Changeset 121

Timestamp:

05/07/04 15:59:03 (9 years ago)

Author:

aprilp

Message:

* Now we store both incoming and outgoing counters on server and expire if no activity at all on both
* Changed the structure of nodes a little

Location:

trunk/wifidog

Files:

• ChangeLog (modified) (1 diff)
• src/auth.c (modified) (2 diffs)
• src/centralserver.c (modified) (2 diffs)
• src/centralserver.h (modified) (1 diff)
• src/firewall.c (modified) (3 diffs)
• src/firewall.h (modified) (2 diffs)
• src/http.c (modified) (2 diffs)
• src/iptables.c (modified) (6 diffs)
• src/iptables.h (modified) (2 diffs)

trunk/wifidog/ChangeLog

@@ -1 +1 @@
 # $Header$
+2004-05-07  Philippe April <wifidog@philippeapril.com>
+    * Now we store both incoming and outgoing counters on server
+    and expire if no activity at all on both
+    * Changed the structure of nodes a little
+
 2004-05-07  Philippe April <wifidog@philippeapril.com>
     * New parameter ExternalInterface

trunk/wifidog/src/auth.c

@@ -102 +102 @@
         pthread_mutex_unlock(&nodes_mutex);
                 
-        authenticate(&auth_response, ip, mac, token, 0);
+        authenticate(&auth_response, ip, mac, token, 0, 0);
         
         pthread_mutex_lock(&nodes_mutex);
@@ -143 +143 @@
         
     p1 = node_find_by_ip(node->ip);
-    p1->noactivity = time(NULL);
     switch(auth_response.authcode) {
         case AUTH_VALIDATION:

trunk/wifidog/src/centralserver.c

@@ -49 +49 @@
 
 int
-authenticate(t_authresponse *authresponse, char *ip, char *mac, char *token, long int stats)
+authenticate(t_authresponse *authresponse, char *ip, char *mac, char *token, long int incoming, long int outgoing)
 {
         int sockfd, numbytes;
@@ -81 +81 @@
                 return(-1); /* non-fatal */
         }
-        sprintf(buf, "GET %s?ip=%s&mac=%s&token=%s&stats=%ld HTTP/1.1"
+        sprintf(buf, "GET %s?ip=%s&mac=%s&token=%s&incoming=%ld&outgoing=%ld HTTP/1.1"
                 "\nHost: %s\n\n", config.authserv_path, ip, mac, token,
-                stats, config.authserv_hostname);
+                incoming, outgoing, config.authserv_hostname);
         send(sockfd, buf, strlen(buf), 0);
 

trunk/wifidog/src/centralserver.h

@@ -28 +28 @@
 #define _CENTRALSERVER_H_
 
-int authenticate(t_authresponse *authresponse, char *ip, char *mac, char *token, long int stats);
+int authenticate(t_authresponse *authresponse, char *ip, char *mac, char *token, long int incoming, long int outgoing);
 
 #endif /* _CENTRALSERVER_H_ */

trunk/wifidog/src/firewall.c

@@ -200 +200 @@
 fw_counter(void)
 {
-    FILE           *output;
-    unsigned long int counter;
     t_authresponse  authresponse;
-    unsigned int    tag, rc;
-    char            ip[255],
-                    mac[255],
-                    *script,
-                    *token;
-    t_node         *p1;
-
-    /* FIXME make iptables a DEFINE or something */
-    asprintf(&script, "%s %s", "iptables", "-v -x -t mangle -L " TABLE_WIFIDOG_MARK);
-
-    if (!(output = popen(script, "r"))) {
-        debug(LOG_ERR, "popen(): %s", strerror(errno));
+    char            *token, *ip;
+    t_node         *p1, *p2;
+
+    if (-1 == iptables_fw_counters()) {
+        debug(LOG_ERR, "Could not get counters from firewall!");
         return;
     }
 
-    free(script);
-
-    /* skip the first two lines */
-    while (('\n' != fgetc(output)) && !feof(output))
-        ;
-    while (('\n' != fgetc(output)) && !feof(output))
-        ;
-    while (output && !(feof(output))) {
-        rc = fscanf(output, "%*s %lu %*s %*s %*s %*s %*s %s %*s %*s %s %*s %*s 0x%u", &counter, ip, mac, &tag);
-        if (4 == rc && EOF != rc) {
-            pthread_mutex_lock(&nodes_mutex);
-
-            p1 = node_find_by_ip(ip);
-
-            if (p1) {
-                token = strdup(p1->token);
-
-                pthread_mutex_unlock(&nodes_mutex);
-                authenticate(&authresponse, ip, mac, token, counter);
-                pthread_mutex_lock(&nodes_mutex);
-
-                free(token);
-
-                p1 = node_find_by_ip(ip);
-                if (p1 == NULL) {
-                    /* FIXME We should not continue for this entry past this point */
-                    debug(LOG_DEBUG, "Node %s was freed while being re-validated!", ip);
+    p1 = firstnode;
+
+    pthread_mutex_lock(&nodes_mutex);
+    p2 = firstnode;
+    while (NULL != (p1 = p2)) {
+        p2 = p1->next;
+        ip = strdup(p1->ip);
+        token = strdup(p1->token);
+        pthread_mutex_unlock(&nodes_mutex);
+        authenticate(&authresponse, p1->ip, p1->mac, token, p1->counters.incoming, p1->counters.outgoing);
+        pthread_mutex_lock(&nodes_mutex);
+
+        if (!(p1 = node_find_by_ip(ip))) {
+            debug(LOG_ERR, "Node %s was freed while being re-validated!", ip);
+        } else {
+            if (p1->counters.last_updated +
+                (config.checkinterval * config.clienttimeout)
+                <= time(NULL)) {
+                /* Timing out user */
+                debug(LOG_INFO, "%s - Inactive for %ld seconds, removing node and denying in firewall", p1->ip, config.checkinterval * config.clienttimeout);
+                fw_deny(p1->ip, p1->mac, p1->tag);
+                node_delete(p1);
+            } else {
+                /*
+                 * This handles any change in
+                 * the status this allows us
+                 * to change the status of a
+                 * user while he's connected
+                 */
+                switch (authresponse.authcode) {
+                    case AUTH_DENIED:
+
+                    case AUTH_VALIDATION_FAILED:
+                        debug(LOG_NOTICE, "%s - Validation timeout, now denied. Removing node and firewall rules", p1->ip);
+                        fw_deny(p1->ip, p1->mac, p1->tag);
+                        node_delete(p1);
+                        break;
+
+                    case AUTH_ALLOWED:
+                        if (p1->tag != MARK_KNOWN) {
+                            debug(LOG_INFO, "%s - Access has changed, refreshing firewall and clearing counters", p1->ip);
+                            fw_deny(p1->ip, p1->mac, p1->tag);
+                            p1->tag = MARK_KNOWN;
+                            p1->counters.incoming = p1->counters.outgoing = 0;
+                            fw_allow(p1->ip, p1->mac, p1->tag);
+                        }
+                        break;
+
+                    case AUTH_VALIDATION:
+                        /*
+                         * Do nothing, user
+                         * is in validation
+                         * period
+                         */
+                        debug(LOG_INFO, "%s - User in validation period", p1->ip);
+                        break;
+
+                    default:
+                        debug(LOG_DEBUG, "I do not know about authentication code %d", authresponse.authcode);
+                        break;
                 }
-                debug(LOG_DEBUG, "%s - Counter currently %ld, new counter %ld", p1->ip, p1->counter, counter);
-                if (counter > p1->counter) {
-                    p1->counter = counter;
-                    debug(LOG_INFO, "%s - Updated counter to %ld bytes", p1->ip, p1->counter);
-                    p1->noactivity = time(NULL);
-                } else {
-                    debug(LOG_INFO, "%s - Recorded no activity since %ld", p1->ip, p1->noactivity);
-                }
-                if (p1->noactivity +
-                    (config.checkinterval * config.clienttimeout)
-                    <= time(NULL)) {
-                    /* Timing out user */
-                    debug(LOG_INFO, "%s - Inactive for %ld seconds, removing node and denying in firewall", ip, config.checkinterval * config.clienttimeout);
-                    fw_deny(p1->ip, p1->mac, p1->tag);
-                    node_delete(p1);
-                } else {
-                    /*
-                     * This handles any change in
-                     * the status this allows us
-                     * to change the status of a
-                     * user while he's connected
-                     */
-                    switch (authresponse.authcode) {
-                        case AUTH_DENIED:
-
-                        case AUTH_VALIDATION_FAILED:
-                            debug(LOG_NOTICE, "%s - Validation timeout, now denied. Removing node and firewall rules", ip);
-                            fw_deny(p1->ip, p1->mac, p1->tag);
-                            node_delete(p1);
-                            break;
-
-                        case AUTH_ALLOWED:
-                            if (p1->tag != MARK_KNOWN) {
-                                debug(LOG_INFO, "%s - Access has changed, refreshing firewall and clearing counters", ip);
-                                fw_deny(p1->ip, p1->mac, p1->tag);
-                                p1->tag = MARK_KNOWN;
-                                p1->counter = 0;
-                                fw_allow(p1->ip, p1->mac, p1->tag);
-                            }
-                            break;
-
-                        case AUTH_VALIDATION:
-                            /*
-                             * Do nothing, user
-                             * is in validation
-                             * period
-                             */
-                            debug(LOG_INFO, "%s - User in validation period", ip);
-                            break;
-
-                        default:
-                            debug(LOG_DEBUG, "I do not know about authentication code %d", authresponse.authcode);
-                            break;
-                    }
-                }
-                pthread_mutex_unlock(&nodes_mutex);
-            } else {
-                /* Node was not found in list, FIXME remove from firewall rules */
-                debug(LOG_NOTICE, "Node %s was not found in list", ip);
             }
         }
-    }
-    pclose(output);
+
+        free(token);
+        free(ip);
+    }
+    pthread_mutex_unlock(&nodes_mutex);
+
+
+//            debug(LOG_DEBUG, "%s - Counter currently %ld, new counter %ld", p1->ip, p1->counter, counters[i]->outgoing);
+//
+//                if (counters[i]->outgoing > p1->counter) {
+//                    p1->counter = counters[i]->outgoing;
+//                    debug(LOG_INFO, "%s - Updated counter to %ld bytes", p1->ip, p1->counter);
+//                    p1->noactivity = time(NULL);
+//                } else {
+//                    debug(LOG_INFO, "%s - Recorded no activity since %ld", p1->ip, p1->noactivity);
+//                }
+//                if (p1->noactivity +
+//                    (config.checkinterval * config.clienttimeout)
+//                    <= time(NULL)) {
+//                    /* Timing out user */
+//                    debug(LOG_INFO, "%s - Inactive for %ld seconds, removing node and denying in firewall", p1->ip, config.checkinterval * config.clienttimeout);
+//                    fw_deny(p1->ip, p1->mac, p1->tag);
+//                    node_delete(p1);
+//                } else {
+//                    /*
+//                     * This handles any change in
+//                     * the status this allows us
+//                     * to change the status of a
+//                     * user while he's connected
+//                     */
+//                    switch (authresponse.authcode) {
+//                        case AUTH_DENIED:
+//
+//                        case AUTH_VALIDATION_FAILED:
+//                            debug(LOG_NOTICE, "%s - Validation timeout, now denied. Removing node and firewall rules", p1->ip);
+//                            fw_deny(p1->ip, p1->mac, p1->tag);
+//                            node_delete(p1);
+//                            break;
+//
+//                        case AUTH_ALLOWED:
+//                            if (p1->tag != MARK_KNOWN) {
+//                                debug(LOG_INFO, "%s - Access has changed, refreshing firewall and clearing counters", p1->ip);
+//                                fw_deny(p1->ip, p1->mac, p1->tag);
+//                                p1->tag = MARK_KNOWN;
+//                                p1->counter = 0;
+//                                fw_allow(p1->ip, p1->mac, p1->tag);
+//                            }
+//                            break;
+//
+//                        case AUTH_VALIDATION:
+//                            /*
+//                             * Do nothing, user
+//                             * is in validation
+//                             * period
+//                             */
+//                            debug(LOG_INFO, "%s - User in validation period", p1->ip);
+//                            break;
+//
+//                        default:
+//                            debug(LOG_DEBUG, "I do not know about authentication code %d", authresponse.authcode);
+//                            break;
+//                    }
+//                }
+//        } else {
+//            /* Node was not found in list, FIXME remove from firewall rules */
+//            debug(LOG_NOTICE, "Node %s was not found in list", counters[i]->ip);
+//        }
+//        pthread_mutex_unlock(&nodes_mutex);
+//    }
+
 }
 
@@ -331 +364 @@
  * @param token Token
  * @param counter Value of the counter at creation (usually 0)
- * @param active Is the node active, or not
  * @return Pointer to the node we just created
  */
 t_node         *
-node_add(char *ip, char *mac, char *token, long int counter, int active)
+node_add(char *ip, char *mac, char *token)
 {
     t_node         *curnode, *prevnode;
@@ -358 +390 @@
     curnode->mac = strdup(mac);
     curnode->token = strdup(token);
-    curnode->counter = counter;
-    curnode->active = active;
+    curnode->counters.incoming = curnode->counters.outgoing = 0;
+    curnode->counters.last_updated = time(NULL);
 
     if (prevnode == NULL) {

trunk/wifidog/src/firewall.h

@@ -34 +34 @@
 } t_marks;
 
+typedef struct counters_t_ {
+    long int incoming;
+    long int outgoing;
+    long int last_updated;
+} counters_t;
+
 typedef struct _t_node {
         struct  _t_node *next;
-        char    *ip,
-                *mac,
-                *token;
-        int     active, /* boolean */
-        noactivity, /* seconds since there has not been activity */
-        tag, /* the MARK in the firewall */
-                fd;     /* socket */
-        long    int     counter;
+        char *ip;
+    char *mac;
+        char *token;
+
+    /* the MARK in the firewall */
+    unsigned int tag;
+
+    /* socket */
+        int     fd;
+
+    /* the counters */
+        counters_t counters;
 } t_node;
 
@@ -55 +65 @@
 
 void node_init(void);
-t_node *node_add(char *ip, char *mac, char *token, long int counter,
-                int active);
+t_node *node_add(char *ip, char *mac, char *token);
 t_node *node_find_by_ip(char *ip);
 t_node *node_find_by_token(char *token);

trunk/wifidog/src/http.c

@@ -111 +111 @@
                                 debug(LOG_DEBUG, "New node for %s",
                                         webserver->clientAddr);
-                                node_add(webserver->clientAddr, mac,
-                                        token->value, 0, 0);
+                                node_add(webserver->clientAddr, mac, token->value);
                         } else {
                                 debug(LOG_DEBUG, "Node for %s already "
@@ -130 +129 @@
                         
                         /* start sub process */
-                        pthread_create(&tid, NULL, (void *)auth_thread,
-                                        (void *)ip);
+                        pthread_create(&tid, NULL, (void *)auth_thread, (void *)ip);
                         pthread_detach(tid);
 

trunk/wifidog/src/iptables.c

@@ -31 +31 @@
 #include <stdlib.h>
 #include <stdarg.h>
+#include <syslog.h>
+#include <errno.h>
+#include <string.h>
+#include <pthread.h>
 
 #include "conf.h"
 #include "iptables.h"
 #include "firewall.h"
-
+#include "debug.h"
+
+extern pthread_mutex_t  nodes_mutex;
 extern s_config config;
 extern int fw_quiet;
@@ -100 +106 @@
     iptables_do_command("-t nat -I PREROUTING 1 -i %s -j " TABLE_WIFIDOG_CLASS, config.gw_interface);
 
-    iptables_do_command("-t mangle -N " TABLE_WIFIDOG_MARK);
-    iptables_do_command("-t mangle -I PREROUTING 1 -i %s -j " TABLE_WIFIDOG_MARK, config.gw_interface);
-
-    iptables_do_command("-t mangle -N " TABLE_WIFIDOG_TRAFFIC);
-    iptables_do_command("-t mangle -I FORWARD 1 -i %s -j " TABLE_WIFIDOG_TRAFFIC, config.external_interface);
+    iptables_do_command("-t mangle -N " TABLE_WIFIDOG_OUTGOING);
+    iptables_do_command("-t mangle -I PREROUTING 1 -i %s -j " TABLE_WIFIDOG_OUTGOING, config.gw_interface);
+
+    iptables_do_command("-t mangle -N " TABLE_WIFIDOG_INCOMING);
+    iptables_do_command("-t mangle -I FORWARD 1 -i %s -j " TABLE_WIFIDOG_INCOMING, config.external_interface);
 
     return 1;
@@ -123 +129 @@
     fw_quiet = 1;
     iptables_do_command("-t nat -F " TABLE_WIFIDOG_CLASS);
-    iptables_do_command("-t mangle -F " TABLE_WIFIDOG_MARK);
-    iptables_do_command("-t mangle -F " TABLE_WIFIDOG_TRAFFIC);
+    iptables_do_command("-t mangle -F " TABLE_WIFIDOG_OUTGOING);
+    iptables_do_command("-t mangle -F " TABLE_WIFIDOG_INCOMING);
 
     iptables_do_command("-t nat -F " TABLE_WIFIDOG_VALIDATE);
@@ -146 +152 @@
     rc = 0;
     for (tries = 0; tries < 10 && rc == 0; tries++) {
-        rc = iptables_do_command("-t mangle -D PREROUTING -i %s -j " TABLE_WIFIDOG_MARK, config.gw_interface);
-    }
-    iptables_do_command("-t mangle -X " TABLE_WIFIDOG_MARK);
+        rc = iptables_do_command("-t mangle -D PREROUTING -i %s -j " TABLE_WIFIDOG_OUTGOING, config.gw_interface);
+    }
+    iptables_do_command("-t mangle -X " TABLE_WIFIDOG_OUTGOING);
 
     rc = 0;
     for (tries = 0; tries < 10 && rc == 0; tries++) {
-        rc = iptables_do_command("-t mangle -D FORWARD -i %s -j " TABLE_WIFIDOG_TRAFFIC, config.external_interface);
-    }
-    iptables_do_command("-t mangle -X " TABLE_WIFIDOG_TRAFFIC);
+        rc = iptables_do_command("-t mangle -D FORWARD -i %s -j " TABLE_WIFIDOG_INCOMING, config.external_interface);
+    }
+    iptables_do_command("-t mangle -X " TABLE_WIFIDOG_INCOMING);
 
     return 1;
@@ -167 +173 @@
     switch(type) {
         case FW_ACCESS_ALLOW:
-            iptables_do_command("-t mangle -A " TABLE_WIFIDOG_MARK " -s %s -m mac --mac-source %s -j MARK --set-mark %d", ip, mac, tag);
-            rc = iptables_do_command("-t mangle -A " TABLE_WIFIDOG_TRAFFIC " -d %s -j ACCEPT", ip);
+            iptables_do_command("-t mangle -A " TABLE_WIFIDOG_OUTGOING " -s %s -m mac --mac-source %s -j MARK --set-mark %d", ip, mac, tag);
+            rc = iptables_do_command("-t mangle -A " TABLE_WIFIDOG_INCOMING " -d %s -j ACCEPT", ip);
             break;
         case FW_ACCESS_DENY:
-            iptables_do_command("-t mangle -D " TABLE_WIFIDOG_MARK " -s %s -m mac --mac-source %s -j MARK --set-mark %d", ip, mac, tag);
-            rc = iptables_do_command("-t mangle -D " TABLE_WIFIDOG_TRAFFIC " -d %s -j ACCEPT", ip);
+            iptables_do_command("-t mangle -D " TABLE_WIFIDOG_OUTGOING " -s %s -m mac --mac-source %s -j MARK --set-mark %d", ip, mac, tag);
+            rc = iptables_do_command("-t mangle -D " TABLE_WIFIDOG_INCOMING " -d %s -j ACCEPT", ip);
             break;
         default:
@@ -182 +188 @@
 }
 
+int
+iptables_fw_counters(void)
+{
+    FILE *output;
+    char *script,
+        ip[16],
+        rc;
+    unsigned long int counter;
+    t_node *p1;
+
+    /* Look for outgoing traffic */
+    asprintf(&script, "%s %s", "iptables", "-v -x -t mangle -L " TABLE_WIFIDOG_OUTGOING);
+    if (!(output = popen(script, "r"))) {
+        debug(LOG_ERR, "popen(): %s", strerror(errno));
+        return -1;
+    }
+    free(script);
+
+    /* skip the first two lines */
+    while (('\n' != fgetc(output)) && !feof(output))
+        ;
+    while (('\n' != fgetc(output)) && !feof(output))
+        ;
+    while (output && !(feof(output))) {
+        rc = fscanf(output, "%*s %lu %*s %*s %*s %*s %*s %s %*s %*s %*s %*s %*s 0x%*u", &counter, ip);
+        if (2 == rc && EOF != rc) {
+            debug(LOG_DEBUG, "Outgoing %s Bytes=%ld", ip, counter);
+            pthread_mutex_lock(&nodes_mutex);
+            if ((p1 = node_find_by_ip(ip))) {
+                if (p1->counters.outgoing < counter) {
+                    p1->counters.outgoing = counter;
+                    p1->counters.last_updated = time(NULL);
+                    debug(LOG_DEBUG, "%s - Updated counter to %ld bytes", ip, counter);
+                }
+            } else {
+                debug(LOG_ERR, "Could not find %s in node list", ip);
+            }
+            pthread_mutex_unlock(&nodes_mutex);
+        }
+    }
+    pclose(output);
+
+    /* Look for incoming traffic */
+    asprintf(&script, "%s %s", "iptables", "-v -x -t mangle -L " TABLE_WIFIDOG_INCOMING);
+    if (!(output = popen(script, "r"))) {
+        debug(LOG_ERR, "popen(): %s", strerror(errno));
+        return -1;
+    }
+    free(script);
+
+    /* skip the first two lines */
+    while (('\n' != fgetc(output)) && !feof(output))
+        ;
+    while (('\n' != fgetc(output)) && !feof(output))
+        ;
+    while (output && !(feof(output))) {
+        rc = fscanf(output, "%*s %lu %*s %*s %*s %*s %*s %*s %s", &counter, ip);
+        if (2 == rc && EOF != rc) {
+            debug(LOG_DEBUG, "Incoming %s Bytes=%ld", ip, counter);
+            pthread_mutex_lock(&nodes_mutex);
+            if ((p1 = node_find_by_ip(ip))) {
+                if (p1->counters.incoming < counter) {
+                    p1->counters.incoming = counter;
+                    p1->counters.last_updated = time(NULL);
+                    debug(LOG_DEBUG, "%s - Updated counter to %ld bytes", ip, counter);
+                }
+            } else {
+                debug(LOG_ERR, "Could not find %s in node list", ip);
+            }
+            pthread_mutex_unlock(&nodes_mutex);
+        }
+    }
+    pclose(output);
+
+    return 1;
+}
+

trunk/wifidog/src/iptables.h

@@ -28 +28 @@
 #define _IPTABLES_H_
 
-#define TABLE_WIFIDOG_MARK      "WiFiDog_Mark"
+#include "firewall.h"
+
 #define TABLE_WIFIDOG_CLASS     "WiFiDog_Class"
-#define TABLE_WIFIDOG_TRAFFIC   "WiFiDog_Traffic"
+#define TABLE_WIFIDOG_OUTGOING  "WiFiDog_Outgoing"
+#define TABLE_WIFIDOG_INCOMING  "WiFiDog_Incoming"
 
 #define TABLE_WIFIDOG_VALIDATE  "WiFiDog_Validate"
@@ -46 +48 @@
 int iptables_fw_destroy(void);
 int iptables_fw_access(fw_access_t type, char *ip, char *mac, int tag);
+int iptables_fw_counters(void);
 
 #endif /* _IPTABLES_H_ */