portal-detect

#!/bin/sh
# Copyright (C) 2019 GL.iNet
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#

ACTION=$1
INTERFACE=$2
DEVICE=$3
GATEWAY=$4
DNS1=""
DNS2=""
lan_ip=""
auth_ip=""
redict_url=""
result=0
enable="0"

[ -f /var/run/portal-detect.lock ] && exit 0

[ -z "$INTERFACE" ] && {
	INTERFACE="wwan"
}

[ -z "$DEVICE" ] && {
	DEVICE=$(ifstatus wwan|jsonfilter -e  @.l3_device)
}

[ -z "$GATEWAY" ] && {
	GATEWAY=$(ifstatus wwan|jsonfilter -e  @.route[0].nexthop)
}

[ -z "$DEVICE" -o -z "$GATEWAY" -o -z "$ACTION" ] && {
	logger -t portal-prarm "$ACTION $DEVICE $GATEWAY"
	exit 0
}

touch /var/run/portal-detect.lock

DNS1=$(ifstatus wwan|jsonfilter -e '@["dns-server"][0]')
DNS2=$(ifstatus wwan|jsonfilter -e '@["dns-server"][1]')
[ -z "$DNS1" ] && {
	DNS1="$GATEWAY"
}
[ -z "$DNS2" ] && {
	DNS2="$GATEWAY"
}

ipt_safe()
{
	$@
	[ ! $? = 0  ] && {
		logger "iptables command execute failed, try again!"
		sleep 0.5
		$@
	}
	
}

check_vpn_dns()
{
	local ov wg cf rb
	ov=$(uci get glconfig.openvpn.enable)
	wg=$( uci get wireguard.@proxy[0].enable)
	cf=$(uci get glconfig.general.cloudflare_dns)
	rb=$(uci get dhcp.@dnsmasq[0].rebind_protection)

	[ "$ov" != "1" -a  "$wg" != "1" -a "$cf" != "1" -a "$rb" != "1" ] && return 0
	return 1
}

probe_portal()
{
	local wan_status
	logger -t portal-probe "probe"
	enable=$(uci get glconfig.repeater.portal 2>/dev/null)
	[ ! "$enable" = "1" ] && {
		logger -t portal-probe "portal monitor not enable"
		result=0
		return 0;	
	}
	check_vpn_dns
	[ $? = 0 ] && {
		logger -t portal-probe "not any VPN or DNS setings, just return"
		result=0
		return 0;
	}
	wan_status=$(cat /var/run/mwan3/iface_state/wan)
	[ "$wan_status" = "online" ] && {
		logger -t portal-probe "wan is online, just return"
		result=0
		return 0	
	}
	tmp=$(curl --connect-timeout 5 --interface $DEVICE --dns-interface $DEVICE --dns-servers $DNS1  captive.apple.com -s -w "%{http_code}:%{redirect_url}" -o /dev/null)
	[ $? = 0 ] || {
		result=0
		return 0	
	}
	http_code=$(echo $tmp|awk -F ':' '{print $1}')
	[ "$http_code" = 302 ] || {
		result=0
		return 0
	}
	redict_url=$(echo $tmp|awk -F '/' '{print $3}')
	logger -t portal-probe "httpcode:$http_code URL:$redict_url"
	result=2
}

poll_portal()
{
	local wan_status
	logger -t portal-probe "poll"
	while [ true ];do
	enable=$(uci get glconfig.repeater.portal 2>/dev/null)
	[ ! "$enable" = "1" ] && {
		logger -t portal-poll "portal monitor not enable"
		remove_portal
		break;
	}
	check_vpn_dns
	[ $? = 0 ] && {
		logger -t portal-poll "not any VPN or DNS setings, just return"
		remove_portal
		break;
	}	
	wan_status=$(cat /var/run/mwan3/iface_state/wan)
	[ "$wan_status" = "online" ] && {
		logger -t portal-poll "wan online,stop portal poll"
		remove_portal
		break
	}	
	http_code=$(curl --connect-timeout 5 --interface $DEVICE --dns-interface $DEVICE --dns-servers $DNS1  captive.apple.com -s -w "%{http_code}" -o /dev/null)
	[ $? = 0 ] || continue
	[ "$http_code" = 302  ] || {
		logger -t portal-poll "authenticated"
		sleep 5
		remove_portal
		break
	}
	sleep 2
	done
}

join_portal()
{	
	local rebind_ip="52.41.190.83"

	auth_ip=$(curl --connect-timeout 5 --interface $DEVICE --dns-interface $DEVICE  --dns-server $DNS1 -Ls -w "%{remote_ip}"  captive.apple.com -o /dev/null)
	[ -z "$auth_ip" ] && return
	
	#echo auth_ip:$auth_ip

	lan_ip=$(ifstatus lan | jsonfilter -e '@["ipv4-address"][0].address')
	[ -z "$lan_ip" ] && {
		logger -t portal-join "lan ip is null"
		return
	}

	ipset create gl_portal_whitelist hash:net
	ipset add gl_portal_whitelist ${GATEWAY}/32
	ipset add gl_portal_whitelist ${rebind_ip}/32
	ipset add gl_portal_whitelist ${auth_ip}/32
	ipset add gl_portal_whitelist ${lan_ip}/32
	ipset add gl_portal_whitelist ${DNS1}/32
	ipset add gl_portal_whitelist ${DNS2}/32
	
	echo "#temporary config" > /tmp/dnsmasq.d/portal-detect.conf
	#echo address=/${redict_url}/${auth_ip} >>/tmp/dnsmasq.d/portal-detect.conf
	echo address=/.com/${rebind_ip} >>/tmp/dnsmasq.d/portal-detect.conf
	echo address=/.net/${rebind_ip} >>/tmp/dnsmasq.d/portal-detect.conf
	echo address=/.org/${rebind_ip} >>/tmp/dnsmasq.d/portal-detect.conf
	echo address=/.top/${rebind_ip} >>/tmp/dnsmasq.d/portal-detect.conf
	echo address=/.cn/${rebind_ip} >>/tmp/dnsmasq.d/portal-detect.conf

	
	echo server=/$redict_url/$DNS1 >>/tmp/dnsmasq.d/portal-detect.conf
	echo ipset=/$redict_url/gl_portal_whitelist >>/tmp/dnsmasq.d/portal-detect.conf
	echo server=/apple.com/$DNS1 >>/tmp/dnsmasq.d/portal-detect.conf
	echo ipset=/apple.com/gl_portal_whitelist >>/tmp/dnsmasq.d/portal-detect.conf
	echo server=/captive.apple.com/$DNS1 >>/tmp/dnsmasq.d/portal-detect.conf
	echo ipset=/captive.apple.com/gl_portal_whitelist >>/tmp/dnsmasq.d/portal-detect.conf
	echo server=/ssl.google-analytics.com/$DNS1 >>/tmp/dnsmasq.d/portal-detect.conf
	echo ipset=/ssl.google-analytics.com/gl_portal_whitelist >>/tmp/dnsmasq.d/portal-detect.conf
	echo server=/captive.g.aaplimg.com/$DNS1 >>/tmp/dnsmasq.d/portal-detect.conf
	echo ipset=/captive.g.aaplimg.com/gl_portal_whitelist >>/tmp/dnsmasq.d/portal-detect.conf
	
	echo rebind-domain-ok=${redict_url}  >>/tmp/dnsmasq.d/portal-detect.conf
	
	#Read the Linux connection track mark associated with incoming DNS queries and set the same mark value on upstream traffic used to answer those queries.
	echo conntrack  >>/tmp/dnsmasq.d/portal-detect.conf	
	
	/etc/init.d/dnsmasq restart
	
	while [ true ];do
		[ ! -f /var/run/fw3.lock ] && break
		sleep 1
		logger -t portal-join "wait for firewall free"
	done
	
	iptables  -N GL_PORTAL_DETECT
	iptables  -I FORWARD -j GL_PORTAL_DETECT
	iptables  -I GL_PORTAL_DETECT -m set --match-set gl_portal_whitelist dst -j ACCEPT

	
	iptables -t nat -N GL_PORTAL_DETECT
	iptables -t nat -I PREROUTING -j GL_PORTAL_DETECT
	iptables -t nat -A GL_PORTAL_DETECT -p udp -m udp --dport 53 -j DNAT --to-destination $lan_ip
	iptables -t nat -A GL_PORTAL_DETECT -p tcp -m tcp --dport 53 -j DNAT --to-destination $lan_ip
	
	iptables -t mangle -N GL_PORTAL_DETECT
	iptables -t mangle -A PREROUTING -j GL_PORTAL_DETECT
	iptables -t mangle -A GL_PORTAL_DETECT -m set --match-set gl_portal_whitelist dst -m conntrack --ctstate NEW  -j MARK --set-mark 0x80/0x80
	iptables -t mangle -A GL_PORTAL_DETECT -m mark  --mark 0x80/0x80 -j CONNMARK --save-mark --nfmask 0x80 --ctmask 0x80
	iptables -t mangle -A GL_PORTAL_DETECT -m mark  --mark 0x80/0x80 -j CONNMARK --restore-mark --nfmask 0x80 --ctmask 0x80
	
	ip route add via $GATEWAY 0.0.0.0/1 dev wlan-sta  table 50
	ip route add via $GATEWAY 128.0.0.0/1 dev wlan-sta  table 50
	ip rule add fwmark 0x80/0x80 table 50
	
	
}

remove_portal()
{
	logger -t portal-remove "remove"
	ip rule del fwmark 0x80/0x80 table 50
	ip route flush table 50

	while [ true ];do
		[ ! -f /var/run/fw3.lock ] && break
		sleep 1
		logger -t portal-remove "wait for firewall free"
	done
	ipt_safe iptables -t mangle -D PREROUTING -j GL_PORTAL_DETECT
	ipt_safe iptables -t mangle -F  GL_PORTAL_DETECT
	ipt_safe iptables -t mangle -X GL_PORTAL_DETECT	
	
	ipt_safe iptables -t nat -D PREROUTING -j GL_PORTAL_DETECT
	ipt_safe iptables -t nat -F  GL_PORTAL_DETECT
	ipt_safe iptables -t nat -X GL_PORTAL_DETECT
	
	ipt_safe iptables -D FORWARD -j GL_PORTAL_DETECT
	ipt_safe iptables -F  GL_PORTAL_DETECT
	ipt_safe iptables -X GL_PORTAL_DETECT	

	[ -f /tmp/dnsmasq.d/portal-detect.conf ] && rm  /tmp/dnsmasq.d/portal-detect.conf
 	/etc/init.d/dnsmasq restart	
	
	ipset destroy gl_portal_whitelist
}

clear_portal() {
	remove_portal
	[ -f /var/run/portal-detect.lock ] && rm /var/run/portal-detect.lock
	exit 0
}

trap "clear_portal" INT TERM QUIT KILL

[ "$ACTION" = "join" ] && {
	while [ true ];do
		probe_portal
		[ $result = 2 ] && {
			join_portal
			poll_portal
		}
		sleep 10
	done
}

[ "$ACTION" = "remove" ] && {
	remove_portal
}

[ "$ACTION" = "poll" ] && {
	poll_portal
}

[ "$ACTION" = "probe" ] && {
	probe_portal
}

[ -f /var/run/portal-detect.lock ] && rm /var/run/portal-detect.lock
exit $result