Changeset 438

Timestamp:

02/09/05 00:45:46 (4 years ago)

Author:

minaguib

Message:

* Consolidated much of the networking calls to the auth servers into a magical function called connect_auth_server() that's responsible for dns lookup, connecting, marking servers bad, marking online/auth_online, and refreshing the firewall rules.
* Added new functions mark_auth_online(), mark_auth_offline() and is_auth_online() - similar in nature to is_online() etc. except tailored to decide on auth servers status - currently being called by connect_auth_server()
* Different apology in 404 handler depending on whether internet is down or just auth server is down
* wdctl status now shows status of is_online and is_auth_online

Still to do:
Create config section to set pass-through hostnames for fake DNS
Bugfix: Need to clear CONNTRACK in iptables for client<-udp->hotspot:53 after they authenticate so they don't keep hitting the fake DNS server

Files:

• branches/CaptiveDNS/wifidog/ChangeLog (modified) (1 diff)
• branches/CaptiveDNS/wifidog/src/centralserver.c (modified) (5 diffs)
• branches/CaptiveDNS/wifidog/src/centralserver.h (modified) (1 diff)
• branches/CaptiveDNS/wifidog/src/conf.c (modified) (2 diffs)
• branches/CaptiveDNS/wifidog/src/fw_iptables.c (modified) (1 diff)
• branches/CaptiveDNS/wifidog/src/http.c (modified) (2 diffs)
• branches/CaptiveDNS/wifidog/src/ping_thread.c (modified) (4 diffs)
• branches/CaptiveDNS/wifidog/src/util.c (modified) (4 diffs)
• branches/CaptiveDNS/wifidog/src/util.h (modified) (1 diff)
• branches/CaptiveDNS/wifidog/src/wdctl_thread.c (modified) (1 diff)

branches/CaptiveDNS/wifidog/ChangeLog

@@ -1 +1 @@
-# $Header$
+
+2005-02-09 Mina Naguib <mina@ilesansfil.org>
+        * Consolidated much of the networking calls to the auth servers into a
+        magical function called connect_auth_server() that's responsible for
+        dns lookup, connecting, marking servers bad, marking online/auth_online,
+        and refreshing the firewall rules.
+        * Added new functions mark_auth_online(), mark_auth_offline() and
+        is_auth_online() - similar in nature to is_online() etc. except tailored to
+        decide on auth servers status - currently being called by
+        connect_auth_server()
+        * Different apology in 404 handler depending on whether internet is down or
+        just auth server is down
+        * wdctl status now shows status of is_online and is_auth_online
-
-2005-02-06 Mina Naguib <mina@ilesansfil.org>

branches/CaptiveDNS/wifidog/src/centralserver.c

@@ -47 +47 @@
-#include "centralserver.h"
-#include "../config.h"
+
+extern pthread_mutex_t  config_mutex;
-
-/** Initiates a transaction with the auth server, either to authenticate or to update the traffic counters at the server
@@ -60 +62 @@
-auth_server_request(t_authresponse *authresponse, char *request_type, char *ip, char *mac, char *token, long int incoming, long int outgoing)
-{
-, num_tries, done
-        
+
+       
-        char buf[MAX_BUF];
-        struct in_addr *h_addr;
-        struct sockaddr_in their_addr;
-        char *tmp;
-        s_config *config = config_get_config();
-        t_auth_serv *auth_server = NULL;
-
-        /* Blanket default is failed. */
-        authresponse->authcode = AUTH_VALIDATION_FAILED;
-        
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
-
-        /**
@@ -126 +86 @@
-                "Host: %s\n"
-                "\n",
-auth_server
+config_get_config()->auth_servers
-            token, incoming, outgoing, VERSION, 
-
+
+
+
-        send(sockfd, buf, strlen(buf), 0);
-
-        debug(LOG_DEBUG, "Sending HTTP request to auth server: [%s]\n", buf);
-
-        numbytes = totalbytes = 0;
@@ -139 +99 @@
-        
-        if (numbytes == -1) {
-read()
+Error reading from auth server
-                close(sockfd);
-                return(-1);
-        }
-
-        numbytes = totalbytes;
-        
-        buf[numbytes] = '\0';
-
-        close(sockfd);
-
+        buf[totalbytes] = '\0';
-        debug(LOG_DEBUG, "HTTP Response from Server: [%s]", buf);
-        
-        if ((tmp = strstr(buf, "Auth: "))) {
-                if (sscanf(tmp, "Auth: %d", (int *)&authresponse->authcode) == 1) {
-
-
+
-                        return(authresponse->authcode);
-                } else {
-information
+authentication code
-                        return(AUTH_ERROR);
-                }
@@ -168 +123 @@
-}
-
+/* Tries really hard to connect to an auth server. Returns a file descriptor, -1 on error
+ */
+int connect_auth_server() {
+        int sockfd;
+
+        LOCK_CONFIG();
+        sockfd = _connect_auth_server(0);
+        UNLOCK_CONFIG();
+
+        if (sockfd == -1) {
+                debug(LOG_ERR, "Failed to connect to any of the auth servers");
+                mark_auth_offline();
+        }
+        else {
+                debug(LOG_DEBUG, "Connected to auth server");
+                mark_auth_online();
+        }
+        return (sockfd);
+}
+
+/* Helper function called by connect_auth_server() to do the actual work including recursion - do not call directly
+@param level recursion level indicator
+ */
+int _connect_auth_server(int level) {
+        s_config *config = config_get_config();
+        t_auth_serv *auth_server = NULL;
+        struct in_addr *h_addr;
+        int num_servers = 0;
+        char * hostname = NULL;
+        char * popular_servers[] = {
+                  "www.google.com"
+                , "www.yahoo.com"
+                , NULL
+        };
+        char ** popularserver;
+        char * ip;
+        struct sockaddr_in their_addr;
+        int sockfd;
+
+        level++;
+
+        /*
+         * Let's calculate the number of servers we have
+         */
+        for (auth_server = config->auth_servers; auth_server; auth_server = auth_server->next) {
+                num_servers++;
+        }
+        debug(LOG_DEBUG, "Level %d: Calculated %d auth servers in list", level, num_servers);
+
+        if (level > num_servers) {
+                /*
+                 * We've called ourselves too many times
+                 * That means we've cycled through all the servers in the server list at least once and none are accessible
+                 */
+                return (-1);
+        }
+
+        /*
+         * Let's resolve the hostname of the top server to an IP address
+         */
+        auth_server = config->auth_servers;
+        hostname = auth_server->authserv_hostname;
+        debug(LOG_DEBUG, "Level %d: Resolving auth server [%s]", level, hostname);
+        h_addr = wd_gethostbyname(hostname);
+        if (!h_addr) {
+                /*
+                 * DNS resolving it failed
+                 *
+                 * Can we resolve any of the popular servers ?
+                 */
+                debug(LOG_DEBUG, "Level %d: Resolving auth server [%s] failed", level, hostname);
+
+                for (popularserver = popular_servers; *popularserver; popularserver++) {
+                        debug(LOG_DEBUG, "Level %d: Resolving popular server [%s]", level, *popularserver);
+                        h_addr = wd_gethostbyname(*popularserver);
+                        if (h_addr) {
+                                debug(LOG_DEBUG, "Level %d: Resolving popular server [%s] succeeded = [%s]", level, *popularserver, inet_ntoa(*h_addr));
+                                break;
+                        }
+                        else {
+                                debug(LOG_DEBUG, "Level %d: Resolving popular server [%s] failed", level, *popularserver);
+                        }
+                }
+
+                if (h_addr) {
+                        free (h_addr);
+                        /*
+                         * Yes
+                         *
+                         * The server's DNS server is probably dead. Try the next server
+                         */
+                        debug(LOG_DEBUG, "Level %d: Marking auth server [%s] as bad and trying next if possible", level, hostname);
+                        if (auth_server->last_ip) {
+                                free(auth_server->last_ip);
+                                auth_server->last_ip = NULL;
+                        }
+                        mark_auth_server_bad(auth_server);
+                        return _connect_auth_server(level);
+                }
+                else {
+                        /*
+                         * No
+                         *
+                         * It's probably safe to assume that the internet connection is malfunctioning
+                         * and nothing we can do will make it work
+                         */
+                        debug(LOG_DEBUG, "Level %d: Failed to resolve auth server and all popular servers. The internet connection is probably down", level);
+                        return(-1);
+                }
+        }
+        else {
+                /*
+                 * DNS resolving was successful
+                 */
+                ip = strdup(inet_ntoa(*h_addr));
+                debug(LOG_DEBUG, "Level %d: Resolving auth server [%s] succeeded = [%s]", level, hostname, ip);
+
+                if (!auth_server->last_ip || strcmp(auth_server->last_ip, ip) != 0) {
+                        /*
+                         * But the IP address is different from the last one we knew
+                         * Update it
+                         */
+                        debug(LOG_DEBUG, "Level %d: Updating last_ip IP of server [%s] to [%s]", level, hostname, ip);
+                        if (auth_server->last_ip) free(auth_server->last_ip);
+                        auth_server->last_ip = ip;
+
+                        /* Update firewall rules */
+                        fw_clear_authservers();
+                        fw_set_authservers();
+                }
+                else {
+                        /*
+                         * IP is the same as last time
+                         */
+                        free(ip);
+                }
+
+                /*
+                 * Connect to it
+                 */
+                debug(LOG_DEBUG, "Level %d: Connecting to auth server %s:%d", level, hostname, auth_server->authserv_http_port);
+                their_addr.sin_family = AF_INET;
+                their_addr.sin_port = htons(auth_server->authserv_http_port);
+                their_addr.sin_addr = *h_addr;
+                memset(&(their_addr.sin_zero), '\0', sizeof(their_addr.sin_zero));
+                free (h_addr);
+
+                if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
+                        debug(LOG_ERR, "Level %d: Failed to create a new SOCK_STREAM socket: %s", strerror(errno));
+                        return(-1);
+                }
+
+                if (connect(sockfd, (struct sockaddr *)&their_addr, sizeof(struct sockaddr)) == -1) {
+                        /*
+                         * Failed to connect
+                         * Mark the server as bad and try the next one
+                         */
+                        debug(LOG_DEBUG, "Level %d: Failed to connect to auth server %s:%d (%s). Marking it as bad and trying next if possible", level, hostname, auth_server->authserv_http_port, strerror(errno));
+                        close(sockfd);
+                        mark_auth_server_bad(auth_server);
+                        return _connect_auth_server(level);
+                }
+                else {
+                        /*
+                         * We have successfully connected
+                         */
+                        debug(LOG_DEBUG, "Level %d: Successfully connected to auth server %s:%d", level, hostname, auth_server->authserv_http_port);
+                        return sockfd;
+                }
+        }
+}
+
+/* config->authserv_maxtries */

branches/CaptiveDNS/wifidog/src/centralserver.h

@@ -38 +38 @@
-int auth_server_request(t_authresponse *authresponse, char *request_type, char *ip, char *mac, char *token, long int incoming, long int outgoing);
-
+/** @brief Tries really hard to connect to an auth server.  Returns a connected file descriptor or -1 on error */
+int connect_auth_server();
+
+/** @brief Helper function called by connect_auth_server() to do the actual work including recursion - do not call directly */
+int _connect_auth_server(int level);
+
-#endif /* _CENTRALSERVER_H_ */

branches/CaptiveDNS/wifidog/src/conf.c

@@ -759 +759 @@
-        t_auth_serv     *tmp;
-
-        /* lock mutex so two different threads both don't mark the same
-         * server as bad */
-        pthread_mutex_lock(&config_mutex);
-
-        if (config.auth_servers == bad_server && bad_server->next != NULL) {
-                /* Go to the last */
@@ -774 +770 @@
-        }
-
-
-
-
-
-
-
-
+

branches/CaptiveDNS/wifidog/src/fw_iptables.c

@@ -160 +160 @@
-    config = config_get_config();
-    
-    LOCK_CONFIG();
-    
-    for (auth_server = config->auth_servers; auth_server != NULL; auth_server = auth_server->next) {
-
-
-
+
-                iptables_do_command("-t nat -A " TABLE_WIFIDOG_AUTHSERVERS " -d %s -j ACCEPT", auth_server->last_ip);
-            }
-    }
-
-    UNLOCK_CONFIG();
-}
-

branches/CaptiveDNS/wifidog/src/http.c

@@ -77 +77 @@
-        
-        if (!is_online()) {
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-                httpdOutput(r, "We apologize, but it seems that we are currently unable to re-direct you to the login screen.");
-                httpdOutput(r, "<p>");
-                httpdOutput(r, "The maintainers of this network are aware of this disruption.  We hope that this situation will be resolved soon.");
-                httpdOutput(r, "<p>");
-while please <a href='%s'>click here</a> to try
+couple of minutes please <a href='%s'>click here</a> to try your request
-                httpdOutput(r, "</body></html>");
-I am
+auth server
-        }
-        else if ((asprintf(&newlocation, "Location: %s://%s:%d%slogin?"
@@ -115 +127 @@
-                                config->gw_id,
-                                url);
-
-
+
-                free(newlocation);
-        }

branches/CaptiveDNS/wifidog/src/ping_thread.c

@@ -92 +92 @@
-        size_t                  numbytes,
-                                totalbytes;
-
-
-
-
-
-
-
-
-
+
+
-        fd_set                  readfds;
-        struct timeval          timeout;
@@ -106 +99 @@
-        debug(LOG_DEBUG, "Entering ping()");
-        
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
-                return;
-        }
-
-        if (auth_server->last_ip == NULL) {
-                auth_server->last_ip = strdup(inet_ntoa(*h_addr));
-                if (auth_server->last_ip == NULL) {
-                        debug(LOG_CRIT, "Could not allocate memory, Banzai!");
-                        exit(-1);
-                }
-        } else {
-                tmp_addr = strdup(inet_ntoa(*h_addr));
-                if (strcmp(auth_server->last_ip, tmp_addr) != 0) {
-                        free(auth_server->last_ip);
-                        auth_server->last_ip = tmp_addr;
-                        fw_clear_authservers();
-                        fw_set_authservers();
-                } else {
-                        free(tmp_addr);
-                }
-        }
-
-        their_addr.sin_family = AF_INET;
-        their_addr.sin_port = htons(auth_server->authserv_http_port);
-        their_addr.sin_addr = *h_addr;
-        memset(&(their_addr.sin_zero), '\0', sizeof(their_addr.sin_zero));
-
-        debug(LOG_INFO, "Connecting to auth server %s on port %d", 
-                        auth_server->authserv_hostname, 
-                        auth_server->authserv_http_port);
-
-        if (connect(sockfd, (struct sockaddr *)&their_addr,
-                                sizeof(struct sockaddr)) == -1) {
-                debug(LOG_ERR, "connect(): %s", strerror(errno));
-                debug(LOG_ERR, "Bumping auth server to last in line.");
-                mark_auth_server_bad(auth_server);
-                close(sockfd);
-                free(h_addr);
-                return;
-        }
-        free(h_addr);
-                
-        mark_online();
-
-        snprintf(request, sizeof(request) - 1, "GET %sping/?gw_id=%s HTTP/1.0\n"
@@ -171 +111 @@
-                        "Host: %s\n"
-                        "\n",
-auth_server
+config_get_config()->auth_servers
-                        config_get_config()->gw_id,
-                        VERSION,
-auth_server
+config_get_config()->auth_servers
-
-        debug(LOG_DEBUG, "HTTP Request to Server: [%s]", request);
@@ -199 +139 @@
-                                        MAX_BUF - (totalbytes + 1));
-                        if (numbytes < 0) {
-read()
-mark_auth_server_bad(auth_server);
+An error occurred while reading from auth server
+/* FIXME */
-                                close(sockfd);
-                                return;
-
+
+
-                                done = 1;
-
+
+
-                                totalbytes += numbytes;
-
-
+
-                        }
-
-
-
+
+
+
+
-                        close(sockfd);
-                        return;
-
-
-
+
+
+
+
-                        close(sockfd);
-                        return;
-                }
-        } while (!done);
+        close(sockfd);
-
-        debug(LOG_DEBUG, "Done reading reply, total %d bytes", totalbytes);
-
-
-
-
-
-
+
-
-        debug(LOG_DEBUG, "HTTP Response from Server: [%s]", request);
-        
-
-
-
-
-
+
+
+
-        }
-
-
+
+
+
+
-        return; 
-}

branches/CaptiveDNS/wifidog/src/util.c

@@ -55 +55 @@
-static time_t last_online_time = 0;
-static time_t last_offline_time = 0;
+static time_t last_auth_online_time = 0;
+static time_t last_auth_offline_time = 0;
-
-/** Fork a child and execute a shell command, the parent
@@ -112 +114 @@
-        if (he == NULL) {
-                free(h_addr);
+                UNLOCK_GHBN();
-                mark_offline();
-                UNLOCK_GHBN();
-                return NULL;
-        }
@@ -156 +158 @@
-
-void mark_online() {
+        int isonline;
+        isonline = is_online();
-        time(&last_online_time);
+        if (!isonline) {
+                debug(LOG_INFO, "ONLINE status changed to ON");
+        }
-}
-
-void mark_offline() {
+        int isonline;
+        isonline = is_online();
-        time(&last_offline_time);
+        /* If we're offline it definately means the auth server is offline */
+        mark_auth_offline();
+        if (isonline) {
+                debug(LOG_INFO, "ONLINE status changed to OFF");
+        }
-}
-
@@ -174 +188 @@
-}
-
+void mark_auth_online() {
+        int isauthonline;
+        isauthonline = is_auth_online();
+        time(&last_auth_online_time);
+        /* If auth server is online it means we're definately online */
+        mark_online();
+        if (!isauthonline) {
+                debug(LOG_INFO, "AUTH_ONLINE status changed to ON");
+        }
+}
+
+void mark_auth_offline() {
+        int isauthonline;
+        isauthonline = is_auth_online();
+        time(&last_auth_offline_time);
+        if (isauthonline) {
+                debug(LOG_INFO, "AUTH_ONLINE status changed to OFF");
+        }
+}
+
+int is_auth_online() {
+        if (!is_online()) {
+                /* If we're not online auth is definately not online :) */
+                return (0);
+        }
+        else if (last_auth_online_time == 0 || (last_auth_offline_time - last_auth_online_time) >= (config_get_config()->checkinterval * 2) ) {
+                /* Auth is  probably offline */
+                return (0);
+        }
+        else {
+                /* Auth is probably online */
+                return (1);
+        }
+}
+

branches/CaptiveDNS/wifidog/src/util.h

@@ -43 +43 @@
-int is_online();
-
+/* @brief Sets hint that an auth server online action succeeded */
+void mark_auth_online();
+/* @brief Sets hint that an auth server online action failed */
+void mark_auth_offline();
+/* @brief Returns a guess (true or false) on whether we're an auth server is online or not based on previous calls to mark_auth_online and mark_auth_offline */
+int is_auth_online();
+
-#define LOCK_GHBN() do { \
-        debug(LOG_DEBUG, "Locking wd_gethostbyname()"); \

branches/CaptiveDNS/wifidog/src/wdctl_thread.c

@@ -263 +263 @@
-    UNLOCK_CONFIG();
-        
+        snprintf((buffer + len), (sizeof(buffer) - len), "\nis_online: %s\n", (is_online() ? "yes" : "no"));
+        len = strlen(buffer);
+        
+        snprintf((buffer + len), (sizeof(buffer) - len), "is_auth_online: %s\n", (is_auth_online() ? "yes" : "no"));
+        len = strlen(buffer);
+
-        write(fd, buffer, len);
-}