OpenWrt Forum Archive

Hi,

I was trying to get a WiFi presence detection running for home automation purposes. Actually I started writing this topic because I couldn't get it running. Suddenly it worked :-). Maybe anybody else is going to achieve this and may found some helpful information here or someone else is going to add some extra knowledge.

Most of my findings are taken from here: https://wiki.openwrt.org/doc/techref/ub … _over_http

I did this on my Netgear WNDR3800 with "OpenWrt Designated Driver r48747", Kernel version 4.1.16.

So here it goes: I learned that I can ask UBUS for WiFi clients on the command line:

$ ubus call hostapd.wlan0 get_clients

Which returns something like this:

{
        "freq": 2472,
        "clients": {
                "11:aa:22:cc:33:dd": {
                        "auth": true,
                        "assoc": true,
                        "authorized": true,
                        "preauth": false,
                        "wds": false,
                        "wmm": true,
                        "ht": true,
                        "vht": false,
                        "wps": false,
                        "mfp": false,
                        "aid": 1
                }
        }
}

Then I found, that UBUS can be called via HTTP, which is great. So I sent a login request:

{
    "id": 1,
    "jsonrpc": "2.0",
    "method": "call",
    "params": [
        "00000000000000000000000000000000",
        "session",
        "login",
        {
            "password": "foobarbaz",
            "username": "root"
        }
    ]
}

... and got my session id (ubus_rpc_session)

{
    "id": 1,
    "jsonrpc": "2.0",
    "result": [
        0,
        {
            "acls": {
                "access-group": {
                    "unauthenticated": [
                        "read"
                    ]
                },
                "ubus": {
                    "session": [
                        "access",
                        "login"
                    ]
                }
            },
            "data": {
                "username": "root"
            },
            "expires": 300,
            "timeout": 300,
            "ubus_rpc_session": "0123456789abcdef0123456789abcdef"
        }
    ]
}

Then I sent a call to get a list of clients:

{ "jsonrpc": "2.0",
  "id": "1",
  "method": "call",
  "params": [
             "0123456789abcdef0123456789abcdef", "hostapd.wlan0", "get_clients", 
             { }
            ]
}

I received a code -32002, Access denied.

I added a file: /usr/share/rpcd/acl.d/superuser.json with the following content:

{
        "lesssuperuser": {
                "description": "not quite a super user",
                "read": {
                        "ubus": {
                                "hostapd.wlan0": [ "*" ],
                                "hostapd.wlan1": [ "*" ]
                        },
                },
                "write": {},
                }
        }
}

And restarted RPCD:

$ /etc/init.d/rpcd restart

The next request brought what I wanted:

{
    "id": "1",
    "jsonrpc": "2.0",
    "result": [
        0,
        {
            "clients": {
                "11:aa:22:cc:33:dd": {
                    "aid": 1,
                    "assoc": true,
                    "auth": true,
                    "authorized": true,
                    "ht": true,
                    "mfp": false,
                    "preauth": false,
                    "vht": false,
                    "wds": false,
                    "wmm": true,
                    "wps": false
                }
            },
            "freq": 2472
        }
    ]
}

There's one thing left. Now I'm logging on as "root". I don't want that. But I don't understand how user root is aligned with "lesssuperuser" in file "superuser.json".

I know there is a file /etc/config/rpcd and I added a user here but when I use this user for the login request I'm getting a result=6 which means "Access denied". Any hints on this are welcome :-)

Cheers,
SiKr

Ok, I went digging through the rpcd source and figured it out.

Add a new login block to /etc/config/rpcd:

config login
    option username 'house'
    option password '$1$$etC7nAAakIqzi3qrKRuaq1'
    list read 'listclients'
    list write 'listclients'

The password option is hashed, as the wiki says, you can use 'uhttpd -m PASSWORD' to generate it.

The read/write option there names which ACL(s) should apply to this user. The ACL name is at the top level of the JSON object. So for example, to create an ACL that only allows access to 'iwinfo assoclist', create /usr/share/rpcd/acl.d/listclients.json:

{
    "listclients": {
        "description": "Allow access to wifi client list",
        "read": {
            "ubus": {
                "session": [
                    "access",
                    "login"
                ],
                "iwinfo": [
                    "assoclist"
                ]
            }
        },
        "write": {
            "ubus": {
                "session": [
                    "access",
                    "login"
                ],
                "iwinfo": [
                    "assoclist"
                ]
            }
        }

    }
}

Don't forget to restart rpcd after making the changes. Works for me now.