applications/luci-splash: Always insert the mangling rules, not just when bandwidth...

[project/luci.git] / applications / luci-splash / root / usr / sbin / luci-splash

diff --git a/applications/luci-splash/root/usr/sbin/luci-splash b/applications/luci-splash/root/usr/sbin/luci-splash
index da3b58d..34b2e9c 100755 (executable)
--- a/applications/luci-splash/root/usr/sbin/luci-splash
+++ b/applications/luci-splash/root/usr/sbin/luci-splash
@@ -9,12 +9,15 @@ require("luci.sys.iptparser")
 local uci = luci.model.uci.cursor_state()
 local ipt = luci.sys.iptparser.IptParser()
 local net = luci.sys.net
+local fs = require "luci.fs"
 
 local limit_up = 0
 local limit_down = 0
 
+local has_ipv6 = fs.access("/proc/net/ipv6_route") and fs.access("/usr/sbin/ip6tables")
+
 function lock()
-       os.execute("lock -w /var/run/luci_splash.lock && lock /var/run/luci_splash.lock")
+       os.execute("lock /var/run/luci_splash.lock")
 end
 
 function unlock()
@@ -191,6 +194,26 @@ function ipt_delete_all(args, comp, off)
        end
 end
 
+function ipt6_delete_all(args, comp, off)
+       off = off or { }
+       for i, r in ipairs(ipt:find(args)) do
+               if comp == nil or comp(r) then
+                       off[r.table] = off[r.table] or { }
+                       off[r.table][r.chain] = off[r.table][r.chain] or 0
+
+                       os.execute("ip6tables -t %q -D %q %d 2>/dev/null"
+                               %{ r.table, r.chain, r.index - off[r.table][r.chain] })
+
+                       off[r.table][r.chain] = off[r.table][r.chain] + 1
+               end
+       end
+end
+
+
+-- Convert mac to uci-compatible section name
+function convert_mac_to_secname(mac)
+       return string.gsub(mac, ":", "")
+end
 
 -- Add a lease to state and invoke add_rule
 function add_lease(mac, arp, no_uci)
@@ -208,7 +231,7 @@ function add_lease(mac, arp, no_uci)
        -- Add lease if there is an ip addr
        if ipaddr then
                if not no_uci then
-                       uci:section("luci_splash", "lease", nil, {
+                       uci:section("luci_splash", "lease", convert_mac_to_secname(mac), {
                                mac    = mac,
                                ipaddr = ipaddr,
                                start  = os.time()
@@ -241,7 +264,7 @@ end
 
 -- Add a whitelist entry
 function add_whitelist(mac)
-       uci:section("luci_splash", "whitelist", nil, { mac = mac })
+       uci:section("luci_splash", "whitelist", convert_mac_to_secname(mac), { mac = mac })
        uci:save("luci_splash")
        uci:commit("luci_splash")
        add_whitelist_rule(mac)
@@ -250,7 +273,7 @@ end
 
 -- Add a blacklist entry
 function add_blacklist(mac)
-       uci:section("luci_splash", "blacklist", nil, { mac = mac })
+       uci:section("luci_splash", "blacklist", convert_mac_to_secname(mac), { mac = mac })
        uci:save("luci_splash")
        uci:commit("luci_splash")
        add_blacklist_rule(mac)
@@ -281,13 +304,19 @@ end
 
 -- Add an iptables rule
 function add_lease_rule(mac, ipaddr)
-       if limit_up > 0 and limit_down > 0 then
-               os.execute("iptables -t mangle -I luci_splash_mark_out -m mac --mac-source %q -j MARK --set-mark 79" % mac)
-               os.execute("iptables -t mangle -I luci_splash_mark_in -d %q -j MARK --set-mark 80" % ipaddr)
+    os.execute("iptables -t mangle -I luci_splash_mark_out -m mac --mac-source %q -j MARK --set-mark 79" % mac)
+    os.execute("iptables -t mangle -I luci_splash_mark_in -d %q -j MARK --set-mark 80" % ipaddr)
+       if has_ipv6 then
+        os.execute("ip6tables -t mangle -I luci_splash_mark_out -m mac --mac-source %q -j MARK --set-mark 79" % mac)
+        os.execute("ip6tables -t mangle -I luci_splash_mark_in -d %q -j MARK --set-mark 80" % ipaddr)
        end
 
+
        os.execute("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
        os.execute("iptables -t nat    -I luci_splash_leases -m mac --mac-source %q -j RETURN" % mac)
+       if has_ipv6 then
+               os.execute("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
+       end
 end
 
 
@@ -302,6 +331,9 @@ function remove_lease_rule(mac, ipaddr)
 
        ipt_delete_all({table="filter", chain="luci_splash_filter",   options={"MAC", mac:upper()}})
        ipt_delete_all({table="nat",    chain="luci_splash_leases",   options={"MAC", mac:upper()}})
+       if has_ipv6 then
+               ipt6_delete_all({table="filter", chain="luci_splash_filter",   options={"MAC", mac:upper()}})
+       end
 end
 
 
@@ -309,13 +341,18 @@ end
 function add_whitelist_rule(mac)
        os.execute("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
        os.execute("iptables -t nat    -I luci_splash_leases -m mac --mac-source %q -j RETURN" % mac)
+       if has_ipv6 then
+               os.execute("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j RETURN" % mac)
+       end
 end
 
 
 -- Add blacklist rules
 function add_blacklist_rule(mac)
        os.execute("iptables -t filter -I luci_splash_filter -m mac --mac-source %q -j DROP" % mac)
-       os.execute("iptables -t nat    -I luci_splash_leases -m mac --mac-source %q -j DROP" % mac)
+       if has_ipv6 then
+               os.execute("ip6tables -t filter -I luci_splash_filter -m mac --mac-source %q -j DROP" % mac)
+       end
 end
 
 
@@ -343,7 +380,7 @@ function sync()
                                remove_lease_rule(v.mac, v.ipaddr)
                        else
                                -- Rewrite state
-                               uci:section("luci_splash", "lease", nil, {              
+                               uci:section("luci_splash", "lease", convert_mac_to_secname(v.mac), {            
                                        mac    = v.mac,
                                        ipaddr = v.ipaddr,
                                        start  = v.start
@@ -362,16 +399,22 @@ function sync()
 
        ipt_delete_all({table="filter", chain="luci_splash_filter", options={"MAC"}},
                function(r) return not macs[r.options[2]:lower()] end)
-
        ipt_delete_all({table="nat", chain="luci_splash_leases", options={"MAC"}},
                function(r) return not macs[r.options[2]:lower()] end)
-
        ipt_delete_all({table="mangle", chain="luci_splash_mark_out", options={"MAC", "MARK", "set"}},
                function(r) return not macs[r.options[2]:lower()] end)
-
        ipt_delete_all({table="mangle", chain="luci_splash_mark_in", options={"MARK", "set"}},
                function(r) return not ips[r.destination] end)
 
+       if has_ipv6 then
+               ipt6_delete_all({table="filter", chain="luci_splash_filter", options={"MAC"}},
+                       function(r) return not macs[r.options[2]:lower()] end)
+               ipt_delete_all({table="mangle", chain="luci_splash_mark_out", options={"MAC", "MARK", "set"}},
+                       function(r) return not macs[r.options[2]:lower()] end)
+               ipt_delete_all({table="mangle", chain="luci_splash_mark_in", options={"MARK", "set"}},
+                       function(r) return not ips[r.destination] end)
+       end
+
        unlock()
 end
 
@@ -380,7 +423,7 @@ function list()
        -- Get current arp cache
        local arpcache = { }
        for _, entry in ipairs(net.arptable()) do
-               arpcache[entry["HW address"]:lower()] = { entry["Device"], entry["IP address"] }
+               arpcache[entry["HW address"]:lower()] = { entry["Device"]:lower(), entry["IP address"]:lower() }
        end
 
        -- Find traffic usage
@@ -410,7 +453,7 @@ function list()
                if s[".type"] == "lease" and s.mac then
                        local ti, to = traffic(s)
                        local mac = s.mac:lower()
-                       local arp = arpcache[mac]:lower()
+                       local arp = arpcache[mac]
                        print(string.format(
                                "%-17s  %-15s  %-9s  %3dm  %-7s  %7dKB  %7dKB",
                                mac, s.ipaddr, "leased",
@@ -426,11 +469,11 @@ function list()
        ) do
                if (s[".type"] == "whitelist" or s[".type"] == "blacklist") and s.mac then
                        local mac = s.mac:lower()
-                       local arp = arpcache[mac]:lower()
+                       local arp = arpcache[mac]
                        print(string.format(
                                "%-17s  %-15s  %-9s  %4s  %-7s  %9s  %9s",
-                               mac, arp and arp[2] or "?", s[".type"], "- ",
-                               arp and arp[1] or "?", "-", "-"
+                               mac, arp and arp[2] or "?", s[".type"],
+                               "- ", arp and arp[1] or "?", "-", "-"
                        ))
                end
        end