secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 18:36:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(nac): discover clients on br-lxc + config-extendable lan_interfaces (was 0 clients)

Browse Source 
_parse_arp() filtered every neighbour not in a hardcoded LAN_INTERFACES set
(lan0-3/br0/br-lan/eth0-1), so on gk2 (clients on br-lxc + eth2) the dashboard
showed nothing but the template. Add br-lxc to the default set and read extra
interfaces from nac config lan_interfaces. gk2 config adds eth2 → 13 clients.
This commit is contained in:
CyberMind-FR 2026-07-10 14:13:54 +02:00
parent 8a90404770
commit 4ed0758da8
2 changed files with 29 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
packages/secubox-nac/api/main.py
View File

@ -247,13 +247,30 @@ def _parse_leases() -> list[dict]:
return clients
# Interfaces to scan for ARP entries (LAN interfaces only)
LAN_INTERFACES = {"lan0", "lan1", "lan2", "lan3", "br0", "br-lan", "eth0", "eth1"}
# Interfaces to scan for ARP entries. Defaults cover the DSA switch LAN ports,
# common bridges, and the secubox LXC bridge (br-lxc — its containers are
# managed clients). A board whose clients reach it on another interface (e.g.
# gk2 sits transparently on the upstream 192.168.1.0/24 via eth2) extends this
# via nac config `lan_interfaces` (list or comma string) — WITHOUT this, ARP
# discovery filters every neighbour out and the dashboard shows no clients.
_DEFAULT_LAN_INTERFACES = {"lan0", "lan1", "lan2", "lan3", "br0", "br-lan", "br-lxc", "eth0", "eth1"}
def _lan_interfaces() -> set:
try:
cfg = get_config("nac") or {}
extra = cfg.get("lan_interfaces") or []
if isinstance(extra, str):
extra = [x.strip() for x in extra.split(",") if x.strip()]
return _DEFAULT_LAN_INTERFACES | set(extra)
except Exception:
return _DEFAULT_LAN_INTERFACES
def _parse_arp() -> list[dict]:
"""Parse ARP table for network clients (fallback when DHCP leases unavailable)."""
clients = []
lan_ifs = _lan_interfaces()
try:
# Use ip neigh for more reliable ARP parsing
r = subprocess.run(
@ -287,7 +304,7 @@ def _parse_arp() -> list[dict]:
continue
# Only include clients from LAN interfaces
if iface and iface not in LAN_INTERFACES:
if iface and iface not in lan_ifs:
continue
# Skip IPv6 link-local

9
packages/secubox-nac/debian/changelog
View File

@ -1,3 +1,12 @@
secubox-nac (1.0.5-1~bookworm1) bookworm; urgency=medium
* fix: NAC discovered 0 clients when devices live on br-lxc or an interface
outside the hardcoded LAN set (dashboard showed only the template). ARP
discovery now includes br-lxc by default and reads extra interfaces from
nac config (gk2: eth2).
-- Gerald KERMA <devel@cybermind.fr> Thu, 10 Jul 2026 11:00:00 +0200
secubox-nac (1.0.4-1~bookworm2) bookworm; urgency=medium
* webui: hybrid-dark cyan reskin (WebUI Panel Guidelines) baked into the package.