Re: [Cerowrt-devel] BCP38 implementation

["Toke Høiland-Jørgensen" <toke@toke.dk>]

[-- Attachment #1: Type: text/plain, Size: 1479 bytes --]

So, another new version that should now be relatively feature-complete.
It should be possible to just install these two packages:

http://archive.tohojo.dk/cerowrt/wndr/3.10.32-9-tohojo/packages/bcp38_4-1_ar71xx.ipk

http://archive.tohojo.dk/cerowrt/wndr/3.10.32-9-tohojo/packages/luci-app-bcp38_2-1_all.ipk

and have everything enabled and working. This version does away with the
firewall rules in the config (so no need to add them; if they exist it
shouldn't hurt, I think, but might as well just remove them) in favour
of inserting a whole separate iptables chain to do the matching on.

There's now also an auto-detection feature for the upstream network,
which should automatically whitelist it when the rules are set up. It
does this by looking at the routing table for the upstream interface,
and testing all 'scope link' routes against the configured ipset, adding
exceptions if they match. There's a config toggle to turn off this
behaviour, and manual exceptions can be added instead of (or in addition
to) the auto-detection.

Since this detection is done at every run time, it should also include
hotplugging; the firewall is reloaded every time an interface is
hotplugged, which also reloads the bcp38 configuration and re-does the
auto-detection.


Testing is very much appreciated; until some of you tell me different, I
believe this version is suitable for inclusion in cerowrt. At least all
the issues on my own previous lists have been fixed AFAIK. :)

-Toke

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 489 bytes --]