#!/bin/sh /etc/rc.common # Copyright (C) 2018 Dengfeng Liu . /lib/functions/network.sh START=99 USE_PROCD=1 PROG=/usr/bin/wifidogx CONFIGFILE=/tmp/wifidogx.conf EXTRA_COMMANDS="status" EXTRA_HELP=" status Print the status of the service" PX5G_BIN="/usr/sbin/px5g" OPENSSL_BIN="/usr/bin/openssl" APFREE_CERT="/etc/apfree.crt" APFREE_KEY="/etc/apfree.key" generate_keys() { local days bits country state location commonname local UNIQUEID GENKEY_CMD # Prefer px5g for certificate generation (existence evaluated last) UNIQUEID=$(hexdump -n 4 -e '4/1 "%02x" "\n"' /dev/urandom) [ -x "$OPENSSL_BIN" ] && GENKEY_CMD="$OPENSSL_BIN req -x509 -sha256 -outform pem -nodes" [ -x "$PX5G_BIN" ] && GENKEY_CMD="$PX5G_BIN selfsigned -pem" [ -n "$GENKEY_CMD" ] && { $GENKEY_CMD \ -days "${days:-720}" -newkey rsa:"${bits:-2048}" -keyout "${APFREE_KEY}.new" -out "${APFREE_CERT}.new" \ -subj /C="${country:-CN}"/ST="${state:-Beijing}"/L="${location:-Unknown}"/O="${commonname:-ApFreeWiFidog}$UNIQUEID"/CN="${commonname:-ApFreeWiFidog}" sync mv "${APFREE_KEY}.new" "${APFREE_KEY}" mv "${APFREE_CERT}.new" "${APFREE_CERT}" } } service_trigger() { procd_add_reload_trigger "wifidogx" } echo_firewall_rule() { echo " FirewallRule $1" } prepare_mqtt_conf() { local cfg=$1 local serveraddr local serverport config_get serveraddr "$cfg" "serveraddr" config_get serverport "$cfg" "serverport" [ -z "${serveraddr}" -o -z "${serverport}" ] && return 1 cat <<-EOF >>${CONFIGFILE} MQTT { ServerAddr ${serveraddr} ServerPort ${serverport} } EOF } prepare_wifidog_conf() { local cfg=$1 local enable local gateway_id local gateway_interface local auth_server_hostname local auth_server_path local auth_server_path_login local auth_server_path_portal local auth_server_path_msg local auth_server_path_ping local auth_server_path_auth local delta_traffic local check_interval local client_timeout local trusted_domains local js_filter local trusted_maclist local untrusted_maclist local pool_mode local thread_number local queue_size local wired_passed local trusted_iplist local trusted_pan_domains local proxy_port local no_auth local apple_cna local update_domain_interval local dns_timeout local default_gateway_id local external_interface local auth_server_port [ -f ${CONFIGFILE} ] && rm -f ${CONFIGFILE} config_get enable "${cfg}" "disabled" 0 [ "${enable}" = "0" ] || { echo "wifidogx disabled in /etc/config/wifidogx file, please set disabled to 0 to enable it" >&2 return } default_gateway_id=$(sed -e 's/://g' /sys/class/net/br-lan/address) network_get_device external_interface wan config_get gateway_id "${cfg}" "gateway_id" "${default_gateway_id}" config_get gateway_interface "${cfg}" "gateway_interface" "br-lan" config_get auth_server_hostname "${cfg}" "auth_server_hostname" config_get auth_server_port "${cfg}" "auth_server_port" "80" config_get auth_server_path "${cfg}" "auth_server_path" "/wifidog/" config_get auth_server_path_login "${cfg}" "auth_server_path_login" config_get auth_server_path_portal "${cfg}" "auth_server_path_portal" config_get auth_server_path_msg "${cfg}" "auth_server_path_msg" config_get auth_server_path_ping "${cfg}" "auth_server_path_ping" config_get auth_server_path_auth "${cfg}" "auth_server_path_auth" config_get delta_traffic "${cfg}" "delta_traffic" config_get check_interval "${cfg}" "check_interval" "60" config_get js_filter "${cfg}" "js_filter" 1 config_get client_timeout "${cfg}" "client_timeout" "5" config_get trusted_domains "${cfg}" "trusted_domains" config_get trusted_maclist "${cfg}" "trusted_maclist" config_get untrusted_maclist "${cfg}" "untrusted_maclist" config_get pool_mode "${cfg}" "pool_mode" 0 config_get thread_number "${cfg}" "thread_number" 20 config_get queue_size "${cfg}" "queue_size" 200 config_get wired_passed "${cfg}" "wired_passed" 1 config_get trusted_iplist "${cfg}" "trusted_iplist" config_get trusted_pan_domains "${cfg}" "trusted_pan_domains" config_get proxy_port "${cfg}" "proxy_port" config_get no_auth "${cfg}" "no_auth" config_get apple_cna "${cfg}" "bypass_apple_cna" config_get update_domain_interval "${cfg}" "update_domain_interval" config_get dns_timeout "${cfg}" "dns_timeout" local set_auth_server_path_login local set_auth_server_path_portal local set_auth_server_path_msg local set_auth_server_path_ping local set_auth_server_path_auth local set_delta_traffic local set_trusted_maclist local set_untrusted_maclist local set_trusted_domains local set_trusted_iplist local set_trusted_pan_domains local set_proxy_port local set_no_auth local set_firewall_rule_global local set_firewall_rule_validating_users local set_firewall_rule_known_users local set_firewall_rule_auth_is_down local set_firewall_rule_unknown_users local set_firewall_rule_locked_users local set_apple_cna local set_update_domain_interval local set_dns_timeout set_auth_server_path_login=$([ -n "$auth_server_path_login" ] && echo " LoginScriptPathFragment $auth_server_path_login") set_auth_server_path_portal=$([ -n "$auth_server_path_portal" ] && echo " PortalScriptPathFragment $auth_server_path_portal") set_auth_server_path_msg=$([ -n "$auth_server_path_msg" ] && echo " MsgScriptPathFragment $auth_server_path_msg") set_auth_server_path_ping=$([ -n "$auth_server_path_ping" ] && echo " PingScriptPathFragment $auth_server_path_ping") set_auth_server_path_auth=$([ -n "$auth_server_path_auth" ] && echo " AuthScriptPathFragment $auth_server_path_auth") set_delta_traffic=$([ -n "$delta_traffic" ] && echo "DeltaTraffic $delta_traffic") set_trusted_maclist=$([ -n "$trusted_maclist" ] && echo "TrustedMACList $trusted_maclist") set_untrusted_maclist=$([ -n "$untrusted_maclist" ] && echo "UntrustedMACList $untrusted_maclist") set_trusted_domains=$([ -n "$trusted_domains" ] && echo "TrustedDomains $trusted_domains") set_trusted_iplist=$([ -n "$trusted_iplist" ] && echo "TrustedIpList $trusted_iplist") set_trusted_pan_domains=$([ -n "$trusted_pan_domains" ] && echo "TrustedPanDomains $trusted_pan_domains") set_proxy_port=$([ -n "$proxy_port" ] && echo "Proxyport $proxy_port") set_no_auth=$([ -n "$no_auth" ] && echo "NoAuth $no_auth") set_firewall_rule_global=$(config_list_foreach "$cfg" "firewall_rule_global" echo_firewall_rule) set_firewall_rule_validating_users=$(config_list_foreach "$cfg" "firewall_rule_validating_users" echo_firewall_rule) set_firewall_rule_known_users=$(config_list_foreach "$cfg" "firewall_rule_known_users" echo_firewall_rule) set_firewall_rule_auth_is_down=$(config_list_foreach "$cfg" "firewall_rule_auth_is_down" echo_firewall_rule) set_firewall_rule_unknown_users=$(config_list_foreach "$cfg" "firewall_rule_unknown_users" echo_firewall_rule) set_firewall_rule_locked_users=$(config_list_foreach "$cfg" "firewall_rule_locked_users" echo_firewall_rule) set_apple_cna=$([ -n "$apple_cna" ] && echo "BypassAppleCNA $apple_cna") set_update_domain_interval=$([ -n "$update_domain_interval" ] && echo "UpdateDomainInterval $update_domain_interval") set_dns_timeout=$([ -n "$dns_timeout" ] && echo "DNSTimeout $dns_timeout") cat <<-EOF >$CONFIGFILE GatewayID $gateway_id GatewayInterface $gateway_interface Externalinterface $external_interface AuthServer { Hostname $auth_server_hostname HTTPPort $auth_server_port Path $auth_server_path $set_auth_server_path_login $set_auth_server_path_portal $set_auth_server_path_msg $set_auth_server_path_ping $set_auth_server_path_auth } $set_delta_traffic CheckInterval $check_interval ClientTimeout $client_timeout JsFilter $js_filter WiredPassed $wired_passed $set_trusted_domains $set_untrusted_maclist $set_trusted_maclist $set_trusted_iplist $set_trusted_pan_domains $set_proxy_port $set_no_auth $set_apple_cna $set_update_domain_interval $set_dns_timeout FirewallRuleSet global { $set_firewall_rule_global } FirewallRuleSet validating-users { $set_firewall_rule_validating_users FirewallRule allow to 0.0.0.0/0 } FirewallRuleSet known-users { $set_firewall_rule_known_users FirewallRule allow to 0.0.0.0/0 } FirewallRuleSet auth-is-down { $set_firewall_rule_auth_is_down } FirewallRuleSet unknown-users { $set_firewall_rule_unknown_users FirewallRule allow udp port 53 FirewallRule allow tcp port 53 FirewallRule allow udp port 67 FirewallRule allow tcp port 67 } FirewallRuleSet locked-users { $set_firewall_rule_locked_users FirewallRule block to 0.0.0.0/0 } EOF } init_config() { config_load wifidogx config_foreach prepare_wifidog_conf wifidog [ ! -f ${CONFIGFILE} ] && { echo "no wifidogx.conf, exit..." >&2 exit } [ -s "${APFREE_CERT}" -a -s "${APFREE_KEY}" ] || { generate_keys } [ -s ${APFREE_KEY} -a -s ${APFREE_CERT} ] || { echo "no cert or key, exit..." >&2 exit } config_foreach prepare_mqtt_conf mqtt sed -i -e '/^$/d' ${CONFIGFILE} } start_service() { init_config procd_open_instance # -f: run in foreground procd_set_param command $PROG -c $CONFIGFILE -f -d 0 procd_set_param respawn # respawn automatically if something died procd_set_param file $CONFIGFILE procd_close_instance } status() { /usr/bin/wdctlx status }