wifidog-ng: Update to 2.0.0

Signed-off-by: Jianhui Zhao <jianhuizhao329@gmail.com>
This commit is contained in:
Jianhui Zhao
2018-07-26 23:28:41 +08:00
parent a8407ee18a
commit 840a9ad63f
17 changed files with 1276 additions and 53 deletions
+221
View File
@@ -0,0 +1,221 @@
--[[
Copyright (C) 2018 Jianhui Zhao <jianhuizhao329@gmail.com>
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
USA
--]]
local uh = require "uhttpd"
local http = require "socket.http"
local util = require "wifidog-ng.util"
local config = require "wifidog-ng.config"
local M = {}
local apple_host = {
["captive.apple.com"] = true,
["www.apple.com"] = true,
}
local terms = {}
local function is_authed_user(mac)
local r = os.execute("ipset test wifidog-ng-mac " .. mac .. " 2> /dev/null")
return r == 0
end
local function allow_user(mac, temppass)
if not temppass then
terms[mac].authed = true
os.execute("ipset add wifidog-ng-mac " .. mac)
else
local cfg = config.get()
os.execute("ipset add wifidog-ng-mac " .. mac .. " timeout " .. cfg.temppass_time)
end
end
local function deny_user(mac)
os.execute("ipset del wifidog-ng-mac " .. mac)
end
function M.get_terms()
local r = {}
for k, v in pairs(terms) do
if v.authed then
r[k] = {ip = v.ip}
end
end
return r
end
function M.new_term(ip, mac, token)
terms[mac] = {ip = ip, token = token}
if token then
terms[mac].authed = true
allow_user(mac)
end
end
local function http_callback_auth(cl)
local cfg = config.get()
local token = cl:get_var("token")
local ip = cl:get_remote_addr()
local mac = util.arp_get(cfg.gw_ifname, ip)
if not mac then
uh.log(uh.LOG_ERR, "Not found macaddr for " .. ip)
cl:send_error(401, "Unauthorized", "Not found your macaddr")
return uh.REQUEST_DONE
end
if token and #token > 0 then
if cl:get_var("logout") then
local url = string.format("%s&stage=logout&ip=%s&mac=%s&token=%s", cfg.auth_url, ip, mac, token)
http.request(url)
deny_user(mac)
else
local url = string.format("%s&stage=login&ip=%s&mac=%s&token=%s", cfg.auth_url, ip, mac, token)
local r = http.request(url)
if not r then
cl:send_error(401, "Unauthorized")
return uh.REQUEST_DONE
end
local auth = r:match("Auth: (%d)")
if auth == "1" then
allow_user(mac)
cl:redirect(302, string.format("%s&mac=%s", cfg.portal_url, mac))
else
cl:redirect(302, string.format("%s&mac=%s", cfg.msg_url, mac))
return uh.REQUEST_DONE
end
end
else
cl:send_error(401, "Unauthorized")
return uh.REQUEST_DONE
end
end
local function http_callback_temppass(cl)
local cfg = config.get()
local ip = cl:get_remote_addr()
local mac = util.arp_get(cfg.gw_ifname, ip)
if not mac then
uh.log(uh.LOG_ERR, "Not found macaddr for " .. ip)
cl:send_error(401, "Unauthorized", "Not found your macaddr")
return uh.REQUEST_DONE
end
local script = cl:get_var("script") or ""
cl:send_header(200, "OK", -1)
cl:header_end()
allow_user(mac, true)
cl:chunk_send(cl:get_var("script") or "");
cl:request_done()
return uh.REQUEST_DONE
end
local function http_callback_404(cl, path)
local cfg = config.get()
if cl:get_http_method() ~= uh.HTTP_METHOD_GET then
cl:send_error(401, "Unauthorized")
return uh.REQUEST_DONE
end
local ip = cl:get_remote_addr()
local mac = util.arp_get(cfg.gw_ifname, ip)
if not mac then
uh.log(uh.LOG_ERR, "Not found macaddr for " .. ip)
cl:send_error(401, "Unauthorized", "Not found your macaddr")
return uh.REQUEST_DONE
end
term = terms[mac]
if not term then
terms[mac] = {ip = ip}
end
term = terms[mac]
if is_authed_user(mac) then
cl:redirect(302, "%s&mac=%s", cfg.portal_url, mac)
return uh.REQUEST_DONE
end
cl:send_header(200, "OK", -1)
cl:header_end()
local header_host = cl:get_header("host")
if apple_host[header_host] then
local http_ver = cl:get_http_version()
if http_ver == uh.HTTP_VER_10 then
if not term.apple then
cl:chunk_send("fuck you")
term.apple = true
cl:request_done()
return uh.REQUEST_DONE
end
end
end
local redirect_html = [[
<!doctype html><html><head><title>Success</title>
<script type="text/javascript">
setTimeout(function() {location.replace('%s&ip=%s&mac=%s');}, 1);</script>
<style type="text/css">body {color:#FFF}</style></head>
<body>Success</body></html>
]]
cl:chunk_send(string.format(redirect_html, cfg.login_url, ip, mac))
cl:request_done()
return uh.REQUEST_DONE
end
local function on_request(cl, path)
if path == "/wifidog/auth" then
return http_callback_auth(cl)
elseif path == "/wifidog/temppass" then
return http_callback_temppass(cl)
end
return uh.REQUEST_CONTINUE
end
function M.init()
local cfg = config.get()
local srv = uh.new(cfg.gw_address, cfg.gw_port)
srv:on_request(on_request)
srv:on_error404(http_callback_404)
if uh.SSL_SUPPORTED then
local srv_ssl = uh.new(cfg.gw_address, cfg.gw_ssl_port)
srv_ssl:ssl_init("/etc/wifidog-ng/ssl.crt", "/etc/wifidog-ng/ssl.key")
srv_ssl:on_request(on_request)
srv_ssl:on_error404(http_callback_404)
end
end
return M
+158
View File
@@ -0,0 +1,158 @@
--[[
Copyright (C) 2018 Jianhui Zhao <jianhuizhao329@gmail.com>
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
USA
--]]
local uci = require "uci"
local util = require "wifidog-ng.util"
local M = {}
local cfg = {}
function M.parse()
local c = uci.cursor()
c:foreach('wifidog-ng', 'gateway', function(s)
local port = s.port or 2060
local ssl_port = s.ssl_port or 8443
local interface = s.interface or "lan"
local checkinterval = s.checkinterval or 30
local client_timeout = s.client_timeout or 5
local temppass_time = s.temppass_time or 30
local id = s.id
local address = s.address
cfg.gw_port = tonumber(port)
cfg.gw_ssl_port = tonumber(ssl_port)
cfg.checkinterval = tonumber(checkinterval)
cfg.client_timeout = tonumber(client_timeout)
cfg.temppass_time = tonumber(temppass_time)
cfg.gw_address = s.address
cfg.gw_id = s.id
local st = util.ubus("network.interface." .. interface, "status")
cfg.gw_ifname = st.device
if not cfg.gw_address then
cfg.gw_address = st["ipv4-address"][1].address
end
if not cfg.gw_id then
local devst = util.ubus("network.device", "status", {name = st.device})
local macaddr = devst.macaddr
cfg.gw_id = macaddr:gsub(":", ""):upper()
end
end)
c:foreach('wifidog-ng', 'server', function(s)
local host = s.host
local path = s.path or "/wifidog/"
local gw_port = cfg.gw_port
local gw_id = cfg.gw_id
local gw_address = cfg.gw_address
local ssid = cfg.ssid or ""
local proto, port = "http", ""
if s.port ~= "80" and s.port ~= "443" then
port = ":" .. s.port
end
if s.ssl == "1" then
proto = "https"
end
cfg.login_url = string.format("%s://%s%s%s%s?gw_address=%s&gw_port=%d&gw_id=%s&ssid=%s",
proto, host, port, path, s.login_path, gw_address, gw_port, gw_id, ssid)
cfg.auth_url = string.format("%s://%s%s%s%s?gw_id=%s",
proto, host, port, path, s.auth_path, gw_id)
cfg.ping_url = string.format("%s://%s%s%s%s?gw_id=%s",
proto, host, port, path, s.ping_path, gw_id)
cfg.portal_url = string.format("%s://%s%s%s%s?gw_id=%s",
proto, host, port, path, s.portal_path, gw_id)
cfg.msg_url = string.format("%s://%s%s%s%s?gw_id=%s",
proto, host, port, path, s.msg_path, gw_id)
end)
cfg.parsed = true
end
function M.get()
if not cfg.parsed then
M.parse()
end
return cfg
end
function M.add_whitelist(typ, value)
local c = uci.cursor()
local opt
if typ == "mac" then
typ = "validated_user"
opt = "mac"
elseif typ == "domain" then
typ = "validated_domain"
opt = "domain"
else
return
end
local exist = false
c:foreach("wifidog-ng", typ, function(s)
if s[opt] == value then
exist = true
end
end)
if not exist then
local s = c:add("wifidog-ng", typ)
c:set("wifidog-ng", s, opt, value)
c:commit("wifidog-ng")
end
end
function M.del_whitelist(typ, value)
local c = uci.cursor()
local opt
if typ == "mac" then
typ = "validated_user"
opt = "mac"
elseif typ == "domain" then
typ = "validated_domain"
opt = "domain"
else
return
end
c:foreach("wifidog-ng", typ, function(s)
if s[opt] == value then
c:delete("wifidog-ng", s[".name"])
end
end)
c:commit("wifidog-ng")
end
return M
@@ -0,0 +1,46 @@
--[[
Copyright (C) 2018 Jianhui Zhao <jianhuizhao329@gmail.com>
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
USA
--]]
local uloop = require "uloop"
local http = require "socket.http"
local util = require "wifidog-ng.util"
local config = require "wifidog-ng.config"
local M = {}
local timer = nil
local start_time = os.time()
local function heartbeat()
local cfg = config.get()
timer:set(1000 * cfg.checkinterval)
local sysinfo = util.ubus("system", "info")
local url = string.format("%s&sys_uptime=%d&sys_memfree=%d&sys_load=%d&wifidog_uptime=%d",
cfg.ping_url, sysinfo.uptime, sysinfo.memory.free, sysinfo.load[1], os.time() - start_time)
http.request(url)
end
function M.start()
timer = uloop.timer(heartbeat, 1000)
end
return M
+128
View File
@@ -0,0 +1,128 @@
--[[
Copyright (C) 2018 Jianhui Zhao <jianhuizhao329@gmail.com>
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
USA
--]]
local uci = require "uci"
local ubus = require "ubus"
local http = require "socket.http"
local auth = require "wifidog-ng.auth"
local config = require "wifidog-ng.config"
local M = {}
local conn = nil
local ubus_codes = {
["INVALID_COMMAND"] = 1,
["INVALID_ARGUMENT"] = 2,
["METHOD_NOT_FOUND"] = 3,
["NOT_FOUND"] = 4,
["NO_DATA"] = 5,
["PERMISSION_DENIED"] = 6,
["TIMEOUT"] = 7,
["NOT_SUPPORTED"] = 8,
["UNKNOWN_ERROR"] = 9,
["CONNECTION_FAILED"] = 10
}
local function reload_validated_domain()
local c = uci.cursor()
local file = io.open("/tmp/dnsmasq.d/wifidog-ng", "w")
c:foreach("wifidog-ng", "validated_domain", function(s)
file:write("ipset=/" .. s.domain .. "/wifidog-ng-ip\n")
end)
file:close()
os.execute("/etc/init.d/dnsmasq restart &")
end
local methods = {
["wifidog-ng"] = {
roam = {
function(req, msg)
local cfg = config.get()
if not msg.ip or not msg.mac then
return ubus_codes["INVALID_ARGUMENT"]
end
local url = string.format("%s&stage=roam&ip=%s&mac=%s", cfg.auth_url, msg.ip, msg.mac)
local r = http.request(url) or ""
local token = r:match("token=(%w+)")
if token then
auth.new_term(msg.ip, msg.mac, token)
end
end, {ip = ubus.STRING, mac = ubus.STRING }
},
term = {
function(req, msg)
if msg.action == "show" then
conn:reply(req, {terms = auth.get_terms()});
return
end
if not msg.action or not msg.mac then
return ubus_codes["INVALID_ARGUMENT"]
end
if msg.action == "add" then
auth.allow_user(mac)
elseif msg.action == "del" then
auth.deny_user(mac)
end
end, {action = ubus.STRING, mac = ubus.STRING }
},
whitelist = {
function(req, msg)
if not msg.action or not msg.type or not msg.value then
return ubus_codes["INVALID_ARGUMENT"]
end
if msg.action == "add" then
config.add_whitelist(msg.type, msg.value)
if msg.type == "mac" then
auth.allow_user(msg.value)
end
elseif msg.action == "del" then
config.del_whitelist(msg.type, msg.value)
if msg.type == "mac" then
auth.deny_user(msg.value)
end
end
if msg.type == "domain" then
reload_validated_domain()
end
end, {action = ubus.STRING, type = ubus.STRING, value = ubus.STRING }
},
}
}
function M.init()
conn = ubus.connect()
if not conn then
error("Failed to connect to ubus")
end
conn:add(methods)
end
return M
+83
View File
@@ -0,0 +1,83 @@
--[[
Copyright (C) 2018 Jianhui Zhao <jianhuizhao329@gmail.com>
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
USA
--]]
local _ubus = require "ubus"
local _ubus_connection = nil
local M = {}
function M.arp_get(ifname, ipaddr)
for l in io.lines("/proc/net/arp") do
local f = {}
for e in string.gmatch(l, "%S+") do
f[#f + 1] = e
end
if f[1] == ipaddr and f[6] == ifname then
return f[4]
end
end
end
function M.read_file(path, len)
local file = io.open(path, "r")
if not file then return nil end
if not len then len = "*a" end
local data = file:read(len)
file:close()
return data
end
local ubus_codes = {
"INVALID_COMMAND",
"INVALID_ARGUMENT",
"METHOD_NOT_FOUND",
"NOT_FOUND",
"NO_DATA",
"PERMISSION_DENIED",
"TIMEOUT",
"NOT_SUPPORTED",
"UNKNOWN_ERROR",
"CONNECTION_FAILED"
}
function M.ubus(object, method, data)
if not _ubus_connection then
_ubus_connection = _ubus.connect()
assert(_ubus_connection, "Unable to establish ubus connection")
end
if object and method then
if type(data) ~= "table" then
data = { }
end
local rv, err = _ubus_connection:call(object, method, data)
return rv, err, ubus_codes[err]
elseif object then
return _ubus_connection:signatures(object)
else
return _ubus_connection:objects()
end
end
return M
@@ -0,0 +1,30 @@
--[[
Copyright (C) 2018 Jianhui Zhao <jianhuizhao329@gmail.com>
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
USA
--]]
local M = {
MAJOR = 2,
MINOR = 0,
PATCH = 0
}
function M.string()
return string.format("%d.%d.%d", M.MAJOR, M.MINOR, M.PATCH)
end
return M