applications/luci-splash/root/etc/init.d/luci_splash

   1 #!/bin/sh /etc/rc.common
   2
   3 START=70
   4 EXTRA_COMMANDS=clear_leases
   5 LIMIT_DOWN=0
   6 LIMIT_DOWN_BURST=0
   7 LIMIT_UP=0
   8
   9 IPT_REPLAY=/var/run/luci_splash.iptlog
  10 LOCK=/var/run/luci_splash.lock
  11
  12 include /lib/network
  13 scan_interfaces
  14 config_load luci_splash
  15
  16 silent() {
  17         "$@" 2>/dev/null
  18 }
  19
  20 ipt_log() {
  21         iptables -I "$@"
  22         echo iptables -D "$@" >> $IPT_REPLAY
  23 }
  24
  25 iface_add() {
  26         local cfg="$1"
  27
  28         config_get zone "$cfg" zone
  29         [ -n "$zone" ] || return 0
  30
  31         config_get net "$cfg" network
  32         [ -n "$net" ] || return 0
  33
  34         config_get ifname "$net" ifname
  35         [ -n "$ifname" ] || return 0
  36
  37         config_get ipaddr "$net" ipaddr
  38         [ -n "$ipaddr" ] || return 0
  39
  40         config_get netmask "$net" netmask
  41         [ -n "$netmask" ] || return 0
  42
  43         config_get parentiface "$net" interface
  44         [ -n "$parentiface" ] && {
  45                 config_get parentproto   "$parentiface" proto
  46                 config_get parentipaddr  "$parentiface" ipaddr
  47                 config_get parentnetmask "$parentiface" netmask
  48         }
  49
  50         eval "$(ipcalc.sh $ipaddr $netmask)"
  51
  52         ### Add interface specific chain entry rules
  53         ipt_log "zone_${zone}_prerouting" -i "${ifname%:*}" -s "$NETWORK/$PREFIX" -j luci_splash_prerouting -t nat
  54         ipt_log "zone_${zone}_forward"    -i "${ifname%:*}" -s "$NETWORK/$PREFIX" -j luci_splash_forwarding -t filter
  55
  56         ### Allow traffic to the same subnet
  57         iptables -t nat    -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN
  58         iptables -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN
  59
  60         ### Allow traffic to the mesh subnet
  61         [ "$parentproto" = "static" -a -n "$parentipaddr" ] && {
  62                 iptables -t nat    -I luci_splash_prerouting -d "$parentipaddr/${parentnetmask:-32}" -j RETURN
  63                 iptables -t filter -I luci_splash_forwarding -d "$parentipaddr/${parentnetmask:-32}" -j RETURN
  64         }
  65
  66         qos_iface_add "$ifname"
  67 }
  68
  69 iface_del() {
  70         config_get zone "$1" zone
  71         [ -n "$zone" ] || return 0
  72
  73         config_get net "$1" network
  74         [ -n "$net" ] || return 0
  75
  76         config_get ifname "$net" ifname
  77         [ -n "$ifname" ] || return 0
  78
  79         # Clear interface specific rules
  80         [ -s $IPT_REPLAY ] && {
  81                 grep -- "-i ${ifname%:*}" $IPT_REPLAY | while read ln; do silent $ln; done
  82                 sed -ie "/-i ${ifname%:*}/d" $IPT_REPLAY
  83         }
  84
  85         qos_iface_del "$ifname"
  86 }
  87
  88 mac_add() {
  89         config_get mac "$1" mac
  90         append MACS "$mac"
  91 }
  92
  93 subnet_add() {
  94         local cfg="$1"
  95
  96         config_get ipaddr  "$cfg" ipaddr
  97         config_get netmask "$cfg" netmask
  98
  99         [ -n "$ipaddr" ] && {
 100                 iptables -t nat    -I luci_splash_prerouting -d "$ipaddr/${netmask:-32}" -j RETURN
 101                 iptables -t filter -I luci_splash_forwarding -d "$ipaddr/${netmask:-32}" -j RETURN
 102         }
 103 }
 104
 105 qos_iface_add() {
 106         local iface="$1"
 107
 108         # 77 -> download root qdisc
 109         # 78 -> upload root qdisc
 110         # 79 -> fwmark: client->inet
 111         # 80 -> fwmark: inet->client
 112
 113         silent tc qdisc del dev "$iface" root handle 77:
 114
 115         if [ "$LIMIT_UP" -gt 0 -a "$LIMIT_DOWN" -gt 0 ]; then
 116                 tc qdisc add dev "$iface" root handle 77: htb
 117
 118                 # assume maximum rate of 20.000 kilobit for wlan
 119                 tc class add dev "$iface" parent 77: classid 77:1 htb rate 20000kbit
 120
 121                 # set download limit and burst
 122                 tc class add dev "$iface" parent 77:1 classid 77:10 htb \
 123                         rate ${LIMIT_DOWN}kbit ceil ${LIMIT_DOWN_BURST}kbit prio 2
 124
 125                 tc qdisc add dev "$iface" parent 77:10 handle 78: sfq perturb 10
 126
 127                 # adding ingress can result in "File exists" if qos-scripts are active
 128                 silent tc qdisc add dev "$iface" ingress
 129
 130                 # set client download speed
 131                 tc filter add dev "$iface" parent 77: protocol ip prio 2 \
 132                         handle 80 fw flowid 77:10
 133
 134                 # set client upload speed
 135                 tc filter add dev "$iface" parent ffff: protocol ip prio 1 \
 136                         handle 79 fw police rate ${LIMIT_UP}kbit mtu 6k burst 6k drop
 137         fi
 138 }
 139
 140 qos_iface_del() {
 141         local iface="$1"
 142
 143         silent tc qdisc del dev "$iface" root handle 77:
 144         silent tc qdisc del dev "$iface" root handle 78:
 145         silent tc filter del dev "$iface" parent ffff: protocol ip prio 1 handle 79 fw
 146 }
 147
 148 boot() {
 149         ### Setup splash-relay
 150         uci get lucid.splashr 2>/dev/null || {
 151 uci batch <<EOF
 152         set lucid.splashr=daemon
 153         set lucid.splashr.slave=httpd
 154         add_list lucid.splashr.address=8082
 155         add_list lucid.splashr.publisher=splashredir
 156         set lucid.splashr.enabled=1
 157
 158         set lucid.splashredir=Redirector
 159         set lucid.splashredir.name=Splashd
 160         set lucid.splashredir.virtual='/'
 161         set lucid.splashredir.physical=':80/luci/splash'
 162
 163         commit lucid
 164 EOF
 165         }
 166
 167         ### We are started by the firewall include
 168         exit 0
 169 }
 170
 171 start() {
 172         lock -w $LOCK && lock $LOCK
 173
 174         ### Find QoS limits
 175         config_get LIMIT_UP general limit_up
 176         config_get LIMIT_DOWN general limit_down
 177         config_get LIMIT_DOWN_BURST general limit_down_burst
 178
 179         LIMIT_UP="$((8*${LIMIT_UP:-0}))"
 180         LIMIT_DOWN="$((8*${LIMIT_DOWN:-0}))"
 181         LIMIT_DOWN_BURST="${LIMIT_DOWN_BURST:+$((8*$LIMIT_DOWN_BURST))}"
 182         LIMIT_DOWN_BURST="${LIMIT_DOWN_BURST:-$(($LIMIT_DOWN / 5 * 6))}"
 183
 184         ### Load required modules
 185         [ "$LIMIT_UP" -gt 0 -a "$LIMIT_DOWN" -gt 0 ] && {
 186                 silent insmod cls_fw
 187                 silent insmod cls_u32
 188                 silent insmod sch_htb
 189                 silent insmod sch_sfq
 190                 silent insmod sch_ingress
 191         }
 192
 193         ### Create subchains
 194         iptables -t nat    -N luci_splash_prerouting
 195         iptables -t nat    -N luci_splash_leases
 196         iptables -t filter -N luci_splash_forwarding
 197         iptables -t filter -N luci_splash_filter
 198
 199         ### Clear iptables replay log
 200         [ -s $IPT_REPLAY ] && . $IPT_REPLAY
 201         echo -n > $IPT_REPLAY
 202
 203         ### Build the main and portal rule
 204         config_foreach iface_add iface
 205         config_foreach subnet_add subnet
 206
 207         ### Add interface independant prerouting rules
 208         iptables -t nat -A luci_splash_prerouting -j luci_splash_leases
 209         iptables -t nat -A luci_splash_leases -p udp --dport 53 -j REDIRECT --to-ports 53
 210         iptables -t nat -A luci_splash_leases -p tcp --dport 80 -j REDIRECT --to-ports 8082
 211
 212         ### Add interface independant forwarding rules
 213         iptables -t filter -A luci_splash_forwarding -j luci_splash_filter
 214         iptables -t filter -A luci_splash_filter -p tcp -j REJECT --reject-with tcp-reset
 215         iptables -t filter -A luci_splash_filter -j REJECT --reject-with icmp-net-prohibited
 216
 217         ### Add QoS chain
 218         [ "$LIMIT_UP" -gt 0 -a "$LIMIT_DOWN" -gt 0 ] && {
 219                 iptables -t mangle -N luci_splash_mark_out
 220                 iptables -t mangle -N luci_splash_mark_in
 221                 iptables -t mangle -I PREROUTING  -j luci_splash_mark_out
 222                 iptables -t mangle -I POSTROUTING -j luci_splash_mark_in
 223         }
 224
 225         ### Find active mac addresses
 226         MACS=""
 227         config_foreach mac_add lease
 228         config_foreach mac_add blacklist
 229         config_foreach mac_add whitelist
 230
 231         ### Add crontab entry
 232         test -f /etc/crontabs/root || touch /etc/crontabs/root
 233         grep -q luci-splash /etc/crontabs/root || {
 234                 echo '*/5 * * * *       /usr/sbin/luci-splash sync' >> /etc/crontabs/root
 235         }
 236
 237         lock -u $LOCK
 238
 239         ### Populate iptables
 240         [ -n "$MACS" ] && luci-splash add-rules $MACS
 241 }
 242
 243 stop() {
 244         lock -w $LOCK && lock $LOCK
 245
 246         ### Clear interface rules
 247         config_foreach iface_del iface
 248
 249         silent iptables -t mangle -D PREROUTING  -j luci_splash_mark_out
 250         silent iptables -t mangle -D POSTROUTING -j luci_splash_mark_in
 251
 252         ### Clear subchains
 253         silent iptables -t nat    -F luci_splash_prerouting
 254         silent iptables -t nat    -F luci_splash_leases
 255         silent iptables -t filter -F luci_splash_forwarding
 256         silent iptables -t filter -F luci_splash_filter
 257         silent iptables -t mangle -F luci_splash_mark_out
 258         silent iptables -t mangle -F luci_splash_mark_in
 259
 260         ### Delete subchains
 261         silent iptables -t nat    -X luci_splash_prerouting
 262         silent iptables -t nat    -X luci_splash_leases
 263         silent iptables -t filter -X luci_splash_forwarding
 264         silent iptables -t filter -X luci_splash_filter
 265         silent iptables -t mangle -X luci_splash_mark_out
 266         silent iptables -t mangle -X luci_splash_mark_in
 267
 268         sed -ie '/\/usr\/sbin\/luci-splash sync/d' /var/spool/cron/crontabs/root
 269
 270         lock -u $LOCK
 271 }
 272
 273 clear_leases() {
 274         ### Find active mac addresses
 275         MACS=""
 276         config_foreach mac_add lease
 277
 278         ### Clear leases
 279         [ -n "$MACS" ] && luci-splash remove $MACS
 280 }
 281