21ff95af78
- pxe-nic-check: count 802.1X only from an authenticator (EAPOL type 0 with EAP Request/Success/Failure). iPXE sends EAPOL-Start on every NIC open and Windows sends Start/Response, so a PXE-booting bay made the verdict 'ge' and the watch stopped dnsmasq for the floor. - pxe-nic-check: join the STP/PAE/LLDP/CDP/PVST+ multicast groups on every capture socket, so CDP-only ports are heard on a plain NIC. - pxe-nic-check --watch: if dnsmasq was (re)started inside the window, re-check (~6 s) before stopping it; skip when already stopped. New --state-cmd and --print-imaging. - pxe-nic-carrier (+ pxe-nic-carrier.service): networkd-dispatcher hook for the imaging NIC only. Carrier loss stops dnsmasq; carrier gain restarts it through its guard if it was running or the hook stopped it. - pxe-dhcp-hook.sh: clear only SMB (tcp 445/139) conntrack entries and sockets, not all traffic for the client, which raced iPXE's first HTTP fetch. - GetPxeScript.aspx: every boot line has a failure branch (iPXE 2.0 accepts an unsigned EFI kernel and fails at boot under Secure Boot, which aborted the script). - Tests: client EAPOL, packet_mreq packing, watch race, shell helpers on stub PATH, lab scenarios eapol-client, br-eapol-client, race, carrier.
18 lines
704 B
Desktop File
18 lines
704 B
Desktop File
# Periodic imaging-NIC watch (pxe-nic-check.timer runs this every 5 min).
|
|
# Listens 60 s on each NIC, probes the imaging NIC for foreign DHCP, writes
|
|
# /run/pxe-nic-status.json for the webapp, and STOPS dnsmasq if the imaging
|
|
# NIC turns out to be on the GE network or next to another DHCP server.
|
|
# It never starts dnsmasq: after fixing the cabling, start it by hand
|
|
# (systemctl start dnsmasq), which re-runs the guard. If dnsmasq was
|
|
# restarted inside the window it re-checks (~6 s) before stopping it.
|
|
|
|
[Unit]
|
|
Description=PXE NIC watch: keep dnsmasq off the GE corporate network
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/pxe-nic-check --watch
|
|
TimeoutStartSec=180
|
|
Nice=5
|