Show
Ignore:
Timestamp:
06/24/07 00:13:13 (7 years ago)
Author:
benoitg
Message:
  • Close #321: Make the Gateway retry forever if it cannot find it's interface. You never know when someone may finally replug the network cable or something...
  • Close #332: Apply patch from Laurent Marchal. biguphpc<AT>gmail<DOT>com
  • fw_iptables.c: Fix error in iptables_fw_access(). Rules were created as ACCEPT instead of DROP
  • firewall.c: Fix bug in fw_sync_with_authserver(). The traffic for the validation period of a user who validated his account while connected wouldn't get counted.
  • doc/wifidog_firewall_map.dia: At long last, full documentation of the firewall. We would have avoided a lot of stupid mistakes if we produced that sooner.
  • Release 1.1.3_rc1
Files:
1 modified

Legend:

Unmodified
Added
Removed
  • trunk/wifidog/src/fw_iptables.c

    r1236 r1241  
    6060static int fw_quiet = 0; 
    6161 
    62 /** @internal */ 
     62/** @internal  
     63 * */ 
    6364static int 
    6465iptables_do_command(char *format, ...) 
     
    219220                        /* Assign links and rules to these new chains */ 
    220221                        iptables_do_command("-t mangle -I PREROUTING 1 -i %s -j " TABLE_WIFIDOG_OUTGOING, gw_interface); 
    221                         iptables_do_command("-t mangle -I PREROUTING 1 -i %s -j " TABLE_WIFIDOG_TRUSTED, gw_interface); 
     222                        iptables_do_command("-t mangle -I PREROUTING 1 -i %s -j " TABLE_WIFIDOG_TRUSTED, gw_interface);//this rule will be inserted before the prior one 
    222223                        iptables_do_command("-t mangle -I POSTROUTING 1 -o %s -j " TABLE_WIFIDOG_INCOMING, gw_interface); 
    223224 
     
    275276                        iptables_do_command("-t filter -I FORWARD -i %s -j " TABLE_WIFIDOG_WIFI_TO_INTERNET, gw_interface); 
    276277 
    277             /* TCPMSS rule for PPPoE */ 
     278 
    278279                        iptables_do_command("-t filter -A " TABLE_WIFIDOG_WIFI_TO_INTERNET " -m state --state INVALID -j DROP"); 
    279280 
     
    282283                           iptables_do_command("-t filter -A " TABLE_WIFIDOG_WIFI_TO_INTERNET " -m state --state RELATED,ESTABLISHED -j ACCEPT");*/ 
    283284 
    284  
    285             if (ext_interface != NULL) { 
    286                             iptables_do_command("-t filter -A " TABLE_WIFIDOG_WIFI_TO_INTERNET " -i %s -m state --state NEW,INVALID -j DROP", ext_interface); 
    287                             iptables_do_command("-t filter -A " TABLE_WIFIDOG_WIFI_TO_INTERNET " -o %s -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu", ext_interface); 
    288             } else { 
    289                 /* Will this work even if we don't specify an external interface? */ 
    290                             iptables_do_command("-t filter -A " TABLE_WIFIDOG_WIFI_TO_INTERNET " -m state --state NEW,INVALID -j DROP"); 
    291                             iptables_do_command("-t filter -A " TABLE_WIFIDOG_WIFI_TO_INTERNET " -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu"); 
    292             } 
     285                        //Won't this rule NEVER match anyway?!?!? benoitg, 2007-06-23 
     286                        //iptables_do_command("-t filter -A " TABLE_WIFIDOG_WIFI_TO_INTERNET " -i %s -m state --state NEW -j DROP", ext_interface); 
     287             
     288            /* TCPMSS rule for PPPoE */ 
     289                        iptables_do_command("-t filter -A " TABLE_WIFIDOG_WIFI_TO_INTERNET " -o %s -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu", ext_interface); 
    293290 
    294291                        iptables_do_command("-t filter -A " TABLE_WIFIDOG_WIFI_TO_INTERNET " -j " TABLE_WIFIDOG_AUTHSERVERS); 
     
    462459        case FW_ACCESS_DENY: 
    463460            iptables_do_command("-t mangle -D " TABLE_WIFIDOG_OUTGOING " -s %s -m mac --mac-source %s -j MARK --set-mark %d", ip, mac, tag); 
    464             rc = iptables_do_command("-t mangle -D " TABLE_WIFIDOG_INCOMING " -d %s -j ACCEPT", ip); 
     461            rc = iptables_do_command("-t mangle -D " TABLE_WIFIDOG_INCOMING " -d %s -j DROP", ip); 
    465462            break; 
    466463        default: