From 3e45e17626f384028208e38b14cf688f9da22b63 Mon Sep 17 00:00:00 2001
From: Ian Gulliver <ian@flamingcow.tv>
Date: Sun, 14 Apr 2019 19:03:54 +0000
Subject: [PATCH] First historical article

---
 2016-05-17-wifi-bridging-redux.html | 60 +++++++++++++++++++++++++++--
 include/article-header.html         |  2 +-
 include/bottom.html                 |  4 ++
 include/page-head.html              |  2 +-
 include/style.css                   | 23 ++++++++++-
 include/top.html                    |  4 ++
 index.html                          |  1 +
 7 files changed, 89 insertions(+), 7 deletions(-)

diff --git a/2016-05-17-wifi-bridging-redux.html b/2016-05-17-wifi-bridging-redux.html
index fee04c3..df73bf5 100644
--- a/2016-05-17-wifi-bridging-redux.html
+++ b/2016-05-17-wifi-bridging-redux.html
@@ -7,17 +7,71 @@
 
 <p>You can copy the hardware from the router post, or use what you’ve got; I don’t believe this is driver-specific.</p>
 
-<p>Your access point, however, does require support for this to work. It needs to:
+<p>Your access point, however, does require support for this to work. It needs to:</p>
 <ul>
 	<li>Make use of <a href="http://madwifi-project.org/wiki/AboutWDS">4-address WDS</a>. Basically, this means “don’t assume that the source MAC address of the ethernet frame and the source MAC address of the WLAN frame are the same”.</li>
 	<li>Allow frames where the ethernet and WLAN source MAC addresses differ (like above, but a policy decision).</li>
 	<li>Not assume that the WLAN MAC address is the only MAC at the other end of the link. This assumption is frequently used to reduce the effect of broadcast traffic in a WiFi environment by filtering. There may be settings like “Multicast optimization”, “Broadcast optimization”, or “DHCP optimization” that you need to turn off.</li>
 </ul>
-</p>
 
 <h3>Bridging</h3>
 
 <p>Linux supports bridging. There’s a bridge-utils package in Ubuntu with the tools you need:
+<code>sudo apt-get install bridge-utils</code></p>
+
+<p>To see current bridges, run:
+<code>brcrl show</code></p>
+
+<p>However, you can’t normally add a WiFi interface to a bridge:
+<code>$ sudo brctl addif br0 eth0 wlan0
+can't add wlan0 to bridge br0: Operation not supported</code></p>
+
+<p>Googling this error produces a wide range of well-meaning yet completely unhelpful results.</p>
+
+<h3>Enable 4 address mode</h3>
+
+<p>To be able to add a WiFi interface to a bridge, you have to put it into 4-address mode first:
+<code># If necessary:
+# sudo apt-get install iw
+sudo iw dev wlan0 set 4addr on</code></p>
+
+<p>From that point forward, the interface won’t be able to talk normally, and wpa_supplicant is likely to time out in the association phase (run “sudo wpa_cli” to watch its logs).</p>
+
+<p>Now add the interface to a bridge:
+<code>sudo brctl addif br0 wlan0</code></p>
+
+<p>You should now be able to fetch an IP on br0 via DHCP. Unless, of course, you need wpa_supplicant to work…</p>
+
+<h3>wpa_supplicant</h3>
+
+<p>wpa_supplicant needs to be bridge-aware to work with 4-address mode. Fortunately, it has a flag (-b) to set the bridge interface. Unfortunately, this flag is broken in 2.1, the version in Ubuntu Trusty. I verified that it works in wpa_supplicant 2.5 built from source; I haven’t verified 2.4 from Xenial.</p>
+
+<p>A wpa_supplicant commandline looks something like:
+<code>wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf -C /var/run/wpa_supplicant -P /var/run/wpa_supplicant.wlan0.pid -b br0</code></p>
+
+<p>With that working, the interface should get to wpa_state=COMPLETED, and br0 should work normally. Remember that wlan0 will still be unusable directly.</p>
+
+<h3>Ordering</h3>
+
+<p>Bringing up these interfaces is tricky; the ordering is annoying.</p>
+<ul>
+	<li>4-address mode has to be on before you can add wlan0 to br0</li>
+	<li>br0 must exist before you can start wpa_supplicant</li>
+	<li>wpa_supplicant must be running before you can get an IP address on br0</li>
+</ul>
+
+<h3>Putting it together</h3>
+
+<p>Because of the ordering issues, it’s easier to treat this all as one interface that has to come up together. Here’s an example interface stanza that does this:
+<code>auto br0
+iface br0 inet dhcp
+  pre-up /sbin/iw dev wlan0 set 4addr on
+  pre-up /sbin/brctl addbr $IFACE || true
+  pre-up /sbin/start-stop-daemon --start --pidfile=/var/run/wpa_supplicant.wlan0.pid --exec=/usr/local/sbin/wpa_supplicant --user=root -- -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf -C /var/run/wpa_supplicant -P /var/run/wpa_supplicant.wlan0.pid -b $IFACE
+  bridge_ports eth0 eth1 wlan0
+  post-down /sbin/start-stop-daemon --stop --pidfile=/var/run/wpa_supplicant.wlan0.pid --exec=/usr/local/sbin/wpa_supplicant --user=root
+  post-down /sbin/iw dev wlan0 set 4addr off</code></p>
+
+<p>We use start-stop-daemon because it provides idempotence and safety from stale PID files.</p>
 
-</p>
 <!--# include file="include/bottom.html" -->
diff --git a/include/article-header.html b/include/article-header.html
index 7166de3..6b41844 100644
--- a/include/article-header.html
+++ b/include/article-header.html
@@ -5,7 +5,7 @@
 <!--# endif -->
 
 <!--# if expr="$title" -->
-<h2><!--# echo var="title" --></h3>
+<h2><!--# echo var="title" --></h2>
 <!--# endif -->
 
 <hr>
diff --git a/include/bottom.html b/include/bottom.html
index 75f0619..f6187e2 100644
--- a/include/bottom.html
+++ b/include/bottom.html
@@ -1,5 +1,9 @@
 <!--# include file="article-footer.html" -->
+
+<!--# if expr="$title" -->
 </article>
+<!--# endif -->
+
 </main>
 <!--# include file="page-footer.html" -->
 </body>
diff --git a/include/page-head.html b/include/page-head.html
index 9a5facf..9ab0609 100644
--- a/include/page-head.html
+++ b/include/page-head.html
@@ -3,7 +3,7 @@
 	<meta charset="UTF-8">
 	<meta name="theme-color" content="#000000">
 	<link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">
-	<style type="text/css">
+	<style>
 	<!--# include file="style.css" -->
 	</style>
 	<title><!--# echo var="title" default="where the flamingcow roams" --></title>
diff --git a/include/style.css b/include/style.css
index 94446e8..cc6199e 100644
--- a/include/style.css
+++ b/include/style.css
@@ -52,13 +52,14 @@ h2 {
 	font-size: 16px;
 	font-weight: bold;
 	text-transform: uppercase;
-	margin-block-start: 0.5em;
-	margin-block-end: 0.5em;
+	margin-top: 0.5em;
+	margin-bottom: 0.5em;
 }
 
 h3 {
 	font-size: 16px;
 	font-weight: bold;
+	margin-top: 2em;
 }
 
 h4 {
@@ -74,3 +75,21 @@ h4 {
 ul li {
 	margin-bottom: 10px;
 }
+
+code {
+	display: block;
+	white-space: pre;
+
+	font-family: Monospace, Courier;
+	font-size: 16px;
+
+	background-color: #e8e8e8;
+	color: black;
+
+	border: 1px solid black; 
+
+	padding: 1ch;
+	margin: 1ch;
+
+	overflow: scroll;
+}
diff --git a/include/top.html b/include/top.html
index 83bb43f..66e8421 100644
--- a/include/top.html
+++ b/include/top.html
@@ -5,5 +5,9 @@
 <!--# include file="page-header.html" -->
 
 <main>
+
+<!--# if expr="$title" -->
 <article>
+<!--# endif -->
+
 <!--# include file="article-header.html" -->
diff --git a/index.html b/index.html
index 4097695..a1df2ed 100644
--- a/index.html
+++ b/index.html
@@ -3,6 +3,7 @@
 <div class="index">
 <ol>
 	<li>2019-Apr-14: <a href="2019-04-14-reboot.html">Reboot</a></li>
+	<li>2016-May-17: <a href="2016-05-17-wifi-bridging-redux.html">WiFi bridging redux</a></li>
 </ol>
 </div>