github/openNDS
1
1
Fork 0
mirror of https://github.com/openNDS/openNDS.git synced 2026-01-09 11:57:55 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix - Multiple changes to walled garden and blocklist sets

Browse Source 
Signed-off-by: Rob White <rob@blue-wave.net>
This commit is contained in:
Rob White
2025-08-21 16:30:09 +01:00
parent 1548db9f96
commit 0d531d50f0
5 changed files with 17 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
forward_authentication_service/libs/dnsconfig.sh
View File

@@ -15,7 +15,13 @@ hosts="/etc/hosts"
setconf="$1"
uciconfig=$(uci show dhcp 2>/dev/null)
ipset_to_nftset () {
ipset_to_nftset() {
# Translate a legacy ipset to an nftset
# The legacy ipset might be dynamically updated eg by dnsmasq, so loop around for a set time
# Note: It loops after a sleep of one second so the call to this library function should probably always be forked into the background to prevent blocking
# (hint: use a trailing "&" when calling it)
# $ipsetname contains the name of the ipset
# $loopcount contains the number of loops to do
local timeout=$loopcount
@@ -32,7 +38,7 @@ ipset_to_nftset () {
elements=${elements:2}
if [ ! -z "$elements" ] && [ "$elements" != "$last_elements" ]; then
nft add element ip nds_filter "$ipsetname" {"$elements"}
nft add element inet nds_filter "$ipsetname" {"$elements"}
fi
last_elements="$elements"

4
forward_authentication_service/libs/libopennds.sh
View File

@@ -1456,7 +1456,7 @@ nft_set () {
if [ "$nftsetmode" = "add" ] || [ "$nftsetmode" = "insert" ]; then
# Add the set, add/insert the rule and the Dnsmasq config
nft add set ip nds_filter "$nftsetname" { type ipv4_addr\; size 128\; }
nft add set inet nds_filter "$nftsetname" { type ipv4_addr\; size 128\; }
ret=$?
if [ "$ret" -ne 0 ]; then
@@ -1545,7 +1545,7 @@ nft_set () {
echo $ucicmd | uci -q batch
ucicmd="set dhcp.nds_$nftsetname.table='nds_filter'"
echo $ucicmd | uci -q batch
ucicmd="set dhcp.nds_$nftsetname.table_family='ip'"
ucicmd="set dhcp.nds_$nftsetname.table_family='inet'"
echo $ucicmd | uci -q batch
domains=$fqdns

8
src/auth.c
View File

@@ -585,17 +585,13 @@ fw_refresh_client_list(void)
// If Walled Garden ipset exists, copy it to the nftset.
dnscmd = safe_calloc(STATUS_BUF);
safe_snprintf(dnscmd, STATUS_BUF, "/usr/lib/opennds/dnsconfig.sh \"ipset_to_nftset\" \"walledgarden\" %d &", config->checkinterval);
if (system(dnscmd) != 0) {
debug(LOG_DEBUG, "legacy ipset not defined: %s", dnscmd);
}
system(dnscmd);
free(dnscmd);
// If Block List ipset exists, copy it to the nftset.
dnscmd = safe_calloc(STATUS_BUF);
safe_snprintf(dnscmd, STATUS_BUF, "/usr/lib/opennds/dnsconfig.sh \"ipset_to_nftset\" \"blocklist\" %d &", config->checkinterval);
if (system(dnscmd) != 0) {
debug(LOG_DEBUG, "legacy ipset not defined: %s", dnscmd);
}
system(dnscmd);
free(dnscmd);
if (routercheck > 0) {

7
src/conf.c
View File

@@ -348,13 +348,6 @@ config_init(int argc, char **argv)
debug(LOG_NOTICE, "Interface %s is at %s (%s)", config.gw_interface, config.gw_ip, config.gw_mac);
// Make sure fas_remoteip is set. Note: This does not enable FAS.
if (strcmp(config.fas_remoteip, "disabled") == 0) {
config.fas_remoteip = safe_strdup(config.gw_ip);
}
debug(LOG_DEBUG, "FAS remote ip address is [ %s ]", config.fas_remoteip);
// Generate a unique faskey if not set in config
if (strcmp(config.fas_key, DEFAULT_FASKEY) == 0) {
setupcmd = safe_calloc(STATUS_BUF);

7
src/main.c
View File

@@ -600,13 +600,16 @@ setup_from_config(void)
// If FAS is enabled then set it up
if (config->fas_port) {
debug(LOG_INFO, "fas_secure_enabled is set to level %d", config->fas_secure_enabled);
debug(LOG_INFO, "fasremoteip is %s, fasremotefqdn is %s", config->fas_remoteip, config->fas_remotefqdn);
// Check the FAS remote IP address
if ((strcmp(config->fas_remoteip, "disabled") == 0)) {
if ((strcmp(config->fas_remoteip, "disabled") == 0) && (strcmp(config->fas_remotefqdn, "disabled") == 0)) {
debug(LOG_DEBUG, "Setting undefined fas_remoteip");
config->fas_remoteip = safe_strdup(config->gw_ip);
}
if (config->fas_remoteip) {
if (strcmp(config->fas_remoteip, "disabled") != 0) {
if (is_addr(config->fas_remoteip) == 1) {
debug(LOG_INFO, "fasremoteip - %s - is a valid IPv4 address...", config->fas_remoteip);
} else {