bc422649e9
pxe-nic-check classifies each NIC from what it hears: LLDP/CDP/802.1X from managed switches, foreign DHCP offers and their domain (one DHCPDISCOVER on the imaging NIC; the GE NIC's networkd lease is read instead), STP and ARP hosts for information. A kernel BPF filter keeps bulk SMB traffic out of the capture loop; bridge ports are listened on too, since LLDP and EAPOL stop at the port. - dnsmasq drop-in runs --guard as ExecStartPre: exit 1 on a ge or foreign-dhcp imaging verdict, fail open (loudly) on bugs or no link - pxe-nic-check.timer runs --watch every 5 min: stops dnsmasq on a bad imaging verdict, never starts it - /run/pxe-nic-status.json (0644, atomic) for the webapp - playbook installs it all and writes /etc/pxe-server/nic.conf from pxe_imaging_mac, pxe_ge_mac, pxe_corp_domain_suffixes, pxe_nic_allowed_switches - unit tests plus a no-root network-namespace lab (veth pairs, a raw socket DHCP/LLDP peer and real dnsmasq); docs/pxe-nic-guard.md has the operator notes and the two floor tests
17 lines
619 B
Desktop File
17 lines
619 B
Desktop File
# Periodic imaging-NIC watch (pxe-nic-check.timer runs this every 5 min).
|
|
# Listens 60 s on each NIC, probes the imaging NIC for foreign DHCP, writes
|
|
# /run/pxe-nic-status.json for the webapp, and STOPS dnsmasq if the imaging
|
|
# NIC turns out to be on the GE network or next to another DHCP server.
|
|
# It never starts dnsmasq: after fixing the cabling, start it by hand
|
|
# (systemctl start dnsmasq), which re-runs the guard.
|
|
|
|
[Unit]
|
|
Description=PXE NIC watch: keep dnsmasq off the GE corporate network
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/pxe-nic-check --watch
|
|
TimeoutStartSec=180
|
|
Nice=5
|