51 lines
2.5 KiB
Rust
51 lines
2.5 KiB
Rust
|
use anyhow::{Context, Result};
|
||
|
|
|
||
|
|
use crate::opkg::PkgManager;
|
||
|
|
use crate::tollgate::TollGateConfig;
|
||
|
|
use crate::Router;
|
||
|
|
|
||
|
|
/// Install and configure NoDogSplash — the captive-portal engine that
|
||
|
|
/// `tollgate-wrt` delegates all MAC authorization and gate open/close to via
|
||
|
|
/// `ndsctl`. `tollgate-wrt` contains no firewall/netfilter code of its own
|
||
|
|
/// (confirmed: its binary has no `nft`/`ipset`/`iptables` calls at all); the
|
||
|
|
/// upstream package therefore hard-depends on `+nodogsplash` and its postinst
|
||
|
|
/// restarts it. Without NoDogSplash actually running, nothing blocks
|
||
|
|
/// unauthenticated clients from reaching the internet, regardless of what
|
||
|
|
/// TollGate itself is configured to charge.
|
||
|
|
///
|
||
|
|
/// Gates the dedicated `br-tollgate` bridge (see `wifi::provision_network`),
|
||
|
|
/// not `br-lan` — the paid SSID here lives on its own isolated network/subnet
|
||
|
|
/// rather than the canonical upstream layout where it's bridged into `lan`.
|
||
|
|
pub fn provision(router: &Router, pkg_mgr: PkgManager, cfg: &TollGateConfig) -> Result<()> {
|
||
|
|
router
|
||
|
|
.install_package(pkg_mgr, "nodogsplash")
|
||
|
|
.context("install nodogsplash — required by tollgate-wrt for client gating")?;
|
||
|
|
|
||
|
|
router.run_ok("touch /etc/config/nodogsplash")?;
|
||
|
|
router.uci_set("nodogsplash.main", "nodogsplash")?;
|
||
|
|
router.uci_set("nodogsplash.main.enabled", "1")?;
|
||
|
|
router.uci_set("nodogsplash.main.gatewayinterface", "br-tollgate")?;
|
||
|
|
router.uci_set("nodogsplash.main.gatewayname", &format!("{} Portal", cfg.ssid))?;
|
||
|
|
router.uci_set("nodogsplash.main.gatewaydomainname", "TollGate.lan")?;
|
||
|
|
router.uci_set("nodogsplash.main.gatewayport", "2050")?;
|
||
|
|
|
||
|
|
// Pre-auth "walled garden": unauthenticated clients must still be able to
|
||
|
|
// reach the TollGate payment endpoint (2121) and the splash portal itself
|
||
|
|
// (2050) — everything else is blocked by NoDogSplash until ndsctl
|
||
|
|
// authorizes their MAC. Rebuild the list each run rather than trying to
|
||
|
|
// dedupe, so repeated provisioning stays idempotent.
|
||
|
|
let _ = router.uci_delete("nodogsplash.main.users_to_router");
|
||
|
|
router.uci_add_list("nodogsplash.main.users_to_router", "allow tcp port 2121")?;
|
||
|
|
router.uci_add_list("nodogsplash.main.users_to_router", "allow tcp port 2050")?;
|
||
|
|
|
||
|
|
router.uci_commit(Some("nodogsplash"))?;
|
||
|
|
Ok(())
|
||
|
|
}
|
||
|
|
|
||
|
|
/// (Re)start the nodogsplash service so config changes and gate state take effect.
|
||
|
|
pub fn restart(router: &Router) -> Result<()> {
|
||
|
|
router.run_ok("/etc/init.d/nodogsplash enable")?;
|
||
|
|
router.run_ok("/etc/init.d/nodogsplash restart || /etc/init.d/nodogsplash start")?;
|
||
|
|
Ok(())
|
||
|
|
}
|