip “nobackup” and “srv” directories 2021-09-01 09:27:49 +02:00
Michael Stapelberg b88ddd41c3 netconfig: don’t try to add bridge to itself 2021-06-12 22:24:38 +02:00
Michael Stapelberg bfb94377f4 netconfig: move bridge creation into its own function 
also don’t short-circuit the rest of the configuration if bridge config fails
 2021-06-12 18:25:37 +02:00
Michael Stapelberg cffd872346 netconfig: implement bridge configuration 
fixes https://github.com/rtr7/router7/issues/65
 2021-06-06 15:43:55 +02:00
Michael Stapelberg d0f963def3 fix integration test: explicitly install iproute2 in container 2021-06-03 21:18:51 +02:00
Michael Stapelberg e34a5ae0f3 update go.mod and go.sum 2021-06-03 21:12:13 +02:00
Michael Stapelberg cbadfe5128 dhcp4: ensure MQTT topic names are printable (for mosquitto_sub) 2021-06-03 21:06:03 +02:00
Michael Stapelberg 3834acfa2b dhcp4d: ensure MQTT topic names are valid UTF-8 
https://twitter.com/zekjur/status/1347295676909158400
 2021-01-07 22:52:58 +01:00
Michael Stapelberg c30bf38438 bump dependencies 2020-12-31 22:13:25 +01:00
Michael Stapelberg 5f25043b94 dhcp4d: only publish to MQTT when channel is ready to prevent deadlocks 2020-12-31 16:42:12 +01:00
Michael Stapelberg c3c531931c retry MQTT connections, even if initial connection attempt fails 2020-12-31 16:42:01 +01:00
Michael Stapelberg 32b0dc7d59 Makefile: Go 1.16’s go install wants the @latest suffix 2020-12-19 13:52:03 +01:00
Michael Stapelberg 04f2be01d9 dhcp4d: optionally publish DHCP leases to MQTT 
Enable using:

  mkdir -p /perm/dhcp4d
  echo 'tcp://10.0.0.54:1883' > /perm/dhcp4d/mqtt-broker.txt
 2020-12-19 13:34:46 +01:00
Michael Stapelberg e5ea79aef8 update go.{mod,sum} with Go 1.16beta1 2020-12-18 10:10:17 +01:00
Michael Stapelberg 7f135438b8 dhcp4d: mention apple-suggested lease time of 1 hour 2020-11-01 19:24:24 +01:00
Michael Stapelberg a8fce3cbbc diag: drain ping reply channel to avoid goroutine leak 2020-09-14 22:10:09 +02:00
Michael Stapelberg 99c4046ebf diagd: import net/http/pprof 2020-09-14 22:10:07 +02:00
Michael Stapelberg efbe826a4e diagd: -interface flag for easier testing 2020-09-14 22:10:07 +02:00
Michael Stapelberg 416c1a58f6 diag: plug socket leak by adding missing Close() 2020-09-14 22:10:07 +02:00
Michael Stapelberg f8d79d0ecc dhcp4: close healthiness checking connection 2020-09-14 12:54:14 +02:00
Michael Stapelberg fddfe80222 dhcp4: start from scratch after 5 minutes of continued unhealthiness 
fixes #58
 2020-09-14 09:06:05 +02:00
Michael Stapelberg ee17db29b6 GitHub actions: also exit early if gofmt reports syntax errors 2020-08-01 09:46:19 +02:00
Michael Stapelberg 5573c4dde7 GitHub actions: fix gofmt check 2020-08-01 09:28:02 +02:00
Michael Stapelberg cf1e1dd480 re-generate website to pick up previous commit 2020-07-06 09:50:52 +02:00
Michael Stapelberg f86e20be53 dhcp6: port dhcp4 backoff logic 2020-07-02 22:07:26 +02:00
Michael Stapelberg ae8cfee616 dhcp6: inspect server advertisment IAPD and report error, if any 
The fiber7 DHCPv6 servers (sometimes?) use this field for reporting errors.
 2020-07-02 22:06:55 +02:00
Michael Stapelberg 281f876834 integration/netconfig: verify wg(8) is available 
The kernel used on GitHub actions now allows creating wireguard interfaces
apparently.
 2020-07-02 21:14:35 +02:00
Michael Stapelberg 8c1b3676ab gokr-packer invocations: set empty -eeprom_package= 
We don’t need Raspberry Pi 4 EEPROM files on router7 on amd64,
and this makes the build easier.

fixes #54
 2020-07-02 21:06:22 +02:00
Michael Stapelberg dff392e558 website: bundle assets for faster loading/privacy 2020-06-21 10:06:18 +02:00
Michael Stapelberg 876a3308d2 style tables with bootstrap table styles 
as per https://willschenk.com/articles/2020/styling_tables_with_hugo/
 2020-06-21 09:52:38 +02:00
Michael Stapelberg cb95bb6df8 move README into (hugo-powered) website router7.org 2020-06-21 09:43:13 +02:00
Michael Stapelberg 1250211381 github actions: try caching the module cache 2020-06-16 23:41:21 +02:00
Michael Stapelberg 9c7e626f7d switch from travis to GitHub actions 2020-06-16 23:22:34 +02:00
Michael Stapelberg b090fa2924 qemu: enable i6300esb watchdog device 
For the corresponding kernel change, see:
https://github.com/rtr7/kernel/commit/0f4dcc4a8739bb42448b9876b0fd786db5f66936
 2020-06-16 23:09:35 +02:00
Michael Stapelberg 1fd5468bab first start of a qemu target 2020-06-04 09:59:24 +02:00
Michael Stapelberg aa14d119e6 dyndns: add log message when records are updated 
Now both cases are covered.
 2020-05-28 17:24:51 +02:00
Michael Stapelberg decb0978d7 dyndns: update to newer libdns/cloudflare, remove workaround 2020-05-28 17:22:24 +02:00
Michael Stapelberg f1e4ee0662 dyndns: don’t crashloop when config does not exist 
related to #46
 2020-05-28 09:46:37 +02:00
Michael Stapelberg 7950291db6 dyndns: tweak up-to-date message output 2020-05-28 09:42:55 +02:00
Michael Stapelberg 4a5f55a5de defense in depth: verify hex.DecodeString length 
related to #49
 2020-05-27 09:50:04 +02:00
Michael Stapelberg 53c495091e quirk: enforce minimum lease time of 1 hour for Nintendo devices 
The Nintendo Switch has been observed to hold on to IP addresses even after
their expiration. My guess is that this is an oversight: likely the device
enters power saving mode with a configured IP address and just sleeps through
the expiration time.

As the device seems to wake up once every hour, we enforce a minimum lease time
of 1 hour, but only for affected devices. The rest of the network gets short
lease times.

https://twitter.com/zekjur/status/1263949112036282374
 2020-05-23 09:07:17 +02:00