Pirania hackaton final fix #1239
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…irania script functionality
Adiciona doc extensa (gerada por ia)
- Fix typo: 'pireania' -> 'pirania' in forward chain definition - Add counter and log prefix "DROP-UNAUTH" to catch-all drop rule - Update comment to better describe the rule's purpose
Update nft rules to block all protocols when no voucher
Implements a second-layer access control system that restricts internet access during configurable time periods (e.g., 20:00-07:00 on weekdays). Key features: - Scheduled restrictions with day-of-week and time range configuration - Unrestricted vouchers that bypass Tranca restrictions entirely - Category-based allowlists during restricted periods (e.g., messenger IPs) - Cron-based scheduler that evaluates schedule every minute - Smart nftables rule rebuilding on state changes During Tranca Redes active periods: - Authorized MACs can only reach category allowlist destinations - Unrestricted voucher holders bypass all restrictions - Unauthorized MACs remain blocked as usual Feature is disabled by default (enabled='0').
Replace the deprecated liblucihttp-lua dependency with pure Lua implementations for URL encoding/decoding. This improves compatibility with newer OpenWrt versions where lucihttp is being phased out. Changes: - Implement RFC 3986 compliant urlencode() using pure Lua - Implement urldecode() supporting both %XX and + encoding - Implement urldecode_params() for query string parsing - Remove liblucihttp-lua from package dependencies - Add comprehensive unit tests for URL utilities (31 tests) The implementation handles all existing use cases including: - Voucher code parsing from query strings - URL encoding for redirect parameters - Support for & and ; as query parameter separators
Member
|
Looks amazing :D In 6786e6e @henmohr removed the usage of ipset, but somehow the |
Implement catch_interfaces and catch_bridged_interfaces to scope Pirania captive portal to specific interfaces only, preventing mesh traffic from being affected. Changes: - Add kmod-nft-bridge dependency for bridge-family nftables support - Create bridge pirania table with L2 marking (mark 0x9124714) - Add pirania-catch-ifaces and pirania-catch-bridge-ifaces sets - Use regular chains (pirania_prerouting, pirania_forward) with base chain gating via interface match or mark match - Update clean_tables() to remove both bridge and inet tables - Update update_ipsets() to populate interface sets from UCI - Default config now uses catch_bridged_interfaces (wlan0-ap) instead of catch_interfaces (br-lan) to avoid catching mesh traffic This preserves legacy behavior when interfaces are configured while allowing mesh-safe defaults that only catch Wi-Fi AP traffic.
- Add critical note about chain creation order (regular chains before base chains that reference them) - Mark validated checklist items from testing on router - Add note about adding wlan0-apname to catch list for the example router
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a continuation of the work on #1224