hotspot-to-wpa: rework for RouterOS 7.24 compatibility

We need RouterOS 7.24 for this to catch runtime errors for bad
command parameters.

Actually this would work with RouterOS 7.23 on architectures that
support http-version=http2 ...

README.md

@@ -288,7 +288,7 @@ Available scripts
 * [Download, import and update firewall address-lists](doc/fw-addr-lists.md) (`fw-addr-lists`)
 * [Wait for global functions und modules](doc/global-wait.md) (`global-wait`)
 * [Send GPS position to server](doc/gps-track.md) (`gps-track`)
-* [Use WPA network with hotspot credentials](doc/hotspot-to-wpa.md) (`hotspot-to-wpa` & `hotspot-to-wpa-cleanup`)
+* [Use WPA network with hotspot credentials](doc/hotspot-to-wpa.md) (`hotspot-to-wpa`, `hotspot-to-wpa-lease` & `hotspot-to-wpa-cleanup`)
 * [Create DNS records for IPSec peers](doc/ipsec-to-dns.md) (`ipsec-to-dns`)
 * [Update configuration on IPv6 prefix change](doc/ipv6-update.md) (`ipv6-update`)
 * [Manage IP addresses with bridge status](doc/ip-addr-bridge.md) (`ip-addr-bridge`)

doc/hotspot-to-wpa.md

@@ -26,35 +26,40 @@ Requirements and installation
 You need a properly configured hotspot on one (open) SSID and a WPA enabled
 SSID with suffix "`-wpa`".
 
-Then install the script.
+Then install the scripts. Depending on whether you use `wifi` package
-Depending on whether you use `wifi` package (`/interface/wifi`)or legacy
+(`/interface/wifi`) or legacy wifi with CAPsMAN (`/caps-man`) you need to
-wifi with CAPsMAN (`/caps-man`) you need to install a different script and
+install a different set of scripts.
-set it as `on-login` script in hotspot.
 
 For `wifi`:
 
-    $ScriptInstallUpdate hotspot-to-wpa.wifi;
+    $ScriptInstallUpdate hotspot-to-wpa,hotspot-to-wpa-lease.wifi,dhcpv4-server-lease;
-    /ip/hotspot/user/profile/set on-login="hotspot-to-wpa.wifi" [ find ];
 
 For legacy CAPsMAN:
 
-    $ScriptInstallUpdate hotspot-to-wpa.capsman;
+    $ScriptInstallUpdate hotspot-to-wpa,hotspot-to-wpa-lease.capsman,dhcpv4-server-lease;
-    /ip/hotspot/user/profile/set on-login="hotspot-to-wpa.capsman" [ find ];
+
+Then set `hotspot-to-wpa` as `on-login` script in hotspot.
+
+    /ip/hotspot/user/profile/set on-login="hotspot-to-wpa" [ find ];
+
+Finally ad add the lease script your hotspot interfaces' dhcp server.
+
+    /ip/dhcp-server/set lease-script="dhcpv4-server-lease" hotspot;
 
 ### Automatic cleanup
 
-With just `hotspot-to-wpa` installed the mac addresses will last in the
+With just the above scripts installed the mac addresses will last in the
 access list forever. Install the optional script for automatic cleanup
 and add a scheduler.
 
 For `wifi`:
 
-    $ScriptInstallUpdate hotspot-to-wpa-cleanup.wifi,dhcpv4-server-lease;
+    $ScriptInstallUpdate hotspot-to-wpa-cleanup.wifi;
     /system/scheduler/add interval=1d name="hotspot-to-wpa-cleanup" on-event="/system/script/run hotspot-to-wpa-cleanup.wifi;" start-time=startup;
 
 For legacy CAPsMAN:
 
-    $ScriptInstallUpdate hotspot-to-wpa-cleanup.capsman,dhcpv4-server-lease;
+    $ScriptInstallUpdate hotspot-to-wpa-cleanup.capsman;
     /system/scheduler/add interval=1d name="hotspot-to-wpa-cleanup" on-event="/system/script/run hotspot-to-wpa-cleanup.capsman;" start-time=startup;
 
 And add the lease script and matcher comment to your wpa interfaces' dhcp

doc/mode-button.md

@@ -26,14 +26,16 @@ can configure the reset button to act the same, see
 
 Copy this code to terminal to check:
 
-    :if ([ :len [ /system/routerboard/mode-button/print as-value ] ] > 0) do={
+    {
-      :put "Mode button is supported.";
+      :if ([ :len [ /system/routerboard/mode-button/print as-value ] ] > 0) do={
-    } else={
+        :put "Mode button is supported.";
+        :exit;
+      }
       :if ([ :len [ /system/routerboard/reset-button/print as-value ] ] > 0) do={
         :put "Mode button is not supported, but reset button is.";
-      } else={
+        :exit;
-        :put "Neither mode button nor reset button is supported.";
       }
+      :put "Neither mode button nor reset button is supported.";
     }
 
 Requirements and installation

global-functions.rsc

@@ -15,7 +15,7 @@
 # Git commit id & info, expected configuration version
 :global CommitId "unknown";
 :global CommitInfo "unknown";
-:global ExpectedConfigVersion 144;
+:global ExpectedConfigVersion 145;
 
 # global variables not to be changed by user
 :global GlobalFunctionsReady false;
@@ -1280,14 +1280,6 @@
     :local ScriptInfo [ $ParseKeyValueStore ($ScriptVal->"comment") ];
     :local SourceNew;
 
-    :foreach Scheduler in=[ /system/scheduler/find where on-event~("\\b" . $ScriptVal->"name" . "\\b") ] do={
-      :local SchedulerVal [ /system/scheduler/get $Scheduler ];
-      :if ($ScriptVal->"policy" != $SchedulerVal->"policy") do={
-        $LogPrint warning $0 ("Policies differ for script '" . $ScriptVal->"name" . \
-          "' and its scheduler '" . $SchedulerVal->"name" . "'!");
-      }
-    }
-
     :if ($ScriptInfo->"ignore" = true) do={
       $LogPrint debug $0 ("Ignoring script '" . $ScriptVal->"name" . "', as requested.");
       :continue;

hotspot-to-wpa-lease.capsman.rsc

@@ -0,0 +1,109 @@
+#!rsc by RouterOS
+# RouterOS script: hotspot-to-wpa-lease.capsman
+# Copyright (c) 2019-2026 Christian Hesse <mail@eworm.de>
+# https://rsc.eworm.de/COPYING.md
+#
+# provides: dhcpv4-server-lease, order=40
+# requires RouterOS, version=7.22
+# requires device-mode, hotspot
+#
+# add private WPA passphrase after hotspot login
+# https://rsc.eworm.de/doc/hotspot-to-wpa.md
+#
+# !! Do not edit this file, it is generated from template!
+
+:onerror Err {
+  :global GlobalConfigReady; :global GlobalFunctionsReady;
+  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
+      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
+  :local ScriptName [ :jobname ];
+
+  :global EitherOr;
+  :global LogPrint;
+  :global ParseKeyValueStore;
+  :global ScriptLock;
+
+  :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"hotspot-to-wpa" ] do={
+    :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
+
+    :if (($LeaseVal->"hotspot-to-wpa") != true) do={
+      :continue;
+    }
+
+    :local MacAddress $"mac-address";
+    :local UserName $username;
+
+    :if ([ $ScriptLock $ScriptName ] = false) do={
+      :exit;
+    }
+
+    :if ([ :typeof $MacAddress ] = "nothing" || [ :typeof $UserName ] = "nothing") do={
+      $LogPrint error $ScriptName ("This script is supposed to run from hotspot on login.");
+      :exit;
+    }
+
+    :local Date [ /system/clock/get date ];
+    :local UserVal ({});
+    :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
+      :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
+    }
+    :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+
+    :if ([ :len [ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
+      /caps-man/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
+      $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
+    }
+    :local PlaceBefore ([ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
+
+    :if ([ :len [ /caps-man/access-list/find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
+      /caps-man/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
+      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
+    }
+    :local Template [ /caps-man/access-list/get ([ find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
+
+    :if ($Template->"action" = "reject") do={
+      $LogPrint info $ScriptName ("Ignoring login for hotspot '" . $Hotspot . "'.");
+      :exit;
+    }
+
+    $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
+      " (user " . $UserName . ").");
+    /caps-man/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
+    /caps-man/access-list/add private-passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
+        mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
+        action=reject place-before=$PlaceBefore;
+
+    :local Entry [ /caps-man/access-list/find where mac-address=$MacAddress \
+        comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
+    :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
+    :if ([ :len $PrivatePassphrase ] > 0) do={
+      :if ($PrivatePassphrase = "ignore") do={
+        /caps-man/access-list/set $Entry !private-passphrase;
+      } else={
+        /caps-man/access-list/set $Entry private-passphrase=$PrivatePassphrase;
+      }
+    }
+    :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
+    :if ([ :len $SsidRegexp ] > 0) do={
+      /caps-man/access-list/set $Entry ssid-regexp=$SsidRegexp;
+    }
+    :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
+    :if ([ :len $VlanId ] > 0) do={
+      /caps-man/access-list/set $Entry vlan-id=$VlanId;
+    }
+    :local VlanMode [ $EitherOr ($UserInfo->"vlan-mode") ($Template->"vlan-mode") ];
+    :if ([ :len $VlanMode] > 0) do={
+      /caps-man/access-list/set $Entry vlan-mode=$VlanMode;
+    }
+
+    :delay 2s;
+    /caps-man/access-list/set $Entry action=accept;
+
+    /ip/dhcp-server/lease/remove $Lease;
+  }
+} do={
+  :global ExitOnError; $ExitOnError [ :jobname ] $Err;
+}

hotspot-to-wpa-lease.template.rsc

@@ -0,0 +1,129 @@
+#!rsc by RouterOS
+# RouterOS script: hotspot-to-wpa-lease%TEMPL%
+# Copyright (c) 2019-2026 Christian Hesse <mail@eworm.de>
+# https://rsc.eworm.de/COPYING.md
+#
+# provides: dhcpv4-server-lease, order=40
+# requires RouterOS, version=7.22
+# requires device-mode, hotspot
+#
+# add private WPA passphrase after hotspot login
+# https://rsc.eworm.de/doc/hotspot-to-wpa.md
+#
+# !! This is just a template to generate the real script!
+# !! Pattern '%TEMPL%' is replaced, paths are filtered.
+
+:onerror Err {
+  :global GlobalConfigReady; :global GlobalFunctionsReady;
+  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
+      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
+  :local ScriptName [ :jobname ];
+
+  :global EitherOr;
+  :global LogPrint;
+  :global ParseKeyValueStore;
+  :global ScriptLock;
+
+  :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"hotspot-to-wpa" ] do={
+    :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
+
+    :if (($LeaseVal->"hotspot-to-wpa") != true) do={
+      :continue;
+    }
+
+    :local MacAddress $"mac-address";
+    :local UserName $username;
+
+    :if ([ $ScriptLock $ScriptName ] = false) do={
+      :exit;
+    }
+
+    :if ([ :typeof $MacAddress ] = "nothing" || [ :typeof $UserName ] = "nothing") do={
+      $LogPrint error $ScriptName ("This script is supposed to run from hotspot on login.");
+      :exit;
+    }
+
+    :local Date [ /system/clock/get date ];
+    :local UserVal ({});
+    :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
+      :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
+    }
+    :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+
+    :if ([ :len [ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
+    :if ([ :len [ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
+      /caps-man/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
+      /interface/wifi/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
+      $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
+    }
+    :local PlaceBefore ([ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
+    :local PlaceBefore ([ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
+
+    :if ([ :len [ /caps-man/access-list/find where \
+    :if ([ :len [ /interface/wifi/access-list/find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
+      /caps-man/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
+      /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
+      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
+    }
+    :local Template [ /caps-man/access-list/get ([ find where \
+    :local Template [ /interface/wifi/access-list/get ([ find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
+
+    :if ($Template->"action" = "reject") do={
+      $LogPrint info $ScriptName ("Ignoring login for hotspot '" . $Hotspot . "'.");
+      :exit;
+    }
+
+    $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
+      " (user " . $UserName . ").");
+    /caps-man/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
+    /interface/wifi/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
+    /caps-man/access-list/add private-passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
+    /interface/wifi/access-list/add passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
+        mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
+        action=reject place-before=$PlaceBefore;
+
+    :local Entry [ /caps-man/access-list/find where mac-address=$MacAddress \
+    :local Entry [ /interface/wifi/access-list/find where mac-address=$MacAddress \
+        comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
+# NOT /caps-man/ #
+    :set ($Template->"private-passphrase") ($Template->"passphrase");
+# NOT /caps-man/ #
+    :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
+    :if ([ :len $PrivatePassphrase ] > 0) do={
+      :if ($PrivatePassphrase = "ignore") do={
+        /caps-man/access-list/set $Entry !private-passphrase;
+        /interface/wifi/access-list/set $Entry !passphrase;
+      } else={
+        /caps-man/access-list/set $Entry private-passphrase=$PrivatePassphrase;
+        /interface/wifi/access-list/set $Entry passphrase=$PrivatePassphrase;
+      }
+    }
+    :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
+    :if ([ :len $SsidRegexp ] > 0) do={
+      /caps-man/access-list/set $Entry ssid-regexp=$SsidRegexp;
+      /interface/wifi/access-list/set $Entry ssid-regexp=$SsidRegexp;
+    }
+    :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
+    :if ([ :len $VlanId ] > 0) do={
+      /caps-man/access-list/set $Entry vlan-id=$VlanId;
+      /interface/wifi/access-list/set $Entry vlan-id=$VlanId;
+    }
+# NOT /interface/wifi/ #
+    :local VlanMode [ $EitherOr ($UserInfo->"vlan-mode") ($Template->"vlan-mode") ];
+    :if ([ :len $VlanMode] > 0) do={
+      /caps-man/access-list/set $Entry vlan-mode=$VlanMode;
+    }
+# NOT /interface/wifi/ #
+
+    :delay 2s;
+    /caps-man/access-list/set $Entry action=accept;
+    /interface/wifi/access-list/set $Entry action=accept;
+
+    /ip/dhcp-server/lease/remove $Lease;
+  }
+} do={
+  :global ExitOnError; $ExitOnError [ :jobname ] $Err;
+}

hotspot-to-wpa-lease.wifi.rsc

@@ -0,0 +1,106 @@
+#!rsc by RouterOS
+# RouterOS script: hotspot-to-wpa-lease.wifi
+# Copyright (c) 2019-2026 Christian Hesse <mail@eworm.de>
+# https://rsc.eworm.de/COPYING.md
+#
+# provides: dhcpv4-server-lease, order=40
+# requires RouterOS, version=7.22
+# requires device-mode, hotspot
+#
+# add private WPA passphrase after hotspot login
+# https://rsc.eworm.de/doc/hotspot-to-wpa.md
+#
+# !! Do not edit this file, it is generated from template!
+
+:onerror Err {
+  :global GlobalConfigReady; :global GlobalFunctionsReady;
+  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
+      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
+  :local ScriptName [ :jobname ];
+
+  :global EitherOr;
+  :global LogPrint;
+  :global ParseKeyValueStore;
+  :global ScriptLock;
+
+  :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"hotspot-to-wpa" ] do={
+    :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
+
+    :if (($LeaseVal->"hotspot-to-wpa") != true) do={
+      :continue;
+    }
+
+    :local MacAddress $"mac-address";
+    :local UserName $username;
+
+    :if ([ $ScriptLock $ScriptName ] = false) do={
+      :exit;
+    }
+
+    :if ([ :typeof $MacAddress ] = "nothing" || [ :typeof $UserName ] = "nothing") do={
+      $LogPrint error $ScriptName ("This script is supposed to run from hotspot on login.");
+      :exit;
+    }
+
+    :local Date [ /system/clock/get date ];
+    :local UserVal ({});
+    :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
+      :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
+    }
+    :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+
+    :if ([ :len [ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
+      /interface/wifi/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
+      $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
+    }
+    :local PlaceBefore ([ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
+
+    :if ([ :len [ /interface/wifi/access-list/find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
+      /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
+      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
+    }
+    :local Template [ /interface/wifi/access-list/get ([ find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
+
+    :if ($Template->"action" = "reject") do={
+      $LogPrint info $ScriptName ("Ignoring login for hotspot '" . $Hotspot . "'.");
+      :exit;
+    }
+
+    $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
+      " (user " . $UserName . ").");
+    /interface/wifi/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
+    /interface/wifi/access-list/add passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
+        mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
+        action=reject place-before=$PlaceBefore;
+
+    :local Entry [ /interface/wifi/access-list/find where mac-address=$MacAddress \
+        comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
+    :set ($Template->"private-passphrase") ($Template->"passphrase");
+    :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
+    :if ([ :len $PrivatePassphrase ] > 0) do={
+      :if ($PrivatePassphrase = "ignore") do={
+        /interface/wifi/access-list/set $Entry !passphrase;
+      } else={
+        /interface/wifi/access-list/set $Entry passphrase=$PrivatePassphrase;
+      }
+    }
+    :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
+    :if ([ :len $SsidRegexp ] > 0) do={
+      /interface/wifi/access-list/set $Entry ssid-regexp=$SsidRegexp;
+    }
+    :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
+    :if ([ :len $VlanId ] > 0) do={
+      /interface/wifi/access-list/set $Entry vlan-id=$VlanId;
+    }
+
+    :delay 2s;
+    /interface/wifi/access-list/set $Entry action=accept;
+
+    /ip/dhcp-server/lease/remove $Lease;
+  }
+} do={
+  :global ExitOnError; $ExitOnError [ :jobname ] $Err;
+}

hotspot-to-wpa.capsman.rsc

@@ -1,101 +0,0 @@
-#!rsc by RouterOS
-# RouterOS script: hotspot-to-wpa.capsman
-# Copyright (c) 2019-2026 Christian Hesse <mail@eworm.de>
-# https://rsc.eworm.de/COPYING.md
-#
-# requires RouterOS, version=7.22
-# requires device-mode, hotspot
-#
-# add private WPA passphrase after hotspot login
-# https://rsc.eworm.de/doc/hotspot-to-wpa.md
-#
-# !! Do not edit this file, it is generated from template!
-
-:onerror Err {
-  :global GlobalConfigReady; :global GlobalFunctionsReady;
-  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
-      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
-  :local ScriptName [ :jobname ];
-
-  :global EitherOr;
-  :global LogPrint;
-  :global ParseKeyValueStore;
-  :global ScriptLock;
-
-  :local MacAddress $"mac-address";
-  :local UserName $username;
-
-  :if ([ $ScriptLock $ScriptName ] = false) do={
-    :exit;
-  }
-
-  :if ([ :typeof $MacAddress ] = "nothing" || [ :typeof $UserName ] = "nothing") do={
-    $LogPrint error $ScriptName ("This script is supposed to run from hotspot on login.");
-    :exit;
-  }
-
-  :local Date [ /system/clock/get date ];
-  :local UserVal ({});
-  :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
-    :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
-  }
-  :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-  :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
-
-  :if ([ :len [ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
-    /caps-man/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
-    $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
-  }
-  :local PlaceBefore ([ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
-
-  :if ([ :len [ /caps-man/access-list/find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
-    /caps-man/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-    $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
-  }
-  :local Template [ /caps-man/access-list/get ([ find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
-
-  :if ($Template->"action" = "reject") do={
-    $LogPrint info $ScriptName ("Ignoring login for hotspot '" . $Hotspot . "'.");
-    :exit;
-  }
-
-  # allow login page to load
-  :delay 1s;
-
-  $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
-    " (user " . $UserName . ").");
-  /caps-man/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
-  /caps-man/access-list/add private-passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
-      mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
-      action=reject place-before=$PlaceBefore;
-
-  :local Entry [ /caps-man/access-list/find where mac-address=$MacAddress \
-      comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
-  :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
-  :if ([ :len $PrivatePassphrase ] > 0) do={
-    :if ($PrivatePassphrase = "ignore") do={
-      /caps-man/access-list/set $Entry !private-passphrase;
-    } else={
-      /caps-man/access-list/set $Entry private-passphrase=$PrivatePassphrase;
-    }
-  }
-  :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
-  :if ([ :len $SsidRegexp ] > 0) do={
-    /caps-man/access-list/set $Entry ssid-regexp=$SsidRegexp;
-  }
-  :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
-  :if ([ :len $VlanId ] > 0) do={
-    /caps-man/access-list/set $Entry vlan-id=$VlanId;
-  }
-  :local VlanMode [ $EitherOr ($UserInfo->"vlan-mode") ($Template->"vlan-mode") ];
-  :if ([ :len $VlanMode] > 0) do={
-    /caps-man/access-list/set $Entry vlan-mode=$VlanMode;
-  }
-
-  :delay 2s;
-  /caps-man/access-list/set $Entry action=accept;
-} do={
-  :global ExitOnError; $ExitOnError [ :jobname ] $Err;
-}

hotspot-to-wpa.rsc

@@ -0,0 +1,44 @@
+#!rsc by RouterOS
+# RouterOS script: hotspot-to-wpa.wifi
+# Copyright (c) 2019-2026 Christian Hesse <mail@eworm.de>
+# https://rsc.eworm.de/COPYING.md
+#
+# requires RouterOS, version=7.22
+# requires device-mode, hotspot
+# requires policy, policy=read;write
+#
+# add private WPA passphrase after hotspot login
+# https://rsc.eworm.de/doc/hotspot-to-wpa.md
+
+:local ExitOK false;
+:onerror Err {
+  :local ScriptName [ :jobname ];
+
+  :local Address $"address";
+  :local Interface $"interface";
+  :local MacAddress $"mac-address";
+  :local UserName $"username";
+
+  :local Lease [ /ip/dhcp-server/lease/find where mac-address=$MacAddress address=$Address ];
+
+  :if ([ :len $Lease ] != 1) do={
+    :log warning ($ScriptName . ": Did not find exactly one lease for " . $MacAddress . "!");
+    :set ExitOK true;
+    :error false;
+  }
+
+  /ip/dhcp-server/lease/set \
+    comment=[ :serialize to=json ({ \
+      "hotspot-to-wpa"=true; \
+      "address"=$Address; \
+      "interface"=$Interface; \
+      "mac-address"=$MacAddress; \
+      "username"=$UserName }) ] $Lease;
+  /ip/dhcp-server/lease/make-static $Lease;
+  :delay 1s;
+  /ip/dhcp-server/lease/disable $Lease;
+} do={
+  :if ($ExitOK = false) do={
+    :log error ([ :jobname ] . ": " . $Err);
+  }
+}

hotspot-to-wpa.template.rsc

@@ -1,121 +0,0 @@
-#!rsc by RouterOS
-# RouterOS script: hotspot-to-wpa%TEMPL%
-# Copyright (c) 2019-2026 Christian Hesse <mail@eworm.de>
-# https://rsc.eworm.de/COPYING.md
-#
-# requires RouterOS, version=7.22
-# requires device-mode, hotspot
-#
-# add private WPA passphrase after hotspot login
-# https://rsc.eworm.de/doc/hotspot-to-wpa.md
-#
-# !! This is just a template to generate the real script!
-# !! Pattern '%TEMPL%' is replaced, paths are filtered.
-
-:onerror Err {
-  :global GlobalConfigReady; :global GlobalFunctionsReady;
-  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
-      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
-  :local ScriptName [ :jobname ];
-
-  :global EitherOr;
-  :global LogPrint;
-  :global ParseKeyValueStore;
-  :global ScriptLock;
-
-  :local MacAddress $"mac-address";
-  :local UserName $username;
-
-  :if ([ $ScriptLock $ScriptName ] = false) do={
-    :exit;
-  }
-
-  :if ([ :typeof $MacAddress ] = "nothing" || [ :typeof $UserName ] = "nothing") do={
-    $LogPrint error $ScriptName ("This script is supposed to run from hotspot on login.");
-    :exit;
-  }
-
-  :local Date [ /system/clock/get date ];
-  :local UserVal ({});
-  :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
-    :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
-  }
-  :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-  :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
-
-  :if ([ :len [ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
-  :if ([ :len [ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
-    /caps-man/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
-    /interface/wifi/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
-    $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
-  }
-  :local PlaceBefore ([ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
-  :local PlaceBefore ([ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
-
-  :if ([ :len [ /caps-man/access-list/find where \
-  :if ([ :len [ /interface/wifi/access-list/find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
-    /caps-man/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-    /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-    $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
-  }
-  :local Template [ /caps-man/access-list/get ([ find where \
-  :local Template [ /interface/wifi/access-list/get ([ find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
-
-  :if ($Template->"action" = "reject") do={
-    $LogPrint info $ScriptName ("Ignoring login for hotspot '" . $Hotspot . "'.");
-    :exit;
-  }
-
-  # allow login page to load
-  :delay 1s;
-
-  $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
-    " (user " . $UserName . ").");
-  /caps-man/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
-  /interface/wifi/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
-  /caps-man/access-list/add private-passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
-  /interface/wifi/access-list/add passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
-      mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
-      action=reject place-before=$PlaceBefore;
-
-  :local Entry [ /caps-man/access-list/find where mac-address=$MacAddress \
-  :local Entry [ /interface/wifi/access-list/find where mac-address=$MacAddress \
-      comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
-# NOT /caps-man/ #
-  :set ($Template->"private-passphrase") ($Template->"passphrase");
-# NOT /caps-man/ #
-  :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
-  :if ([ :len $PrivatePassphrase ] > 0) do={
-    :if ($PrivatePassphrase = "ignore") do={
-      /caps-man/access-list/set $Entry !private-passphrase;
-      /interface/wifi/access-list/set $Entry !passphrase;
-    } else={
-      /caps-man/access-list/set $Entry private-passphrase=$PrivatePassphrase;
-      /interface/wifi/access-list/set $Entry passphrase=$PrivatePassphrase;
-    }
-  }
-  :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
-  :if ([ :len $SsidRegexp ] > 0) do={
-    /caps-man/access-list/set $Entry ssid-regexp=$SsidRegexp;
-    /interface/wifi/access-list/set $Entry ssid-regexp=$SsidRegexp;
-  }
-  :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
-  :if ([ :len $VlanId ] > 0) do={
-    /caps-man/access-list/set $Entry vlan-id=$VlanId;
-    /interface/wifi/access-list/set $Entry vlan-id=$VlanId;
-  }
-# NOT /interface/wifi/ #
-  :local VlanMode [ $EitherOr ($UserInfo->"vlan-mode") ($Template->"vlan-mode") ];
-  :if ([ :len $VlanMode] > 0) do={
-    /caps-man/access-list/set $Entry vlan-mode=$VlanMode;
-  }
-# NOT /interface/wifi/ #
-
-  :delay 2s;
-  /caps-man/access-list/set $Entry action=accept;
-  /interface/wifi/access-list/set $Entry action=accept;
-} do={
-  :global ExitOnError; $ExitOnError [ :jobname ] $Err;
-}

hotspot-to-wpa.wifi.rsc

@@ -1,98 +0,0 @@
-#!rsc by RouterOS
-# RouterOS script: hotspot-to-wpa.wifi
-# Copyright (c) 2019-2026 Christian Hesse <mail@eworm.de>
-# https://rsc.eworm.de/COPYING.md
-#
-# requires RouterOS, version=7.22
-# requires device-mode, hotspot
-#
-# add private WPA passphrase after hotspot login
-# https://rsc.eworm.de/doc/hotspot-to-wpa.md
-#
-# !! Do not edit this file, it is generated from template!
-
-:onerror Err {
-  :global GlobalConfigReady; :global GlobalFunctionsReady;
-  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
-      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
-  :local ScriptName [ :jobname ];
-
-  :global EitherOr;
-  :global LogPrint;
-  :global ParseKeyValueStore;
-  :global ScriptLock;
-
-  :local MacAddress $"mac-address";
-  :local UserName $username;
-
-  :if ([ $ScriptLock $ScriptName ] = false) do={
-    :exit;
-  }
-
-  :if ([ :typeof $MacAddress ] = "nothing" || [ :typeof $UserName ] = "nothing") do={
-    $LogPrint error $ScriptName ("This script is supposed to run from hotspot on login.");
-    :exit;
-  }
-
-  :local Date [ /system/clock/get date ];
-  :local UserVal ({});
-  :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
-    :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
-  }
-  :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-  :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
-
-  :if ([ :len [ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
-    /interface/wifi/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
-    $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
-  }
-  :local PlaceBefore ([ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
-
-  :if ([ :len [ /interface/wifi/access-list/find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
-    /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-    $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
-  }
-  :local Template [ /interface/wifi/access-list/get ([ find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
-
-  :if ($Template->"action" = "reject") do={
-    $LogPrint info $ScriptName ("Ignoring login for hotspot '" . $Hotspot . "'.");
-    :exit;
-  }
-
-  # allow login page to load
-  :delay 1s;
-
-  $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
-    " (user " . $UserName . ").");
-  /interface/wifi/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
-  /interface/wifi/access-list/add passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
-      mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
-      action=reject place-before=$PlaceBefore;
-
-  :local Entry [ /interface/wifi/access-list/find where mac-address=$MacAddress \
-      comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
-  :set ($Template->"private-passphrase") ($Template->"passphrase");
-  :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
-  :if ([ :len $PrivatePassphrase ] > 0) do={
-    :if ($PrivatePassphrase = "ignore") do={
-      /interface/wifi/access-list/set $Entry !passphrase;
-    } else={
-      /interface/wifi/access-list/set $Entry passphrase=$PrivatePassphrase;
-    }
-  }
-  :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
-  :if ([ :len $SsidRegexp ] > 0) do={
-    /interface/wifi/access-list/set $Entry ssid-regexp=$SsidRegexp;
-  }
-  :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
-  :if ([ :len $VlanId ] > 0) do={
-    /interface/wifi/access-list/set $Entry vlan-id=$VlanId;
-  }
-
-  :delay 2s;
-  /interface/wifi/access-list/set $Entry action=accept;
-} do={
-  :global ExitOnError; $ExitOnError [ :jobname ] $Err;
-}

news-and-changes.rsc

@@ -69,6 +69,7 @@
   142="Added a setting for 'mod/notification-email' to check availability of certificate chain.";
   143="Made backup scripts 'backup-email' and 'backup-upload' support date & time in filenames.";
   144="Split and reworked 'mode-button' for compatibility with RouterOS 7.24, configuration was updated automatically.";
+  145="Split and reworked 'hotspot-to-wpa' for compatibility with RouterOS 7.24, configuration was updated automatically.";
 };
 
 # Migration steps to be applied on script updates
@@ -81,4 +82,5 @@
   138="/certificate/set trusted=yes [ find where trusted=yes ];";
   140=":if ([ :len [ /system/script/find where name=\"lease-script\" ] ] > 0) do={ /system/script/set name=\"dhcpv4-server-lease\" \"lease-script\"; :global ScriptInstallUpdate; \$ScriptInstallUpdate; /ip/dhcp-server/set lease-script=\"dhcpv4-server-lease\" [ find where lease-script=\"lease-script\" ]; };";
   144=":if ([ :len [ /system/script/find where name=\"mode-button\" ] ] > 0) do={ :global ScriptInstallUpdate; \$ScriptInstallUpdate mode-button-scheduler; };";
+  145=":local Script [ /system/script/find where name~\"^hostspot-to-wap\\\\.\"; :if ([ :len \$Script ] > 0) do={ :local Type ([ :toarray delimiter=\".\" [ /system/script/get name \$Script ] ]->1); /system/script/set name=\"hostspot-to-wap\" \$Script; :global ScriptInstallUpdate; \$ScriptInstallUpdate (\"dhcpv4-server-lease,hostspot-to-wap-lease.\" . \$Type); /ip/hotspot/user/profile/set on-login=\"hotspot-to-wpa\" [ find where on-login~\"hotspot-to-wpa\" ]; :foreach Hotspot in=[ /ip/hotspot/find ] do={ /ip/dhcp-server/set lease-script=\"dhcpv4-server-lease\" [ find where interface=[ /ip/hotspot/get \$Hotspot interface ] ]; }; };";
 };