From bef3fd6ee35e3eac24044b8aa4041fcbba373b59 Mon Sep 17 00:00:00 2001 From: AguTrachta Date: Sun, 17 Aug 2025 09:40:10 -0300 Subject: [PATCH 1/8] build: add kmod-nft-netdev dependency Ensure nftables netdev/ingress hooks are available at runtime. This module is required for the netdev table used to guard bat0 against Babel flooding (UDP/6696 + multicast) before bridging. --- packages/lime-proto-babeld/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/lime-proto-babeld/Makefile b/packages/lime-proto-babeld/Makefile index 6e6221909..9cda1fccc 100644 --- a/packages/lime-proto-babeld/Makefile +++ b/packages/lime-proto-babeld/Makefile @@ -4,7 +4,7 @@ define Package/$(PKG_NAME) SECTION:=lime CATEGORY:=LibreMesh TITLE:=LiMe babeld proto support - DEPENDS:=+babeld +lime-system +luci-lib-nixio + DEPENDS:=+babeld +lime-system +luci-lib-nixio +kmod-nft-netdev MAINTAINER:=Gioacchino Mazzurco VERSION:=$(if $(PKG_VERSION),$(PKG_VERSION),$(PKG_SRC_VERSION)) PKGARCH:=all From c8aade10a3926604caca9ea35b497ec8c3007d68 Mon Sep 17 00:00:00 2001 From: AguTrachta Date: Sun, 17 Aug 2025 09:41:44 -0300 Subject: [PATCH 2/8] feat: register br-lan as a wired interface Configure Babel to run on br-lan with type=wired to enable wired optimizations --- .../lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua b/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua index 1fb4735c0..2870c0f19 100644 --- a/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua +++ b/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua @@ -87,6 +87,10 @@ function babeld.configure(args) uci:set("babeld", "denyany", "type", "redistribute") uci:set("babeld", "denyany", "action", "deny") + uci:set("babeld", "br_lan_interface", "interface") + uci:set("babeld", "br_lan_interface", "ifname", "br-lan") + uci:set("babeld", "br_lan_interface", "type", "wired") + uci:save("babeld") end From 745ca218009615235d76dc1c60ad52cb53ca2b74 Mon Sep 17 00:00:00 2001 From: AguTrachta Date: Sun, 17 Aug 2025 09:43:42 -0300 Subject: [PATCH 3/8] chore: drop VLAN-on-wlan path and add base interface directly This simplifies the topology and aligns with running Babel on br-lan. --- .../files/usr/lib/lua/lime/proto/babeld.lua | 37 +++++-------------- 1 file changed, 10 insertions(+), 27 deletions(-) diff --git a/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua b/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua index 2870c0f19..15b172147 100644 --- a/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua +++ b/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua @@ -103,48 +103,31 @@ function babeld.setup_interface(ifname, args) utils.log("lime.proto.babeld.setup_interface(%s, ...)", ifname) - local vlanId = args[2] or 17 - local vlanProto = args[3] or "8021ad" - local nameSuffix = args[4] or "_babeld" - local owrtInterfaceName, linuxVlanIfName, owrtDeviceName = - network.createVlanIface(ifname, vlanId, nameSuffix, vlanProto) + network.createVlanIface(ifname, vlanId, nameSuffix, vlanProto) --revisar local ipv4, _ = network.primary_address() local uci = config.get_uci_cursor() - if(vlanId ~= 0 and (ifname:match("^eth") or ifname:match("^lan"))) then - uci:set("network", owrtDeviceName, "mtu", tostring(network.MTU_ETH_WITH_VLAN)) - end + local section_name = "babeld_" .. ifname:gsub("[.-]", "_") - uci:set("network", owrtInterfaceName, "proto", "static") - uci:set("network", owrtInterfaceName, "ipaddr", ipv4:host():string()) - uci:set("network", owrtInterfaceName, "netmask", "255.255.255.255") - uci:save("network") + uci:set("babeld", section_name, "interface") + uci:set("babeld", section_name, "ifname", ifname) - uci:set("babeld", owrtInterfaceName, "interface") - uci:set("babeld", owrtInterfaceName, "ifname", linuxVlanIfName) - --! It is quite common to have dummy radio device attached via ethernet so - --! disable wired optimization always as it would consider the link down at - --! first packet lost - uci:set("babeld", owrtInterfaceName, "type", "wireless") + if ifname:match("^wlan") then + uci:set("babeld", section_name, "type", "wireless") + else + uci:set("babeld", section_name, "type", "wired") + end uci:save("babeld") end function babeld.runOnDevice(linuxDev, args) utils.log("lime.proto.babeld.runOnDevice(%s, ...)", linuxDev) - - local vlanId = args[2] or 17 - local vlanProto = args[3] or "8021ad" - - local vlanDev = network.createVlan(linuxDev, vlanId, vlanProto) - network.createStatic(vlanDev) - local libubus = require("ubus") local ubus = libubus.connect() - ubus:call('babeld', 'add_interface', { ifname = vlanDev }) + ubus:call('babeld', 'add_interface', { ifname = linuxDev }) end - return babeld From 8183b91960bc9eb49f8011c0b46c734e067019b0 Mon Sep 17 00:00:00 2001 From: AguTrachta Date: Sun, 17 Aug 2025 09:45:10 -0300 Subject: [PATCH 4/8] feat: install nft netdev guard on bat0 to prevent ghost neighbors When kmod-batman-adv is installed, deploy a small nftables ruleset and fw4 include to drop Babel traffic arriving on bat0 before it reaches the bridge --- .../files/usr/lib/lua/lime/proto/babeld.lua | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua b/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua index 15b172147..f9ef71f6c 100644 --- a/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua +++ b/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua @@ -93,6 +93,30 @@ function babeld.configure(args) uci:save("babeld") + if utils.is_installed("kmod-batman-adv") then + if not fs.stat("/etc/nft-lime") then fs.mkdir("/etc/nft-lime") end + if not fs.stat("/etc/nft-lime/20-lime-babel-filter.nft") then + fs.writefile("/etc/nft-lime/20-lime-babel-filter.nft", [[ +table netdev lime_babel_filter { + chain prevent_babel_leak_from_bat0 { + type filter hook ingress device "bat0" priority 0; policy accept; + ether daddr 33:33:00:00:01:06 counter drop + ether daddr 01:00:5e:00:00:6f counter drop + ip6 nexthdr udp udp dport 6696 counter drop + ip protocol udp udp dport 6696 counter drop + } +} +]]) + + uci:set("firewall", "lime_babel_filter_include", "include") + uci:set("firewall", "lime_babel_filter_include", "path", "/etc/nft-lime/20-lime-babel-filter.nft") + uci:set("firewall", "lime_babel_filter_include", "type", "nftables") + uci:set("firewall", "lime_babel_filter_include", "position", "ruleset-post") + uci:set("firewall", "lime_babel_filter_include", "enabled", "1") + + uci:save("firewall") + end + end end function babeld.setup_interface(ifname, args) From 639285bbb84ca2747e1a10d5eaadb3946cb83e98 Mon Sep 17 00:00:00 2001 From: AguTrachta Date: Sun, 17 Aug 2025 09:48:37 -0300 Subject: [PATCH 5/8] refactor: remove leftover VLAN iface creation from setup_interface --- .../files/usr/lib/lua/lime/proto/babeld.lua | 5 ----- 1 file changed, 5 deletions(-) diff --git a/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua b/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua index f9ef71f6c..215b07fc6 100644 --- a/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua +++ b/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua @@ -127,11 +127,6 @@ function babeld.setup_interface(ifname, args) utils.log("lime.proto.babeld.setup_interface(%s, ...)", ifname) - local owrtInterfaceName, linuxVlanIfName, owrtDeviceName = - network.createVlanIface(ifname, vlanId, nameSuffix, vlanProto) --revisar - - local ipv4, _ = network.primary_address() - local uci = config.get_uci_cursor() local section_name = "babeld_" .. ifname:gsub("[.-]", "_") From 05ce54b648d6a9426bcd9dae0c8619e6a9cb8239 Mon Sep 17 00:00:00 2001 From: AguTrachta Date: Wed, 20 Aug 2025 11:13:28 -0300 Subject: [PATCH 6/8] chore: we don't need kmod-nft-netdev --- packages/lime-proto-babeld/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/lime-proto-babeld/Makefile b/packages/lime-proto-babeld/Makefile index 9cda1fccc..d1a0b38e3 100644 --- a/packages/lime-proto-babeld/Makefile +++ b/packages/lime-proto-babeld/Makefile @@ -4,7 +4,7 @@ define Package/$(PKG_NAME) SECTION:=lime CATEGORY:=LibreMesh TITLE:=LiMe babeld proto support - DEPENDS:=+babeld +lime-system +luci-lib-nixio +kmod-nft-netdev + DEPENDS:=+babeld +lime-system +luci-lib-nixio MAINTAINER:=Gioacchino Mazzurco VERSION:=$(if $(PKG_VERSION),$(PKG_VERSION),$(PKG_SRC_VERSION)) PKGARCH:=all From 31a6d8b28c4e5b6e0aeaff6805332c1dd5262bb1 Mon Sep 17 00:00:00 2001 From: AguTrachta Date: Thu, 21 Aug 2025 14:13:29 -0300 Subject: [PATCH 7/8] refactor: migrate nftables rules from netdev to inet table --- .../files/usr/lib/lua/lime/proto/babeld.lua | 37 ++++++++++--------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua b/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua index 215b07fc6..757b62f18 100644 --- a/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua +++ b/packages/lime-proto-babeld/files/usr/lib/lua/lime/proto/babeld.lua @@ -93,30 +93,33 @@ function babeld.configure(args) uci:save("babeld") - if utils.is_installed("kmod-batman-adv") then - if not fs.stat("/etc/nft-lime") then fs.mkdir("/etc/nft-lime") end - if not fs.stat("/etc/nft-lime/20-lime-babel-filter.nft") then - fs.writefile("/etc/nft-lime/20-lime-babel-filter.nft", [[ -table netdev lime_babel_filter { + if utils.is_installed("kmod-batman-adv") then + local dir = "/usr/share/nftables.d/ruleset-post" + local path = dir .. "/20-lime-babel-filter.nft" + + if not fs.stat(dir) then fs.mkdir(dir) end + + if not fs.stat(path) then + fs.writefile(path, [[ +#!/usr/sbin/nft -f +add table inet lime_babel_filter +add chain inet lime_babel_filter prevent_babel_leak_from_bat0 +delete chain inet lime_babel_filter prevent_babel_leak_from_bat0 + +table inet lime_babel_filter { chain prevent_babel_leak_from_bat0 { type filter hook ingress device "bat0" priority 0; policy accept; - ether daddr 33:33:00:00:01:06 counter drop - ether daddr 01:00:5e:00:00:6f counter drop + + ip6 daddr ff02::1:6 udp dport 6696 counter drop + ip daddr 224.0.0.111 udp dport 6696 counter drop + ip6 nexthdr udp udp dport 6696 counter drop ip protocol udp udp dport 6696 counter drop } } ]]) - - uci:set("firewall", "lime_babel_filter_include", "include") - uci:set("firewall", "lime_babel_filter_include", "path", "/etc/nft-lime/20-lime-babel-filter.nft") - uci:set("firewall", "lime_babel_filter_include", "type", "nftables") - uci:set("firewall", "lime_babel_filter_include", "position", "ruleset-post") - uci:set("firewall", "lime_babel_filter_include", "enabled", "1") - - uci:save("firewall") - end - end + end + end end function babeld.setup_interface(ifname, args) From dffdd71cea2380f6f276a5394775e78bff47b54c Mon Sep 17 00:00:00 2001 From: AguTrachta Date: Sat, 23 Aug 2025 12:06:09 -0300 Subject: [PATCH 8/8] fix: white space deleted --- packages/lime-proto-babeld/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/lime-proto-babeld/Makefile b/packages/lime-proto-babeld/Makefile index d1a0b38e3..6e6221909 100644 --- a/packages/lime-proto-babeld/Makefile +++ b/packages/lime-proto-babeld/Makefile @@ -4,7 +4,7 @@ define Package/$(PKG_NAME) SECTION:=lime CATEGORY:=LibreMesh TITLE:=LiMe babeld proto support - DEPENDS:=+babeld +lime-system +luci-lib-nixio + DEPENDS:=+babeld +lime-system +luci-lib-nixio MAINTAINER:=Gioacchino Mazzurco VERSION:=$(if $(PKG_VERSION),$(PKG_VERSION),$(PKG_SRC_VERSION)) PKGARCH:=all