Changeset 492

Timestamp:

03/11/05 11:15:06 (8 years ago)

Author:

minaguib

Message:

* If external interface was unspecified in the conf file, try to determine it from the default route
* If external interface is known, specify it in the trigger rule in nat.PREROUTING to prevent the rule from matching traffic inbound to the router itself. This should fix the issue raised by Philippe and Pascal on the mailing list

Location:

trunk/wifidog

Files:

• ChangeLog (modified) (1 diff)
• src/fw_iptables.c (modified) (4 diffs)
• src/gateway.c (modified) (1 diff)
• src/util.c (modified) (2 diffs)
• src/util.h (modified) (1 diff)

trunk/wifidog/ChangeLog

@@ -1 +1 @@
 # $Header$
+
+2005-03-11 Mina Naguib <mina@ilesansfil.org>
+        * If external interface was unspecified in the conf file, try to determine
+        it from the default route
+        * If external interface is known, specify it in the trigger rule in
+        nat.PREROUTING to prevent the rule from matching traffic inbound to the
+        router itself.  This should fix the issue raised by Philippe and Pascal on
+        the mailing list
 
 2005-03-07 Mina Naguib <mina@ilesansfil.org>

trunk/wifidog/src/fw_iptables.c

@@ -183 +183 @@
     s_config *config;
          char * gw_interface = NULL;
+         char * external_interface = NULL;
          int gw_port = 0;
    
@@ -191 +192 @@
          gw_interface = safe_strdup(config->gw_interface);
          gw_port = config->gw_port;
+         if (config->external_interface)
+                 external_interface = safe_strdup(config->external_interface);
          UNLOCK_CONFIG();
     
@@ -219 +222 @@
 
                         /* Assign links and rules to these new chains */
-                        iptables_do_command("-t nat -I PREROUTING 1 -i %s -j " TABLE_WIFIDOG_WIFI_TO_INTERNET, gw_interface);
+                        if (external_interface)
+                                iptables_do_command("-t nat -I PREROUTING 1 -i %s -o %s -j " TABLE_WIFIDOG_WIFI_TO_INTERNET, gw_interface, external_interface);
+                        else
+                                iptables_do_command("-t nat -I PREROUTING 1 -i %s -j " TABLE_WIFIDOG_WIFI_TO_INTERNET, gw_interface);
                         iptables_do_command("-t nat -A " TABLE_WIFIDOG_WIFI_TO_INTERNET " -m mark --mark 0x%u -j RETURN", FW_MARK_KNOWN);
                         iptables_do_command("-t nat -A " TABLE_WIFIDOG_WIFI_TO_INTERNET " -m mark --mark 0x%u -j RETURN", FW_MARK_PROBATION);
@@ -264 +270 @@
 
         free(gw_interface);
+        if (external_interface)
+                free(external_interface);
 
     return 1;

trunk/wifidog/src/gateway.c

@@ -179 +179 @@
         debug(LOG_DEBUG, "%s = %s", config->gw_interface, config->gw_address);
     }
+         /* If we don't have the external interface, try to get it */
+         if (!config->external_interface) {
+                 config->external_interface = get_default_iface();
+                 if (!config->external_interface) {
+                         debug(LOG_CRIT, "Failed to determine external interface.  The firewall rules will not be up to par");
+                 }
+         }
+
 
         /* Initializes the web server */

trunk/wifidog/src/util.c

@@ -49 +49 @@
 #include <netdb.h>
 
+#include "common.h"
 #include "client_list.h"
 #include "safe.h"
@@ -137 +138 @@
 }
 
+/*
+ * @return Interface name or NULL if it cannot be determined - must be free()ed by caller when no longer needed
+ */
+char * get_default_iface() {
+        FILE * fh;
+        char * retval = NULL;
+        char buffer[MAX_BUF];
+        char ifname[MAX_BUF];
+        char mask[MAX_BUF];
+        debug(LOG_INFO, "Trying to determine the default interface");
+
+        if ((fh = fopen("/proc/net/route", "r"))) {
+                while (!feof(fh) && fgets(buffer, sizeof(buffer), fh)) {
+                        if (sscanf(buffer, "%s %s", ifname, mask) == 2 && strcmp(mask, "00000000") == 0) {
+                                /* Found it */
+                                retval = safe_strdup(ifname);
+                                debug(LOG_INFO, "Determined default interface [%s]", retval);
+                                break;
+                        }
+                }
+                fclose(fh);
+        }
+        else {
+                debug(LOG_ERR, "Failed to open /proc/net/route");
+        }
+
+        if (!retval)
+                debug(LOG_ERR, "Failed to determine default interface");
+
+        return retval;
+}
+
 char *get_iface_ip(char *ifname) {
 #ifdef __linux__

trunk/wifidog/src/util.h

@@ -38 +38 @@
 char *get_iface_ip(char *ifname);
 
+/* @Brief get the interface name used by the default route */
+char * get_default_iface();
+
 /* @brief Sets hint that an online action (dns/connect/etc using WAN) succeeded */
 void mark_online();