Changeset 1351

Timestamp:

06/11/08 02:10:17 (2 years ago)

Author:

benoitg

Message:

• Authenticator.php: Fix SQL error closing connections.
• auth/index.php: Probably fix the "Access denied" message when user click twice problem that resurfaced.
• At long last, implement operational Dynamic abuse control (out of the embryo of the token architecture)! Configurable in Network preferences if you have the permissions. Unlike static limits, this is a sliding window (typically a month) during which user have a bandwidth and connection duration limit, per node, and totalled throughout the network.
• UIAllowedBandwidth: New, simplistic content type to show the user how much of his allocation he consumed. Off course, the goal is actually to make it into a pretty graph....

Location:

trunk/wifidog-auth

Files:

• CHANGELOG (modified) (1 diff)
• sql/wifidog-postgres-initial-data.sql (modified) (2 diffs)
• sql/wifidog-postgres-schema.sql (modified) (18 diffs)
• wifidog/admin/generic_object_admin.php (modified) (1 diff)
• wifidog/auth/index.php (modified) (2 diffs)
• wifidog/classes/Authenticator.php (modified) (1 diff)
• wifidog/classes/Content/UIAllowedBandwidth (added)
• wifidog/classes/Content/UIAllowedBandwidth/UIAllowedBandwidth.php (added)
• wifidog/classes/Network.php (modified) (3 diffs)
• wifidog/classes/Node.php (modified) (3 diffs)
• wifidog/classes/Permission.php (modified) (1 diff)
• wifidog/classes/User.php (modified) (3 diffs)
• wifidog/config.php (modified) (1 diff)
• wifidog/include/schema_validate.php (modified) (2 diffs)

trunk/wifidog-auth/CHANGELOG

@@ -1 +1 @@
 # $Id$
+2008-06-10 Benoit Grégoire  <bock@step.polymtl.ca>
+        * Authenticator.php:  Fix SQL error closing connections.
+        * auth/index.php:  Probably fix the "Access denied" message when user click twice problem that resurfaced.
+        * At long last, implement operational Dynamic abuse control (out of the embryo of the token architecture)!  Configurable in Network preferences if you have the permissions.  Unlike static limits, this is a sliding window (typically a month) during which user have a bandwidth and connection duration limit, per node, and totalled throughout the network.
+        * UIAllowedBandwidth:  New, simplistic content type to show the user how much of his allocation he consumed.  Off course, the goal is actually to make it into a pretty graph....
+
 2008-06-10 Benoit Grégoire  <bock@step.polymtl.ca>
         * Begin implementing http://dev.wifidog.org/wiki/doc/developer/TokenArchitecture.  This is a first step:  SQL schema changes, and adapt the current functionnality to the new schema to have a baseline.  Everything should work as before, please notify me if you notice anything strange...

trunk/wifidog-auth/sql/wifidog-postgres-initial-data.sql

@@ -197 +197 @@
 INSERT INTO virtual_hosts (virtual_host_id, hostname, default_network) VALUES ('DEFAULT_VHOST', 'localhost', 'default-network');
 INSERT INTO server (server_id, default_virtual_host) VALUES ('SERVER_ID', 'DEFAULT_VHOST');
-INSERT into roles (role_id, stakeholder_type_id) VALUES ('SERVER_SYSADMIN', 'Server');
-INSERT into roles (role_id, stakeholder_type_id) VALUES ('NETWORK_SYSADMIN', 'Network');
+INSERT into roles (role_id, stakeholder_type_id) VALUES ('SERVER_OWNER', 'Server');
+INSERT into roles (role_id, stakeholder_type_id) VALUES ('NETWORK_OWNER', 'Network');
 --
 -- PostgreSQL database dump
@@ -215 +215 @@
 --
 
-INSERT INTO schema_info (tag, value) VALUES ('schema_version', '56');
+INSERT INTO schema_info (tag, value) VALUES ('schema_version', '61');
 
 

trunk/wifidog-auth/sql/wifidog-postgres-schema.sql

@@ -25 +25 @@
 
 --
--- Name: SCHEMA public; Type: COMMENT; Schema: -; Owner: -
---
-
-COMMENT ON SCHEMA public IS 'Standard public schema';
-
-
---
 -- Name: plpgsql; Type: PROCEDURAL LANGUAGE; Schema: -; Owner: -
 --
@@ -50 +43 @@
 CREATE TABLE connections (
     conn_id integer NOT NULL,
-    token character varying(32) DEFAULT ''::character varying NOT NULL,
-    token_status character varying(10) DEFAULT 'UNUSED'::character varying NOT NULL,
+    token_id character varying(32) DEFAULT ''::character varying NOT NULL,
     timestamp_in timestamp without time zone,
     node_id character varying(32),
@@ -61 +53 @@
     last_updated timestamp without time zone NOT NULL,
     incoming bigint,
-    outgoing bigint
-);
-
-
---
--- Name: connections_conn_id_seq; Type: SEQUENCE; Schema: public; Owner: -
---
-
-CREATE SEQUENCE connections_conn_id_seq
-    INCREMENT BY 1
-    NO MAXVALUE
-    NO MINVALUE
-    CACHE 1;
-
-
---
--- Name: connections_conn_id_seq; Type: SEQUENCE OWNED BY; Schema: public; Owner: -
---
-
-ALTER SEQUENCE connections_conn_id_seq OWNED BY connections.conn_id;
+    outgoing bigint,
+    max_total_bytes integer,
+    max_incoming_bytes integer,
+    max_outgoing_bytes integer,
+    expiration_date timestamp without time zone,
+    logout_reason integer
+);
 
 
@@ -295 +274 @@
 CREATE TABLE content_key_value_pairs (
     content_id text NOT NULL,
-    "key" text NOT NULL,
+    key text NOT NULL,
     value text
 );
@@ -451 +430 @@
     gmaps_map_type text DEFAULT 'G_NORMAL_MAP'::text NOT NULL,
     theme_pack text,
+    connection_limit_window interval,
+    connection_limit_network_max_total_bytes integer,
+    connection_limit_network_max_usage_duration interval,
+    connection_limit_node_max_total_bytes integer,
+    connection_limit_node_max_usage_duration interval,
     CONSTRAINT networks_gmaps_map_type CHECK ((gmaps_map_type <> ''::text)),
     CONSTRAINT networks_name CHECK ((name <> ''::text)),
@@ -536 +520 @@
     last_heartbeat_wifidog_uptime integer,
     last_heartbeat_sys_memfree integer,
-    last_heartbeat_sys_load real
+    last_heartbeat_sys_load real,
+    connection_limit_node_max_total_bytes_override integer,
+    connection_limit_node_max_usage_duration_override interval
 );
 
@@ -672 +658 @@
 
 
+--
+-- Name: token_lots; Type: TABLE; Schema: public; Owner: -; Tablespace: 
+--
+
+CREATE TABLE token_lots (
+    token_lot_id text NOT NULL,
+    token_lot_comment text,
+    token_lot_creation_date timestamp without time zone DEFAULT now() NOT NULL
+);
+
+
 SET default_with_oids = true;
 
@@ -682 +679 @@
 );
 
+
+SET default_with_oids = false;
+
+--
+-- Name: token_templates; Type: TABLE; Schema: public; Owner: -; Tablespace: 
+--
+
+CREATE TABLE token_templates (
+    token_template_id text NOT NULL,
+    token_template_network text NOT NULL,
+    token_template_creation_date timestamp without time zone DEFAULT now() NOT NULL,
+    token_max_incoming_data integer,
+    token_max_outgoing_data integer,
+    token_max_total_data integer,
+    token_max_connection_duration interval,
+    token_max_usage_duration interval,
+    token_max_wall_clock_duration interval,
+    token_max_age interval,
+    token_is_reusable boolean DEFAULT true
+);
+
+
+--
+-- Name: tokens; Type: TABLE; Schema: public; Owner: -; Tablespace: 
+--
+
+CREATE TABLE tokens (
+    token_id text NOT NULL,
+    token_template_id text,
+    token_status text,
+    token_lot_id text,
+    token_creation_date timestamp without time zone DEFAULT now() NOT NULL,
+    token_issuer text NOT NULL,
+    token_owner text
+);
+
+
+--
+-- Name: tokens_template_valid_nodes; Type: TABLE; Schema: public; Owner: -; Tablespace: 
+--
+
+CREATE TABLE tokens_template_valid_nodes (
+    token_template_id text NOT NULL,
+    token_valid_at_node text NOT NULL
+);
+
+
+SET default_with_oids = true;
 
 --
@@ -723 +768 @@
     never_show_username boolean DEFAULT false,
     prefered_locale text,
+    open_id_url text,
     CONSTRAINT check_user_not_empty CHECK (((user_id)::text <> ''::text))
 );
@@ -764 +810 @@
 
 --
+-- Name: connections_conn_id_seq; Type: SEQUENCE; Schema: public; Owner: -
+--
+
+CREATE SEQUENCE connections_conn_id_seq
+    INCREMENT BY 1
+    NO MAXVALUE
+    NO MINVALUE
+    CACHE 1;
+
+
+--
+-- Name: connections_conn_id_seq; Type: SEQUENCE OWNED BY; Schema: public; Owner: -
+--
+
+ALTER SEQUENCE connections_conn_id_seq OWNED BY connections.conn_id;
+
+
+--
 -- Name: conn_id; Type: DEFAULT; Schema: public; Owner: -
 --
@@ -847 +911 @@
 
 ALTER TABLE ONLY content_key_value_pairs
-    ADD CONSTRAINT content_key_value_pairs_pkey PRIMARY KEY (content_id, "key");
+    ADD CONSTRAINT content_key_value_pairs_pkey PRIMARY KEY (content_id, key);
 
 
@@ -1099 +1163 @@
 
 --
+-- Name: token_lots_pkey; Type: CONSTRAINT; Schema: public; Owner: -; Tablespace: 
+--
+
+ALTER TABLE ONLY token_lots
+    ADD CONSTRAINT token_lots_pkey PRIMARY KEY (token_lot_id);
+
+
+--
 -- Name: token_status_pkey; Type: CONSTRAINT; Schema: public; Owner: -; Tablespace: 
 --
@@ -1107 +1179 @@
 
 --
+-- Name: token_templates_pkey; Type: CONSTRAINT; Schema: public; Owner: -; Tablespace: 
+--
+
+ALTER TABLE ONLY token_templates
+    ADD CONSTRAINT token_templates_pkey PRIMARY KEY (token_template_id);
+
+
+--
+-- Name: tokens_pkey; Type: CONSTRAINT; Schema: public; Owner: -; Tablespace: 
+--
+
+ALTER TABLE ONLY tokens
+    ADD CONSTRAINT tokens_pkey PRIMARY KEY (token_id);
+
+
+--
+-- Name: tokens_template_valid_nodes_pkey; Type: CONSTRAINT; Schema: public; Owner: -; Tablespace: 
+--
+
+ALTER TABLE ONLY tokens_template_valid_nodes
+    ADD CONSTRAINT tokens_template_valid_nodes_pkey PRIMARY KEY (token_template_id, token_valid_at_node);
+
+
+--
 -- Name: user_has_content_pkey; Type: CONSTRAINT; Schema: public; Owner: -; Tablespace: 
 --
@@ -1183 +1279 @@
 
 --
+-- Name: idx_content_display_log; Type: INDEX; Schema: public; Owner: -; Tablespace: 
+--
+
+CREATE INDEX idx_content_display_log ON content_display_log USING btree (last_display_timestamp);
+
+
+--
 -- Name: idx_content_group_element_content_group_id; Type: INDEX; Schema: public; Owner: -; Tablespace: 
 --
@@ -1211 +1314 @@
 
 --
+-- Name: idx_nodes_node_deployment_status; Type: INDEX; Schema: public; Owner: -; Tablespace: 
+--
+
+CREATE INDEX idx_nodes_node_deployment_status ON nodes USING btree (node_deployment_status);
+
+
+--
 -- Name: idx_token; Type: INDEX; Schema: public; Owner: -; Tablespace: 
 --
 
-CREATE INDEX idx_token ON connections USING btree (token);
-
-
---
--- Name: idx_token_status_and_user_id; Type: INDEX; Schema: public; Owner: -; Tablespace: 
---
-
-CREATE INDEX idx_token_status_and_user_id ON connections USING btree (token_status, user_id);
+CREATE INDEX idx_token ON connections USING btree (token_id);
+
+
+--
+-- Name: idx_token_status; Type: INDEX; Schema: public; Owner: -; Tablespace: 
+--
+
+CREATE INDEX idx_token_status ON tokens USING btree (token_status);
 
 
@@ -1232 +1342 @@
 
 --
+-- Name: idx_users_topen_id_url; Type: INDEX; Schema: public; Owner: -; Tablespace: 
+--
+
+CREATE INDEX idx_users_topen_id_url ON users USING btree (open_id_url);
+
+
+--
 -- Name: profile_template_fields_semantic_id; Type: INDEX; Schema: public; Owner: -; Tablespace: 
 --
 
 CREATE INDEX profile_template_fields_semantic_id ON profile_template_fields USING btree (semantic_id);
-
-
---
--- Name: $1; Type: FK CONSTRAINT; Schema: public; Owner: -
---
-
-ALTER TABLE ONLY connections
-    ADD CONSTRAINT "$1" FOREIGN KEY (token_status) REFERENCES token_status(token_status);
 
 
@@ -1607 +1716 @@
 
 --
+-- Name: fk_roles; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY network_stakeholders
+    ADD CONSTRAINT fk_roles FOREIGN KEY (role_id) REFERENCES roles(role_id) ON UPDATE CASCADE ON DELETE CASCADE;
+
+
+--
+-- Name: fk_roles; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY node_stakeholders
+    ADD CONSTRAINT fk_roles FOREIGN KEY (role_id) REFERENCES roles(role_id) ON UPDATE CASCADE ON DELETE CASCADE;
+
+
+--
+-- Name: fk_roles; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY server_stakeholders
+    ADD CONSTRAINT fk_roles FOREIGN KEY (role_id) REFERENCES roles(role_id) ON UPDATE CASCADE ON DELETE CASCADE;
+
+
+--
+-- Name: fk_tokens; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY connections
+    ADD CONSTRAINT fk_tokens FOREIGN KEY (token_id) REFERENCES tokens(token_id) ON UPDATE CASCADE ON DELETE RESTRICT;
+
+
+--
 -- Name: fk_users; Type: FK CONSTRAINT; Schema: public; Owner: -
 --
@@ -1791 +1932 @@
 
 --
+-- Name: token_templates_token_template_network_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY token_templates
+    ADD CONSTRAINT token_templates_token_template_network_fkey FOREIGN KEY (token_template_network) REFERENCES networks(network_id) ON UPDATE CASCADE ON DELETE CASCADE;
+
+
+--
+-- Name: tokens_template_valid_nodes_token_template_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY tokens_template_valid_nodes
+    ADD CONSTRAINT tokens_template_valid_nodes_token_template_id_fkey FOREIGN KEY (token_template_id) REFERENCES token_templates(token_template_id) ON UPDATE CASCADE ON DELETE CASCADE;
+
+
+--
+-- Name: tokens_template_valid_nodes_token_valid_at_node_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY tokens_template_valid_nodes
+    ADD CONSTRAINT tokens_template_valid_nodes_token_valid_at_node_fkey FOREIGN KEY (token_valid_at_node) REFERENCES nodes(node_id) ON UPDATE CASCADE ON DELETE CASCADE;
+
+
+--
+-- Name: tokens_token_issuer_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY tokens
+    ADD CONSTRAINT tokens_token_issuer_fkey FOREIGN KEY (token_issuer) REFERENCES users(user_id) ON UPDATE CASCADE ON DELETE CASCADE;
+
+
+--
+-- Name: tokens_token_lot_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY tokens
+    ADD CONSTRAINT tokens_token_lot_id_fkey FOREIGN KEY (token_lot_id) REFERENCES token_lots(token_lot_id) ON UPDATE CASCADE ON DELETE CASCADE;
+
+
+--
+-- Name: tokens_token_owner_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY tokens
+    ADD CONSTRAINT tokens_token_owner_fkey FOREIGN KEY (token_owner) REFERENCES users(user_id) ON UPDATE CASCADE ON DELETE CASCADE;
+
+
+--
+-- Name: tokens_token_status_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY tokens
+    ADD CONSTRAINT tokens_token_status_fkey FOREIGN KEY (token_status) REFERENCES token_status(token_status) ON UPDATE CASCADE ON DELETE RESTRICT;
+
+
+--
+-- Name: tokens_token_template_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY tokens
+    ADD CONSTRAINT tokens_token_template_id_fkey FOREIGN KEY (token_template_id) REFERENCES token_templates(token_template_id) ON UPDATE CASCADE ON DELETE CASCADE;
+
+
+--
 -- Name: user_has_profiles_profile_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: -
 --

trunk/wifidog-auth/wifidog/admin/generic_object_admin.php

@@ -374 +374 @@
                             case "ProfileTemplate" :
                             case "ContentTypeFilter" :
-                                if (!User :: getCurrentUser()->DEPRECATEDisSuperAdmin()) {
-                                    $supportsDeletion = false;
-                                }
                                 break;
 

trunk/wifidog-auth/wifidog/auth/index.php

@@ -51 +51 @@
 require_once('../include/common.php');
 require_once('classes/Network.php');
-$db = AbstractDb::getObject(); 
+require_once('classes/User.php');
+$db = AbstractDb::getObject();
 $auth_response = ACCOUNT_STATUS_DENIED;
 $auth_message = '';
@@ -89 +90 @@
                     // Start accounting
                     if ($authenticator->acctStart($info['conn_id'], $auth_message))
-                        $auth_response = ACCOUNT_STATUS_ALLOWED;
+                    $auth_response = ACCOUNT_STATUS_ALLOWED;
                     else
-                        $auth_response = ACCOUNT_STATUS_DENIED;
+                    $auth_response = ACCOUNT_STATUS_DENIED;
 
                 }
             }
             else
-                if ($info['token_status'] == TOKEN_INUSE &&
-                                        isset($info['gw_id']) && isset($_REQUEST['gw_id']) && $info['gw_id'] == $_REQUEST['gw_id'] &&
-                                        isset($info['mac']) && isset($_REQUEST['mac']) && $info['mac'] == $_REQUEST['mac'] &&
-                                        isset($info['ip']) && isset($_REQUEST['ip']) && $info['ip'] == $_REQUEST['ip'])
+            if ($info['token_status'] == TOKEN_INUSE &&
+            $info['gw_id'] && isset($_REQUEST['gw_id']) && $info['gw_id'] == $_REQUEST['gw_id'] &&
+            $info['user_mac'] && isset($_REQUEST['mac']) && $info['user_mac'] == $_REQUEST['mac'] &&
+            $info['user_ip'] && isset($_REQUEST['ip']) && $info['user_ip'] == $_REQUEST['ip'])
+            {
+                // This solves the bug where the user clicks twice before getting the portal page
+                $auth_response = ACCOUNT_STATUS_ALLOWED;
+            }
+            else
+            {
+                $auth_message .= "| Tried to login with a token that wasn't TOKEN_UNUSED. ";
+            }
+        }
+        else
+        if ($_REQUEST['stage'] == STAGE_LOGOUT || $_REQUEST['stage'] == STAGE_COUNTERS)
+        {
+            if (!empty ($_REQUEST['incoming']) || !empty ($_REQUEST['outgoing']))
+            {
+                $incoming = $db->escapeString($_REQUEST['incoming']);
+                $outgoing = $db->escapeString($_REQUEST['outgoing']);
+
+                if (($incoming >= $info['incoming']) && ($outgoing >= $info['outgoing']))
                 {
-                    // This solves the bug where the user clicks twice before getting the portal page
-                    $auth_response = ACCOUNT_STATUS_ALLOWED;
+                    $authenticator->acctUpdate($info['conn_id'], $incoming, $outgoing);
+                    $auth_message .= "| Updated counters. ";
                 }
                 else
                 {
-                    $auth_message .= "| Tried to login with a token that wasn't TOKEN_UNUSED. ";
+                    $auth_message .= "| Warning:  Incoming or outgoing counter is smaller than what is stored in the database; counters not updated. ";
+
                 }
-        }
-        else
-            if ($_REQUEST['stage'] == STAGE_LOGOUT || $_REQUEST['stage'] == STAGE_COUNTERS)
+            }
+            else
             {
-                if ($_REQUEST['stage'] == STAGE_LOGOUT)
+                $auth_message .= "| Incoming or outgoing counter is missing; counters not updated. ";
+            }
+
+            if ($_REQUEST['stage'] == STAGE_LOGOUT)
+            {
+                $authenticator->logout($info['conn_id']);
+                $auth_message .= "| User is now logged out. ";
+            }
+
+            if ($_REQUEST['stage'] == STAGE_COUNTERS)
+            {
+                if ($info['token_status'] == TOKEN_INUSE)
                 {
-                    $authenticator->logout($info['conn_id']);
-                    $auth_message .= "| User is now logged out. ";
-                }
-
-                if ($_REQUEST['stage'] == STAGE_COUNTERS)
-                {
-                    if ($info['token_status'] == TOKEN_INUSE)
+                    /* This is for the 15 minutes validation period, the exact same code is also present when the stage is login.  If you update this one don't forget to update the other one! */
+                    if (($info['account_status'] == ACCOUNT_STATUS_VALIDATION) && ($info['validation_grace_time_expired'] == 't'))
                     {
-                        /* This is for the 15 minutes validation period, the exact same code is also present when the stage is login.  If you update this one don't forget to update the other one! */
-                        if (($info['account_status'] == ACCOUNT_STATUS_VALIDATION) && ($info['validation_grace_time_expired'] == 't'))
-                        {
-                            $auth_response = ACCOUNT_STATUS_VALIDATION_FAILED;
-                            $auth_message .= "| The validation grace period which began at ".$info['reg_date']." has now expired. ";
-                        }
-                        else
-                        {
-                            $auth_response = $info['account_status'];
-                        }
+                        $auth_response = ACCOUNT_STATUS_VALIDATION_FAILED;
+                        $auth_message .= "| The validation grace period which began at ".$info['reg_date']." has now expired. ";
                     }
                     else
                     {
-                        $auth_response = ACCOUNT_STATUS_DENIED;
-                        $auth_message .= "| Invalid token status: ".$token_to_text[$info['token_status']].". ";
-                    }
-
-                }
-
-                if (!empty ($_REQUEST['incoming']) || !empty ($_REQUEST['outgoing']))
-                {
-                    $incoming = $db->escapeString($_REQUEST['incoming']);
-                    $outgoing = $db->escapeString($_REQUEST['outgoing']);
-
-                    if (($incoming >= $info['incoming']) && ($outgoing >= $info['outgoing']))
-                    {
-                        $authenticator->acctUpdate($info['conn_id'], $incoming, $outgoing);
-                        $auth_message .= "| Updated counters. ";
-                    }
-                    else
-                    {
-                        $auth_message .= "| Warning:  Incoming or outgoing counter is smaller than what is stored in the database; counters not updated. ";
-
+                        /* TODO:  This is a bit hackish, is't a shortcut untill the Token architecture uniform connection limit calculations are in place. */
+                        $abuseControlFault = User::isAbuseControlViolated(User::getObject($info['user_id']), $info['user_mac'], Node::getObject($info['node_id']));
+                        if($abuseControlFault) {
+                            $auth_response = ACCOUNT_STATUS_DENIED;
+                            $auth_message .= "| $abuseControlFault ";
+                        }
+                        else {
+                            $auth_response = $info['account_status'];
+                        }
                     }
                 }
                 else
                 {
-                    $auth_message .= "| Incoming or outgoing counter is missing; counters not updated. ";
+                    $auth_response = ACCOUNT_STATUS_DENIED;
+                    $auth_message .= "| Invalid token status: ".$token_to_text[$info['token_status']].". ";
                 }
+
             }
-            else
-            {
-                $auth_message .= "| Error: Unknown stage. ";
-                $auth_response = ACCOUNT_STATUS_ERROR;
-            }
+
+        }
+        else
+        {
+            $auth_message .= "| Error: Unknown stage. ";
+            $auth_response = ACCOUNT_STATUS_ERROR;
+        }
     }
 }

trunk/wifidog-auth/wifidog/classes/Authenticator.php

@@ -345 +345 @@
         // Stop traffic counters update
         $conn_id = $db->escapeString($conn_id);
-        $db->execSqlUpdate("UPDATE connections SET "."timestamp_out=CURRENT_TIMESTAMP,"."token_status='".TOKEN_USED."' "."WHERE conn_id='{$conn_id}';\n", false);
+        $sql = "UPDATE connections SET timestamp_out=CURRENT_TIMESTAMP WHERE conn_id='{$conn_id}';\n";
+        $sql .= "UPDATE tokens SET token_status='".TOKEN_USED."' FROM connections WHERE connections.token_id=tokens.token_id AND conn_id='{$conn_id}';\n";
+        
+        $db->execSqlUpdate($sql, false);
     }
 

trunk/wifidog-auth/wifidog/classes/Network.php

@@ -1431 +1431 @@
     }
 
-    /**
-     * Get an array of all Content linked to the network
-     *
-     * @param bool   $exclude_subscribed_content Exclude subscribed content?
-     * @param object $subscriber                 The User object used to
-     *                                           discriminate the content
-     *
-     * @return array An array of Content or an empty array
-     */
-    /*public function getAllContent($exclude_subscribed_content = false, $subscriber = null)
-     {
-
-        $db = AbstractDb::getObject();
-
-        // Init values
-        $content_rows = null;
-        $retval = array ();
-
-        // Get all network, but exclude user subscribed content if asked
-        if ($exclude_subscribed_content == true && $subscriber) {
-        $sql = "SELECT content_id FROM network_has_content WHERE network_id='$this->_id' AND content_id NOT IN (SELECT content_id FROM user_has_content WHERE user_id = '{$subscriber->getId()}') ORDER BY subscribe_timestamp DESC";
-        } else {
-        $sql = "SELECT content_id FROM network_has_content WHERE network_id='$this->_id' ORDER BY subscribe_timestamp DESC";
-        }
-
-        $db->execSql($sql, $content_rows, false);
-
-        if ($content_rows != null) {
-        foreach ($content_rows as $content_row) {
-        $retval[] = Content :: getObject($content_row['content_id']);
-        }
-        }
-
-        return $retval;
-        }
-        */
+    /** The length of the window during which the user must not have exceeded the limits below.
+     *
+     * @return string Interval as returned by postgresql
+     */
+    public function getConnectionLimitWindow()
+    {
+        return $this->_row['connection_limit_window'];
+    }
+
+    /**
+     * Set the network's creation date
+     *
+     * @param string $value The new creation date
+     *
+     * @return bool True on success, false on failure
+     */
+    public function setConnectionLimitWindow($value)
+    {
+        $db = AbstractDb::getObject();
+        // Init values
+        $retVal = true;
+
+        if ($value != $this->getConnectionLimitWindow()) {
+            $value?$value_sql="'".$db->escapeString($value)."'":$value_sql="NULL";
+            $retVal = $db->execSqlUpdate("UPDATE networks SET connection_limit_window = $value_sql WHERE network_id = '{$this->getId()}'", false);
+            $this->refresh();
+        }
+        return $retVal;
+    }
+
+    /** Maximum data transfer during the abuse control window, in bytes
+     *
+     * @return integer Number of bytes
+     */
+    public function getConnectionLimitNetworkMaxTotalBytes()
+    {
+        return $this->_row['connection_limit_network_max_total_bytes'];
+    }
+
+    /**
+     * Maximum data transfer during the abuse control window, in bytes
+     *
+     * @param $value integer Number of bytes
+     *
+     * @return bool True on success, false on failure
+     */
+    public function setConnectionLimitNetworkMaxTotalBytes($value)
+    {
+        $db = AbstractDb::getObject();
+        // Init values
+        $retVal = true;
+
+        if ($value != $this->getConnectionLimitNetworkMaxTotalBytes()) {
+            $value?$value_sql="'".$db->escapeString($value)."'":$value_sql="NULL";
+            $retVal = $db->execSqlUpdate("UPDATE networks SET connection_limit_network_max_total_bytes = $value_sql WHERE network_id = '{$this->getId()}'", false);
+            $this->refresh();
+        }
+        return $retVal;
+    }
+
+    /** Maximum connection duration during the abuse control window
+     *
+     * @return string Interval as returned by postgresql
+     */
+    public function getConnectionLimitNetworkMaxDuration()
+    {
+        return $this->_row['connection_limit_network_max_usage_duration'];
+    }
+
+    /** Maximum connection duration during the abuse control window
+     *
+     * @param string $value The new creation date
+     *
+     * @return bool True on success, false on failure
+     */
+    public function setConnectionLimitNetworkMaxDuration($value)
+    {
+        $db = AbstractDb::getObject();
+        // Init values
+        $retVal = true;
+
+        if ($value != $this->getConnectionLimitNetworkMaxDuration()) {
+            $value?$value_sql="'".$db->escapeString($value)."'":$value_sql="NULL";
+            $retVal = $db->execSqlUpdate("UPDATE networks SET connection_limit_network_max_usage_duration = $value_sql WHERE network_id = '{$this->getId()}'", false);
+            $this->refresh();
+        }
+        return $retVal;
+    }
+
+    /** Maximum data transfer during the abuse control window, in bytes
+     *
+     * @return integer Number of bytes
+     */
+    public function getConnectionLimitNodeMaxTotalBytes()
+    {
+        return $this->_row['connection_limit_node_max_total_bytes'];
+    }
+
+    /**
+     * Maximum data transfer during the abuse control window, in bytes
+     *
+     * @param $value integer Number of bytes
+     *
+     * @return bool True on success, false on failure
+     */
+    public function setConnectionLimitNodeMaxTotalBytes($value)
+    {
+        $db = AbstractDb::getObject();
+        // Init values
+        $retVal = true;
+
+        if ($value != $this->getConnectionLimitNodeMaxTotalBytes()) {
+            $value?$value_sql="'".$db->escapeString($value)."'":$value_sql="NULL";
+            $retVal = $db->execSqlUpdate("UPDATE networks SET connection_limit_node_max_total_bytes = $value_sql WHERE network_id = '{$this->getId()}'", false);
+            $this->refresh();
+        }
+        return $retVal;
+    }
+
+    /** Maximum connection duration during the abuse control window
+     *
+     * @return string Interval as returned by postgresql
+     */
+    public function getConnectionLimitNodeMaxDuration()
+    {
+        return $this->_row['connection_limit_node_max_usage_duration'];
+    }
+
+    /** Maximum connection duration during the abuse control window
+     *
+     * @param string $value The new creation date
+     *
+     * @return bool True on success, false on failure
+     */
+    public function setConnectionLimitNodeMaxDuration($value)
+    {
+        $db = AbstractDb::getObject();
+        // Init values
+        $retVal = true;
+
+        if ($value != $this->getConnectionLimitNodeMaxDuration()) {
+            $value?$value_sql="'".$db->escapeString($value)."'":$value_sql="NULL";
+            $retVal = $db->execSqlUpdate("UPDATE networks SET connection_limit_node_max_usage_duration = $value_sql WHERE network_id = '{$this->getId()}'", false);
+            $this->refresh();
+        }
+        return $retVal;
+    }
+
 
     /**
@@ -1614 +1726 @@
 
         /*
+         * Dynamic abuse control
+         */
+        $html_dynamic_abuse_control = array();
+        $permArray=null;
+        $permArray[]=array(Permission::P('NETWORK_PERM_EDIT_DYNAMIC_ABUSE_CONTROL'), $this);
+        if (Security::hasAnyPermission($permArray)) {
+            //  connection_limit_window
+            $title = _("Abuse control window");
+            $help = _("The length of the window (in seconds) during which the user must not have exceeded the limits below.  Typically a month (259200 s) or a week (604800s).  A user who exceeds the limits will be denied access until his usage falls below the limits.");
+            $data = InterfaceElements::generateInputText("network_" . $this->getId() . "_connection_limit_window", $this->getConnectionLimitWindow(), "network_connection_limit_window_input");
+            $html_dynamic_abuse_control[] = InterfaceElements::generateAdminSectionContainer("network_connection_limit_window", $title, $data, $help);
+
+            //  connection_limit_network_max_total_bytes
+            $title = _("Network max total bytes transfered");
+            $help = _("Maximum data transfer during the abuse control window");
+            $data = InterfaceElements::generateInputText("network_" . $this->getId() . "_connection_limit_network_max_total_bytes", $this->getConnectionLimitNetworkMaxTotalBytes(), "network_connection_limit_network_max_total_bytes");
+            $html_dynamic_abuse_control[] = InterfaceElements::generateAdminSectionContainer("network_connection_limit_network_max_total_bytes", $title, $data, $help);
+
+            //  connection_limit_network_max_usage_duration
+            $title = _("Network max connection duration");
+            $help = _("Maximum connection duration during the abuse control window");
+            $data = InterfaceElements::generateInputText("network_" . $this->getId() . "_connection_limit_network_max_usage_duration", $this->getConnectionLimitNetworkMaxDuration(), "network_connection_limit_network_max_usage_duration");
+            $html_dynamic_abuse_control[] = InterfaceElements::generateAdminSectionContainer("network_connection_limit_network_max_usage_duration", $title, $data, $help);
+
+            //  connection_limit_node_max_total_bytes
+            $title = _("Node max total bytes transfered");
+            $help = _("Maximum data transfer during the abuse control window");
+            $data = InterfaceElements::generateInputText("network_" . $this->getId() . "_connection_limit_node_max_total_bytes", $this->getConnectionLimitNodeMaxTotalBytes(), "network_connection_limit_node_max_total_bytes");
+            $html_dynamic_abuse_control[] = InterfaceElements::generateAdminSectionContainer("network_connection_limit_node_max_total_bytes", $title, $data, $help);
+
+            //  connection_limit_node_max_usage_duration
+            $title = _("Node max connection duration");
+            $help = _("Maximum connection duration during the abuse control window");
+            $data = InterfaceElements::generateInputText("network_" . $this->getId() . "_connection_limit_node_max_usage_duration", $this->getConnectionLimitNodeMaxDuration(), "network_connection_limit_node_max_usage_duration");
+            $html_dynamic_abuse_control[] = InterfaceElements::generateAdminSectionContainer("network_connection_limit_node_max_usage_duration", $title, $data, $help);
+        }
+        else{
+            $html_dynamic_abuse_control[] = _("You do not have access to edit these options");
+        }
+        // Build section
+        $html .= InterfaceElements::generateAdminSectionContainer("network_user_verification", _("Dynamic abuse control"), implode(null, $html_dynamic_abuse_control));
+
+        /*
          * Access management
          */
@@ -1751 +1906 @@
         $this->setCustomPortalRedirectAllowed(empty ($_REQUEST[$name]) ? false : true);
 
+        /*
+         * Dynamic abuse control
+         */
+        $html_dynamic_abuse_control = array();
+        $permArray=null;
+        $permArray[]=array(Permission::P('NETWORK_PERM_EDIT_DYNAMIC_ABUSE_CONTROL'), $this);
+        if (Security::hasAnyPermission($permArray)) {
+            //  connection_limit_window
+            $name = "network_" . $this->getId() . "_connection_limit_window";
+            $this->setConnectionLimitWindow($_REQUEST[$name]);
+
+            //  connection_limit_network_max_total_bytes
+            $name = "network_" . $this->getId() . "_connection_limit_network_max_total_bytes";
+            $this->setConnectionLimitNetworkMaxTotalBytes($_REQUEST[$name]);
+
+            //  connection_limit_network_max_usage_duration
+            $name = "network_" . $this->getId() . "_connection_limit_network_max_usage_duration";
+            $this->setConnectionLimitNetworkMaxDuration($_REQUEST[$name]);
+
+            //  connection_limit_node_max_total_bytes
+            $name = "network_" . $this->getId() . "_connection_limit_node_max_total_bytes";
+            $this->setConnectionLimitNodeMaxTotalBytes($_REQUEST[$name]);
+
+            //  connection_limit_node_max_usage_duration
+            $name = "network_" . $this->getId() . "_connection_limit_node_max_usage_duration";
+            $this->setConnectionLimitNodeMaxDuration($_REQUEST[$name]);
+        }
+         
         // Access rights
         require_once('classes/Stakeholder.php');

trunk/wifidog-auth/wifidog/classes/Node.php

@@ -1032 +1032 @@
     public function getAdminUI()
     {
+        $permArray=null;
         $permArray[]=array(Permission::P('NETWORK_PERM_EDIT_ANY_NODE_CONFIG'), $this->getNetwork());
         $permArray[]=array(Permission::P('NODE_PERM_EDIT_CONFIG'), $this);
@@ -1044 +1045 @@
         // Get information about the network
         $network = $this->getNetwork();
-
-        // Check if user is a admin
-        $_userIsAdmin = User::getCurrentUser()->DEPRECATEDisSuperAdmin();
-
+        
         $node_id = $this->getId();
 
@@ -1249 +1247 @@
          * Access rights
          */
-        if ($_userIsAdmin) {
+        if (User::getCurrentUser()->DEPRECATEDisSuperAdmin()) {
             require_once('classes/Stakeholder.php');
             $html_access_rights = Stakeholder::getAssignStakeholdersUI($this);

trunk/wifidog-auth/wifidog/classes/Permission.php

@@ -90 +90 @@
             $PERMISSIONS['NETWORK_PERM_EDIT_ANY_NODE_CONFIG'] = array(_("User is allowed to edit any configuration of any node on the network"), StakeholderType::Network, true);
             $PERMISSIONS['NETWORK_PERM_ADD_NODE'] = array(_("User is allowed to create a new Node on this network"), StakeholderType::Network, true);
-            
+            $PERMISSIONS['NETWORK_PERM_EDIT_DYNAMIC_ABUSE_CONTROL'] = array(_("User is allowed to set dynamic abuse control options for the network"), StakeholderType::Network, false);
+
             $PERMISSIONS['SERVER_PERM_EDIT_ROLES'] = array(_("User is allowed to edit user role definitions"), StakeholderType::Server, true);
             $PERMISSIONS['SERVER_PERM_EDIT_ANY_VIRTUAL_HOST'] = array(_("User is allowed to edit any virtual host definition"), StakeholderType::Server, true);

trunk/wifidog-auth/wifidog/classes/User.php

@@ -521 +521 @@
     }
 
+    /** Retrieves the connection history necessary for abuse control
+
+    * @return false if abuse control is disabled */
+
+    static function getAbuseControlConnectionHistory($user = null, $mac = null, $node = null) {
+        if (!$user) {
+            $user = User::getCurrentUser();
+        }
+        if (!$node) {
+            $node = Node::getCurrentNode();//Maybe this should be getCurrentRealNode, but it would make debuging harder
+        }
+        $network = $node->getNetwork();
+
+        $db = AbstractDb::getObject();
+
+        if ($network->getConnectionLimitWindow()) {
+            //$sql =  " SELECT * from connections \n";//For debugging
+            $sql =  " SELECT \n";
+            $sql .= " SUM (incoming+outgoing) AS network_total_bytes, \n";
+            $sql .= " SUM (CASE WHEN node_id = '".$node->getId()."' THEN (incoming+outgoing) END) AS node_total_bytes, \n";
+            $sql .= " SUM (timestamp_out - timestamp_in) AS network_duration, \n";
+            $sql .= " SUM (CASE WHEN node_id = '".$node->getId()."' THEN (timestamp_out - timestamp_in) END) AS node_duration \n";//For real
+            $sql .= " FROM connections \n";//For real
+            $sql .= " JOIN nodes USING (node_id) \n";
+            $sql .= " JOIN networks USING (network_id) \n";
+            $sql .= " JOIN tokens ON (tokens.token_id = connections.token_id) \n";
+            $sql .= " WHERE 1=1 \n";
+
+            if ($mac) {
+                //Catch some cheaters
+                $mac = $db->escapeString($mac);
+                $mac_sql_or = " OR connections.user_mac = '$mac' ";
+            }
+            else {
+                $mac_sql_or = null;
+            }
+            $sql .= " AND (connections.user_id = '".$user->getId()."' $mac_sql_or ) \n";
+
+            $sql .= " AND (timestamp_in > CURRENT_TIMESTAMP - networks.connection_limit_window OR tokens.token_status = '".TOKEN_INUSE."')";  //Get every connection within the window plus any still active connection, even if it started before the window
+
+            $subselect = $sql;
+            $sql =  " SELECT subselect.*, \n";
+            $sql .= " networks.connection_limit_window, \n";
+            $sql .= " networks.connection_limit_network_max_total_bytes, COALESCE(network_total_bytes>networks.connection_limit_network_max_total_bytes, false) AS network_total_bytes_exceeded_limit, \n";
+            $sql .= " networks.connection_limit_node_max_total_bytes, COALESCE(node_total_bytes>networks.connection_limit_node_max_total_bytes, false) AS node_total_bytes_exceeded_limit, \n";
+            $sql .= " networks.connection_limit_network_max_usage_duration, COALESCE(network_duration>networks.connection_limit_network_max_usage_duration, false) AS network_duration_exceeded_limit, \n";
+            $sql .= " networks.connection_limit_node_max_usage_duration, COALESCE(node_duration>networks.connection_limit_node_max_usage_duration, false) AS node_duration_exceeded_limit \n";
+
+            $sql .= " FROM ($subselect) AS subselect JOIN networks ON (network_id = '".$network->getId()."')";
+
+            $db->execSqlUniqueRes($sql, $connection_limits_report, false);
+            return $connection_limits_report;
+        }
+        else {
+            return false;
+        }
+    }
+
+    /** Takes the same paramaters as getAbuseControlConnectionHistory, and tells you if the abuse limits are busted
+
+    * @return false if abuse control respected, else a string containing the reason(s) for the bust  */
+
+    static function isAbuseControlViolated($user = null, $mac = null, $node = null) {
+        $retval = false;
+        $abuseControlReport = self::getAbuseControlConnectionHistory($user, $mac, $node);
+        if($abuseControlReport) {
+            //pretty_print_r($abuseControlReport);
+
+            if($abuseControlReport['network_total_bytes_exceeded_limit']=='t') {
+                $retval .= sprintf(_("During the last %s period, you transfered %d bytes throughout the network, which exceeds the %d bytes limit."), $abuseControlReport['connection_limit_window'], $abuseControlReport['network_total_bytes'], $abuseControlReport['connection_limit_network_max_total_bytes']);
+            }
+            if($abuseControlReport['node_total_bytes_exceeded_limit']=='t') {
+                $retval .= sprintf(_("During the last %s period, you transfered %d bytes at this node, which exceeds the %d bytes limit."), $abuseControlReport['connection_limit_window'], $abuseControlReport['node_total_bytes'], $abuseControlReport['connection_limit_node_max_total_bytes']);
+            }
+            if($abuseControlReport['network_duration_exceeded_limit']=='t') {
+                $retval .= sprintf(_("During the last %s period, you were online for a duration of %s throughout the network, which exceeds the %s limit."), $abuseControlReport['connection_limit_window'], $abuseControlReport['network_duration'], $abuseControlReport['connection_limit_network_max_usage_duration']);
+            }
+            if($abuseControlReport['node_duration_exceeded_limit']=='t') {
+                $retval .= sprintf(_("During the last %s period, you were online for a duration of %s at this node, which exceeds the %s limit."), $abuseControlReport['connection_limit_window'], $abuseControlReport['node_duration'], $abuseControlReport['connection_limit_node_max_usage_duration']);
+            }
+        }
+        return $retval;
+    }
     /** Generate a token in the connection table so the user can actually use the internet
     @return true on success, false on failure
@@ -536 +619 @@
                 //echo "$session && $node_ip && {$session->get(SESS_NODE_ID_VAR)}";
                 $node_id = $db->escapeString($session->get(SESS_NODE_ID_VAR));
-
+                $abuseControlFault = User::isAbuseControlViolated($this, null, Node::getObject($node_id));
+                if($abuseControlFault) {
+                    throw new Exception ($abuseControlFault);
+                }
                 /*
                  * Delete all unused tokens for this user, so we don't fill the database
@@ -543 +629 @@
                 $sql = "DELETE FROM connections USING tokens "."WHERE tokens.token_id=connections.token_id AND token_status='".TOKEN_UNUSED."' AND user_id = '".$this->getId()."';\n";
                 // TODO:  Try to find a reusable token before creating a brand new one!
-                
+
                 $sql .= "INSERT INTO tokens (token_owner, token_issuer, token_id, token_status) VALUES ('" . $this->getId() . "', '" . $this->getId() . "', '$token', '" . TOKEN_UNUSED . "');\n";
                 $sql .= "INSERT INTO connections (user_id, token_id, timestamp_in, node_id, node_ip, last_updated) VALUES ('" . $this->getId() . "', '$token', CURRENT_TIMESTAMP, '$node_id', '$node_ip', CURRENT_TIMESTAMP)";
                 $db->execSqlUpdate($sql, false);
                 $retval = $token;
-            } else
-            $retval = false;
-        } else {
+            }
+            else {
+                $retval = false;
+            }
+        }
+        else {
             $retval = false;
         }

trunk/wifidog-auth/wifidog/config.php

@@ -108 +108 @@
  * =======
  *
- * Experimental:  If you installed PEAR::Cache_Lite and set this value to true, caching
+ * Experimental:  If you installed PEAR::Cache_Lite and set this value to true, additional caching
  * will be enabled.
  *

trunk/wifidog-auth/wifidog/include/schema_validate.php

@@ -48 +48 @@
  * Define current database schema version
  */
-define('REQUIRED_SCHEMA_VERSION', 60);
+define('REQUIRED_SCHEMA_VERSION', 61);
 /** Used to test a new shecma version before modyfying the database */
 define('SCHEMA_UPDATE_TEST_MODE', false);
@@ -1383 +1383 @@
         $sql .= "ALTER TABLE connections RENAME COLUMN token TO token_id;\n";     
     }
-    /*
-
-
-    */
+    $new_schema_version = 61;
+    if ($schema_version < $new_schema_version && $new_schema_version <= $targetSchema) {
+        printUpdateVersion($new_schema_version);
+        $sql .= "\n\nUPDATE schema_info SET value='$new_schema_version' WHERE tag='schema_version';\n";
+
+        $sql .= "ALTER TABLE networks ADD column connection_limit_window interval; \n";
+        $sql .= "ALTER TABLE networks ALTER COLUMN connection_limit_window SET DEFAULT NULL;\n";
+        $sql .= "ALTER TABLE networks ADD COLUMN connection_limit_network_max_total_bytes integer;\n";
+        $sql .= "ALTER TABLE networks ALTER COLUMN connection_limit_network_max_total_bytes SET DEFAULT NULL;\n";
+        $sql .= "ALTER TABLE networks ADD COLUMN connection_limit_network_max_usage_duration interval;\n";
+        $sql .= "ALTER TABLE networks ALTER COLUMN connection_limit_network_max_usage_duration SET DEFAULT NULL;\n";
+        $sql .= "ALTER TABLE networks ADD COLUMN connection_limit_node_max_total_bytes integer;\n";
+        $sql .= "ALTER TABLE networks ALTER COLUMN connection_limit_node_max_total_bytes SET DEFAULT NULL;\n";
+        $sql .= "ALTER TABLE networks ADD COLUMN connection_limit_node_max_usage_duration interval;\n";
+        $sql .= "ALTER TABLE networks ALTER COLUMN connection_limit_node_max_usage_duration SET DEFAULT NULL;\n";
+
+        $sql .= "ALTER TABLE nodes ADD COLUMN connection_limit_node_max_total_bytes_override integer;\n";
+        $sql .= "ALTER TABLE nodes ALTER COLUMN connection_limit_node_max_total_bytes_override SET DEFAULT NULL;\n";
+        $sql .= "ALTER TABLE nodes ADD COLUMN connection_limit_node_max_usage_duration_override interval;\n";
+        $sql .= "ALTER TABLE nodes ALTER COLUMN connection_limit_node_max_usage_duration_override SET DEFAULT NULL;\n";
+        
+    }
+    
     /*
      $new_schema_version = ;