Changeset 290

Timestamp:

11/22/04 16:45:58 (4 years ago)

Author:

alexcv

Message:

Massive update

Files:

• trunk/wifidog/ChangeLog (modified) (1 diff)
• trunk/wifidog/libhttpd/api.c (modified) (1 diff)
• trunk/wifidog/src/conf.c (modified) (11 diffs)
• trunk/wifidog/src/conf.h (modified) (4 diffs)
• trunk/wifidog/src/fw_iptables.c (modified) (6 diffs)
• trunk/wifidog/src/ping_thread.c (modified) (2 diffs)
• trunk/wifidog/wifidog.conf (modified) (13 diffs)

trunk/wifidog/ChangeLog

@@ -1 +1 @@
-# $Header$
+
+2004-11-22 Alexandre Carmel-Veilleux <acv@acv.ca>
+        * libhttpd/api.c: Fix leak in HttpdEndRequest().
+        * src/ping_thread.c: Fix auth_server IP change code with latest
+          from previous branch.
+        * src/conf.h: Same as above.
+        * src/fw_iptables.c: Same as above.
+        * src/conf.[ch]: Firewall rule set parsing code.
+        * wifidog.conf: Default firewall rule set defined.
+        * src/fw_iptables.[ch]: Firewall rule set enacting code.
+
-2004-11-18 Benoit Gr�ire  <bock@step.polymtl.ca>
-        * src/ping_thread.c: Merge phil's bug fixes from stable branch

trunk/wifidog/libhttpd/api.c

@@ -602 +602 @@
-{
-        _httpd_freeVariables(r->variables);
-        r->variables = NULL;
-        shutdown(r->clientSock,2);
-        close(r->clientSock);
+        free(r);
-}
-

trunk/wifidog/src/conf.c

@@ -82 +82 @@
-        oWdctlSocket,
-        oSyslogFacility,
-
+
+
-} OpCodes;
-
@@ -112 +113 @@
-        { "httpport",           oAuthServHTTPPort },
-        { "path",               oAuthServPath },
+        { "firewallruleset",    oFirewallRuleSet },
-        { "firewallrule",       oFirewallRule },
-        { NULL,                 oBadOption },
@@ -120 +122 @@
-static int parse_boolean_value(char *);
-static void parse_auth_server(FILE *, char *, int *);
-
+
+
-
-/** Accessor for the current gateway configuration
@@ -153 +156 @@
-        config.log_syslog = DEFAULT_LOG_SYSLOG;
-        config.wdctl_sock = strdup(DEFAULT_WDCTL_SOCK);
-
+ets
-}
-
@@ -332 +335 @@
-} while (0)
-
+/** @internal
+Parses firewall rule set information
+*/
+static void
+parse_firewall_ruleset(char *ruleset, FILE *file, char *filename, int *linenum)
+{
+        char            line[MAX_BUF],
+                        *p1,
+                        *p2;
+        int             opcode;
+
+        debug(LOG_DEBUG, "Adding Firewall Rule Set %s", ruleset);
+        
+        /* Read first line */   
+        memset(line, 0, MAX_BUF);
+        fgets(line, MAX_BUF - 1, file);
+        (*linenum)++; /* increment line counter. */
+
+        /* Parsing loop */
+        while ((line[0] != '\0') && (strchr(line, '}') == NULL)) {
+                /* skip leading blank spaces */
+                for (p1 = line; isblank(*p1); p1++);
+
+                /* End at end of line */
+                if ((p2 = strchr(p1, '#')) != NULL) {
+                        *p2 = '\0';
+                } else if ((p2 = strchr(p1, '\r')) != NULL) {
+                        *p2 = '\0';
+                } else if ((p2 = strchr(p1, '\n')) != NULL) {
+                        *p2 = '\0';
+                }
+
+                /* next, we coopt the parsing of the regular config */
+                if (strlen(p1) > 0) {
+                        p2 = p1;
+                        /* keep going until word boundary is found. */
+                        while ((*p2 != '\0') && (!isblank(*p2)))
+                                p2++;
+
+                        /* Terminate first word. */
+                        *p2 = '\0';
+                        p2++;
+
+                        /* skip all further blanks. */
+                        while (isblank(*p2))
+                                p2++;
+                        
+                        /* Get opcode */
+                        opcode = config_parse_token(p1, filename, *linenum);
+
+                        debug(LOG_DEBUG, "p1 = [%s]; p2 = [%s]", p1, p2);
+                        
+                        switch (opcode) {
+                                case oFirewallRule:
+                                        parse_firewall_rule(ruleset, p2);
+                                        break;
+
+                                case oBadOption:
+                                default:
+                                        debug(LOG_ERR, "Bad option on line %d "
+                                                        "in %s.", *linenum,
+                                                        filename);
+                                        debug(LOG_ERR, "Exiting...");
+                                        exit(-1);
+                                        break;
+                        }
+                }
+
+                /* Read next line */
+                memset(line, 0, MAX_BUF);
+                fgets(line, MAX_BUF - 1, file);
+                (*linenum)++; /* increment line counter. */
+        }
+
+        debug(LOG_DEBUG, "Firewall Rule Set %s added.", ruleset);
+}
+
-static int
-token
+ruleset
-{
-        int i;
@@ -339 +419 @@
-        int all_nums = 1; /**< If 0, port contained non-numerics */
-        int finished = 0; /**< reached end of line */
+        char *token = NULL; /**< First word */
-        char *port = NULL; /**< port to open/block */
-        char *protocol = NULL; /**< protocol to block, tcp/udp/icmp */
-        char *mask = NULL; /**< Netmask */
-        char *other_kw = NULL; /**< other key word */
+        t_firewall_ruleset *tmpr;
+        t_firewall_ruleset *tmpr2;
-        t_firewall_rule *tmp;
-        t_firewall_rule *tmp2;
-
-
-
-
+
+
-        /* lower case */
-        for (i = 0; *(leftover + i) != '\0'
-                        && (*(leftover + i) = tolower(*(leftover + i))); i++);
-        
+        token = leftover;
+        TO_NEXT_WORD(leftover, finished);
+        
-        /* Parse token */
-
+ || finished
-                block_allow = 0;
-        } else if (!strcasecmp(token, "allow")) {
@@ -366 +451 @@
-        /* Parse the remainder */
-        /* Get the protocol */
-
-
-
-
-
-
-
+
+
+
+
+
-        }
-
-        /* should be exactly "port" */
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
-        }
-
@@ -424 +502 @@
-        memset((void *)tmp, 0, sizeof(t_firewall_rule));
-        tmp->block_allow = block_allow;
-
-
+
+
+
+
-        if (mask == NULL)
-                tmp->mask = strdup("0.0.0.0/0");
@@ -435 +515 @@
-        
-        /* Append the rule record */
-
-
+
+
+
+
+
+
-        } else {
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                while (tmp2->next != NULL)
-                        tmp2 = tmp2->next;
@@ -445 +549 @@
-        
-        return 1;
+}
+
+t_firewall_rule *
+get_ruleset(char *ruleset)
+{
+        t_firewall_ruleset      *tmp;
+
+        for (tmp = config.rulesets; tmp != NULL
+                        && strcmp(tmp->name, ruleset) != 0; tmp = tmp->next);
+
+        return(tmp->rules);
-}
-
@@ -524 +639 @@
-                                                        &linenum);
-                                        break;
-
-
+
+
+
-                                        break;
-                                case oHTTPDName:

trunk/wifidog/src/conf.h

@@ -62 +62 @@
-                                     listens on */
-    int authserv_use_ssl;       /**< @brief Use SSL or not */
-struct in_add
+cha
-    struct _auth_serv_t *next;
-} t_auth_serv;
@@ -76 +76 @@
-    struct _firewall_rule_t *next;
-} t_firewall_rule;
+
+/**
+ * Firewall rulesets
+ */
+typedef struct _firewall_ruleset_t {
+    char                        *name;
+    t_firewall_rule             *rules;
+    struct _firewall_ruleset_t  *next;
+} t_firewall_ruleset;
-
-/**
@@ -108 +117 @@
-    int syslog_facility;        /**< @brief facility to use when using syslog for
-                                     logging */
-    *rule
+set *ruleset
-} s_config;
-
@@ -132 +141 @@
-void mark_auth_server_bad(t_auth_serv *);
-
+/** @brief Fetch a firewall rule set. */
+t_firewall_rule *get_ruleset(char *);
+
-#define LOCK_CONFIG() do { \
-        debug(LOG_DEBUG, "Locking config"); \

trunk/wifidog/src/fw_iptables.c

@@ -36 +36 @@
-#include <pthread.h>
-
+#include "common.h"
+
-#include "conf.h"
-#include "fw_iptables.h"
@@ -44 +46 @@
-
-static int iptables_do_command(char *format, ...);
+static char *iptables_compile(char *, t_firewall_rule *);
+static void iptables_load_ruleset(char *, char *);
-
-extern pthread_mutex_t  client_list_mutex;
@@ -73 +77 @@
-}
-
+/**
+ * @internal
+ * Compiles a struct definition of a firewall rule into a valid iptables
+ * command.
+ * @arg chain Chain that the command will be (-A)ppended to.
+ * @arg rule Definition of a rule into a struct, from conf.c.
+ */
+static char *
+iptables_compile(char *chain, t_firewall_rule *rule)
+{
+    char        command[MAX_BUF],
+                *mode;
+    
+    memset(command, 0, MAX_BUF);
+    
+    if (rule->block_allow == 1) {
+        mode = strdup("ACCEPT");
+    } else {
+        mode = strdup("DROP");
+    }
+    
+    snprintf(command, sizeof(command),  "-t nat -A %s ", chain);
+    if (rule->mask != NULL) {
+        snprintf((command + strlen(command)), (sizeof(command) - 
+                strlen(command)), "-d %s ", rule->mask);
+    }
+    if (rule->protocol != NULL) {
+        snprintf((command + strlen(command)), (sizeof(command) -
+                strlen(command)), "-p %s ", rule->protocol);
+    }
+    if (rule->port != NULL) {
+        snprintf((command + strlen(command)), (sizeof(command) -
+                strlen(command)), "--dport %s ", rule->port);
+    }
+    snprintf((command + strlen(command)), (sizeof(command) - 
+            strlen(command)), "-j %s", mode);
+    
+    free(mode);
+
+    /* XXX The buffer command, an automatic variable, will get cleaned
+     * off of the stack when we return, so we strdup() it. */
+    return(strdup(command));
+}
+
+/**
+ * @internal
+ * Load all the rules in a rule set.
+ * @arg ruleset Name of the ruleset
+ * @arg chain IPTables chain the rules go into
+ */
+static void
+iptables_load_ruleset(char *ruleset, char *chain)
+{
+        t_firewall_rule         *rules;
+        char                    *cmd;
+
+        debug(LOG_DEBUG, "Load ruleset %s into chain %s", ruleset, chain);
+        
+        for (rules = get_ruleset(ruleset); rules != NULL; rules = rules->next) {
+                cmd = iptables_compile(chain, rules);
+                debug(LOG_DEBUG, "Loading rule \"%s\" into %s", cmd, chain);
+                iptables_do_command(cmd);
+        }
+
+        debug(LOG_DEBUG, "Ruleset %s loaded into %s", ruleset, chain);
+}
+
-void
-iptables_fw_clear_authservers(void)
@@ -92 +163 @@
-    for (auth_server = config->auth_servers; auth_server != NULL;
-                    auth_server = auth_server->next) {
-
+
+
+
+
+
+
-    }
-
@@ -119 +195 @@
-
-    /** Insert global rules BEFORE the "defaults" */
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
-
-    LOCK_CONFIG();
@@ -142 +207 @@
-    
-    /** Insert global rules BEFORE the "defaults" */
-
-
-
-
-
-
-
+
+
+
+
-    iptables_do_command("-t nat -A " TABLE_WIFIDOG_UNKNOWN " -p tcp --dport 80 -j REDIRECT --to-ports %d", config->gw_port);
-
-
-
+
-    iptables_do_command("-t nat -A " TABLE_WIFIDOG_UNKNOWN " -j DROP");
-
-    iptables_do_command("-t nat -N " TABLE_WIFIDOG_KNOWN);
-
-    /** Insert global rules BEFORE the "defaults" */
-
-do_command("-t nat -A " TABLE_WIFIDOG_KNOWN " -j ACCEPT"
+
+load_ruleset("known-users", TABLE_WIFIDOG_KNOWN
-
-    iptables_do_command("-t nat -N " TABLE_WIFIDOG_LOCKED);
-do_command("-t nat -A " TABLE_WIFIDOG_LOCKED " -j DROP"
-
+load_ruleset("locked-users", TABLE_WIFIDOG_KNOWN
+
-    iptables_do_command("-t nat -N " TABLE_WIFIDOG_CLASS);
-
-
-
+
-    iptables_do_command("-t nat -A " TABLE_WIFIDOG_CLASS " -i %s -m mark --mark 0x%u -j " TABLE_WIFIDOG_VALIDATE, config->gw_interface, FW_MARK_PROBATION);
-    iptables_do_command("-t nat -A " TABLE_WIFIDOG_CLASS " -i %s -m mark --mark 0x%u -j " TABLE_WIFIDOG_KNOWN, config->gw_interface, FW_MARK_KNOWN);

trunk/wifidog/src/ping_thread.c

@@ -97 +97 @@
-                                i;
-        t_auth_serv             *auth_server;
-
+
+
-        struct in_addr          *h_addr;
-        struct sockaddr_in      their_addr;
@@ -127 +128 @@
-
-        if (auth_server->last_ip == NULL) {
-
-
+
-                if (auth_server->last_ip == NULL) {
-                        debug(LOG_CRIT, "Could not allocate memory, Banzai!");
-                        exit(-1);
-                }
-                memcpy(auth_server->last_ip, h_addr, sizeof(struct in_addr));
-        } else {
-
-
-
-
-
-
+
+
+
+
-                        fw_clear_authservers();
-                        fw_set_authservers();
+                } else {
+                        free(tmp_addr);
-                }
-        }

trunk/wifidog/wifidog.conf

@@ -2 +2 @@
-# WiFiDog Configuration file
-
-m
+ameter
-# Default: default
-# Optional but essential for monitoring purposes
@@ -12 +12 @@
-GatewayID default
-
-m
+ameter
-# Default: NONE
-# Mandatory
@@ -20 +20 @@
-ExternalInterface eth0
-
-m
+ameter
-# Default: NONE
-# Mandatory
@@ -28 +28 @@
-GatewayInterface eth1
-
-m
+ameter
-# Default: NONE
-# Mandatory
@@ -36 +36 @@
-GatewayAddress 192.168.1.1
-
-m
+ameter
-# Default: 1
-# Optional
@@ -46 +46 @@
-# AuthServMaxTries 3
-
-m
+ameter
-# Default: NONE
-# Mandatory
@@ -79 +79 @@
-#}
-
-m
+ameter
-# Default: 1
-# Optional
@@ -86 +86 @@
-# Daemon 1
-
-m
+ameter
-# Default: 2060
-# Optional
@@ -93 +93 @@
-# GatewayPort 2060
-
-m
+ameter
-# Default: WiFiDog
-# Optional
@@ -100 +100 @@
-# HTTPDName WiFiDog
-
-m
+ameter
-# Default: 10
-# Optional
@@ -107 +107 @@
-# HTTPDMaxConn 10
-
-m
+ameter
-# Default: 60
-# Optional
@@ -114 +114 @@
-CheckInterval 60
-
-m
+ameter
-# Default: 5
-# Optional
@@ -122 +122 @@
-ClientTimeout 5
-
+# Parameter: FirewallRuleSet
+# Default: none
+# Mandatory
+#
+# Groups a number of FirewallRule statements together.
+
+# Parameter: FirewallRule
+# Default: none
+# 
+# Define one firewall rule in a rule set.
+
+# Rule Set: global
+# 
+# Used for rules to be applied to all other rulesets except locked.
+# This is the default config for the Teliphone service.
+FirewallRuleSet global {
+        FirewallRule allow udp to 69.90.89.192/27
+        FirewallRule allow udp to 69.90.85.0/27
+        FirewallRule allow tcp port 80 to 69.90.89.205
+}
+
+# Rule Set: validating-users
+#
+# Used for new users validating their account
+FirewallRuleSet validating-users {
+        FirewallRule allow udp port 67
+        FirewallRule allow tdp port 67
+        FirewallRule allow udp port 53
+        FirewallRule allow tcp port 53
+        FirewallRule allow tcp port 80
+        FirewallRule allow tcp port 110
+        FirewallRule allow tcp port 995
+        FirewallRule allow tcp port 143
+        FirewallRule allow tcp port 993
+        FirewallRule allow tcp port 220
+        FirewallRule allow tcp port 443
+        FirewallRule block to 0.0.0.0/0
+}
+
+# Rule Set: known-users
+#
+# Used for normal validated users.
+FirewallRuleSet known-users {
+        FirewallRule allow to 0.0.0.0/0
+}
+
+# Rule Set: unknown-users
+#
+# Used for unvalidated users, this is the ruleset that gets redirected.
+FirewallRuleSet unknown-users {
+        FirewallRule allow udp port 53
+        FirewallRule allow tcp port 53
+        FirewallRule allow udp port 67
+        FirewallRule allow tcp port 67
+}
+
+# Rule Set: locked-users
+#
+# Used for users that have been locked out.
+FirewallRuleSet locked-users {
+        FirewallRule block to 0.0.0.0/0
+}