blob: f3df6a14f20b0b1300e5fa46e16f5b28351dd8ec (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
|
#!/bin/sh /etc/rc.common
#
# description: Startup/shutdown script for nodogsplash captive portal
#
# Alexander Couzens <lynxis@fe80.eu> 2014
# P. Kube 2007
#
# (Based on wifidog startup script
# Date : 2004-08-25
# Version : 1.0
# Comment by that author: Could be better, but it's working as expected)
#
START=95
STOP=95
USE_PROCD=1
IPT=/usr/sbin/iptables
WD_DIR=/usr/bin
# -s -d 5 runs in background, with level 5 (not so verbose) messages to syslog
# -f -d 7 runs in foreground, with level 7 (verbose) debug messages to terminal
OPTIONS="-s -f -d 5"
CONFIGFILE="/tmp/invalid_nodogsplash.conf"
# nolog(loglevel message ...)
nolog() {
local level=$1
shift
logger -s -t nodogsplash -p daemon.$level $@
}
# append_config_option_map <cfgfile> <uci_cfg_obj> <option_name> <config_counterpart> [<optional default>]
# append "$config_counterpart $value" to cfgfile if option_name exists
# e.g. append_config_option "$CONFIGFILE" "$cfg" bind_address BindAddress 0.0.0.0
# will append "BindAddress 192.168.1.1" if uci bind_address is '192.168.1.1'
append_config_option_map() {
local val=""
local config_file="$1"
local cfg="$2"
local option_name="$3"
local config_counterpart="$4"
local default="$5"
config_get val "$cfg" "$option_name" "$default"
[ -n "$val" ] && echo "$config_counterpart $val" >> $config_file
}
# append_config_option <cfgfile> <uci_cfg_obj> <option_name> [<optional default>]
# append "$option_name $value" to cfgfile if option_name exists
# e.g. append_config_option "$CONFIGFILE" "$cfg" bind_address 0.0.0.0
# will append "bind_address 192.168.1.1" if uci bind_address is '192.168.1.1'
# if uci bind_address is unset append "bind_address 0.0.0.0"
append_config_option() {
local val=""
local config_file="$1"
local cfg="$2"
local option_name="$3"
local default="$4"
config_get val "$cfg" "$option_name" "$default"
[ -n "$val" ] && echo "$option_name $val" >> $config_file
}
setup_mac_lists() {
local cfg="$1"
local MAC=""
local val
append_mac() {
append MAC "$1" ","
}
config_get val "$cfg" macmechanism
if [ -z "$val" ] ; then
# check if we have AllowedMACList or BlockedMACList defined they will be ignored
config_get val "$cfg" allowedmac
if [ -n "$val" ] ; then
echo "Ignoring allowedmac - macmechanism not \"allow\"" >&2
fi
config_get val "$cfg" blockedmac
if [ -n "$val" ] ; then
echo "Ignoring blockedmac - macmechanism not \"block\"" >&2
fi
elif [ "$val" == "allow" ] ; then
MAC=""
config_list_foreach "$cfg" allowedmac append_mac
echo "AllowedMACList $MAC" >> $CONFIGFILE
elif [ "$val" == "block" ] ; then
MAC=""
config_list_foreach "$cfg" blockedmac append_mac
echo "BlockedMACList $MAC" >> $CONFIGFILE
else
nolog error "$cfg Invalid macmechanism '$val' - allow or block are valid."
return 1
fi
MAC=""
config_list_foreach "$cfg" trustedmac append_mac
[ -n "$MAC" ] && echo "TrustedMACList $MAC" >> $CONFIGFILE
}
setup_firewall() {
local cfg="$1"
local uciname
local val
append_firewall() {
echo " FirewallRule $1" >> $CONFIGFILE
}
for rule in $(echo authenticated-users preauthenticated-users users-to-router trusted-users trusted-users-to-router)
do
uci_name=${rule//-/_}
# uci does not allow - dashes
echo "FirewallRuleSet $rule {" >> $CONFIGFILE
config_list_foreach "$cfg" ${uci_name} append_firewall
echo "}" >> $CONFIGFILE
config_get val "$cfg" policy_${uci_name}
[ -n "$val" ] && echo "EmptyRuleSetPolicy $rule $val" >> $CONFIGFILE
done
}
generate_uci_config() {
local cfg="$1"
local val
local ifname
local download
local upload
CONFIGFILE="/tmp/etc/nodogsplash_$cfg.conf"
echo "# auto-generated config file from /etc/config/nodogsplash" > $CONFIGFILE
config_get val "$cfg" config
if [ -n "$val" ] ; then
if [ ! -f "$val" ] ; then
nolog error "Configuration file '$file' doesn't exist"
return 0
fi
cat "$val" >> $CONFIGFILE
fi
config_get val "$cfg" network
if [ -n "$val" ] ; then
if ! network_get_device ifname "$val" ; then
nolog error "$cfg can not find ifname for network '$val'"
return 1
fi
fi
config_get val "$cfg" gatewayinterface
if [ -n "$val" ] ; then
if [ -n "$ifname" ] ; then
nolog error "$cfg cannot use both option network and gatewayinterface"
return 1
fi
ifname="$val"
fi
if [ -z "$ifname" ] ; then
nolog error "$cfg option network or gatewayinterface missing"
return 1
fi
echo "GatewayInterface $ifname" >> $CONFIGFILE
append_config_option "$CONFIGFILE" "$cfg" gatewayname
append_config_option "$CONFIGFILE" "$cfg" gatewayaddress
append_config_option "$CONFIGFILE" "$cfg" gatewayport
append_config_option "$CONFIGFILE" "$cfg" maxclients
append_config_option "$CONFIGFILE" "$cfg" webroot
append_config_option "$CONFIGFILE" "$cfg" debuglevel
append_config_option "$CONFIGFILE" "$cfg" splashpage
append_config_option "$CONFIGFILE" "$cfg" pagesdir
append_config_option "$CONFIGFILE" "$cfg" checkinterval
append_config_option "$CONFIGFILE" "$cfg" syslogfacility
append_config_option "$CONFIGFILE" "$cfg" gatewayiprange
append_config_option "$CONFIGFILE" "$cfg" imagedir
append_config_option "$CONFIGFILE" "$cfg" redirecturl
append_config_option "$CONFIGFILE" "$cfg" clientidletimeout
append_config_option "$CONFIGFILE" "$cfg" clientforcetimeout
append_config_option "$CONFIGFILE" "$cfg" gatewayiprange
append_config_option "$CONFIGFILE" "$cfg" passwordattempts
append_config_option "$CONFIGFILE" "$cfg" macmechanism
append_config_option "$CONFIGFILE" "$cfg" uploadlimit
append_config_option "$CONFIGFILE" "$cfg" downloadlimit
append_config_option "$CONFIGFILE" "$cfg" remoteauthenticatoraction
append_config_option "$CONFIGFILE" "$cfg" enablepreauth
append_config_option "$CONFIGFILE" "$cfg" binvoucher
append_config_option "$CONFIGFILE" "$cfg" forcevoucher
append_config_option "$CONFIGFILE" "$cfg" passwordauthentication
append_config_option "$CONFIGFILE" "$cfg" usernameauthentication
append_config_option "$CONFIGFILE" "$cfg" passwordattempts
append_config_option "$CONFIGFILE" "$cfg" username
append_config_option "$CONFIGFILE" "$cfg" password
append_config_option "$CONFIGFILE" "$cfg" authenticateimmediately
append_config_option "$CONFIGFILE" "$cfg" decongesthttpdthreads
append_config_option "$CONFIGFILE" "$cfg" httpdthreadthreshold
append_config_option "$CONFIGFILE" "$cfg" httpdthreaddelayms
append_config_option "$CONFIGFILE" "$cfg" fw_mark_authenticated
append_config_option "$CONFIGFILE" "$cfg" fw_mark_trusted
append_config_option "$CONFIGFILE" "$cfg" fw_mark_blocked
config_get download "$cfg" downloadlimit
config_get upload "$cfg" uploadlimit
[ -n "$upload" -o -n "$download" ] && echo "TrafficControl yes" >> $CONFIGFILE
setup_mac_lists "$cfg"
setup_firewall "$cfg"
}
# setup configuration and start instance
create_instance() {
local cfg="$1"
local manual_config
local val
config_get_bool val "$cfg" enabled 0
[ $val -gt 0 ] || return 0
generate_uci_config "$cfg"
if ! test_module ; then
logger -s -t nodogsplash -p daemon.error "nodogsplash is missing some kernel modules"
fi
procd_open_instance $cfg
procd_set_param command /usr/bin/nodogsplash -c $CONFIGFILE $OPTIONS
procd_set_param respawn
procd_set_param file $CONFIGFILE
procd_close_instance
}
start_service() {
include /lib/functions
mkdir -p /tmp/etc/
config_load nodogsplash
config_foreach create_instance nodogsplash
}
stop_service() {
# nodogsplash doesn't exit fast enought, when procd terminates it.
# otherwise procd will restart nodogsplash twice. first time starting nodogsplash fails, second time it succeeds
sleep 1
}
status() {
$WD_DIR/ndsctl status
}
# Test if we got all modules loaded
test_module() {
### Test ipt_mark with iptables
test_ipt_mark () {
($IPT -A FORWARD -m mark --mark 2 -j ACCEPT 2>&1) > /dev/null
IPTABLES_OK=$?
if [ "$IPTABLES_OK" -eq 0 ]; then
($IPT -D FORWARD -m mark --mark 2 -j ACCEPT 2>&1) > /dev/null
return 0
else
return 1
fi
}
### Test ipt_mac with iptables
test_ipt_mac () {
($IPT -A INPUT -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT 2>&1) > /dev/null
IPTABLES_OK=$?
if [ "$IPTABLES_OK" -eq 0 ]; then
($IPT -D INPUT -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT 2>&1) > /dev/null
return 0
else
return 1
fi
}
### Test ipt_IMQ with iptables
test_ipt_IMQ () {
($IPT -t mangle -A PREROUTING -j IMQ --todev 0 2>&1) > /dev/null
IPTABLES_OK=$?
if [ "$IPTABLES_OK" -eq 0 ]; then
($IPT -t mangle -D PREROUTING -j IMQ --todev 0 2>&1) > /dev/null
return 0
else
return 1
fi
}
### Test imq with ip
test_imq () {
(ip link set imq0 up 2>&1) > /dev/null
IMQ0_OK=$?
(ip link set imq1 up 2>&1) > /dev/null
IMQ1_OK=$?
if [ "$IMQ0_OK" -eq 0 -a "$IMQ1_OK" -eq 0 ]; then
(ip link set imq0 down 2>&1) > /dev/null
(ip link set imq1 down 2>&1) > /dev/null
return 0
else
return 1
fi
}
### Test sch_htb with tc; requires imq0
test_sch_htb () {
(tc qdisc del dev imq0 root 2>&1) > /dev/null
(tc qdisc add dev imq0 root htb 2>&1) > /dev/null
TC_OK=$?
if [ "$TC_OK" -eq 0 ]; then
(tc qdisc del dev imq0 root 2>&1) > /dev/null
return 0
else
return 1
fi
}
### Find a module on disk
module_exists () {
EXIST=$(find /lib/modules/`uname -r` -name $1.*o 2> /dev/null)
if [ -n "$EXIST" ]; then
return 0
else
return 1
fi
}
### Test if a module is in memory
module_in_memory () {
MODULE=$(lsmod | grep $1 | awk '{print $1}')
if [ "$MODULE" = "$1" ]; then
return 0
else
return 1
fi
}
### Test functionality of a module; load if necessary
do_module_tests () {
echo " Testing module $1 $2"
"test_$1"
if [ $? -ne 0 ]; then
echo " Module $1 $2 needed"
echo " Scanning disk for $1 module"
module_exists $1
if [ $? -ne 0 ]; then
echo " $1 module missing: please install it"
exit 1
else
echo " $1 exists, trying to load"
insmod $1 $2 > /dev/null
if [ $? -ne 0 ]; then
echo " Error: insmod $1 $2 failed"
exit 1
else
echo " $1 $2 loaded successfully"
fi
fi
else
echo " $1 is working"
fi
}
echo " Testing required modules"
do_module_tests "ipt_mac"
do_module_tests "ipt_mark"
# test for imq modules, only if TrafficControl is enabled in conf
if ( grep -q -E '^[[:space:]]*TrafficControl[[:space:]]+(yes|true|1)' "$CONFIGFILE" ) ; then
do_module_tests "imq" "numdevs=2"
do_module_tests "ipt_IMQ"
do_module_tests "sch_htb"
fi
}
|