You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

285 lines
9.2 KiB

  1. #!/bin/sh /etc/rc.common
  2. # Copyright (C) 2018 Dengfeng Liu
  3. . /lib/functions/network.sh
  4. START=99
  5. USE_PROCD=1
  6. PROG=/usr/bin/wifidogx
  7. CONFIGFILE=/tmp/wifidogx.conf
  8. EXTRA_COMMANDS="status"
  9. EXTRA_HELP=" status Print the status of the service"
  10. PX5G_BIN="/usr/sbin/px5g"
  11. OPENSSL_BIN="/usr/bin/openssl"
  12. APFREE_CERT="/etc/apfree.crt"
  13. APFREE_KEY="/etc/apfree.key"
  14. generate_keys() {
  15. local days bits country state location commonname
  16. local UNIQUEID GENKEY_CMD
  17. # Prefer px5g for certificate generation (existence evaluated last)
  18. UNIQUEID=$(hexdump -n 4 -e '4/1 "%02x" "\n"' /dev/urandom)
  19. [ -x "$OPENSSL_BIN" ] && GENKEY_CMD="$OPENSSL_BIN req -x509 -sha256 -outform pem -nodes"
  20. [ -x "$PX5G_BIN" ] && GENKEY_CMD="$PX5G_BIN selfsigned -pem"
  21. [ -n "$GENKEY_CMD" ] && {
  22. $GENKEY_CMD \
  23. -days "${days:-720}" -newkey rsa:"${bits:-2048}" -keyout "${APFREE_KEY}.new" -out "${APFREE_CERT}.new" \
  24. -subj /C="${country:-CN}"/ST="${state:-Beijing}"/L="${location:-Unknown}"/O="${commonname:-ApFreeWiFidog}$UNIQUEID"/CN="${commonname:-ApFreeWiFidog}"
  25. sync
  26. mv "${APFREE_KEY}.new" "${APFREE_KEY}"
  27. mv "${APFREE_CERT}.new" "${APFREE_CERT}"
  28. }
  29. }
  30. service_trigger() {
  31. procd_add_reload_trigger "wifidogx"
  32. }
  33. echo_firewall_rule() {
  34. echo " FirewallRule $1"
  35. }
  36. prepare_mqtt_conf() {
  37. local cfg=$1
  38. local serveraddr
  39. local serverport
  40. config_get serveraddr "$cfg" "serveraddr"
  41. config_get serverport "$cfg" "serverport"
  42. [ -z "${serveraddr}" ] || [ -z "${serverport}" ] && return 1
  43. cat <<-EOF >>${CONFIGFILE}
  44. MQTT {
  45. ServerAddr ${serveraddr}
  46. ServerPort ${serverport}
  47. }
  48. EOF
  49. }
  50. prepare_wifidog_conf() {
  51. local cfg=$1
  52. local enable
  53. local gateway_id
  54. local gateway_interface
  55. local auth_server_hostname
  56. local auth_server_path
  57. local auth_server_path_login
  58. local auth_server_path_portal
  59. local auth_server_path_msg
  60. local auth_server_path_ping
  61. local auth_server_path_auth
  62. local delta_traffic
  63. local check_interval
  64. local client_timeout
  65. local trusted_domains
  66. local js_filter
  67. local trusted_maclist
  68. local untrusted_maclist
  69. local pool_mode
  70. local thread_number
  71. local queue_size
  72. local wired_passed
  73. local trusted_iplist
  74. local trusted_pan_domains
  75. local proxy_port
  76. local no_auth
  77. local apple_cna
  78. local update_domain_interval
  79. local dns_timeout
  80. local default_gateway_id
  81. local external_interface
  82. local auth_server_port
  83. [ -f ${CONFIGFILE} ] && rm -f ${CONFIGFILE}
  84. config_get enable "${cfg}" "disabled" 0
  85. if [ "${enable}" = "0" ]; then
  86. echo "wifidogx disabled in /etc/config/wifidogx file, please set disabled to 0 to enable it" >&2
  87. return
  88. fi
  89. default_gateway_id=$(sed -e 's/://g' /sys/class/net/br-lan/address)
  90. network_get_device external_interface wan
  91. config_get gateway_id "${cfg}" "gateway_id" "${default_gateway_id}"
  92. config_get gateway_interface "${cfg}" "gateway_interface" "br-lan"
  93. config_get auth_server_hostname "${cfg}" "auth_server_hostname"
  94. config_get auth_server_port "${cfg}" "auth_server_port" "80"
  95. config_get auth_server_path "${cfg}" "auth_server_path" "/wifidog/"
  96. config_get auth_server_path_login "${cfg}" "auth_server_path_login"
  97. config_get auth_server_path_portal "${cfg}" "auth_server_path_portal"
  98. config_get auth_server_path_msg "${cfg}" "auth_server_path_msg"
  99. config_get auth_server_path_ping "${cfg}" "auth_server_path_ping"
  100. config_get auth_server_path_auth "${cfg}" "auth_server_path_auth"
  101. config_get delta_traffic "${cfg}" "delta_traffic"
  102. config_get check_interval "${cfg}" "check_interval" "60"
  103. config_get js_filter "${cfg}" "js_filter" 1
  104. config_get client_timeout "${cfg}" "client_timeout" "5"
  105. config_get trusted_domains "${cfg}" "trusted_domains"
  106. config_get trusted_maclist "${cfg}" "trusted_maclist"
  107. config_get untrusted_maclist "${cfg}" "untrusted_maclist"
  108. config_get pool_mode "${cfg}" "pool_mode" 0
  109. config_get thread_number "${cfg}" "thread_number" 20
  110. config_get queue_size "${cfg}" "queue_size" 200
  111. config_get wired_passed "${cfg}" "wired_passed" 1
  112. config_get trusted_iplist "${cfg}" "trusted_iplist"
  113. config_get trusted_pan_domains "${cfg}" "trusted_pan_domains"
  114. config_get proxy_port "${cfg}" "proxy_port"
  115. config_get no_auth "${cfg}" "no_auth"
  116. config_get apple_cna "${cfg}" "bypass_apple_cna"
  117. config_get update_domain_interval "${cfg}" "update_domain_interval"
  118. config_get dns_timeout "${cfg}" "dns_timeout"
  119. local set_auth_server_path_login
  120. local set_auth_server_path_portal
  121. local set_auth_server_path_msg
  122. local set_auth_server_path_ping
  123. local set_auth_server_path_auth
  124. local set_delta_traffic
  125. local set_trusted_maclist
  126. local set_untrusted_maclist
  127. local set_trusted_domains
  128. local set_trusted_iplist
  129. local set_trusted_pan_domains
  130. local set_proxy_port
  131. local set_no_auth
  132. local set_firewall_rule_global
  133. local set_firewall_rule_validating_users
  134. local set_firewall_rule_known_users
  135. local set_firewall_rule_auth_is_down
  136. local set_firewall_rule_unknown_users
  137. local set_firewall_rule_locked_users
  138. local set_apple_cna
  139. local set_update_domain_interval
  140. local set_dns_timeout
  141. set_auth_server_path_login=$([ -n "$auth_server_path_login" ] && echo " LoginScriptPathFragment $auth_server_path_login")
  142. set_auth_server_path_portal=$([ -n "$auth_server_path_portal" ] && echo " PortalScriptPathFragment $auth_server_path_portal")
  143. set_auth_server_path_msg=$([ -n "$auth_server_path_msg" ] && echo " MsgScriptPathFragment $auth_server_path_msg")
  144. set_auth_server_path_ping=$([ -n "$auth_server_path_ping" ] && echo " PingScriptPathFragment $auth_server_path_ping")
  145. set_auth_server_path_auth=$([ -n "$auth_server_path_auth" ] && echo " AuthScriptPathFragment $auth_server_path_auth")
  146. set_delta_traffic=$([ -n "$delta_traffic" ] && echo "DeltaTraffic $delta_traffic")
  147. set_trusted_maclist=$([ -n "$trusted_maclist" ] && echo "TrustedMACList $trusted_maclist")
  148. set_untrusted_maclist=$([ -n "$untrusted_maclist" ] && echo "UntrustedMACList $untrusted_maclist")
  149. set_trusted_domains=$([ -n "$trusted_domains" ] && echo "TrustedDomains $trusted_domains")
  150. set_trusted_iplist=$([ -n "$trusted_iplist" ] && echo "TrustedIpList $trusted_iplist")
  151. set_trusted_pan_domains=$([ -n "$trusted_pan_domains" ] && echo "TrustedPanDomains $trusted_pan_domains")
  152. set_proxy_port=$([ -n "$proxy_port" ] && echo "Proxyport $proxy_port")
  153. set_no_auth=$([ -n "$no_auth" ] && echo "NoAuth $no_auth")
  154. set_firewall_rule_global=$(config_list_foreach "$cfg" "firewall_rule_global" echo_firewall_rule)
  155. set_firewall_rule_validating_users=$(config_list_foreach "$cfg" "firewall_rule_validating_users" echo_firewall_rule)
  156. set_firewall_rule_known_users=$(config_list_foreach "$cfg" "firewall_rule_known_users" echo_firewall_rule)
  157. set_firewall_rule_auth_is_down=$(config_list_foreach "$cfg" "firewall_rule_auth_is_down" echo_firewall_rule)
  158. set_firewall_rule_unknown_users=$(config_list_foreach "$cfg" "firewall_rule_unknown_users" echo_firewall_rule)
  159. set_firewall_rule_locked_users=$(config_list_foreach "$cfg" "firewall_rule_locked_users" echo_firewall_rule)
  160. set_apple_cna=$([ -n "$apple_cna" ] && echo "BypassAppleCNA $apple_cna")
  161. set_update_domain_interval=$([ -n "$update_domain_interval" ] && echo "UpdateDomainInterval $update_domain_interval")
  162. set_dns_timeout=$([ -n "$dns_timeout" ] && echo "DNSTimeout $dns_timeout")
  163. cat <<-EOF >$CONFIGFILE
  164. GatewayID $gateway_id
  165. GatewayInterface $gateway_interface
  166. Externalinterface $external_interface
  167. AuthServer {
  168. Hostname $auth_server_hostname
  169. HTTPPort $auth_server_port
  170. Path $auth_server_path
  171. $set_auth_server_path_login
  172. $set_auth_server_path_portal
  173. $set_auth_server_path_msg
  174. $set_auth_server_path_ping
  175. $set_auth_server_path_auth
  176. }
  177. $set_delta_traffic
  178. CheckInterval $check_interval
  179. ClientTimeout $client_timeout
  180. JsFilter $js_filter
  181. WiredPassed $wired_passed
  182. $set_trusted_domains
  183. $set_untrusted_maclist
  184. $set_trusted_maclist
  185. $set_trusted_iplist
  186. $set_trusted_pan_domains
  187. $set_proxy_port
  188. $set_no_auth
  189. $set_apple_cna
  190. $set_update_domain_interval
  191. $set_dns_timeout
  192. FirewallRuleSet global {
  193. $set_firewall_rule_global
  194. }
  195. FirewallRuleSet validating-users {
  196. $set_firewall_rule_validating_users
  197. FirewallRule allow to 0.0.0.0/0
  198. }
  199. FirewallRuleSet known-users {
  200. $set_firewall_rule_known_users
  201. FirewallRule allow to 0.0.0.0/0
  202. }
  203. FirewallRuleSet auth-is-down {
  204. $set_firewall_rule_auth_is_down
  205. }
  206. FirewallRuleSet unknown-users {
  207. $set_firewall_rule_unknown_users
  208. FirewallRule allow udp port 53
  209. FirewallRule allow tcp port 53
  210. FirewallRule allow udp port 67
  211. FirewallRule allow tcp port 67
  212. }
  213. FirewallRuleSet locked-users {
  214. $set_firewall_rule_locked_users
  215. FirewallRule block to 0.0.0.0/0
  216. }
  217. EOF
  218. }
  219. init_config() {
  220. config_load wifidogx
  221. config_foreach prepare_wifidog_conf wifidog
  222. if [ ! -f ${CONFIGFILE} ]; then
  223. echo "no wifidogx.conf, exit..." >&2
  224. exit
  225. fi
  226. if [ -s "${APFREE_CERT}" ] && [ -s "${APFREE_KEY}" ]; then
  227. generate_keys
  228. fi
  229. if [ -s ${APFREE_KEY} ] && [ -s ${APFREE_CERT} ]; then
  230. echo "no cert or key, exit..." >&2
  231. exit
  232. fi
  233. config_foreach prepare_mqtt_conf mqtt
  234. sed -i -e '/^$/d' ${CONFIGFILE}
  235. }
  236. start_service() {
  237. init_config
  238. procd_open_instance
  239. # -f: run in foreground
  240. procd_set_param command $PROG -c $CONFIGFILE -f -d 0
  241. procd_set_param respawn # respawn automatically if something died
  242. procd_set_param file $CONFIGFILE
  243. procd_close_instance
  244. }
  245. status_service() {
  246. /usr/bin/wdctlx status
  247. }