X-Git-Url: https://git.archive.openwrt.org/?p=project%2Fluci.git;a=blobdiff_plain;f=applications%2Fluci-splash%2Froot%2Fetc%2Finit.d%2Fluci_splash;h=4f36252e6a207ea68bd8047280d44e8b101f499b;hp=d9ef21c217406b01768abf464a67cd3bb4c84762;hb=15088f5dd4f53cb25e71a871dd4ed25440ec7eb5;hpb=5e9fcc76c02914aa75649492b97aa7d37358c068 diff --git a/applications/luci-splash/root/etc/init.d/luci_splash b/applications/luci-splash/root/etc/init.d/luci_splash index d9ef21c21..4f36252e6 100755 --- a/applications/luci-splash/root/etc/init.d/luci_splash +++ b/applications/luci-splash/root/etc/init.d/luci_splash @@ -1,160 +1,192 @@ #!/bin/sh /etc/rc.common + START=70 EXTRA_COMMANDS=clear_leases -SPLASH_INTERFACES="" LIMIT_DOWN=0 LIMIT_DOWN_BURST=0 LIMIT_UP=0 +TC=/usr/sbin/tc +IPT=/usr/sbin/iptables +IPT6=/usr/sbin/ip6tables + +IPT_REPLAY=/var/run/luci_splash.iptlog +LOCK=/var/run/luci_splash.lock +[ -x $IPT6 ] && [ -f /proc/net/ipv6_route ] && HAS_IPV6=1 silent() { "$@" 2>/dev/null } +ipt_log() { + $IPT -I "$@" + echo $IPT -D "$@" >> $IPT_REPLAY +} + +ipt6_log() { + [ "$HAS_IPV6" = 1 ] || return + $IPT6 -I "$@" + echo $IPT6 -D "$@" >> $IPT_REPLAY +} + + iface_add() { local cfg="$1" - + config_get zone "$cfg" zone [ -n "$zone" ] || return 0 - + config_get net "$cfg" network [ -n "$net" ] || return 0 config_get ifname "$net" ifname [ -n "$ifname" ] || return 0 - + config_get ipaddr "$net" ipaddr [ -n "$ipaddr" ] || return 0 - + config_get netmask "$net" netmask [ -n "$netmask" ] || return 0 - + + config_get ip6addr "$net" ip6addr + + config_get type "$net" type + + parentiface="$(uci -q get network.${net}.ifname)" + + [ -n "$parentiface" ] && [ ! "$type" = "bridge" ] && { + parentiface=${parentiface#@} + config_get parentproto "$parentiface" proto + config_get parentipaddr "$parentiface" ipaddr + config_get parentnetmask "$parentiface" netmask + } + eval "$(ipcalc.sh $ipaddr $netmask)" - iptables -t nat -A prerouting_${zone} -j luci_splash_prerouting - iptables -t nat -A luci_splash_prerouting -s "$NETWORK/$PREFIX" -p ! tcp -j luci_splash_portal - iptables -t nat -A luci_splash_prerouting -s "$NETWORK/$PREFIX" -d ! "$ipaddr" -j luci_splash_portal - iptables -t nat -A luci_splash_prerouting -s "$NETWORK/$PREFIX" -d "$ipaddr" -p tcp -m multiport ! --dport 22,80,443 -j luci_splash_portal + logger -s -p info -t splash "Add $NETWORK/$PREFIX ($ifname) to splashed networks." + + ### Add interface specific chain entry rules + ipt_log "prerouting_${zone}_rule" -i "${ifname%:*}" -s "$NETWORK/$PREFIX" -j luci_splash_prerouting -t nat + ipt_log "forwarding_${zone}_rule" -i "${ifname%:*}" -s "$NETWORK/$PREFIX" -j luci_splash_forwarding -t filter + + if [ "$HAS_IPV6" = 1 ] && [ -n "$ip6addr" ]; then + ipt6_log "forwarding_${zone}_rule" -i "${ifname%:*}" -s "$ip6addr" -j luci_splash_forwarding -t filter + fi + + ### Allow traffic to the same subnet + $IPT -t nat -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN + $IPT -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN - qos_iface_add "$ifname" + ### Allow traffic to the mesh subnet + [ "$parentproto" = "static" -a -n "$parentipaddr" ] && { + $IPT -t nat -I luci_splash_prerouting -d "$parentipaddr/${parentnetmask:-32}" -j RETURN + $IPT -t filter -I luci_splash_forwarding -d "$parentipaddr/${parentnetmask:-32}" -j RETURN + } - append SPLASH_INTERFACES "$ifname" + qos_iface_add "$ifname" "$NETWORK" "$PREFIX" } iface_del() { - config_get zone "$1" zone + config_get zone "$1" zone [ -n "$zone" ] || return 0 - config_get ifname "$1" ifname + config_get net "$1" network + [ -n "$net" ] || return 0 + + config_get ifname "$net" ifname [ -n "$ifname" ] || return 0 - while iptables -t nat -D prerouting_${zone} -j luci_splash_prerouting 2>&-; do :; done + # Clear interface specific rules + [ -s $IPT_REPLAY ] && { + logger -s -p info -t splash "Remove $ifname from splashed networks." + grep -- "-i ${ifname%:*}" $IPT_REPLAY | while read ln; do silent $ln; done + sed -ie "/-i ${ifname%:*}/d" $IPT_REPLAY + } qos_iface_del "$ifname" } -blacklist_add() { - local cfg="$1" - - config_get mac "$cfg" mac - [ -n "$mac" ] && { - iptables -t filter -I luci_splash_counter -m mac --mac-source "$mac" -j RETURN - iptables -t nat -I luci_splash_leases -m mac --mac-source "$mac" -j DROP - } +mac_add() { + config_get mac "$1" mac + append MACS "$mac" } whitelist_add() { - local cfg="$1" - - config_get mac "$cfg" mac - [ -n "$mac" ] && { - iptables -t filter -I luci_splash_counter -m mac --mac-source "$mac" -j RETURN - iptables -t nat -I luci_splash_leases -m mac --mac-source "$mac" -j RETURN - } + config_get mac "$1" mac + iface=$2 + $TC filter add dev "$iface" parent ffff: protocol ip prio 1 u32 match ether src $mac police pass + $TC filter add dev "$iface" parent 1:0 protocol ip prio 1 u32 match ether dst classid 1:1 } -lease_add() { + +subnet_add() { local cfg="$1" - - config_get mac "$cfg" mac - config_get ban "$cfg" kicked - ban=${ban:+DROP} + config_get ipaddr "$cfg" ipaddr + config_get netmask "$cfg" netmask - [ -n "$mac" ] && { - local oIFS="$IFS"; IFS=":" - set -- $mac - IFS="$oIFS"; unset oIFS - - local mac_pre="$1$2" - local mac_post="$3$4$5$6" - local handle="$6" - - iptables -t filter -I luci_splash_counter -m mac --mac-source "$mac" -j RETURN - iptables -t mangle -I luci_splash_mark -m mac --mac-source "$mac" -j MARK --set-mark 79 - iptables -t nat -I luci_splash_leases -m mac --mac-source "$mac" -j "${ban:-RETURN}" - - for i in $SPLASH_INTERFACES; do - tc filter add dev $i parent 77:0 protocol ip prio 2 handle ::$handle u32 \ - match u16 0x0800 0xFFFF at -2 match u32 0x$mac_post 0xFFFFFFFF at -12 \ - match u16 0x$mac_pre 0xFFFF at -14 flowid 77:10 - done + [ -n "$ipaddr" ] && { + $IPT -t nat -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN + $IPT -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN } } qos_iface_add() { local iface="$1" + local network="$2" + local prefix="$3" - # 77 -> download root qdisc - # 78 -> upload root qdisc - # 79 -> fwmark + # 77 -> download root qdisc + # ffff -> upload root qdisc - silent tc qdisc del dev "$iface" root handle 77: + silent $TC qdisc del dev "$iface" root handle 1: + silent $TC class del dev "$iface" parent 1: classid 1:ffff + silent $TC class del dev "$iface" parent 1: classid 1:1 + silent $TC filter del dev "$iface" parent ffff: protocol ip prio 1 u32 + silent $TC filter del dev "$iface" parent ffff: protocol ip prio 2 u32 + silent $TC filter del dev "$iface" parent ffff: protocol ip prio 3 u32 if [ "$LIMIT_UP" -gt 0 -a "$LIMIT_DOWN" -gt 0 ]; then - tc qdisc add dev "$iface" root handle 77: htb + # Setup qdiscs + $TC qdisc add dev "$iface" root handle 1: htb default 1 + silent $TC qdisc add dev "$iface" ingress - # assume maximum rate of 20.000 kilobit for wlan - tc class add dev "$iface" parent 77: classid 77:1 htb rate 20000kbit + # Default class - all clients which are not otherwise handled are put in that class + # and share that bandwidth. + $TC class add dev "$iface" parent 1: classid 1:ffff htb rate ${LIMIT_DOWN}kbit - # set download limit and burst - tc class add dev "$iface" parent 77:1 classid 77:10 htb \ - rate ${LIMIT_DOWN}kbit ceil ${LIMIT_DOWN_BURST}kbit prio 2 + # default class and class for whitelisted clients = unlimited + $TC class add dev "$iface" parent 1: classid 1:1 htb rate 100mbit - tc qdisc add dev "$iface" parent 77:10 handle 78: sfq perturb 10 + # All traffic to the dhcp subnet is put into the limited class + $TC filter add dev "$iface" parent 1:0 protocol ip prio 3 u32 match ip dst $network/$prefix classid 1:ffff + $TC qdisc add dev "$iface" parent 1:ffff sfq perturb 10 + $TC filter add dev "$iface" parent ffff: protocol ip prio 3 u32 match ip src $network/$prefix police rate ${LIMIT_UP}kbit mtu 6k burst 6k drop - # adding ingress can result in "File exists" if qos-scripts are active - silent tc qdisc add dev "$iface" ingress + # classify packets by their iptables MARK set in luci_splash_mark_in (mangle table) + # every client gets his own class and so his own bandwidth limit + $TC filter add dev "$iface" parent 1:0 protocol ip prio 2 fw - # set client upload speed - tc filter add dev "$iface" parent ffff: protocol ip prio 1 \ - handle 79 fw police rate ${LIMIT_UP}kbit mtu 6k burst 6k drop - fi + config_foreach whitelist_add whitelist $iface + fi } qos_iface_del() { local iface="$1" - - silent tc qdisc del dev "$iface" root handle 77: - silent tc qdisc del dev "$iface" root handle 78: - silent tc filter del dev "$iface" parent ffff: protocol ip prio 1 handle 79 fw + silent $TC qdisc del dev "$iface" root handle 77: } boot() { ### Setup splash-relay - uci get lucid.splashr || { + uci get uhttpd.splash 2>/dev/null || { uci batch < $IPT_REPLAY + + ### Add interface independant prerouting rules + $IPT -t nat -A luci_splash_prerouting -j luci_splash_leases + $IPT -t nat -A luci_splash_leases -p udp --dport 53 -j REDIRECT --to-ports 53 + $IPT -t nat -A luci_splash_leases -p tcp --dport 80 -j REDIRECT --to-ports 8082 + + ### Add interface independant forwarding rules + $IPT -t filter -A luci_splash_forwarding -j luci_splash_filter + $IPT -t filter -A luci_splash_filter -p tcp -j REJECT --reject-with tcp-reset + $IPT -t filter -A luci_splash_filter -j REJECT --reject-with icmp-net-prohibited + + if [ "$HAS_IPV6" = 1 ]; then + $IPT6 -t filter -A luci_splash_forwarding -j luci_splash_filter + $IPT6 -t filter -A luci_splash_filter -p tcp -j REJECT --reject-with tcp-reset + $IPT6 -t filter -A luci_splash_filter -j REJECT --reject-with adm-prohibited + fi + + ### Add QoS chain + $IPT -t mangle -N luci_splash_mark_out + $IPT -t mangle -N luci_splash_mark_in + $IPT -t mangle -I PREROUTING -j luci_splash_mark_out + $IPT -t mangle -I POSTROUTING -j luci_splash_mark_in + + if [ "$HAS_IPV6" = 1 ]; then + $IPT6 -t mangle -N luci_splash_mark_out + $IPT6 -t mangle -N luci_splash_mark_in + $IPT6 -t mangle -I PREROUTING -j luci_splash_mark_out + $IPT6 -t mangle -I POSTROUTING -j luci_splash_mark_in + fi ### Build the main and portal rule config_foreach iface_add iface - config_foreach blacklist_add blacklist - config_foreach whitelist_add whitelist - config_foreach lease_add lease - - ### Build the portal rule - iptables -t filter -I INPUT -j luci_splash_counter - iptables -t filter -I FORWARD -j luci_splash_counter + config_foreach subnet_add subnet + + ### Add the community homepage to the list of allowed destination subnets + hp=$(uci -q get freifunk.community.homepage) && { + chp=${hp#http*://} + chp=${chp%%/*} + $IPT -t nat -I luci_splash_prerouting -d "${chp}/32" -j RETURN + $IPT -t filter -I luci_splash_forwarding -d "${chp}/32" -j RETURN + } + + ### Find active mac addresses + MACS="" - [ "$LIMIT_UP" -gt 0 -a "$LIMIT_DOWN" -gt 0 ] && \ - iptables -t mangle -I PREROUTING -j luci_splash_mark - - iptables -t nat -A luci_splash_portal -p udp --dport 33434:33523 -j RETURN - iptables -t nat -A luci_splash_portal -p icmp -j RETURN - iptables -t nat -A luci_splash_portal -p udp --dport 53 -j RETURN - iptables -t nat -A luci_splash_portal -j luci_splash_leases - - ### Build the leases rule - iptables -t nat -A luci_splash_leases -p tcp --dport 80 -j REDIRECT --to-ports 8082 - iptables -t nat -A luci_splash_leases -j DROP + config_foreach mac_add blacklist + config_foreach mac_add whitelist + + #config_load luci_splash_leases + config_foreach mac_add lease + ### Add crontab entry test -f /etc/crontabs/root || touch /etc/crontabs/root grep -q luci-splash /etc/crontabs/root || { echo '*/5 * * * * /usr/sbin/luci-splash sync' >> /etc/crontabs/root } + + lock -u $LOCK + + ### Populate iptables + [ -n "$MACS" ] && luci-splash add-rules $MACS } stop() { - ### Clear interface rules + lock $LOCK + + include /lib/network + scan_interfaces config_load luci_splash + + ### Clear interface rules config_foreach iface_del iface - silent iptables -t filter -D INPUT -j luci_splash_counter - silent iptables -t filter -D FORWARD -j luci_splash_counter - silent iptables -t mangle -D PREROUTING -j luci_splash_mark - + silent $IPT -t mangle -D PREROUTING -j luci_splash_mark_out + silent $IPT -t mangle -D POSTROUTING -j luci_splash_mark_in + + if [ "$HAS_IPV6" = 1 ]; then + silent $IPT6 -t mangle -D PREROUTING -j luci_splash_mark_out + silent $IPT6 -t mangle -D POSTROUTING -j luci_splash_mark_in + fi + ### Clear subchains - silent iptables -t nat -F luci_splash_leases - silent iptables -t nat -F luci_splash_portal - silent iptables -t nat -F luci_splash_prerouting - silent iptables -t filter -F luci_splash_counter - silent iptables -t mangle -F luci_splash_mark - + silent $IPT -t nat -F luci_splash_prerouting + silent $IPT -t nat -F luci_splash_leases + silent $IPT -t filter -F luci_splash_forwarding + silent $IPT -t filter -F luci_splash_filter + silent $IPT -t mangle -F luci_splash_mark_out + silent $IPT -t mangle -F luci_splash_mark_in + + if [ "$HAS_IPV6" = 1 ]; then + $IPT6 -t filter -F luci_splash_forwarding + $IPT6 -t filter -F luci_splash_filter + $IPT6 -t mangle -F luci_splash_mark_out + $IPT6 -t mangle -F luci_splash_mark_in + fi + ### Delete subchains - silent iptables -t nat -X luci_splash_leases - silent iptables -t nat -X luci_splash_portal - silent iptables -t nat -X luci_splash_prerouting - silent iptables -t filter -X luci_splash_counter - silent iptables -t mangle -X luci_splash_mark - + silent $IPT -t nat -X luci_splash_prerouting + silent $IPT -t nat -X luci_splash_leases + silent $IPT -t filter -X luci_splash_forwarding + silent $IPT -t filter -X luci_splash_filter + silent $IPT -t mangle -X luci_splash_mark_out + silent $IPT -t mangle -X luci_splash_mark_in + if [ "$HAS_IPV6" = 1 ]; then + $IPT6 -t filter -X luci_splash_forwarding + $IPT6 -t filter -X luci_splash_filter + $IPT6 -t mangle -X luci_splash_mark_out + $IPT6 -t mangle -X luci_splash_mark_in + fi sed -ie '/\/usr\/sbin\/luci-splash sync/d' /var/spool/cron/crontabs/root + + lock -u $LOCK } - clear_leases() { - stop - while uci -P /var/state del luci_splash.@lease[0] 2>&-;do :; done - start + ### Find active mac addresses + MACS="" + config_foreach mac_add lease + + ### Clear leases + [ -n "$MACS" ] && luci-splash remove $MACS }