17.9. Bloquer et autoriser le trafic en fonction des événements d'authentification hostapd

Procédure

1. Créez le fichier /usr/local/bin/802-1x-tr-mgmt avec le contenu suivant :

   #!/bin/sh
   
   if [ "x$1" == "xblock_all" ]
   then
   
       nft delete table bridge tr-mgmt-br0 2>/dev/null || true
       nft -f - << EOF
   table bridge tr-mgmt-br0 {
           set allowed_macs {
                   type ether_addr
           }
   
           chain accesscontrol {
                   ether saddr @allowed_macs accept
                   ether daddr @allowed_macs accept
                   drop
           }
   
           chain forward {
                   type filter hook forward priority 0; policy accept;
                   meta ibrname "br0" jump accesscontrol
           }
   }
   EOF
       echo "802-1x-tr-mgmt Blocking all traffic through br0. Traffic for given host will be allowed after 802.1x authentication"
   
   elif [ "x$1" == "xallow_all" ]
   then
   
       nft delete table bridge tr-mgmt-br0
       echo "802-1x-tr-mgmt Allowed all forwarding again"
   
   fi
   
   case ${2:-NOTANEVENT} in
   
       AP-STA-CONNECTED | CTRL-EVENT-EAP-SUCCESS | CTRL-EVENT-EAP-SUCCESS2)
           nft add element bridge tr-mgmt-br0 allowed_macs { $3 }
           echo "$1: Allowed traffic from $3"
           ;;
   
       AP-STA-DISCONNECTED | CTRL-EVENT-EAP-FAILURE)
           nft delete element bridge tr-mgmt-br0 allowed_macs { $3 }
           echo "802-1x-tr-mgmt $1: Denied traffic from $3"
           ;;
   
   esac

2. Créez le fichier de service /etc/systemd/system/802-1x-tr-mgmt@.service systemd avec le contenu suivant :

   [Unit]
   Description=Example 802.1x traffic management for hostapd
   After=hostapd.service
   After=sys-devices-virtual-net-%i.device
   
   [Service]
   Type=simple
   ExecStartPre=-/bin/sh -c '/usr/sbin/tc qdisc del dev %i ingress > /dev/null 2>&1'
   ExecStartPre=-/bin/sh -c '/usr/sbin/tc qdisc del dev %i clsact > /dev/null 2>&1'
   ExecStartPre=/usr/sbin/tc qdisc add dev %i clsact
   ExecStartPre=/usr/sbin/tc filter add dev %i ingress pref 10000 protocol 0x888e matchall action ok index 100
   ExecStartPre=/usr/sbin/tc filter add dev %i ingress pref 10001 protocol all matchall action drop index 101
   ExecStart=/usr/sbin/hostapd_cli -i %i -a /usr/local/bin/802-1x-tr-mgmt
   ExecStopPost=-/usr/sbin/tc qdisc del dev %i clsact
   
   [Install]
   WantedBy=multi-user.target

3. Recharger systemd :

   # systemctl daemon-reload

4. Activez et démarrez le service 802-1x-tr-mgmt avec le nom de l'interface sur laquelle hostapd écoute :

   # systemctl enable --now 802-1x-tr-mgmt@br0.service