Recently I came into the situation that I wanted to automate something based on the state of my printer. If I turn it on, a light above it should turn on so the tiny screen on it becomes readable. And when the printer turns off again, the light should turn off. To do this, I needed some way to determine when my printer turns on. Luckily it’s very reliable at getting DHCP leases and releasing them when it turns off again. Additionally, the DHCP server that ships with OpenWRT has a flag to accept a script it should run when leases are changed¹

-6 –dhcp-script= Whenever a new DHCP lease is created, or an old one destroyed, or a TFTP file transfer completes, the executable specified by this option is run. must be an absolute pathname, no PATH search occurs. The arguments to the process are “add”, “old” or “del”, the MAC address of the host (or DUID for IPv6) , the IP address, and the hostname, if known. “add” means a lease has been created, “del” means it has been destroyed, “old” is a notification of an existing lease when dnsmasq starts or a change to MAC address or hostname of an existing lease (also, lease length or expiry and client-id, if –leasefile-ro is set and lease expiry if –script-on-renewal is set). If the MAC address is from a network type other than ethernet, it will have the network type prepended, eg “06-01:23:45:67:89:ab” for token ring. The process is run as root (assuming that dnsmasq was originally run as root) even if dnsmasq is configured to change UID to an unprivileged user.

So this shouldn’t be a big deal, right?

OpenWRT configuration

OpenWRT also packages mosquitto_pub which I tend to use for CLI interactions with my MQTT broker. And since my broker doesn’t do SSL, I installed mosquitto-client-nossl on my OpenWRT router:

$ opkg update
$ opkg install mosquitto-client-nossl

I then placed the following script in /bin/pub_dhcp

#!/bin/sh
/usr/bin/mosquitto_pub \
    -h mqtt.aada.cat \
    -t network/dhcp/leases \
    -m "{\"action\": \"$1\", \"mac-addr\": \"$2\", \"ip-addr\": \"$3\", \"host\": \"$4\"}"
# vim: ft=sh

As dhcpscript is listed as an option in the OpenWRT wiki page² for dnsmasq I added a line in /etc/config/dhcp for dnsmasq to pick up the script

config dnsmasq
    [...]
    option dhcpscript '/bin/pub_dhcp'

After restarting dnsmasq, this should be everything under ordinary circumstances. But unfortunately I found out fairly quickly that things would be a bit more complicated than that since doing only this didn’t work. After several hours of debugging and a good night of sleep, I realised what was up. OpenWRT has, perhaps quite wisely, put dnsmasq into a jail. In the init script, which is not just responsible for controlling the state of the service, but also creating the actual configuration and setting up jails and such, this manifested in the following lines in dnsmasq_start():

procd_add_jail dnsmasq ubus log
procd_add_jail_mount $CONFIGFILE $DHCPBOGUSHOSTNAMEFILE $DHCPSCRIPT $DHCPSCRIPT_DEPENDS
procd_add_jail_mount $EXTRA_MOUNT $RFC6761FILE $TRUSTANCHORSFILE
procd_add_jail_mount $dnsmasqconffile $dnsmasqconfdir $resolvdir $user_dhcpscript 
procd_add_jail_mount /etc/passwd /etc/group /etc/TZ /etc/hosts /etc/ethers
procd_add_jail_mount_rw /var/run/dnsmasq/ $leasefile
case "$logfacility" in */*)
    [ ! -e "$logfacility" ] && touch "$logfacility"
    procd_add_jail_mount_rw "$logfacility"
esac
[ -e "$hostsfile" ] && procd_add_jail_mount $hostsfile

Note the line where $user_dhcpscript is added with several other files into the jail. Notably, nothing in the init script was checking for dependencies of the script itself. So I worked around this by sneakily adding /usr/bin/mosquitto_pub into the init script:

procd_add_jail_mount /usr/bin/mosquitto_pub

I then restarted dnsmasq.

/etc/init.d/dnsmasq restart

And then, subscribing to the appropriate topic, I was able to get events for my printer turning on

$ mosquitto_sub -h mqtt.aada.cat -t network/dhcp/leases
{"action": "add", "mac-addr": "40:f8:df:0a:63:2b", "ip-addr": "192.168.1.25", "host": "g550"}

…and off!

$ mosquitto_sub -h mqtt.aada.cat -t network/dhcp/leases
{"action": "del", "mac-addr": "40:f8:df:0a:63:2b", "ip-addr": "192.168.1.25", "host": "g550"}

With the messages finally being published, I was able to automate my printer’s lighting in Apache NiFi.

Now I am wondering what other interesting things I might be able to do with changes to DHCP leases.

I own a flatbed scanner that includes a transparency unit for scanning film. Since I moved I have not really been using my scanner much, as the USB cable is much too short and there isn’t really space on my desk. But with recent life changes I need to use it a lot, so I decided to look at sharing the scanner over the network.

Luckily the Scanner Access Now Easy (SANE) project comes with saned that is capable of sharing scanners over the network.

After a bunch of grueling research and banging my paws against computers, I managed to set it up in a way that I have my scanner plugged into my server running a saned that I can access from other sane installations on the network.

This post¹ was rather helpful in that regard, but it is quite old and a lot doesn’t apply anymore so I think my setup bears explaining for a current Debian 13 ’trixie’ that is running both on my server and my desktop computer.

Server setup

Ensure scanners work on your server

First make sure that you have sane-utils installed and make sure that your scanner is correctly set up on your server. Unfortunately this depends a bit on the scanner you have. For me this meant downloading my scanner’s drivers from the manufacturer and installing those. After adding my user ada to the scanner group

sudo usermod -a -G scanner ada

the scanner was available and capable of scanning on my server.

You can check if sane is capable of finding your scanner with scanimage -L. If you have chafa installed you can scan a page and view it by running

scanimage --format=jpeg | chafa

Or you can redirect the output of scanimage to a file and view the result by some other means. If you are having trouble accessing the scanner, remember that you should be in the scanner group² for access to the scanner.

Configuring saned

Once you have ensured that your scanner does in fact work, it is time to configure saned. How you do this depends on if your server has a firewall or not and how your network is layed out. For simplicity I will assume that you have a firewall on your server and that your network is a normal home network and that you only intend to access the scanner through a static IPv4 subnet like 192.168.1.0/24.

The file /etc/sane.d/saned.conf needs to have an entry for each host name, IP address or IP subnet that is allowed access to the scanner. For my home network, I entered

192.168.1.0/24

This allows all hosts on my network access over IPv4. Additionally, since I have a firewall on my server, I added

data_portrange = 10000 - 10100

to /etc/sane.d/saned.conf to define the range of ports that saned should use for transferring image data. Later we will add this range to our firewall rules.

The result looks something like

data_portrange = 10000 - 10100
192.168.1.0/24

Next start and enable saned.socket

systemctl enable --now saned.socket

A note on IPv6

Note that since I didn’t add any IPv6 addresses or subnets in the config, saned will refuse connections from those. This also means that you can’t use mDNS hostnames or other local hostnames that resolve to IPv6 addresses as they will probably prioritise IPv6. Since most people on IPv6 in their home networks don’t have a static IP prefix and your router probably also has a firewall the easiest is to append [::]/0 here. Realistically this also means that computers from the far reaches of internet would be able to communicate with your scanner, if your router’s firewall doesn’t disallow that. So make sure that that can’t happen.

Firewall config

Since I also have a firewall (ufw) running, I need to allow sane to talk to other devices on the network. If you don’t have this you can skip this step.

sudo ufw allow saned
sudo ufw allow 10000:10100/tcp

Debian saned.service quirks

Now you might be confused because you thought you could just start saned.service directly. This service is actually masked:

$ systemctl status saned
○ saned.service
     Loaded: masked (Reason: Unit saned.service is masked.)
     Active: inactive (dead)

And you might find yourself, like me, confused at how a masked service is even supposed to be started by socket-activation (i.e. through saned.socket). After some initial confusion about this, I noticed that the service that systemd starts on saned.socket is not as I initially believed saned.service but rather the template unit saned@.service:

$ systemctl cat saned@.service
# /usr/lib/systemd/system/saned@.service
[Unit]
Description=Scanner Service
Requires=saned.socket

[Service]
ExecStart=/usr/sbin/saned
User=saned
Group=saned
StandardInput=null
StandardOutput=append:/var/log/saned.log
StandardError=append:/var/log/saned.log
Environment=SANE_CONFIG_DIR=/etc/sane.d
# Environment=SANE_CONFIG_DIR=/etc/sane.d SANE_DEBUG_DLL=255

[Install]
Also=saned.socket

Anyhow I thought this was worth mentioning in case you need a drop-in file or something for saned somewhere as it caused me a bit of confusion.

Client setup

Now after you have configured saned to allow access to your client machines, set up firewall rules for saned and started/activated the saned.socket, all you need to do is edit /etc/sane.d/net.conf and add the server’s IP address³ here

connection_timeout = 60
192.168.1.2

Now you should be able to see the scanners from that host using scanimage -L, provided that your local user is in the scanner group. You can use any sane frontend software like xsane, simple-scan and similar to scan from your scanner now.

Caveats

I have been using this to scan a lot of documents lately and generally this works well for my setup. There are some things to note however:

• I want to set up sane-airscan at some point to avoid having to edit /etc/sane.d/net.conf directly. I think this probably involves talking to avahi in some fashion and I haven’t been too eager to do that yet.
• Unfortunately I can’t use my scanner’s transparency unit this way and can’t scan film negatives or slides over the network. Maybe there is a way around this, but I haven’t found it yet.

Happy scanning!

Mjau mau miau meoww meow! Meow miaou miau mjaau miaou! meow meow, meow meow! miau!!

mreow!!!