35.6. 根据 hostapd 身份验证事件阻止和允许流量

流程

1. 使用以下内容创建 /usr/local/bin/802-1x-tr-mgmt 文件：

   #!/bin/sh
   
   TABLE="tr-mgmt-${1}"
   read -r -d '' TABLE_DEF << EOF
   table bridge ${TABLE} {
       set allowed_macs {
           type ether_addr
       }
   
       chain accesscontrol {
           ether saddr @allowed_macs accept
           ether daddr @allowed_macs accept
           drop
       }
   
       chain forward {
           type filter hook forward priority 0; policy accept;
           meta ibrname "br0" jump accesscontrol
       }
   }
   EOF
   
   case ${2:-NOTANEVENT} in
       block_all)
           nft destroy table bridge "$TABLE"
           printf "$TABLE_DEF" | nft -f -
           echo "$1: All the bridge traffic blocked. Traffic for a client with a given MAC will be allowed after 802.1x authentication"
           ;;
   
       AP-STA-CONNECTED | CTRL-EVENT-EAP-SUCCESS | CTRL-EVENT-EAP-SUCCESS2)
           nft add element bridge tr-mgmt-br0 allowed_macs { $3 }
           echo "$1: Allowed traffic from $3"
           ;;
   
       AP-STA-DISCONNECTED | CTRL-EVENT-EAP-FAILURE)
           nft delete element bridge tr-mgmt-br0 allowed_macs { $3 }
           echo "$1: Denied traffic from $3"
           ;;
   
       allow_all)
           nft destroy table bridge "$TABLE"
           echo "$1: Allowed all bridge traffice again"
           ;;
   
       NOTANEVENT)
           echo "$0 was called incorrectly, usage: $0 interface event [mac_address]"
           ;;
   esac

2. 使用以下内容创建 /etc/systemd/system/802-1x-tr-mgmt@.service systemd 服务文件：

   [Unit]
   Description=Example 802.1x traffic management for hostapd
   After=hostapd.service
   After=sys-devices-virtual-net-%i.device
   
   [Service]
   Type=simple
   ExecStartPre=bash -c '/usr/sbin/hostapd_cli ping | grep PONG'
   ExecStartPre=/usr/local/bin/802-1x-tr-mgmt %i block_all
   ExecStart=/usr/sbin/hostapd_cli -i %i -a /usr/local/bin/802-1x-tr-mgmt
   ExecStopPost=/usr/local/bin/802-1x-tr-mgmt %i allow_all
   
   [Install]
   WantedBy=multi-user.target

3. 重新载入 systemd：

   # systemctl daemon-reload

4. 启用并启动接口名称 hostapd 正在侦听的 802-1x-tr-mgmt 服务：

   # systemctl enable --now 802-1x-tr-mgmt@br0.service