Adding dot1x support

2026-06-22 20:50:48 +00:00
parent 1f62e5ab17
commit dea7ca451a
13 changed files with 592 additions and 0 deletions
@@ -0,0 +1,33 @@
+# hostapd wired 802.1X authenticator + MACsec, ONE per supplicant-facing link.
+# Copy per link and set `interface=` to that link's NIC (e.g. eth1 for vmbr-secA).
+# Run: hostapd -dd authenticator/hostapd-wired-<link>.conf
+#
+# BENCH-VERIFY: wired+MACsec authenticator directives vary by hostapd build/version
+# (CONFIG_MACSEC + CONFIG_DRIVER_WIRED must be compiled in). Confirm your hostapd
+# was built with MACsec; `hostapd -v` / package notes. This is the half most
+# likely to need tweaking on first bring-up.
+
+interface=eth1
+driver=wired
+
+# --- 802.1X (external RADIUS = FreeRADIUS on the serving host) ---------------
+ieee8021x=1
+eap_server=0
+eapol_version=2
+use_pae_group_addr=1                  # listen on 01:80:c2:00:00:03 (PAE)
+
+auth_server_addr=192.168.50.10        # serving host (FreeRADIUS)
+auth_server_port=1812
+auth_server_shared_secret=testing123  # MUST match freeradius/clients.conf + .env RADIUS_SECRET
+
+# --- MACsec / MKA -----------------------------------------------------------
+# macsec_policy=1 requires MACsec; the CAK is derived from the EAP MSK and MKA
+# negotiates the SAK. This hostapd is the MKA key server for the link.
+macsec_policy=1
+macsec_integ_only=0                   # confidentiality (encrypt), matches the supplicant
+macsec_replay_protect=1
+macsec_replay_window=0
+mka_priority=128                      # lower than the supplicant's default => we're key server
+
+# After MKA succeeds the kernel creates a macsec iface on top of `interface`.
+# setup-link.sh bridges that to the serving uplink so DHCP/NVMe flow through.
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# setup-link.sh <supplicant-nic> <uplink-nic>
+#
+# Prep one authenticator link before starting hostapd on it. The authenticator is
+# a 2-sided node: <supplicant-nic> faces the workstation (hostapd + MACsec runs
+# here), <uplink-nic> faces the serving VLAN (DHCP/NVMe/RADIUS). After MKA
+# succeeds hostapd creates a macsec iface over <supplicant-nic>; the DECRYPTED
+# traffic on that macsec iface must reach the serving network — we bridge it to
+# <uplink-nic>.
+#
+# Run as root on the authenticator node (VM or inline box). BENCH-VERIFY the
+# macsec iface name hostapd creates on your build (assumed "macsec0").
+set -euo pipefail
+
+SUP=${1:?usage: setup-link.sh <supplicant-nic> <uplink-nic>}
+UP=${2:?uplink nic required}
+MACSEC=${3:-macsec0}      # iface hostapd creates after MKA (override if different)
+BR=${BR:-br-auth}
+
+ip link set "$SUP" up
+ip link set "$UP"  up
+
+# Allow EAPOL through any bridge in the path (reserved PAE multicast is dropped
+# by default). The supplicant-facing side is a raw NIC for hostapd, so this is
+# mainly for the uplink bridge.
+ip link add name "$BR" type bridge 2>/dev/null || true
+echo 8 > "/sys/class/net/$BR/bridge/group_fwd_mask" 2>/dev/null || true
+ip link set "$UP" master "$BR"
+ip link set "$BR" up
+
+echo "Authenticator link ready:"
+echo "  supplicant NIC : $SUP   (start hostapd here)"
+echo "  uplink bridge  : $BR <- $UP   (serving VLAN)"
+echo
+echo "AFTER hostapd brings MKA up and creates '$MACSEC', bridge it to the uplink:"
+echo "  ip link set $MACSEC master $BR && ip link set $MACSEC up"
+echo "(Do this once $MACSEC exists; automate with a hostapd 'macsec' up-hook if"
+echo " your build supports one.)"