applications/luci-splash: Always insert the mangling rules, not just when bandwidth...

[project/luci.git] / applications / luci-splash / root / usr / sbin / luci-splash

diff --git a/applications/luci-splash/root/usr/sbin/luci-splash b/applications/luci-splash/root/usr/sbin/luci-splash
index ae459ad..34b2e9c 100755 (executable)
--- a/applications/luci-splash/root/usr/sbin/luci-splash
+++ b/applications/luci-splash/root/usr/sbin/luci-splash
@@ -9,10 +9,13 @@ require("luci.sys.iptparser")
 local uci = luci.model.uci.cursor_state()
 local ipt = luci.sys.iptparser.IptParser()
 local net = luci.sys.net
+local fs = require "luci.fs"
 
 local limit_up = 0
 local limit_down = 0
 
+local has_ipv6 = fs.access("/proc/net/ipv6_route") and fs.access("/usr/sbin/ip6tables")
+
 function lock()
        os.execute("lock /var/run/luci_splash.lock")
 end
@@ -191,6 +194,26 @@ function ipt_delete_all(args, comp, off)
        end
 end
 
+function ipt6_delete_all(args, comp, off)
+       off = off or { }
+       for i, r in ipairs(ipt:find(args)) do
+               if comp == nil or comp(r) then
+                       off[r.table] = off[r.table] or { }
+                       off[r.table][r.chain] = off[r.table][r.chain] or 0
+
+                       os.execute("ip6tables -t %q -D %q %d 2>/dev/null"
+                               %{ r.table, r.chain, r.index - off[r.table][r.chain] })
+
+                       off[r.table][r.chain] = off[r.table][r.chain] + 1
+               end
+       end
+end
+
+
+-- Convert mac to uci-compatible section name
+function convert_mac_to_secname(mac)
+       return string.gsub(mac, ":", "")
+end
 
 -- Add a lease to state and invoke add_rule
 function add_lease(mac, arp, no_uci)
@@ -208,7 +231,7 @@ function add_lease(mac, arp, no_uci)
        -- Add lease if there is an ip addr
        if ipaddr then
                if not no_uci then
-                       uci:section("luci_splash", "lease", nil, {
+                       uci:section("luci_splash", "lease", convert_mac_to_secname(mac), {
                                mac    = mac,
                                ipaddr = ipaddr,
                                start  = os.time()
@@ -241,7 +264,7 @@ end
 
 -- Add a whitelist entry
 function add_whitelist(mac)
-       uci:section("luci_splash", "whitelist", nil, { mac = mac })
+       uci:section("luci_splash", "whitelist", convert_mac_to_secname(mac), { mac = mac })
        uci:save("luci_splash")
        uci:commit("luci_splash")
        add_whitelist_rule(mac)
@@ -250,7 +273,7 @@ end
 
 -- Add a blacklist entry
 function add_blacklist(mac)
-       uci:section("luci_splash", "blacklist", nil, { mac = mac })
+       uci:section("luci_splash", "blacklist", convert_mac_to_secname(mac), { mac = mac })
        uci:save("luci_splash")
        uci:commit("luci_splash")
        add_blacklist_rule(mac)
@@ -281,13 +304,19 @@ end
 
 -- Add an iptables rule
 function add_lease_rule(mac, ipaddr)
-       if limit_up > 0 and limit_down > 0 then
-               os.execute("iptables -t mangle -I luci_splash_mark_out -m mac --mac-source %q -j MARK --set-mark 79" % mac)
-               os.execute("iptables -t mangle -I luci_splash_mark_in -d %q -j MARK --set-mark 80" % ipaddr)
+    os.execute("iptables -t mangle -I luci_splash_mark_out -m mac --mac-source %q -j MARK --set-mark 79" % mac)
+    os.execute("iptables -t mangle -I luci_splash_mark_in -d %q -j MARK --set-mark 80" % ipaddr)
+       if has_ipv6 then
+        os.execute("ip6tables -t mangle -I luci_splash_mark_out -m mac --mac-source %q -j MARK --set-mark 79" % mac)
+        os.execute("ip6tables -t mangle -I luci_splash_mark_in -d %q -j MARK --set-mark 80" % ipaddr)
        end
 
+
        os.execute("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
        os.execute("iptables -t nat    -I luci_splash_leases -m mac --mac-source %q -j RETURN" % mac)
+       if has_ipv6 then
+               os.execute("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
+       end
 end
 
 
@@ -302,6 +331,9 @@ function remove_lease_rule(mac, ipaddr)
 
        ipt_delete_all({table="filter", chain="luci_splash_filter",   options={"MAC", mac:upper()}})
        ipt_delete_all({table="nat",    chain="luci_splash_leases",   options={"MAC", mac:upper()}})
+       if has_ipv6 then
+               ipt6_delete_all({table="filter", chain="luci_splash_filter",   options={"MAC", mac:upper()}})
+       end
 end
 
 
@@ -309,12 +341,18 @@ end
 function add_whitelist_rule(mac)
        os.execute("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
        os.execute("iptables -t nat    -I luci_splash_leases -m mac --mac-source %q -j RETURN" % mac)
+       if has_ipv6 then
+               os.execute("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
+       end
 end
 
 
 -- Add blacklist rules
 function add_blacklist_rule(mac)
        os.execute("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j DROP" % mac)
+       if has_ipv6 then
+               os.execute("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j DROP" % mac)
+       end
 end
 
 
@@ -342,7 +380,7 @@ function sync()
                                remove_lease_rule(v.mac, v.ipaddr)
                        else
                                -- Rewrite state
-                               uci:section("luci_splash", "lease", nil, {              
+                               uci:section("luci_splash", "lease", convert_mac_to_secname(v.mac), {            
                                        mac    = v.mac,
                                        ipaddr = v.ipaddr,
                                        start  = v.start
@@ -361,16 +399,22 @@ function sync()
 
        ipt_delete_all({table="filter", chain="luci_splash_filter", options={"MAC"}},
                function(r) return not macs[r.options[2]:lower()] end)
-
        ipt_delete_all({table="nat", chain="luci_splash_leases", options={"MAC"}},
                function(r) return not macs[r.options[2]:lower()] end)
-
        ipt_delete_all({table="mangle", chain="luci_splash_mark_out", options={"MAC", "MARK", "set"}},
                function(r) return not macs[r.options[2]:lower()] end)
-
        ipt_delete_all({table="mangle", chain="luci_splash_mark_in", options={"MARK", "set"}},
                function(r) return not ips[r.destination] end)
 
+       if has_ipv6 then
+               ipt6_delete_all({table="filter", chain="luci_splash_filter", options={"MAC"}},
+                       function(r) return not macs[r.options[2]:lower()] end)
+               ipt_delete_all({table="mangle", chain="luci_splash_mark_out", options={"MAC", "MARK", "set"}},
+                       function(r) return not macs[r.options[2]:lower()] end)
+               ipt_delete_all({table="mangle", chain="luci_splash_mark_in", options={"MARK", "set"}},
+                       function(r) return not ips[r.destination] end)
+       end
+
        unlock()
 end