mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-10-28 03:12:52 +08:00
618 lines
13 KiB
Bash
Executable File
618 lines
13 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
crrun=$1
|
|
crid=$2
|
|
crstate=${3:-1}
|
|
NAME=devgate
|
|
DEBUG=1 # 开启调试
|
|
|
|
LOG_FILE="/var/log/devgate.log"
|
|
IDLIST="/var/$NAME.idlist"
|
|
RULE_PREFIX="devgate_"
|
|
DEFAULT_SRC_ZONE="lan"
|
|
PUBLIC_DEST_ZONE="wan"
|
|
INTERNAL_DEST_ZONE="*"
|
|
|
|
bin_fw4=$(command -v fw4 2>/dev/null)
|
|
|
|
config_t_get() {
|
|
local index=${3:-0}
|
|
local ret=$(uci -q get "${NAME}.@${1}[${index}].${2}")
|
|
echo "${ret:-$4}"
|
|
}
|
|
|
|
normalize_rule_uid() {
|
|
local uid
|
|
uid=$(printf '%s' "${1:-}" | tr 'A-F' 'a-f' | sed 's/[^a-z0-9]//g' | cut -c1-6)
|
|
|
|
if echo "$uid" | grep -qE '^[a-z0-9]{6}$'; then
|
|
echo "$uid"
|
|
return 0
|
|
fi
|
|
|
|
return 1
|
|
}
|
|
|
|
get_rule_uid() {
|
|
local id="$1"
|
|
local uid
|
|
|
|
uid="$(normalize_rule_uid "$(config_t_get device uid "$id")")" || uid=""
|
|
[ -n "$uid" ] || return 1
|
|
|
|
echo "$uid"
|
|
}
|
|
|
|
resolve_rule_ref() {
|
|
local ref="$1"
|
|
local uid
|
|
|
|
if echo "$ref" | grep -qE '^[0-9]+$' && uci -q show "${NAME}.@device[$ref]" >/dev/null 2>&1; then
|
|
get_rule_uid "$ref"
|
|
return $?
|
|
fi
|
|
|
|
normalize_rule_uid "$ref"
|
|
}
|
|
|
|
get_device_mode() {
|
|
local id="$1"
|
|
local device_mode=$(config_t_get device chain "$id" "forward")
|
|
|
|
case "$device_mode" in
|
|
all|input)
|
|
echo "all"
|
|
;;
|
|
*)
|
|
echo "forward"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
get_forward_dest_zone() {
|
|
local device_mode="$1"
|
|
|
|
case "$device_mode" in
|
|
all)
|
|
echo "$INTERNAL_DEST_ZONE"
|
|
;;
|
|
*)
|
|
echo "$PUBLIC_DEST_ZONE"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
normalize_enabled() {
|
|
case "${1:-1}" in
|
|
1|true|yes|on|enabled)
|
|
echo "1"
|
|
;;
|
|
*)
|
|
echo "0"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
dbg() {
|
|
if [ "$DEBUG" -eq 1 ]; then
|
|
local d="$(date '+%Y-%m-%d %H:%M:%S')"
|
|
echo "[$d] FW-DEBUG: $@" >> "$LOG_FILE"
|
|
fi
|
|
}
|
|
|
|
info() {
|
|
local d="$(date '+%Y-%m-%d %H:%M:%S')"
|
|
echo "[$d] FW-INFO: $@" >> "$LOG_FILE"
|
|
}
|
|
|
|
run_logged() {
|
|
local label="$1"
|
|
shift
|
|
|
|
local output rc
|
|
output="$("$@" 2>&1)"
|
|
rc=$?
|
|
|
|
[ -n "$output" ] && {
|
|
while IFS= read -r line; do
|
|
dbg "$label: $line"
|
|
done <<-EOF
|
|
$output
|
|
EOF
|
|
}
|
|
|
|
return "$rc"
|
|
}
|
|
|
|
normalize_mac() {
|
|
local mac
|
|
mac=$(echo "${1:-}" | xargs | tr 'A-F' 'a-f')
|
|
|
|
if echo "$mac" | grep -qE '^([0-9a-f]{2}:){5}[0-9a-f]{2}$'; then
|
|
echo "$mac"
|
|
return 0
|
|
fi
|
|
|
|
return 1
|
|
}
|
|
|
|
rule_section() {
|
|
local uid="$1"
|
|
|
|
echo "${RULE_PREFIX}${uid}"
|
|
}
|
|
|
|
rule_name() {
|
|
local uid="$1"
|
|
|
|
echo "DevGate-$uid"
|
|
}
|
|
|
|
input_rule_name() {
|
|
local uid="$1"
|
|
|
|
echo "DevGate-$uid-Input"
|
|
}
|
|
|
|
check_firewall_tool() {
|
|
if ! command -v uci >/dev/null 2>&1; then
|
|
info "错误: 未找到uci命令"
|
|
return 1
|
|
fi
|
|
|
|
if [ ! -x /etc/init.d/firewall ] && [ ! -x "$bin_fw4" ]; then
|
|
info "错误: 未找到firewall4防火墙服务"
|
|
return 1
|
|
fi
|
|
|
|
dbg "检测到OpenWrt firewall UCI接口"
|
|
[ -x /etc/init.d/firewall ] && dbg "firewall服务: /etc/init.d/firewall"
|
|
[ -x "$bin_fw4" ] && dbg "fw4命令: $bin_fw4"
|
|
|
|
return 0
|
|
}
|
|
|
|
reload_firewall() {
|
|
if [ -x /etc/init.d/firewall ]; then
|
|
run_logged "firewall reload" /etc/init.d/firewall reload
|
|
return $?
|
|
fi
|
|
|
|
run_logged "fw4 reload" "$bin_fw4" reload
|
|
}
|
|
|
|
commit_firewall() {
|
|
uci -q commit firewall || {
|
|
info "错误: 提交firewall配置失败"
|
|
return 1
|
|
}
|
|
|
|
if [ "${DEVGATE_DEFER_FIREWALL_RELOAD:-0}" = "1" ]; then
|
|
dbg "延迟firewall重载"
|
|
return 0
|
|
fi
|
|
|
|
reload_firewall || {
|
|
info "错误: 重载firewall失败"
|
|
return 1
|
|
}
|
|
}
|
|
|
|
delete_device_firewall_rules() {
|
|
local ref="$1"
|
|
local uid
|
|
|
|
uid="$(resolve_rule_ref "$ref")" || uid=""
|
|
|
|
[ -n "$uid" ] && {
|
|
uci -q delete "firewall.$(rule_section "$uid")"
|
|
uci -q delete "firewall.$(rule_section "$uid")_forward"
|
|
uci -q delete "firewall.$(rule_section "$uid")_input"
|
|
}
|
|
|
|
uci -q delete "firewall.${RULE_PREFIX}${ref}_forward"
|
|
uci -q delete "firewall.${RULE_PREFIX}${ref}_input"
|
|
}
|
|
|
|
delete_all_devgate_firewall_rules() {
|
|
local section
|
|
|
|
uci -q show firewall | sed -n "s/^firewall\.\(${RULE_PREFIX}[A-Za-z0-9_]*\)=rule$/\1/p" | while IFS= read -r section; do
|
|
[ -n "$section" ] && uci -q delete "firewall.$section"
|
|
done
|
|
}
|
|
|
|
set_firewall_option() {
|
|
local section="$1"
|
|
local option="$2"
|
|
local value="$3"
|
|
|
|
uci -q set "firewall.$section.$option=$value"
|
|
}
|
|
|
|
create_forward_rule() {
|
|
local section="$1"
|
|
local mac="$2"
|
|
local name="$3"
|
|
local dest="$4"
|
|
local enabled
|
|
|
|
enabled="$(normalize_enabled "$5")"
|
|
|
|
uci -q set "firewall.$section=rule" || return 1
|
|
set_firewall_option "$section" enabled "$enabled" || return 1
|
|
set_firewall_option "$section" name "$name" || return 1
|
|
set_firewall_option "$section" src "$DEFAULT_SRC_ZONE" || return 1
|
|
set_firewall_option "$section" dest "$dest" || return 1
|
|
set_firewall_option "$section" src_mac "$mac" || return 1
|
|
set_firewall_option "$section" proto "all" || return 1
|
|
set_firewall_option "$section" target "REJECT" || return 1
|
|
}
|
|
|
|
create_input_rule() {
|
|
local section="$1"
|
|
local mac="$2"
|
|
local name="$3"
|
|
local enabled
|
|
|
|
enabled="$(normalize_enabled "$4")"
|
|
|
|
uci -q set "firewall.$section=rule" || return 1
|
|
set_firewall_option "$section" enabled "$enabled" || return 1
|
|
set_firewall_option "$section" name "$name" || return 1
|
|
set_firewall_option "$section" src "$DEFAULT_SRC_ZONE" || return 1
|
|
set_firewall_option "$section" src_mac "$mac" || return 1
|
|
set_firewall_option "$section" proto "all" || return 1
|
|
set_firewall_option "$section" target "REJECT" || return 1
|
|
}
|
|
|
|
verify_firewall_rule() {
|
|
local uid="$1"
|
|
local mac="$2"
|
|
local device_mode="$3"
|
|
local expected_enabled="${4:-}"
|
|
local section input_section
|
|
local expected_dest
|
|
|
|
section=$(rule_section "$uid")
|
|
input_section="${section}_input"
|
|
expected_dest=$(get_forward_dest_zone "$device_mode")
|
|
|
|
dbg "验证firewall通信规则: UID=$uid MAC=$mac mode=$device_mode dest=$expected_dest"
|
|
|
|
[ "$(uci -q get "firewall.$section.name")" = "$(rule_name "$uid")" ] || {
|
|
dbg "验证失败: 规则名称不是$(rule_name "$uid")"
|
|
return 1
|
|
}
|
|
|
|
[ "$(uci -q get "firewall.$section.src_mac")" = "$mac" ] || {
|
|
dbg "验证失败: 转发规则不存在或MAC不匹配"
|
|
return 1
|
|
}
|
|
|
|
[ "$(uci -q get "firewall.$section.target")" = "REJECT" ] || {
|
|
dbg "验证失败: 转发规则目标不是REJECT"
|
|
return 1
|
|
}
|
|
|
|
[ "$(uci -q get "firewall.$section.dest")" = "$expected_dest" ] || {
|
|
dbg "验证失败: 转发规则目标区域不是$expected_dest"
|
|
return 1
|
|
}
|
|
|
|
if [ -n "$expected_enabled" ]; then
|
|
[ "$(uci -q get "firewall.$section.enabled")" = "$expected_enabled" ] || {
|
|
dbg "验证失败: 转发规则启用状态不是$expected_enabled"
|
|
return 1
|
|
}
|
|
fi
|
|
|
|
if [ "$device_mode" = "all" ]; then
|
|
[ "$(uci -q get "firewall.$input_section.name")" = "$(input_rule_name "$uid")" ] || {
|
|
dbg "验证失败: 本机访问规则名称不是$(input_rule_name "$uid")"
|
|
return 1
|
|
}
|
|
|
|
[ "$(uci -q get "firewall.$input_section.src_mac")" = "$mac" ] || {
|
|
dbg "验证失败: 本机访问规则不存在或MAC不匹配"
|
|
return 1
|
|
}
|
|
|
|
[ "$(uci -q get "firewall.$input_section.target")" = "REJECT" ] || {
|
|
dbg "验证失败: 本机访问规则目标不是REJECT"
|
|
return 1
|
|
}
|
|
|
|
if [ -n "$expected_enabled" ]; then
|
|
[ "$(uci -q get "firewall.$input_section.enabled")" = "$expected_enabled" ] || {
|
|
dbg "验证失败: 本机访问规则启用状态不是$expected_enabled"
|
|
return 1
|
|
}
|
|
fi
|
|
else
|
|
! uci -q show "firewall.$input_section" >/dev/null 2>&1 || {
|
|
dbg "验证失败: 存在过期本机访问规则"
|
|
return 1
|
|
}
|
|
fi
|
|
|
|
dbg "验证成功: DevGate通信规则已写入firewall配置"
|
|
return 0
|
|
}
|
|
|
|
init_firewall() {
|
|
check_firewall_tool || return 1
|
|
|
|
info "初始化防火墙规则 (黑名单模式，REJECT目标，规则同步到firewall通信规则)"
|
|
delete_all_devgate_firewall_rules
|
|
commit_firewall || return 1
|
|
rm -f "$IDLIST"
|
|
info "firewall通信规则初始化完成"
|
|
|
|
return 0
|
|
}
|
|
|
|
stop_firewall() {
|
|
info "停止防火墙规则"
|
|
check_firewall_tool || return 1
|
|
|
|
delete_all_devgate_firewall_rules
|
|
commit_firewall || return 1
|
|
|
|
rm -f "$IDLIST"
|
|
info "DevGate通信规则已删除"
|
|
}
|
|
|
|
disable_device_config() {
|
|
local id="$1"
|
|
|
|
uci -q set "${NAME}.@device[$id].enable=0" || return 1
|
|
uci -q commit "$NAME" || return 1
|
|
}
|
|
|
|
skip_device_without_mac() {
|
|
local id="$1"
|
|
local reason="$2"
|
|
local uid
|
|
|
|
info "$reason，固定为未启用: ID=$id"
|
|
uid="$(get_rule_uid "$id" 2>/dev/null)" || uid=""
|
|
[ -n "$uid" ] && delete_device_firewall_rules "$uid"
|
|
disable_device_config "$id" || return 1
|
|
commit_firewall || return 1
|
|
}
|
|
|
|
add_device() {
|
|
check_firewall_tool || return 1
|
|
|
|
local id="$1"
|
|
local rule_enabled
|
|
local uid
|
|
local target=$(config_t_get device mac "$id")
|
|
local device_mode=$(get_device_mode "$id")
|
|
local dest_zone
|
|
[ -z "$target" ] && {
|
|
skip_device_without_mac "$id" "目标设备为空" || return 1
|
|
return 0
|
|
}
|
|
|
|
local comment=$(config_t_get device comment "$id" "设备$id")
|
|
local mac
|
|
|
|
mac=$(normalize_mac "$target") || {
|
|
skip_device_without_mac "$id" "目标MAC无效: $target" || return 1
|
|
return 0
|
|
}
|
|
rule_enabled="$(normalize_enabled "$2")"
|
|
dest_zone=$(get_forward_dest_zone "$device_mode")
|
|
uid="$(get_rule_uid "$id")" || {
|
|
info "添加失败: 规则唯一识别码缺失 ID=$id"
|
|
return 1
|
|
}
|
|
|
|
info "添加设备到firewall通信规则: $comment ($mac, uid=$uid, $device_mode, dest=$dest_zone, enabled=$rule_enabled)"
|
|
|
|
delete_device_firewall_rules "$uid"
|
|
delete_device_firewall_rules "$id"
|
|
create_forward_rule "$(rule_section "$uid")" "$mac" "$(rule_name "$uid")" "$dest_zone" "$rule_enabled" || return 1
|
|
if [ "$device_mode" = "all" ]; then
|
|
create_input_rule "$(rule_section "$uid")_input" "$mac" "$(input_rule_name "$uid")" "$rule_enabled" || return 1
|
|
fi
|
|
|
|
if ! commit_firewall; then
|
|
info "添加失败: firewall重载失败，回滚DevGate规则"
|
|
delete_device_firewall_rules "$uid"
|
|
commit_firewall >/dev/null 2>&1 || true
|
|
return 1
|
|
fi
|
|
|
|
verify_firewall_rule "$uid" "$mac" "$device_mode" "$rule_enabled" || return 1
|
|
}
|
|
|
|
del_device() {
|
|
check_firewall_tool || return 1
|
|
|
|
local ref="$1"
|
|
local uid
|
|
local target=""
|
|
local comment="规则$ref"
|
|
|
|
uid="$(resolve_rule_ref "$ref")" || {
|
|
info "移除失败: 规则唯一识别码无效 $ref"
|
|
return 1
|
|
}
|
|
|
|
if echo "$ref" | grep -qE '^[0-9]+$' && uci -q show "${NAME}.@device[$ref]" >/dev/null 2>&1; then
|
|
target=$(config_t_get device mac "$ref")
|
|
comment=$(config_t_get device comment "$ref" "设备$ref")
|
|
fi
|
|
|
|
info "从firewall通信规则移除设备: $comment ($target, uid=$uid)"
|
|
|
|
delete_device_firewall_rules "$uid"
|
|
delete_device_firewall_rules "$ref"
|
|
commit_firewall || return 1
|
|
}
|
|
|
|
show_firewall_status() {
|
|
check_firewall_tool || return 1
|
|
|
|
echo ""
|
|
echo "防火墙状态:"
|
|
echo "控制方式: 黑名单"
|
|
echo "控制强度: 按设备规则"
|
|
echo "规则来源: /etc/config/firewall 通信规则"
|
|
echo ""
|
|
|
|
echo "DevGate通信规则:"
|
|
if uci -q show firewall | grep -q "^firewall\.${RULE_PREFIX}"; then
|
|
uci -q show firewall | grep "^firewall\.${RULE_PREFIX}"
|
|
else
|
|
echo " 当前没有DevGate通信规则"
|
|
fi
|
|
}
|
|
|
|
diagnose() {
|
|
echo ""
|
|
echo "=== 设备门禁系统诊断 ==="
|
|
echo ""
|
|
|
|
echo "1. 服务状态:"
|
|
if pidof devgatectrl >/dev/null 2>&1; then
|
|
echo " ✓ devgatectrl 正在运行"
|
|
else
|
|
echo " ✗ devgatectrl 未运行"
|
|
fi
|
|
|
|
echo ""
|
|
echo "2. 配置文件:"
|
|
if [ -f "/etc/config/devgate" ]; then
|
|
echo " ✓ 配置文件存在"
|
|
uci show devgate 2>/dev/null | grep -c "device" | while read count; do
|
|
echo " 配置了 $count 个设备"
|
|
done
|
|
else
|
|
echo " ✗ 配置文件不存在"
|
|
fi
|
|
|
|
echo ""
|
|
echo "3. 防火墙接口:"
|
|
if command -v uci >/dev/null 2>&1; then
|
|
echo " ✓ uci: $(command -v uci)"
|
|
else
|
|
echo " ✗ 未找到uci"
|
|
fi
|
|
|
|
if [ -x /etc/init.d/firewall ]; then
|
|
echo " ✓ firewall服务: /etc/init.d/firewall"
|
|
else
|
|
echo " ✗ 未找到firewall服务"
|
|
fi
|
|
|
|
if [ -x "$bin_fw4" ]; then
|
|
echo " ✓ fw4: $bin_fw4"
|
|
echo " 版本: $($bin_fw4 -V 2>/dev/null | head -1)"
|
|
else
|
|
echo " ? 未找到fw4命令"
|
|
fi
|
|
|
|
show_firewall_status
|
|
|
|
echo ""
|
|
echo "4. 当前控制列表:"
|
|
if [ -f "$IDLIST" ] && [ -s "$IDLIST" ]; then
|
|
echo " 当前禁止的设备:"
|
|
cat "$IDLIST" | sed 's/!//g' | while read ref; do
|
|
echo " $ref"
|
|
done
|
|
else
|
|
echo " 当前没有设备被禁止"
|
|
fi
|
|
|
|
echo ""
|
|
echo "=== 诊断完成 ==="
|
|
}
|
|
|
|
case "$crrun" in
|
|
start)
|
|
info "启动设备门禁"
|
|
init_firewall
|
|
if [ $? -eq 0 ]; then
|
|
info "设备门禁启动成功"
|
|
show_firewall_status
|
|
else
|
|
info "设备门禁启动失败"
|
|
exit 1
|
|
fi
|
|
;;
|
|
|
|
stop)
|
|
info "停止设备门禁"
|
|
stop_firewall
|
|
info "设备门禁已停止"
|
|
;;
|
|
|
|
add)
|
|
[ -z "$crid" ] && {
|
|
echo "错误: 需要指定设备ID"
|
|
exit 1
|
|
}
|
|
info "添加设备控制: ID=$crid enabled=$(normalize_enabled "$crstate")"
|
|
add_device "$crid" "$crstate" || exit 1
|
|
show_firewall_status
|
|
;;
|
|
|
|
uid)
|
|
[ -z "$crid" ] && {
|
|
echo "错误: 需要指定设备ID"
|
|
exit 1
|
|
}
|
|
get_rule_uid "$crid" || exit 1
|
|
;;
|
|
|
|
del)
|
|
[ -z "$crid" ] && {
|
|
echo "错误: 需要指定设备ID"
|
|
exit 1
|
|
}
|
|
info "移除设备控制: ID=$crid"
|
|
del_device "$crid" || exit 1
|
|
show_firewall_status
|
|
;;
|
|
|
|
status)
|
|
show_firewall_status
|
|
;;
|
|
|
|
reload)
|
|
check_firewall_tool || exit 1
|
|
reload_firewall || exit 1
|
|
;;
|
|
|
|
diagnose)
|
|
diagnose
|
|
;;
|
|
|
|
help|"")
|
|
echo "设备门禁系统命令工具"
|
|
echo ""
|
|
echo "用法: $0 {start|stop|add <id>|del <id>|status|diagnose|help}"
|
|
echo ""
|
|
echo "命令说明:"
|
|
echo " start - 初始化firewall通信规则"
|
|
echo " stop - 停止并清理所有DevGate通信规则"
|
|
echo " add <id> [0|1] - 添加设备到控制列表，并设置防火墙规则启用状态"
|
|
echo " del <id> - 从控制列表移除设备"
|
|
echo " status - 显示防火墙状态"
|
|
echo " reload - 重载firewall服务"
|
|
echo " diagnose - 系统诊断"
|
|
echo " help - 显示此帮助信息"
|
|
;;
|
|
|
|
*)
|
|
echo "错误: 未知命令 '$crrun'"
|
|
echo "使用: $0 help 查看帮助"
|
|
exit 1
|
|
;;
|
|
esac
|