39 lines
1.6 KiB
Bash
Executable File
39 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# setup-link.sh <supplicant-nic> <uplink-nic>
|
|
#
|
|
# Prep one authenticator link before starting hostapd on it. The authenticator is
|
|
# a 2-sided node: <supplicant-nic> faces the workstation (hostapd + MACsec runs
|
|
# here), <uplink-nic> faces the serving VLAN (DHCP/NVMe/RADIUS). After MKA
|
|
# succeeds hostapd creates a macsec iface over <supplicant-nic>; the DECRYPTED
|
|
# traffic on that macsec iface must reach the serving network — we bridge it to
|
|
# <uplink-nic>.
|
|
#
|
|
# Run as root on the authenticator node (VM or inline box). BENCH-VERIFY the
|
|
# macsec iface name hostapd creates on your build (assumed "macsec0").
|
|
set -euo pipefail
|
|
|
|
SUP=${1:?usage: setup-link.sh <supplicant-nic> <uplink-nic>}
|
|
UP=${2:?uplink nic required}
|
|
MACSEC=${3:-macsec0} # iface hostapd creates after MKA (override if different)
|
|
BR=${BR:-br-auth}
|
|
|
|
ip link set "$SUP" up
|
|
ip link set "$UP" up
|
|
|
|
# Allow EAPOL through any bridge in the path (reserved PAE multicast is dropped
|
|
# by default). The supplicant-facing side is a raw NIC for hostapd, so this is
|
|
# mainly for the uplink bridge.
|
|
ip link add name "$BR" type bridge 2>/dev/null || true
|
|
echo 8 > "/sys/class/net/$BR/bridge/group_fwd_mask" 2>/dev/null || true
|
|
ip link set "$UP" master "$BR"
|
|
ip link set "$BR" up
|
|
|
|
echo "Authenticator link ready:"
|
|
echo " supplicant NIC : $SUP (start hostapd here)"
|
|
echo " uplink bridge : $BR <- $UP (serving VLAN)"
|
|
echo
|
|
echo "AFTER hostapd brings MKA up and creates '$MACSEC', bridge it to the uplink:"
|
|
echo " ip link set $MACSEC master $BR && ip link set $MACSEC up"
|
|
echo "(Do this once $MACSEC exists; automate with a hostapd 'macsec' up-hook if"
|
|
echo " your build supports one.)"
|