Changeset 101

Timestamp:

05/04/04 16:22:22 (9 years ago)

Author:

aprilp

Message:

Calling iptables directly instead of using shell scripts

Location:

trunk/wifidog

Files:

• ChangeLog (modified) (1 diff)
• src/Makefile.am (modified) (2 diffs)
• src/common.h (modified) (2 diffs)
• src/firewall.c (modified) (8 diffs)
• src/firewall.h (modified) (1 diff)
• src/iptables.c (added)
• src/iptables.h (added)

trunk/wifidog/ChangeLog

@@ -1 +1 @@
 # $Header$
+2004-05-05  Philippe April <papril777@yahoo.com>
+    * Calling iptables directly instead of using shell scripts
+    for fw_init, fw_destroy and fw_allow/fw_deny
+
 2004-04-23  Philippe April <papril777@yahoo.com>
     * Fixed a debug line

trunk/wifidog/src/Makefile.am

@@ -15 +15 @@
         conf.c \
         debug.c \
+        iptables.c \
         firewall.c \
         gateway.c \
@@ -25 +26 @@
         conf.h \
         debug.h \
+        iptables.h \
         firewall.h \
         gateway.h \

trunk/wifidog/src/common.h

@@ -57 +57 @@
 #include "commandline.h"
 #include "debug.h"
+#include "iptables.h"
 #include "firewall.h"
 #include "http.h"
@@ -64 +65 @@
 #define MAX_BUF 4096
 
-#define SCRIPT_FWINIT       "fw.init"
-#define SCRIPT_FWACCESS     "fw.access"
-#define SCRIPT_FWDESTROY    "fw.destroy"
 #define SCRIPT_FWCOUNTERS   "fw.counters"
 

trunk/wifidog/src/firewall.c

@@ -52 +52 @@
 fw_allow(char *ip, char *mac, int tag)
 {
-    char            s_tag[16];
-    char            script[MAX_BUF];
-    struct stat     st;
-    char           *command[] = {script, "allow", ip, mac, s_tag, NULL};
-
-    sprintf(s_tag, "%-10d", tag);
-    sprintf(script, "%s/%s/%s", config.fwscripts_path, config.fwtype,
-        SCRIPT_FWACCESS);
-
-    debug(LOG_DEBUG, "Allowing ip %s mac %s with MARK %s", ip, mac, s_tag);
-
-    if (-1 == (stat(script, &st))) {
-        debug(LOG_ERR, "Could not find %s: %s", script,
-              strerror(errno));
-        return (1);
-    }
-    return (execute(command));
+    iptables_do_command("-t mangle -A wifidog_mark -s %s -m mac --mac-source %s -j MARK --set-mark %d", ip, mac, tag);
+
+    return 1;
 }
 
@@ -85 +71 @@
 fw_deny(char *ip, char *mac, int tag)
 {
-    char            s_tag[16];
-    char            script[MAX_BUF];
-    struct stat     st;
-    char           *command[] = {script, "deny", ip, mac, s_tag, NULL};
-
-    sprintf(s_tag, "%-10d", tag);
-    sprintf(script, "%s/%s/%s", config.fwscripts_path, config.fwtype,
-        SCRIPT_FWACCESS);
-
-    debug(LOG_DEBUG, "Denying ip %s mac %s with MARK %s", ip, mac, s_tag);
-
-    if (-1 == (stat(script, &st))) {
-        debug(LOG_ERR, "Could not find %s: %s", script,
-              strerror(errno));
-        return (1);
-    }
-    return (execute(command));
+    iptables_do_command("-t mangle -D wifidog_mark -s %s -m mac --mac-source %s -j MARK --set-mark %d", ip, mac, tag);
+
+    return 1;
 }
 
@@ -112 +84 @@
  */
 int
-execute(char **argv)
-{
-    int             pid, status, rc;
-
-    debug(LOG_DEBUG, "Executing '%s'", argv[0]);
+execute(char *line)
+{
+    int pid,
+        status,
+        rc;
+
+    const char *new_argv[4];
+    new_argv[0] = "/bin/sh";
+    new_argv[1] = "-c";
+    new_argv[2] = line;
+    new_argv[3] = NULL;
 
     if ((pid = fork()) < 0) {    /* fork a child process           */
@@ -122 +100 @@
         exit(1);
     } else if (pid == 0) {    /* for the child process:         */
-        if (execvp(*argv, argv) < 0) {    /* execute the command  */
+        /* We don't want to see any errors */
+        close(2);
+        if (execvp("/bin/sh", (char *const *)new_argv) < 0) {    /* execute the command  */
             debug(LOG_ERR, "fork(): %s", strerror(errno));
             exit(1);
@@ -132 +112 @@
     }
 
-    return (status);
+    return (WEXITSTATUS(status));
 }
 
@@ -177 +157 @@
 fw_init(void)
 {
-    char            port[16];
-    char            script[MAX_BUF];
-    int             rc;
-    struct stat     st;
-    char           *command[] = {script, config.gw_interface, config.gw_address,
-    port, config.authserv_hostname, NULL};
-
-    sprintf(port, "%-5d", config.gw_port);
-    sprintf(script, "%s/%s/%s", config.fwscripts_path, config.fwtype,
-        SCRIPT_FWINIT);
-
-    if (-1 == (stat(script, &st))) {
-        debug(LOG_ERR, "Could not find %s: %s", script,
-              strerror(errno));
-        debug(LOG_ERR, "Exiting...");
-        exit(1);
-    }
-    debug(LOG_NOTICE, "Setting firewall rules");
-
-    if ((rc = execute(command)) != 0) {
-        debug(LOG_ERR, "Could not setup firewall, exiting...");
-        exit(1);
-    }
-    return (rc);
+    debug(LOG_INFO, "Initializing Firewall");
+
+    iptables_do_command("-t nat -N wifidog_validate");
+    iptables_do_command("-t nat -A wifidog_validate -d %s -j ACCEPT", config.gw_address);
+    iptables_do_command("-t nat -A wifidog_validate -d %s -j ACCEPT", config.authserv_hostname);
+    iptables_do_command("-t nat -A wifidog_validate -p udp --dport 67 -j ACCEPT");
+    iptables_do_command("-t nat -A wifidog_validate -p tcp --dport 67 -j ACCEPT");
+    iptables_do_command("-t nat -A wifidog_validate -p udp --dport 53 -j ACCEPT");
+    iptables_do_command("-t nat -A wifidog_validate -p tcp --dport 80 -j ACCEPT");
+    iptables_do_command("-t nat -A wifidog_validate -p tcp --dport 443 -j ACCEPT");
+    iptables_do_command("-t nat -A wifidog_validate -j DROP");
+
+    iptables_do_command("-t nat -N wifidog_unknown");
+    iptables_do_command("-t nat -A wifidog_unknown -d %s -j ACCEPT", config.gw_address);
+    iptables_do_command("-t nat -A wifidog_unknown -d %s -j ACCEPT", config.authserv_hostname);
+    iptables_do_command("-t nat -A wifidog_unknown -p udp --dport 67 -j ACCEPT");
+    iptables_do_command("-t nat -A wifidog_unknown -p tcp --dport 67 -j ACCEPT");
+    iptables_do_command("-t nat -A wifidog_unknown -p udp --dport 53 -j ACCEPT");
+    iptables_do_command("-t nat -A wifidog_unknown -p tcp --dport 80 -j REDIRECT --to-ports %d", config.gw_port);
+    iptables_do_command("-t nat -A wifidog_unknown -j DROP");
+
+    iptables_do_command("-t nat -N wifidog_known");
+    iptables_do_command("-t nat -A wifidog_known -j ACCEPT");
+
+    iptables_do_command("-t nat -N wifidog_locked");
+    iptables_do_command("-t nat -A wifidog_locked -j DROP");
+
+    iptables_do_command("-t nat -N wifidog_class");
+    iptables_do_command("-t nat -A wifidog_class -i %s -m mark --mark 0x1 -j wifidog_validate", config.gw_interface);
+    iptables_do_command("-t nat -A wifidog_class -i %s -m mark --mark 0x2 -j wifidog_known", config.gw_interface);
+    iptables_do_command("-t nat -A wifidog_class -i %s -m mark --mark 0x254 -j wifidog_locked", config.gw_interface);
+    iptables_do_command("-t nat -A wifidog_class -i %s -j wifidog_unknown", config.gw_interface);
+
+    iptables_do_command("-t mangle -N wifidog_mark");
+
+    iptables_do_command("-t mangle -I PREROUTING 1 -i %s -j wifidog_mark", config.gw_interface);
+
+    iptables_do_command("-t nat -I PREROUTING 1 -i %s -j wifidog_class", config.gw_interface);
+
+    return 1;
 }
 
@@ -213 +209 @@
 fw_destroy(void)
 {
-    char            script[MAX_BUF];
-    struct stat     st;
-    char           *command[] = {script, config.gw_interface, NULL};
-
-    sprintf(script, "%s/%s/%s", config.fwscripts_path, config.fwtype,
-        SCRIPT_FWDESTROY);
-
-    if (-1 == (stat(script, &st))) {
-        debug(LOG_ERR, "Could not find %s: %s", script,
-              strerror(errno));
-        return (1);
-    }
-    debug(LOG_NOTICE, "Flushing firewall rules");
-
-    return (execute(command));
+    int rc, tries, fd;
+
+    debug(LOG_INFO, "Removing Firewall rules");
+
+    iptables_do_command("-t nat -F wifidog_class");
+    iptables_do_command("-t mangle -F wifidog_mark");
+
+    iptables_do_command("-t nat -F wifidog_validate");
+    iptables_do_command("-t nat -F wifidog_unknown");
+    iptables_do_command("-t nat -F wifidog_known");
+    iptables_do_command("-t nat -F wifidog_locked");
+    iptables_do_command("-t nat -X wifidog_validate");
+    iptables_do_command("-t nat -X wifidog_unknown");
+    iptables_do_command("-t nat -X wifidog_known");
+    iptables_do_command("-t nat -X wifidog_locked");
+
+    /* We loop in case wifidog has crashed and left some unwanted rules,
+     * maybe we shouldn't loop forever, we'll give it 10 tries
+     */
+    rc = 0;
+    for (tries = 0; tries < 10 && rc == 0; tries++) {
+        rc = iptables_do_command("-t nat -D PREROUTING -i %s -j wifidog_class", config.gw_interface);
+    }
+    iptables_do_command("-t nat -X wifidog_class");
+
+    rc = 0;
+    for (tries = 0; tries < 10 && rc == 0; tries++) {
+        rc = iptables_do_command("-t mangle -D PREROUTING -i %s -j wifidog_mark", config.gw_interface);
+    }
+    iptables_do_command("-t mangle -X wifidog_mark");
+
+    return 1;
 }
 
@@ -491 +504 @@
     }
 }
+

trunk/wifidog/src/firewall.h

@@ -51 +51 @@
 int fw_deny(char *ip, char *mac, int profile);
 void fw_counter(void);
-int execute(char **argv);
+int execute(char *line);
 char *arp_get(char *req_ip);