X-Git-Url: https://git.archive.openwrt.org/?p=project%2Fluci.git;a=blobdiff_plain;f=applications%2Fluci-splash%2Froot%2Fetc%2Finit.d%2Fluci_splash;h=4f36252e6a207ea68bd8047280d44e8b101f499b;hp=5206d448cb6dfe0920886b069449ca05f0efaade;hb=15088f5dd4f53cb25e71a871dd4ed25440ec7eb5;hpb=6fa65fa9ec7a85a4fda885b385dc988cfb258dc2 diff --git a/applications/luci-splash/root/etc/init.d/luci_splash b/applications/luci-splash/root/etc/init.d/luci_splash index 5206d448c..4f36252e6 100755 --- a/applications/luci-splash/root/etc/init.d/luci_splash +++ b/applications/luci-splash/root/etc/init.d/luci_splash @@ -5,23 +5,30 @@ EXTRA_COMMANDS=clear_leases LIMIT_DOWN=0 LIMIT_DOWN_BURST=0 LIMIT_UP=0 +TC=/usr/sbin/tc +IPT=/usr/sbin/iptables +IPT6=/usr/sbin/ip6tables IPT_REPLAY=/var/run/luci_splash.iptlog LOCK=/var/run/luci_splash.lock - -include /lib/network -scan_interfaces -config_load luci_splash +[ -x $IPT6 ] && [ -f /proc/net/ipv6_route ] && HAS_IPV6=1 silent() { "$@" 2>/dev/null } ipt_log() { - iptables -I "$@" - echo iptables -D "$@" >> $IPT_REPLAY + $IPT -I "$@" + echo $IPT -D "$@" >> $IPT_REPLAY +} + +ipt6_log() { + [ "$HAS_IPV6" = 1 ] || return + $IPT6 -I "$@" + echo $IPT6 -D "$@" >> $IPT_REPLAY } + iface_add() { local cfg="$1" @@ -40,8 +47,14 @@ iface_add() { config_get netmask "$net" netmask [ -n "$netmask" ] || return 0 - config_get parentiface "$net" interface - [ -n "$parentiface" ] && { + config_get ip6addr "$net" ip6addr + + config_get type "$net" type + + parentiface="$(uci -q get network.${net}.ifname)" + + [ -n "$parentiface" ] && [ ! "$type" = "bridge" ] && { + parentiface=${parentiface#@} config_get parentproto "$parentiface" proto config_get parentipaddr "$parentiface" ipaddr config_get parentnetmask "$parentiface" netmask @@ -49,21 +62,27 @@ iface_add() { eval "$(ipcalc.sh $ipaddr $netmask)" + logger -s -p info -t splash "Add $NETWORK/$PREFIX ($ifname) to splashed networks." + ### Add interface specific chain entry rules - ipt_log "zone_${zone}_prerouting" -i "${ifname%:*}" -s "$NETWORK/$PREFIX" -j luci_splash_prerouting -t nat - ipt_log "zone_${zone}_forward" -i "${ifname%:*}" -s "$NETWORK/$PREFIX" -j luci_splash_forwarding -t filter + ipt_log "prerouting_${zone}_rule" -i "${ifname%:*}" -s "$NETWORK/$PREFIX" -j luci_splash_prerouting -t nat + ipt_log "forwarding_${zone}_rule" -i "${ifname%:*}" -s "$NETWORK/$PREFIX" -j luci_splash_forwarding -t filter + + if [ "$HAS_IPV6" = 1 ] && [ -n "$ip6addr" ]; then + ipt6_log "forwarding_${zone}_rule" -i "${ifname%:*}" -s "$ip6addr" -j luci_splash_forwarding -t filter + fi ### Allow traffic to the same subnet - iptables -t nat -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN - iptables -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN + $IPT -t nat -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN + $IPT -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN ### Allow traffic to the mesh subnet [ "$parentproto" = "static" -a -n "$parentipaddr" ] && { - iptables -t nat -I luci_splash_prerouting -d "$parentipaddr/${parentnetmask:-32}" -j RETURN - iptables -t filter -I luci_splash_forwarding -d "$parentipaddr/${parentnetmask:-32}" -j RETURN + $IPT -t nat -I luci_splash_prerouting -d "$parentipaddr/${parentnetmask:-32}" -j RETURN + $IPT -t filter -I luci_splash_forwarding -d "$parentipaddr/${parentnetmask:-32}" -j RETURN } - qos_iface_add "$ifname" + qos_iface_add "$ifname" "$NETWORK" "$PREFIX" } iface_del() { @@ -78,6 +97,7 @@ iface_del() { # Clear interface specific rules [ -s $IPT_REPLAY ] && { + logger -s -p info -t splash "Remove $ifname from splashed networks." grep -- "-i ${ifname%:*}" $IPT_REPLAY | while read ln; do silent $ln; done sed -ie "/-i ${ifname%:*}/d" $IPT_REPLAY } @@ -90,6 +110,14 @@ mac_add() { append MACS "$mac" } +whitelist_add() { + config_get mac "$1" mac + iface=$2 + $TC filter add dev "$iface" parent ffff: protocol ip prio 1 u32 match ether src $mac police pass + $TC filter add dev "$iface" parent 1:0 protocol ip prio 1 u32 match ether dst classid 1:1 +} + + subnet_add() { local cfg="$1" @@ -97,52 +125,54 @@ subnet_add() { config_get netmask "$cfg" netmask [ -n "$ipaddr" ] && { - iptables -t nat -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN - iptables -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN + $IPT -t nat -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN + $IPT -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN } } qos_iface_add() { local iface="$1" + local network="$2" + local prefix="$3" - # 77 -> download root qdisc - # 78 -> upload root qdisc - # 79 -> fwmark: client->inet - # 80 -> fwmark: inet->client + # 77 -> download root qdisc + # ffff -> upload root qdisc - silent tc qdisc del dev "$iface" root handle 77: + silent $TC qdisc del dev "$iface" root handle 1: + silent $TC class del dev "$iface" parent 1: classid 1:ffff + silent $TC class del dev "$iface" parent 1: classid 1:1 + silent $TC filter del dev "$iface" parent ffff: protocol ip prio 1 u32 + silent $TC filter del dev "$iface" parent ffff: protocol ip prio 2 u32 + silent $TC filter del dev "$iface" parent ffff: protocol ip prio 3 u32 if [ "$LIMIT_UP" -gt 0 -a "$LIMIT_DOWN" -gt 0 ]; then - tc qdisc add dev "$iface" root handle 77: htb - - # assume maximum rate of 20.000 kilobit for wlan - tc class add dev "$iface" parent 77: classid 77:1 htb rate 20000kbit + # Setup qdiscs + $TC qdisc add dev "$iface" root handle 1: htb default 1 + silent $TC qdisc add dev "$iface" ingress - # set download limit and burst - tc class add dev "$iface" parent 77:1 classid 77:10 htb \ - rate ${LIMIT_DOWN}kbit ceil ${LIMIT_DOWN_BURST}kbit prio 2 + # Default class - all clients which are not otherwise handled are put in that class + # and share that bandwidth. + $TC class add dev "$iface" parent 1: classid 1:ffff htb rate ${LIMIT_DOWN}kbit - tc qdisc add dev "$iface" parent 77:10 handle 78: sfq perturb 10 + # default class and class for whitelisted clients = unlimited + $TC class add dev "$iface" parent 1: classid 1:1 htb rate 100mbit - # adding ingress can result in "File exists" if qos-scripts are active - silent tc qdisc add dev "$iface" ingress + # All traffic to the dhcp subnet is put into the limited class + $TC filter add dev "$iface" parent 1:0 protocol ip prio 3 u32 match ip dst $network/$prefix classid 1:ffff + $TC qdisc add dev "$iface" parent 1:ffff sfq perturb 10 + $TC filter add dev "$iface" parent ffff: protocol ip prio 3 u32 match ip src $network/$prefix police rate ${LIMIT_UP}kbit mtu 6k burst 6k drop - # set client download speed - tc filter add dev "$iface" parent 77: protocol ip prio 2 \ - handle 80 fw flowid 77:10 + # classify packets by their iptables MARK set in luci_splash_mark_in (mangle table) + # every client gets his own class and so his own bandwidth limit + $TC filter add dev "$iface" parent 1:0 protocol ip prio 2 fw - # set client upload speed - tc filter add dev "$iface" parent ffff: protocol ip prio 1 \ - handle 79 fw police rate ${LIMIT_UP}kbit mtu 6k burst 6k drop + config_foreach whitelist_add whitelist $iface fi } qos_iface_del() { local iface="$1" - - silent tc qdisc del dev "$iface" root handle 77: - silent tc qdisc del dev "$iface" root handle 78: - silent tc filter del dev "$iface" parent ffff: protocol ip prio 1 handle 79 fw + silent $TC qdisc del dev "$iface" root handle 77: } boot() { @@ -155,7 +185,7 @@ uci batch < $IPT_REPLAY - ### Build the main and portal rule - config_foreach iface_add iface - config_foreach subnet_add subnet - ### Add interface independant prerouting rules - iptables -t nat -A luci_splash_prerouting -j luci_splash_leases - iptables -t nat -A luci_splash_leases -p udp --dport 53 -j REDIRECT --to-ports 53 - iptables -t nat -A luci_splash_leases -p tcp --dport 80 -j REDIRECT --to-ports 8082 + $IPT -t nat -A luci_splash_prerouting -j luci_splash_leases + $IPT -t nat -A luci_splash_leases -p udp --dport 53 -j REDIRECT --to-ports 53 + $IPT -t nat -A luci_splash_leases -p tcp --dport 80 -j REDIRECT --to-ports 8082 ### Add interface independant forwarding rules - iptables -t filter -A luci_splash_forwarding -j luci_splash_filter - iptables -t filter -A luci_splash_filter -p tcp -j REJECT --reject-with tcp-reset - iptables -t filter -A luci_splash_filter -j REJECT --reject-with icmp-net-prohibited + $IPT -t filter -A luci_splash_forwarding -j luci_splash_filter + $IPT -t filter -A luci_splash_filter -p tcp -j REJECT --reject-with tcp-reset + $IPT -t filter -A luci_splash_filter -j REJECT --reject-with icmp-net-prohibited + + if [ "$HAS_IPV6" = 1 ]; then + $IPT6 -t filter -A luci_splash_forwarding -j luci_splash_filter + $IPT6 -t filter -A luci_splash_filter -p tcp -j REJECT --reject-with tcp-reset + $IPT6 -t filter -A luci_splash_filter -j REJECT --reject-with adm-prohibited + fi ### Add QoS chain - [ "$LIMIT_UP" -gt 0 -a "$LIMIT_DOWN" -gt 0 ] && { - iptables -t mangle -N luci_splash_mark_out - iptables -t mangle -N luci_splash_mark_in - iptables -t mangle -I PREROUTING -j luci_splash_mark_out - iptables -t mangle -I POSTROUTING -j luci_splash_mark_in + $IPT -t mangle -N luci_splash_mark_out + $IPT -t mangle -N luci_splash_mark_in + $IPT -t mangle -I PREROUTING -j luci_splash_mark_out + $IPT -t mangle -I POSTROUTING -j luci_splash_mark_in + + if [ "$HAS_IPV6" = 1 ]; then + $IPT6 -t mangle -N luci_splash_mark_out + $IPT6 -t mangle -N luci_splash_mark_in + $IPT6 -t mangle -I PREROUTING -j luci_splash_mark_out + $IPT6 -t mangle -I POSTROUTING -j luci_splash_mark_in + fi + + ### Build the main and portal rule + config_foreach iface_add iface + config_foreach subnet_add subnet + + ### Add the community homepage to the list of allowed destination subnets + hp=$(uci -q get freifunk.community.homepage) && { + chp=${hp#http*://} + chp=${chp%%/*} + $IPT -t nat -I luci_splash_prerouting -d "${chp}/32" -j RETURN + $IPT -t filter -I luci_splash_forwarding -d "${chp}/32" -j RETURN } ### Find active mac addresses MACS="" - config_foreach mac_add lease + + config_foreach mac_add blacklist config_foreach mac_add whitelist + #config_load luci_splash_leases + config_foreach mac_add lease + ### Add crontab entry test -f /etc/crontabs/root || touch /etc/crontabs/root grep -q luci-splash /etc/crontabs/root || { @@ -238,30 +301,51 @@ start() { } stop() { - lock -w $LOCK && lock $LOCK + lock $LOCK + + include /lib/network + scan_interfaces + config_load luci_splash ### Clear interface rules config_foreach iface_del iface - silent iptables -t mangle -D PREROUTING -j luci_splash_mark_out - silent iptables -t mangle -D POSTROUTING -j luci_splash_mark_in + silent $IPT -t mangle -D PREROUTING -j luci_splash_mark_out + silent $IPT -t mangle -D POSTROUTING -j luci_splash_mark_in + + if [ "$HAS_IPV6" = 1 ]; then + silent $IPT6 -t mangle -D PREROUTING -j luci_splash_mark_out + silent $IPT6 -t mangle -D POSTROUTING -j luci_splash_mark_in + fi ### Clear subchains - silent iptables -t nat -F luci_splash_prerouting - silent iptables -t nat -F luci_splash_leases - silent iptables -t filter -F luci_splash_forwarding - silent iptables -t filter -F luci_splash_filter - silent iptables -t mangle -F luci_splash_mark_out - silent iptables -t mangle -F luci_splash_mark_in + silent $IPT -t nat -F luci_splash_prerouting + silent $IPT -t nat -F luci_splash_leases + silent $IPT -t filter -F luci_splash_forwarding + silent $IPT -t filter -F luci_splash_filter + silent $IPT -t mangle -F luci_splash_mark_out + silent $IPT -t mangle -F luci_splash_mark_in + + if [ "$HAS_IPV6" = 1 ]; then + $IPT6 -t filter -F luci_splash_forwarding + $IPT6 -t filter -F luci_splash_filter + $IPT6 -t mangle -F luci_splash_mark_out + $IPT6 -t mangle -F luci_splash_mark_in + fi ### Delete subchains - silent iptables -t nat -X luci_splash_prerouting - silent iptables -t nat -X luci_splash_leases - silent iptables -t filter -X luci_splash_forwarding - silent iptables -t filter -X luci_splash_filter - silent iptables -t mangle -X luci_splash_mark_out - silent iptables -t mangle -X luci_splash_mark_in - + silent $IPT -t nat -X luci_splash_prerouting + silent $IPT -t nat -X luci_splash_leases + silent $IPT -t filter -X luci_splash_forwarding + silent $IPT -t filter -X luci_splash_filter + silent $IPT -t mangle -X luci_splash_mark_out + silent $IPT -t mangle -X luci_splash_mark_in + if [ "$HAS_IPV6" = 1 ]; then + $IPT6 -t filter -X luci_splash_forwarding + $IPT6 -t filter -X luci_splash_filter + $IPT6 -t mangle -X luci_splash_mark_out + $IPT6 -t mangle -X luci_splash_mark_in + fi sed -ie '/\/usr\/sbin\/luci-splash sync/d' /var/spool/cron/crontabs/root lock -u $LOCK