applications/luci-splash/root/usr/sbin/luci-splash

   1 #!/usr/bin/lua
   2
   3 require("luci.util")
   4 require("luci.model.uci")
   5 require("luci.sys.iptparser")
   6
   7 -- Init state session
   8 local uci = luci.model.uci.cursor_state()
   9 local ipt = luci.sys.iptparser.IptParser()
  10
  11 local splash_interfaces = { }
  12 local limit_up = 0
  13 local limit_down = 0
  14
  15 function main(argv)
  16         local cmd = argv[1]
  17         local arg = argv[2]
  18
  19         limit_up = tonumber(uci:get("luci_splash", "general", "limit_up")) or 0
  20         limit_down = tonumber(uci:get("luci_splash", "general", "limit_down")) or 0
  21
  22         uci:foreach("luci_splash", "iface", function(s)
  23                 if s.network then
  24                         splash_interfaces[#splash_interfaces+1] = uci:get("network", s.network, "ifname")
  25                 end
  26         end)
  27
  28         if cmd == "status" and arg then
  29                 if islisted("whitelist", arg) then
  30                         print("whitelisted")
  31                 elseif islisted("blacklist", arg) then
  32                         print("blacklisted")
  33                 else
  34                         local lease = haslease(arg)
  35                         if lease and lease.kicked then
  36                                 print("kicked")
  37                         elseif lease then
  38                                 print("lease")
  39                         else
  40                                 print("unknown")
  41                         end
  42                 end
  43                 os.exit(0)
  44         elseif cmd == "add" and arg then
  45                 if not haslease(arg) then
  46                         add_lease(arg)
  47                 else
  48                         print("already leased!")
  49                         os.exit(2)
  50                 end
  51                 os.exit(0)
  52         elseif cmd == "remove" and arg then
  53                 remove_lease(arg)
  54                 os.exit(0)
  55         elseif cmd == "sync" then
  56                 sync()
  57                 os.exit(0)
  58         else
  59                 print("Usage: " .. argv[0] .. " <status|add|remove|sync> [MAC]")
  60                 os.exit(1)
  61         end
  62 end
  63
  64 -- Add a lease to state and invoke add_rule
  65 function add_lease(mac)
  66         uci:section("luci_splash", "lease", nil, {
  67                 mac = mac,
  68                 start = os.time()
  69         })
  70         add_rule(mac)
  71
  72         uci:save("luci_splash")
  73 end
  74
  75
  76 -- Remove a lease from state and invoke remove_rule
  77 function remove_lease(mac)
  78         mac = mac:lower()
  79         remove_rule(mac)
  80
  81         uci:delete_all("luci_splash", "lease",
  82                 function(s) return ( s.mac:lower() == mac ) end)
  83
  84         uci:save("luci_splash")
  85 end
  86
  87
  88 -- Add an iptables rule
  89 function add_rule(mac)
  90         local a, b, c, d, e, f = mac:match("(%w+):(%w+):(%w+):(%w+):(%w+):(%w+)")
  91         local mac_pre  = "%s%s" %{ a, b }
  92         local mac_post = "%s%s%s%s" %{ c, d, e, f }
  93         local handle   = f
  94
  95         if limit_up > 0 and limit_down > 0 then
  96                 os.execute("iptables -t mangle -I luci_splash_mark -m mac --mac-source %q -j MARK --set-mark 79" % mac)
  97
  98                 for _, i in ipairs(splash_interfaces) do
  99                         os.execute("tc filter add dev %q parent 77:0 protocol ip prio 2 " % i ..
 100                                 "handle ::%q u32 " % handle ..
 101                                 "match u16 0x0800 0xFFFF at -2 match u32 0x%q 0xFFFFFFFF at -12 " % mac_post ..
 102                                 "match u16 0x%q 0xFFFF at -14 flowid 77:10" % mac_pre)
 103                 end
 104         end
 105
 106         os.execute("iptables -t filter -I luci_splash_counter -m mac --mac-source %q -j RETURN" % mac)
 107         return os.execute("iptables -t nat -I luci_splash_leases -m mac --mac-source %q -j RETURN" % mac)
 108 end
 109
 110
 111 -- Remove an iptables rule
 112 function remove_rule(mac)
 113         local handle = mac:match("%w+:%w+:%w+:%w+:%w+:(%w+)")
 114
 115         local function ipt_delete_foreach(args)
 116                 for _, r in ipairs(ipt:find(args)) do
 117                         if r.options and #r.options >= 2 and r.options[1] == "MAC" and
 118                            r.options[2]:lower() == mac:lower()
 119                         then
 120                                 os.execute("iptables -t %q -D %q -m mac --mac-source %q %s 2>/dev/null"
 121                                         %{ r.table, r.chain, mac,
 122                                                 r.target == "MARK" and "-j MARK --set-mark 79" or
 123                                                         r.target and "-j %q" % r.target or "" })
 124                         end
 125                 end
 126         end
 127
 128         ipt_delete_foreach({table="filter", chain="luci_splash_counter"})
 129         ipt_delete_foreach({table="mangle", chain="luci_splash_mark"})
 130         ipt_delete_foreach({table="nat", chain="luci_splash_leases"})
 131
 132         for _, i in ipairs(splash_interfaces) do
 133                 os.execute("tc filter del dev %q parent 77:0 protocol ip prio 2 " % i ..
 134                         "handle 800::%q u32 2>/dev/null" % handle)
 135         end
 136
 137         ipt:resync()
 138 end
 139
 140
 141 -- Check whether a MAC-Address is listed in the lease state list
 142 function haslease(mac)
 143         mac = mac:lower()
 144         local lease = nil
 145
 146         uci:foreach("luci_splash", "lease",
 147                 function (section)
 148                         if section.mac:lower() == mac then
 149                                 lease = section
 150                         end
 151                 end)
 152
 153         return lease
 154 end
 155
 156
 157 -- Check whether a MAC-Address is in given list
 158 function islisted(what, mac)
 159         mac = mac:lower()
 160
 161         uci:foreach("luci_splash", what,
 162                 function (section)
 163                         if section.mac:lower() == mac then
 164                                 stat = true
 165                                 return
 166                         end
 167                 end)
 168
 169         return false
 170 end
 171
 172
 173 -- Returns a list of MAC-Addresses for which a rule is existing
 174 function listrules()
 175         local macs = { }
 176         for i, r in ipairs(ipt:find({table="nat", chain="luci_splash_leases"})) do
 177                 if r.options and #r.options >= 2 and r.options[1] == "MAC" then
 178                         macs[r.options[2]:lower()] = true
 179                 end
 180         end
 181         return luci.util.keys(macs)
 182 end
 183
 184
 185 -- Synchronise leases, remove abandoned rules
 186 function sync()
 187         local written = {}
 188         local time = os.time()
 189
 190         -- Current leases in state files
 191         local leases = uci:get_all("luci_splash")
 192
 193         -- Convert leasetime to seconds
 194         local leasetime = tonumber(uci:get("luci_splash", "general", "leasetime")) * 3600
 195
 196         -- Clean state file
 197         uci:load("luci_splash")
 198         uci:revert("luci_splash")
 199
 200
 201         -- For all leases
 202         for k, v in pairs(leases) do
 203                 if v[".type"] == "lease" then
 204                         if os.difftime(time, tonumber(v.start)) > leasetime then
 205                                 -- Remove expired
 206                                 remove_rule(v.mac)
 207                         else
 208                                 -- Rewrite state
 209                                 uci:section("luci_splash", "lease", nil, {
 210                                         mac    = v.mac,
 211                                         start  = v.start,
 212                                         kicked = v.kicked
 213                                 })
 214                                 written[v.mac:lower()] = 1
 215                         end
 216                 elseif v[".type"] == "whitelist" or v[".type"] == "blacklist" then
 217                         written[v.mac:lower()] = 1
 218                 end
 219         end
 220
 221
 222         -- Delete rules without state
 223         for i, r in ipairs(listrules()) do
 224                 if #r > 0 and not written[r:lower()] then
 225                         remove_rule(r)
 226                 end
 227         end
 228
 229         uci:save("luci_splash")
 230 end
 231
 232 main(arg)