From f8a2b88692e21d46799738c13d4d12cfa95b4152 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Fri, 23 Jun 2023 17:33:51 +0200
Subject: [PATCH 1/4] hotspot-to-wpa: support non-local users

This has some limitations, though: The password is not known and
additional configuration can not be given in user's comment.
---
 doc/hotspot-to-wpa.md | 3 +++
 global-functions.rsc  | 2 +-
 hotspot-to-wpa.rsc    | 5 ++++-
 news-and-changes.rsc  | 1 +
 4 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/doc/hotspot-to-wpa.md b/doc/hotspot-to-wpa.md
index 0abe18b..097cba4 100644
--- a/doc/hotspot-to-wpa.md
+++ b/doc/hotspot-to-wpa.md
@@ -54,6 +54,9 @@ Create hotspot login credentials:
     /ip/hotspot/user/add comment="Test User 1" name=user1 password=v3ry;
     /ip/hotspot/user/add comment="Test User 2" name=user2 password=s3cr3t;
 
+This also works with authentication via radius, but is limited then:
+Additional information is not available, including the password.
+
 Additionally templates can be created to give more options for access list:
 
 * `action`: set to `reject` to ignore logins on that hotspot
diff --git a/global-functions.rsc b/global-functions.rsc
index 1f1cfa1..0378775 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -12,7 +12,7 @@
 :local 0 "global-functions";
 
 # expected configuration version
-:global ExpectedConfigVersion 101;
+:global ExpectedConfigVersion 102;
 
 # global variables not to be changed by user
 :global GlobalFunctionsReady false;
diff --git a/hotspot-to-wpa.rsc b/hotspot-to-wpa.rsc
index d7aeb65..ede4daf 100644
--- a/hotspot-to-wpa.rsc
+++ b/hotspot-to-wpa.rsc
@@ -25,7 +25,10 @@ $ScriptLock $0;
 }
 
 :local Date [ /system/clock/get date ];
-:local UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
+:local UserVal ({});
+:if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
+  :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
+}
 :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
 :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
 
diff --git a/news-and-changes.rsc b/news-and-changes.rsc
index e33a7db..b062c5e 100644
--- a/news-and-changes.rsc
+++ b/news-and-changes.rsc
@@ -15,6 +15,7 @@
   99="Modified 'dhcp-to-dns', which dropped global configuration. Settings moved to dhcp server's network definitions.";
   100="The script 'ssh-keys-import' became a module 'mod/ssh-keys-import' with enhanced functionality.";
   101="Introduced new script 'fw-addr-lists' to download, import and update firewall address-lists.";
+  102="Modified 'hotspot-to-wpa' to support non-local (radius) users.";
 };
 
 # Migration steps to be applied on script updates

From 0c8bc60648c2b5629273bf64bce81c664470506c Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Mon, 26 Jun 2023 10:44:52 +0200
Subject: [PATCH 2/4] hotspot-to-wpa: reject for two seconds...

... to make the device send a new DHCP request after.
---
 hotspot-to-wpa.rsc | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hotspot-to-wpa.rsc b/hotspot-to-wpa.rsc
index ede4daf..35d4fa5 100644
--- a/hotspot-to-wpa.rsc
+++ b/hotspot-to-wpa.rsc
@@ -57,7 +57,8 @@ $LogPrintExit2 info $0 ("Adding/updating access-list entry for mac address " . $
   " (user " . $UserName . ").") false;
 /caps-man/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
 /caps-man/access-list/add comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
-    mac-address=$MacAddress private-passphrase=($UserVal->"password") ssid-regexp="-wpa\$" place-before=$PlaceBefore;
+    mac-address=$MacAddress private-passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
+    action=reject place-before=$PlaceBefore;
 
 :local Entry [ /caps-man/access-list/find where mac-address=$MacAddress \
     comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
@@ -81,3 +82,6 @@ $LogPrintExit2 info $0 ("Adding/updating access-list entry for mac address " . $
 :if ([ :len $VlanMode] > 0) do={
   /caps-man/access-list/set $Entry vlan-mode=$VlanMode;
 }
+
+:delay 2s;
+/caps-man/access-list/set $Entry action=accept;

From 16a551a0ee712b81dc267e50414ceee39d434edc Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Fri, 23 Jun 2023 22:30:34 +0200
Subject: [PATCH 3/4] hotspot-to-wpa-cleanup: drop hard-coded server name, find
 by comment

---
 doc/hotspot-to-wpa.md      |  6 ++++--
 global-functions.rsc       |  2 +-
 hotspot-to-wpa-cleanup.rsc | 32 +++++++++++++++++++++-----------
 news-and-changes.rsc       |  1 +
 4 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/doc/hotspot-to-wpa.md b/doc/hotspot-to-wpa.md
index 097cba4..5cbe22c 100644
--- a/doc/hotspot-to-wpa.md
+++ b/doc/hotspot-to-wpa.md
@@ -38,9 +38,11 @@ Create a scheduler:
 
     /system/scheduler/add interval=1d name=hotspot-to-wpa-cleanup on-event="/system/script/run hotspot-to-wpa-cleanup;" start-time=startup;
 
-And add the lease script to your wpa interfaces' dhcp server:
+And add the lease script and matcher comment to your wpa interfaces' dhcp
+server. You can add more information to the comment, separated by comma. In
+this example the server is called `hotspot-to-wpa`.
 
-    /ip/dhcp-server/set lease-script=lease-script [ find where name~"wpa" ];
+    /ip/dhcp-server/set lease-script=lease-script comment="hotspot-to-wpa=wpa" hotspot-to-wpa;
 
 Configuration
 -------------
diff --git a/global-functions.rsc b/global-functions.rsc
index 0378775..205f67a 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -12,7 +12,7 @@
 :local 0 "global-functions";
 
 # expected configuration version
-:global ExpectedConfigVersion 102;
+:global ExpectedConfigVersion 103;
 
 # global variables not to be changed by user
 :global GlobalFunctionsReady false;
diff --git a/hotspot-to-wpa-cleanup.rsc b/hotspot-to-wpa-cleanup.rsc
index 15f63f9..b3aba11 100644
--- a/hotspot-to-wpa-cleanup.rsc
+++ b/hotspot-to-wpa-cleanup.rsc
@@ -13,26 +13,36 @@
 :while ($GlobalFunctionsReady != true) do={ :delay 500ms; }
 
 :global LogPrintExit2;
+:global ParseKeyValueStore;
 :global ScriptLock;
 
 $ScriptLock $0 false 10;
 
-:foreach Client in=[ /caps-man/registration-table/find where comment~"^hotspot-to-wpa:" ] do={
-  :local ClientVal [ /caps-man/registration-table/get $Client ];
-  :local Lease [ /ip/dhcp-server/lease/find where server~"wpa" dynamic \
-    mac-address=($ClientVal->"mac-address") ];
-  :if ([ :len $Lease ] > 0) do={
-    $LogPrintExit2 info $0 ("Client with mac address " . ($ClientVal->"mac-address") . \
-      " connected to WPA, making lease static.") false;
-    /ip/dhcp-server/lease/make-static $Lease;
-    /ip/dhcp-server/lease/set comment=($ClientVal->"comment") $Lease;
+:local DHCPServers ({});
+:foreach Server in=[ /ip/dhcp-server/find where comment~"hotspot-to-wpa" ] do={
+  :local ServerVal [ /ip/dhcp-server/get $Server ]
+  :if (([ $ParseKeyValueStore ($ServerVal->"comment") ]->"hotspot-to-wpa") = "wpa") do={
+    :set ($DHCPServers->($ServerVal->"name")) 1;
   }
 }
 
-:foreach Client in=[ /caps-man/access-list/find where comment~"^hotspot-to-wpa:" and \
+:foreach Client in=[ /caps-man/registration-table/find where comment~"^hotspot-to-wpa:" ] do={
+  :local ClientVal [ /caps-man/registration-table/get $Client ];
+  :foreach Lease in=[ /ip/dhcp-server/lease/find where dynamic \
+      mac-address=($ClientVal->"mac-address") ] do={
+    :if (($DHCPServers->[ /ip/dhcp-server/lease/get $Lease server ]) = 1) do={
+      $LogPrintExit2 info $0 ("Client with mac address " . ($ClientVal->"mac-address") . \
+        " connected to WPA, making lease static.") false;
+      /ip/dhcp-server/lease/make-static $Lease;
+      /ip/dhcp-server/lease/set comment=($ClientVal->"comment") $Lease;
+    }
+  }
+}
+
+:foreach Client in=[ /caps-man/access-list/find where comment~"^hotspot-to-wpa:" \
     !(comment~[ /system/clock/get date ]) ] do={
   :local ClientVal [ /caps-man/access-list/get $Client ];
-  :if ([ :len [ /ip/dhcp-server/lease/find where server~"wpa" !dynamic \
+  :if ([ :len [ /ip/dhcp-server/lease/find where !dynamic comment~"^hotspot-to-wpa:" \
        mac-address=($ClientVal->"mac-address") ] ] = 0) do={
     $LogPrintExit2 info $0 ("Client with mac address " . ($ClientVal->"mac-address") . \
       " did not connect to WPA, removing from access list.") false;
diff --git a/news-and-changes.rsc b/news-and-changes.rsc
index b062c5e..fd7742e 100644
--- a/news-and-changes.rsc
+++ b/news-and-changes.rsc
@@ -16,6 +16,7 @@
   100="The script 'ssh-keys-import' became a module 'mod/ssh-keys-import' with enhanced functionality.";
   101="Introduced new script 'fw-addr-lists' to download, import and update firewall address-lists.";
   102="Modified 'hotspot-to-wpa' to support non-local (radius) users.";
+  103="Dropped hard-coded name from 'hotspot-to-wpa-cleanup', instead a comment is required for dhcp server now.";
 };
 
 # Migration steps to be applied on script updates

From 64ab9eec6756a95df14471b0ebf0f3014c478e9a Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Tue, 27 Jun 2023 21:59:18 +0200
Subject: [PATCH 4/4] hotspot-to-wpa-cleanup: drop hard-coded timeout, get from
 comment

This keeps the default of four weeks, though.
---
 doc/hotspot-to-wpa.md      |  5 +++++
 hotspot-to-wpa-cleanup.rsc | 27 ++++++++++++++++-----------
 news-and-changes.rsc       |  2 +-
 3 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/doc/hotspot-to-wpa.md b/doc/hotspot-to-wpa.md
index 5cbe22c..2630694 100644
--- a/doc/hotspot-to-wpa.md
+++ b/doc/hotspot-to-wpa.md
@@ -44,6 +44,11 @@ this example the server is called `hotspot-to-wpa`.
 
     /ip/dhcp-server/set lease-script=lease-script comment="hotspot-to-wpa=wpa" hotspot-to-wpa;
 
+You can specify the timeout after which a device is removed from leases and
+access-list. The default is four weeks.
+
+    /ip/dhcp-server/set lease-script=lease-script comment="hotspot-to-wpa=wpa, timeout=2w" hotspot-to-wpa;
+
 Configuration
 -------------
 
diff --git a/hotspot-to-wpa-cleanup.rsc b/hotspot-to-wpa-cleanup.rsc
index b3aba11..adb0abb 100644
--- a/hotspot-to-wpa-cleanup.rsc
+++ b/hotspot-to-wpa-cleanup.rsc
@@ -12,6 +12,7 @@
 :global GlobalFunctionsReady;
 :while ($GlobalFunctionsReady != true) do={ :delay 500ms; }
 
+:global EitherOr;
 :global LogPrintExit2;
 :global ParseKeyValueStore;
 :global ScriptLock;
@@ -21,8 +22,10 @@ $ScriptLock $0 false 10;
 :local DHCPServers ({});
 :foreach Server in=[ /ip/dhcp-server/find where comment~"hotspot-to-wpa" ] do={
   :local ServerVal [ /ip/dhcp-server/get $Server ]
-  :if (([ $ParseKeyValueStore ($ServerVal->"comment") ]->"hotspot-to-wpa") = "wpa") do={
-    :set ($DHCPServers->($ServerVal->"name")) 1;
+  :local ServerInfo [ $ParseKeyValueStore ($ServerVal->"comment") ];
+  :if (($ServerInfo->"hotspot-to-wpa") = "wpa") do={
+    :set ($DHCPServers->($ServerVal->"name")) \
+      [ :totime [ $EitherOr ($ServerInfo->"timeout") 4w ] ];
   }
 }
 
@@ -30,7 +33,7 @@ $ScriptLock $0 false 10;
   :local ClientVal [ /caps-man/registration-table/get $Client ];
   :foreach Lease in=[ /ip/dhcp-server/lease/find where dynamic \
       mac-address=($ClientVal->"mac-address") ] do={
-    :if (($DHCPServers->[ /ip/dhcp-server/lease/get $Lease server ]) = 1) do={
+    :if (($DHCPServers->[ /ip/dhcp-server/lease/get $Lease server ]) > 0s) do={
       $LogPrintExit2 info $0 ("Client with mac address " . ($ClientVal->"mac-address") . \
         " connected to WPA, making lease static.") false;
       /ip/dhcp-server/lease/make-static $Lease;
@@ -50,12 +53,14 @@ $ScriptLock $0 false 10;
   }
 }
 
-:foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic status=waiting \
-    last-seen>4w comment~"^hotspot-to-wpa:" ] do={
-  :local LeaseVal [ /ip/dhcp-server/lease/get $Lease ];
-  $LogPrintExit2 info $0 ("Client with mac address " . ($LeaseVal->"mac-address") . \
-    " was not seen for long time, removing.") false;
-  /caps-man/access-list/remove [ find where comment~"^hotspot-to-wpa:" \
-     mac-address=($LeaseVal->"mac-address") ];
-  /ip/dhcp-server/lease/remove $Lease;
+:foreach Server,Timeout in=$DHCPServers do={
+  :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic status="waiting" \
+      server=$Server last-seen>$Timeout comment~"^hotspot-to-wpa:" ] do={
+    :local LeaseVal [ /ip/dhcp-server/lease/get $Lease ];
+    $LogPrintExit2 info $0 ("Client with mac address " . ($LeaseVal->"mac-address") . \
+      " was not seen for " . $Timeout . ", removing.") false;
+    /caps-man/access-list/remove [ find where comment~"^hotspot-to-wpa:" \
+      mac-address=($LeaseVal->"mac-address") ];
+    /ip/dhcp-server/lease/remove $Lease;
+  }
 }
diff --git a/news-and-changes.rsc b/news-and-changes.rsc
index fd7742e..572f431 100644
--- a/news-and-changes.rsc
+++ b/news-and-changes.rsc
@@ -16,7 +16,7 @@
   100="The script 'ssh-keys-import' became a module 'mod/ssh-keys-import' with enhanced functionality.";
   101="Introduced new script 'fw-addr-lists' to download, import and update firewall address-lists.";
   102="Modified 'hotspot-to-wpa' to support non-local (radius) users.";
-  103="Dropped hard-coded name from 'hotspot-to-wpa-cleanup', instead a comment is required for dhcp server now.";
+  103="Dropped hard-coded name and timeout from 'hotspot-to-wpa-cleanup', instead a comment is required for dhcp server now.";
 };
 
 # Migration steps to be applied on script updates