Changeset 95

Timestamp:

04/22/04 19:35:32 (9 years ago)

Author:

aprilp

Message:

Added debugging, changed way firewall tags traffic, cleanups

Location:

trunk/wifidog

Files:

• ChangeLog (modified) (1 diff)
• configure.in (modified) (1 diff)
• src/Makefile.am (modified) (2 diffs)
• src/auth.c (modified) (6 diffs)
• src/auth.h (modified) (1 diff)
• src/centralserver.c (modified) (3 diffs)
• src/centralserver.h (modified) (1 diff)
• src/common.h (modified) (2 diffs)
• src/conf.c (modified) (5 diffs)
• src/conf.h (modified) (2 diffs)
• src/debug.c (modified) (2 diffs)
• src/debug.h (modified) (1 diff)
• src/firewall.c (modified) (18 diffs)
• src/firewall.h (modified) (3 diffs)
• src/fw.access (modified) (2 diffs)
• src/fw.destroy (modified) (3 diffs)
• src/fw.init (modified) (1 diff)
• src/gateway.c (modified) (3 diffs)
• src/http.c (modified) (3 diffs)

trunk/wifidog/ChangeLog

@@ -1 +1 @@
 # $Header$
+2004-04-22  Philippe April <papril777@yahoo.com>
+    * Major changes, cleaned up code
+    * Changed the way firewall tags traffic
 
 2004-04-21  Philippe April <papril777@yahoo.com>

trunk/wifidog/configure.in

@@ -18 +18 @@
 
 WIFIDOG_MAJOR_VERSION=0
-WIFIDOG_MINOR_VERSION=1
+WIFIDOG_MINOR_VERSION=2
 WIFIDOG_MICRO_VERSION=0
 WIFIDOG_VERSION=$WIFIDOG_MAJOR_VERSION.$WIFIDOG_MINOR_VERSION.$WIFIDOG_MICRO_VERSION

trunk/wifidog/src/Makefile.am

@@ -19 +19 @@
         centralserver.c \
         http.c \
-        auth.c \
-        userclasses.c
+        auth.c
 
 noinst_HEADERS = commandline.h \
@@ -30 +29 @@
         centralserver.h \
         http.h \
-        auth.h \
-        userclasses.h
+        auth.h
 

trunk/wifidog/src/auth.c

@@ -63 +63 @@
 {
         t_node  *node;
-        int     profile;
-        UserClasses     *tmp_uc;
-        UserRights      *tmp_ur;
+        t_authresponse  auth_response;
         char    *ip,
                 *mac,
                 *token;
+    t_node *p1;
 
         ip = (char *)ptr;
@@ -86 +85 @@
         pthread_mutex_unlock(&nodes_mutex);
                 
-        profile = authenticate(ip, mac, token, 0);
+        authenticate(&auth_response, ip, mac, token, 0);
         
         pthread_mutex_lock(&nodes_mutex);
@@ -103 +102 @@
         }
 
-        if (profile == -1) {
+        if (auth_response.authcode == AUTH_ERROR) {
                 // Error talking to central server
                 debug(LOG_ERR, "Got %d from central server authenticating "
-                        "token %s from %s at %s", profile, node->token,
+                        "token %s from %s at %s", auth_response, node->token,
                         node->ip, node->mac);
                 _http_output(node->fd, "Access denied: We did not get a valid "
@@ -113 +112 @@
                 pthread_mutex_unlock(&nodes_mutex);
                 return;
-        } else if (profile == 0) {
+        } else if (auth_response.authcode == AUTH_DENIED) {
                 // Central server said invalid token
-                _http_output(node->fd, "Your authentication has failed or "
-                        "timed-out.  Please re-login");
+                _http_output(node->fd, "Access denied");
                 node->fd = 0;
                 pthread_mutex_unlock(&nodes_mutex);
@@ -124 +122 @@
         /* If we get here, we've got a profile > 0 */
         
-        debug(LOG_INFO, "Node %s with mac %s and profile "
-                "%d validated", node->ip, node->mac, profile);
+        debug(LOG_INFO, "Node %s with mac %s "
+                "validated", node->ip, node->mac);
         
-        tmp_uc = find_userclasses(profile);
-        
-        if (tmp_uc == NULL) {
-                debug(LOG_WARNING, "Profile %d undefined", profile);
-                _http_output(node->fd, "User Class not defined");
-                node->fd = 0;
-                pthread_mutex_unlock(&nodes_mutex);
-                return;
-        } else {
-                debug(LOG_INFO, "Profile %d UserClasses retrieved", profile);
-        }
-        
-        if (tmp_uc->active) {
-                /* Profile is active */
+    p1 = node_find_by_ip(node->ip);
+    p1->noactivity = time(NULL);
+    switch(auth_response.authcode) {
+        case AUTH_VALIDATION:
+            p1->tag = MARK_VALIDATION;
+                fw_allow(node->ip, node->mac, MARK_VALIDATION);
+                _http_output(node->fd, "You have 15 minutes to activate your account, hurry up!");
+            break;
+        case AUTH_ALLOWED:
+            p1->tag = MARK_KNOWN;
+                fw_allow(node->ip, node->mac, MARK_KNOWN);
+                _http_redirect(node->fd, "http://%s/wifidog/portal.php?gw_id=%s", config.authserv_hostname, config.gw_id);
+            break;
+        case AUTH_VALIDATION_FAILED:
+                _http_output(node->fd, "You have failed to validate your account in 15 minutes");
+            break;
+        case AUTH_DENIED:
+                _http_output(node->fd, "Authentication failure");
+            break;
+        default:
+                _http_output(node->fd, "Internal error");
+            debug(LOG_WARNING, "I don't know what the validation code %d means", auth_response.authcode);
+            break;
+    }
                 
-                tmp_ur = new_userrights();
-                tmp_ur->profile = profile;
-                tmp_ur->start_time = time(NULL);
-                tmp_ur->last_checked = time(NULL);
-                tmp_ur->end_time = tmp_ur->start_time + (time_t)tmp_uc->timeout;
-                
-                fw_allow(node->ip, node->mac, profile);
-                
-                node->active = 1;
-                node->rights = tmp_ur;
-                
-                _http_output(node->fd, "You are now good to go");
-        } else {
-                _http_output(node->fd, "User Class inactive");
-        }
+        //_http_output(node->fd, "You are now good to go");
+        //_http_redirect(node->fd, "http://%s/wifidog/portal.php?gw_id=%s", config.authserv_hostname, config.gw_id);
         
         node->fd = 0;
@@ -168 +163 @@
 _http_output(int fd, char *msg)
 {
-        char response[] = "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-"
-                          "Type: text/html\r\n\r\n";
+        char header[] = "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-"
+                          "Type: text/html\r\n\r\n<html><body>";
+        char footer[] = "</body></html>";
         
-        send(fd, response, sizeof(response), 0);
+        send(fd, header, sizeof(header), 0);
         send(fd, msg, strlen(msg), 0);
+        send(fd, footer, sizeof(footer), 0);
         shutdown(fd, 2);
         close(fd);
 }
+
+void
+_http_redirect(int fd, char *format, ...)
+{
+        char *response, *url;
+    va_list vlist;
+    
+    va_start(vlist, format);
+
+    vasprintf(&url, format, vlist);
+
+    asprintf(&response, "HTTP/1.1 307 Please authenticate yourself here\r\nLocation: %s\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<html><head>Redirection</head><body>Please <a href='%s'>Click here</a> if you're not redirected.", url, url);
+
+        send(fd, response, strlen(response), 0);
+        shutdown(fd, 2);
+        close(fd);
+
+    free(response);
+    free(url);
+}
+

trunk/wifidog/src/auth.h

@@ -29 +29 @@
 #define _AUTH_H_
 
+typedef enum {
+    AUTH_ERROR = -1,
+    AUTH_DENIED = 0,
+    AUTH_ALLOWED = 1,
+    AUTH_VALIDATION = 5,
+    AUTH_VALIDATION_FAILED = 6,
+    AUTH_LOCKED = 254,
+} t_authcode;
+
+typedef struct _t_authresponse {
+    int authcode;
+} t_authresponse;
+
 void auth_thread(void *ptr);
 void cleanup_thread(void *ptr);
+void _http_redirect(int fd, char *format, ...);
 
 #endif

trunk/wifidog/src/centralserver.c

@@ -31 +31 @@
 
 int
-authenticate(char *ip, char *mac, char *token, long int stats)
+authenticate(t_authresponse *authresponse, char *ip, char *mac, char *token, long int stats)
 {
         int sockfd, numbytes;
@@ -37 +37 @@
         struct hostent *he;
         struct sockaddr_in their_addr;
-        int profile;
         char *p1;
 
@@ -80 +79 @@
         close(sockfd);
 
-        if ((p1 = strstr(buf, "Profile: "))) {
-                if (sscanf(p1, "Profile: %d", &profile) == 1) {
-                        debug(LOG_INFO, "Auth server returned profile %d",
-                                profile);
-                        return(profile);
+        if ((p1 = strstr(buf, "Auth: "))) {
+                if (sscanf(p1, "Auth: %d", &authresponse->authcode) == 1) {
+                        debug(LOG_INFO, "Auth server returned response %d",
+                                authresponse->authcode);
+                        return(authresponse->authcode);
                 } else {
                         debug(LOG_WARNING, "Auth server did not return "
                                 "expected information");
-                        return(-1);
+                        return(AUTH_ERROR);
                 }
         } else {
-                return(-1);
+                return(AUTH_ERROR);
         }
 
-        return(-1);
+        return(AUTH_ERROR);
 }
 

trunk/wifidog/src/centralserver.h

@@ -28 +28 @@
 #define _CENTRALSERVER_H_
 
-int authenticate(char *ip, char *mac, char *token, long int stats);
+int authenticate(t_authresponse *authresponse, char *ip, char *mac, char *token, long int stats);
 
 #endif /* _CENTRALSERVER_H_ */

trunk/wifidog/src/common.h

@@ -29 +29 @@
 #define _COMMON_H_
 
+#define _GNU_SOURCE
 #include <stdio.h>
 #include <stdlib.h>
@@ -56 +57 @@
 #include "commandline.h"
 #include "debug.h"
-#include "userclasses.h"
 #include "firewall.h"
 #include "http.h"
+#include "auth.h"
 #include "centralserver.h"
-#include "auth.h"
 
 #define MAX_BUF 4096

trunk/wifidog/src/conf.c

@@ -63 +63 @@
         oFWScriptsPath,
         oFWType,
-        oUserClass,
     oSyslogFacility,
 } OpCodes;
@@ -88 +87 @@
         { "fwscriptspath",      oFWScriptsPath },
         { "fwtype",             oFWType },
-        { "userclass",                  oUserClass },
         { "syslogfacility",     oSyslogFacility },
         { NULL,                 oBadOption },
@@ -114 +112 @@
         config.fwscripts_path = DEFAULT_FWSCRIPTS_PATH;
         config.fwtype = DEFAULT_FWTYPE;
-        config.userclasses = (char **)malloc(sizeof(char *) * 256);
-        memset(config.userclasses, 0, sizeof(char *) * 256);
         config.syslog_facility = DEFAULT_SYSLOG_FACILITY;
     config.daemon = -1;
@@ -197 +193 @@
 
                                 switch(opcode) {
-                                case oUserClass:
-                                        add_userclass((int)strtol(p1, NULL, 10),
-                                                        ++p2);
-                                        break;
                                 case oDaemon:
                                         if (config.daemon == -1 && ((value = parse_value(p1)) != -1)) {
@@ -288 +280 @@
         buf = strdup(ptr);
         return buf;
-}
-
-char *
-add_userclass(int profile, char *ptr)
-{
-        char *tmp_str;
-
-        if (profile > 255 || profile < 0)
-                return NULL;
-
-        if (*(config.userclasses + profile) != NULL)
-                free(*(config.userclasses + profile));
-
-        tmp_str = strdup(ptr);
-
-        *(config.userclasses + profile) = tmp_str;
-
-        return tmp_str;
 }
 

trunk/wifidog/src/conf.h

@@ -35 +35 @@
 int parse_value(char *);
 char *get_string(char *ptr);
-char *add_userclass(int profile, char *ptr);
 
 typedef struct {
@@ -55 +54 @@
     char *fwscripts_path;
     char *fwtype;
-    char **userclasses;
     int log_syslog;
     int syslog_facility;

trunk/wifidog/src/debug.c

@@ -26 +26 @@
 */
 
-#define SYSLOG_NAMES
 #include "common.h"
 
 extern s_config config;
-//extern CODE prioritynames[];
 
 void
-debug(int level, char *format, ...)
+_debug(char *filename, int line, int level, char *format, ...)
 {
-    int i;
     va_list vlist;
 
@@ -42 +39 @@
 
         if (level <= LOG_WARNING) {
-            fprintf(stderr, "[debug %d] ", level);
+            fprintf(stderr, "[%d](%s:%d) ", level, filename, line);
             vfprintf(stderr, format, vlist);
             fputc('\n', stderr);
             fflush(stderr);
         } else if (!config.daemon) {
-            fprintf(stdout, "[debug %d] ", level);
+            fprintf(stdout, "[%d](%s:%d) ", level, filename, line);
             vfprintf(stdout, format, vlist);
             fputc('\n', stdout);

trunk/wifidog/src/debug.h

@@ -28 +28 @@
 #define _DEBUG_H_
 
-void debug(int level, char *format, ...);
+#define debug(level, format...) _debug(__FILE__, __LINE__, level, format)
+void _debug(char *filename, int line, int level, char *format, ...);
 
 #endif /* _DEBUG_H_ */

trunk/wifidog/src/firewall.c

@@ -37 +37 @@
  * @brief Allow a user through the firewall
  *
- * Add a rule in the firewall to tag the user's packets with its profile
- * number by providing his IP and MAC address. This is done by
+ * Add a rule in the firewall to MARK the user's packets with the proper
+ * rule by providing his IP and MAC address. This is done by
  * executing the firewall script "fw.access" like this:
- * fw.access allow <ip> <mac> <profile>
+ * fw.access allow <ip> <mac> <tag>
+ * @param ip IP address to allow
+ * @param mac MAC address to allow
+ * @tag tag Tag
+ * @return Return code of the command
  */
 int
-fw_allow(char *ip, char *mac, int profile)
-{
-        char s_profile[16];
+fw_allow(char *ip, char *mac, int tag)
+{
+        char s_tag[16];
         char script[MAX_BUF];
         struct stat st;
-        char *command[] = {script, "allow", ip, mac, s_profile, NULL};
-
-        sprintf(s_profile, "%-10d", profile);
+        char *command[] = {script, "allow", ip, mac, s_tag, NULL};
+
+    debug(LOG_DEBUG, "Allowing ip %s mac %s with MARK %s", ip, mac, s_tag);
+
+        sprintf(s_tag, "%-10d", tag);
         sprintf(script, "%s/%s/%s", config.fwscripts_path, config.fwtype, 
                 SCRIPT_FWACCESS);
@@ -69 +75 @@
  * by executing the firewall script "fw.access" this way:
  * fw.access deny <ip> <mac> <profile>
+ * @param ip IP address to deny
+ * @param mac MAC address to deny
+ * @tag tag Tag
+ * @return Return code of the command
  */
 int
-fw_deny(char *ip, char *mac, int profile)
-{
-        char s_profile[16];
+fw_deny(char *ip, char *mac, int tag)
+{
+        char s_tag[16];
         char script[MAX_BUF];
         struct stat st;
-        char *command[] = {script, "deny", ip, mac, s_profile, NULL};
-
-        sprintf(s_profile, "%-10d", profile);
+        char *command[] = {script, "deny", ip, mac, s_tag, NULL};
+
+    debug(LOG_DEBUG, "Denying ip %s mac %s with MARK %s", ip, mac, s_tag);
+
+        sprintf(s_tag, "%-10d", tag);
         sprintf(script, "%s/%s/%s", config.fwscripts_path, config.fwtype,
                 SCRIPT_FWACCESS);
@@ -96 +108 @@
  * process waits for the child to return and returns the child's exit()
  * value.
+ * @return Return code of the command
  */
 int
@@ -126 +139 @@
  * Go through all the entries in /proc/net/arp until we find the requested
  * IP address and return the MAC address bound to it.
- */
-/* TODO Make this function portable... Use shell scripts? */
+ * @todo Make this function portable (using shell scripts?)
+ */
 char *
 arp_get(char *req_ip)
@@ -159 +172 @@
  * Initialize the firewall rules by executing the 'fw.init' script:
  * fw.init <gw_interface> <gw_address> <port> <authserv_hostname>
+ * @return Return code of the fw.init script
  */
 int
@@ -196 +210 @@
  * Remove the firewall rules by executing the 'fw.destroy' script.
  * This is used when we do a clean shutdown of WiFiDog.
+ * @return Return code of the fw.destroy script
  */
 int
@@ -218 +233 @@
 }
 
+/**
+ * @todo Make this function smaller and use sub-fonctions
+ */
 void
 fw_counter(void)
@@ -223 +241 @@
         FILE    *output;
         long    int     counter;
-        int     profile,
+    t_authresponse authresponse;
+        int     tag,
                 rc;
         char    ip[255],
@@ -239 +258 @@
                 while (!(feof(output)) && output) {
                         rc = fscanf(output, "%ld %s %s %d", &counter, ip, 
-                                        mac, &profile);
+                                        mac, &tag);
                         if (rc == 4 && rc != EOF) {
 
@@ -245 +264 @@
 
                                 p1 = node_find_by_ip(ip);
-                                
-                                if (!(p1) || (p1->rights->last_checked +
-                                        (config.checkinterval *
-                                         config.clienttimeout)) > time(NULL)) {
-                                        /* Do nothing */
-                                } else if (p1->counter == counter) {
-                                        /* expire clients for inactivity */
-                                        debug(LOG_INFO, "Client %s was "
-                                                "inactive", ip);
-                                        fw_deny(p1->ip, p1->mac,
-                                                p1->rights->profile);
-                                        node_delete(p1);
-                                } else if (!(p1->active)) {
-                                        p1->rights->last_checked = time(NULL);
-                                        p1->counter = counter;
-                                        
+
+                if (p1) {
                                         token = strdup(p1->token);
-                                        
+
                                         pthread_mutex_unlock(&nodes_mutex);
-
-                                        profile = authenticate(ip, mac, token,
-                                                                counter);
-                                        
+                                        authenticate(&authresponse, ip, mac, token, counter);
                                         pthread_mutex_lock(&nodes_mutex);
 
                                         free(token);
-                                        
-                                        /* may have changed while we held the
-                                         * mutex */
+
                                         p1 = node_find_by_ip(ip);
-
                                         if (p1 == NULL) {       
                                                 debug(LOG_DEBUG, "Node was "
                                                         "freed while being "
                                                         "re-validated!");
-                                        } else if (profile <= 0) {
-                                                /* failed */
-                                                debug(LOG_NOTICE, "Auth "
-                                                        "failed for client %s",
-                                                        ip);
-                                                fw_deny(p1->ip, p1->mac,
-                                                        p1->rights->profile);
-                                                node_delete(p1);
-                                        } else {
-                                                /* successful */
-                                                debug(LOG_INFO, "Updated "
-                                                        "client %s counter to "
-                                                        "%ld bytes", ip,
-                                                        counter);
-
-                                                if (!check_userrights(p1)) {
-                                                        fw_deny(p1->ip, p1->mac,
-                                                           p1->rights->profile);
-                                                        node_delete(p1);
-                                                }
-                                        }
-                                }
+                    }
+
+                    debug(LOG_INFO, "User %s counter currently %d, new counter %d", p1->ip, p1->counter, counter);
+                    if (counter > p1->counter) {
+                        p1->counter = counter;
+                                                    debug(LOG_INFO, "Updated "
+                                                "client %s counter to "
+                                                "%ld bytes", ip,
+                                                counter);
+                        p1->noactivity = time(NULL);
+                    } else {
+                                        debug(LOG_INFO, "No activity recorded %s", p1->ip);
+                    }
+                    if (p1->noactivity +
+                       (config.checkinterval * config.clienttimeout)
+                       <= time(NULL)) {
+                        /* Timing out user */
+                                debug(LOG_INFO, "Client %s was inactive for %d seconds, removing node and denying in firewall", ip,
+                            config.checkinterval * config.clienttimeout);
+                                fw_deny(p1->ip, p1->mac, p1->tag);
+                                node_delete(p1);
+                            } else {
+                        /* This handles any change in the status
+                         * this allows us to change the status of a
+                         * user while he's connected */
+                        switch(authresponse.authcode) {
+                            case AUTH_DENIED:
+                            case AUTH_VALIDATION_FAILED:
+                                                    debug(LOG_NOTICE, "Client %s now denied, removing node", ip);
+                                                        fw_deny(p1->ip, p1->mac, p1->tag);
+                                                        node_delete(p1);
+                                break;
+                            case AUTH_ALLOWED:
+                                if (p1->tag != MARK_KNOWN) {
+                                    debug(LOG_INFO, "Access has changed, refreshing firewall and clearing counters");
+                                    fw_deny(p1->ip, p1->mac, p1->tag);
+                                    p1->tag = MARK_KNOWN;
+                                    p1->counter = 0;
+                                    fw_allow(p1->ip, p1->mac, p1->tag);
+                                }
+                                break;
+                            case AUTH_VALIDATION:
+                                /* Do nothing, user is in validation period */
+                                break;
+                            default:
+                                debug(LOG_DEBUG, "I do not know about type %d", authresponse.authcode);
+                                break;
+                        }
+                    }
+                }
+                                
                                 pthread_mutex_unlock(&nodes_mutex);
                         }
@@ -311 +339 @@
 /**
  * @brief Initializes the list of connected clients (node)
+ *
+ * Initializes the list of connected clients (node)
  */
 void
 node_init(void)
 {
-
         firstnode = NULL;
 }
@@ -324 +353 @@
  * Based on the parameters it receives, this function creates a new entry
  * in the connections list. All the memory allocation is done here.
+ * @param ip IP address
+ * @param mac MAC address
+ * @param token Token
+ * @param counter Value of the counter at creation (usually 0)
+ * @param active Is the node active, or not
+ * @return Pointer to the node we just created
  */
 t_node *
@@ -367 +402 @@
 
 /**
- * @brief Finds a specific node by its IP
+ * @brief Finds a node by its IP
+ *
+ * Finds a  node by its IP, returns NULL if the node could not
+ * be found
+ * @param ip IP we are looking for in the linked list
+ * @return Pointer to the node, or NULL if not found
  */
 t_node *
@@ -385 +425 @@
 
 /**
- * @brief Finds a specific node by its token
+ * @brief Finds a node by its token
+ *
+ * Finds a node by its token
+ * @param token Token we are looking for in the linked list
+ * @return Pointer to the node, or NULL if not found
  */
 t_node *
@@ -406 +450 @@
  *
  * This function frees the memory used by the t_node structure in the
- * proper order. It also calls the free_userrights() function to free
- * the memory used by the rights structure for the node.
+ * proper order.
+ * @param node Points to the node to be freed
  */
 void
@@ -422 +466 @@
                 free(node->token);
 
-        if (node->rights != NULL)
-                free_userrights(node->rights);
-
         free(node);
 }
@@ -433 +474 @@
  * Removes the specified node from the connections list and then calls
  * the function to free the memory used by the node.
+ * @param node Points to the node to be deleted
  */
 void
@@ -454 +496 @@
 }
 
-/**
- * @brief Check the rights for a client
- *
- * This function validates that a client hasn't met one of the conditions
- * for the termination of his connection. Right now, we only check to see
- * for a time-out. More checks could be added here.
- */
-int
-check_userrights(t_node *node)
-{
-        if (node->rights->end_time <= time(NULL)) {
-                debug(LOG_INFO, "Connection %s has expired", node->ip);
-                return 0;
-        }
-
-        return 1;
-}
-

trunk/wifidog/src/firewall.h

@@ -28 +28 @@
 #define _FIREWALL_H_
 
+typedef enum _t_marks {
+    MARK_VALIDATION = 1,
+    MARK_KNOWN = 2,
+    MARK_LOCKED = 254,
+} t_marks;
+
 typedef struct _t_node {
         struct  _t_node *next;
@@ -34 +40 @@
                 *token;
         int     active, /* boolean */
+        noactivity, /* seconds since there has not been activity */
+        tag, /* the MARK in the firewall */
                 fd;     /* socket */
         long    int     counter;
-        UserRights      *rights;
 } t_node;
 
@@ -55 +62 @@
 void free_node(t_node *node);
 
-int check_userrights(t_node *node);
-
 #endif /* _FIREWALL_H_ */

trunk/wifidog/src/fw.access

@@ -29 +29 @@
 
 if [ ! $4 ]; then
-    echo "Usage: $0 <allow|deny> <ip> <mac> <profile>"
+    echo "Usage: $0 <allow|deny> <ip> <mac> <tag>"
     echo
     exit 1
@@ -44 +44 @@
 
     *)
-        echo "Usage: $0 <allow|deny> <ip> <mac> <profile>"
+        echo "Usage: $0 <allow|deny> <ip> <mac> <tag>"
         echo
         exit

trunk/wifidog/src/fw.destroy

@@ -29 +29 @@
 GW_INTERFACE=$1
 
-${IPTABLES} -t nat -F wifidog_p1
-${IPTABLES} -t nat -F wifidog_p2
-${IPTABLES} -t nat -F wifidog_p3
-${IPTABLES} -t nat -F wifidog_p4
-${IPTABLES} -t nat -F wifidog_p5
-${IPTABLES} -t nat -F wifidog_class
-${IPTABLES} -t mangle -F wifidog_mark
-${IPTABLES} -t nat -X wifidog_p1
-${IPTABLES} -t nat -X wifidog_p2
-${IPTABLES} -t nat -X wifidog_p3
-${IPTABLES} -t nat -X wifidog_p4
-${IPTABLES} -t nat -X wifidog_p5
+${IPTABLES} -t nat -F wifidog_class 2>/dev/null
+${IPTABLES} -t mangle -F wifidog_mark 2>/dev/null
+
+${IPTABLES} -t nat -F wifidog_validate 2>/dev/null
+${IPTABLES} -t nat -F wifidog_unknown 2>/dev/null
+${IPTABLES} -t nat -F wifidog_known 2>/dev/null
+${IPTABLES} -t nat -F wifidog_locked 2>/dev/null
+${IPTABLES} -t nat -X wifidog_validate 2>/dev/null
+${IPTABLES} -t nat -X wifidog_unknown 2>/dev/null
+${IPTABLES} -t nat -X wifidog_known 2>/dev/null
+${IPTABLES} -t nat -X wifidog_locked 2>/dev/null
 
 RC=0
@@ -49 +48 @@
 done
 
-${IPTABLES} -t nat -X wifidog_class
+${IPTABLES} -t nat -X wifidog_class 2>/dev/null
 
 RC=0
@@ -58 +57 @@
 done
 
-${IPTABLES} -t mangle -X wifidog_mark
+${IPTABLES} -t mangle -X wifidog_mark 2>/dev/null
 

trunk/wifidog/src/fw.init

@@ -38 +38 @@
 AUTHSERV_IP=$4
 
-${IPTABLES} -t nat -N wifidog_p1
-${IPTABLES} -t nat -A wifidog_p1 -d ${GW_IP} -j ACCEPT
-${IPTABLES} -t nat -A wifidog_p1 -d ${AUTHSERV_IP} -j ACCEPT
-${IPTABLES} -t nat -A wifidog_p1 -p udp --dport 53 -j ACCEPT
-${IPTABLES} -t nat -A wifidog_p1 -p tcp --dport 80 -j REDIRECT --to-ports ${GW_PORT}
-${IPTABLES} -t nat -A wifidog_p1 -j DROP
+${IPTABLES} -t nat -N wifidog_validate
+${IPTABLES} -t nat -A wifidog_validate -d ${GW_IP} -j ACCEPT
+${IPTABLES} -t nat -A wifidog_validate -d ${AUTHSERV_IP} -j ACCEPT
+${IPTABLES} -t nat -A wifidog_validate -p udp --dport 67 -j ACCEPT
+${IPTABLES} -t nat -A wifidog_validate -p tcp --dport 67 -j ACCEPT
+${IPTABLES} -t nat -A wifidog_validate -p udp --dport 53 -j ACCEPT
+${IPTABLES} -t nat -A wifidog_validate -p tcp --dport 80 -j ACCEPT
+${IPTABLES} -t nat -A wifidog_validate -p tcp --dport 443 -j ACCEPT
+${IPTABLES} -t nat -A wifidog_validate -j DROP
 
-${IPTABLES} -t nat -N wifidog_p2
-${IPTABLES} -t nat -A wifidog_p2 -j ACCEPT
+${IPTABLES} -t nat -N wifidog_unknown
+${IPTABLES} -t nat -A wifidog_unknown -d ${GW_IP} -j ACCEPT
+${IPTABLES} -t nat -A wifidog_unknown -d ${AUTHSERV_IP} -j ACCEPT
+${IPTABLES} -t nat -A wifidog_unknown -p udp --dport 67 -j ACCEPT
+${IPTABLES} -t nat -A wifidog_unknown -p tcp --dport 67 -j ACCEPT
+${IPTABLES} -t nat -A wifidog_unknown -p udp --dport 53 -j ACCEPT
+${IPTABLES} -t nat -A wifidog_unknown -p tcp --dport 80 -j REDIRECT --to-ports ${GW_PORT}
+${IPTABLES} -t nat -A wifidog_unknown -j DROP
 
-${IPTABLES} -t nat -N wifidog_p3
-${IPTABLES} -t nat -A wifidog_p3 -j ACCEPT
+${IPTABLES} -t nat -N wifidog_known
+${IPTABLES} -t nat -A wifidog_known -j ACCEPT
 
-${IPTABLES} -t nat -N wifidog_p4
-${IPTABLES} -t nat -A wifidog_p4 -j ACCEPT
-
-${IPTABLES} -t nat -N wifidog_p5
-${IPTABLES} -t nat -A wifidog_p5 -j ACCEPT
+${IPTABLES} -t nat -N wifidog_locked
+${IPTABLES} -t nat -A wifidog_locked -j DROP
 
 ${IPTABLES} -t nat -N wifidog_class
-${IPTABLES} -t nat -A wifidog_class -i ${GW_INTERFACE} -m mark --mark 0x1 -j wifidog_p1
-${IPTABLES} -t nat -A wifidog_class -i ${GW_INTERFACE} -m mark --mark 0x2 -j wifidog_p2
-${IPTABLES} -t nat -A wifidog_class -i ${GW_INTERFACE} -m mark --mark 0x3 -j wifidog_p3
-${IPTABLES} -t nat -A wifidog_class -i ${GW_INTERFACE} -m mark --mark 0x4 -j wifidog_p4
-${IPTABLES} -t nat -A wifidog_class -i ${GW_INTERFACE} -m mark --mark 0x5 -j wifidog_p5
+${IPTABLES} -t nat -A wifidog_class -i ${GW_INTERFACE} -m mark --mark 0x1 -j wifidog_validate
+${IPTABLES} -t nat -A wifidog_class -i ${GW_INTERFACE} -m mark --mark 0x2 -j wifidog_known
+${IPTABLES} -t nat -A wifidog_class -i ${GW_INTERFACE} -m mark --mark 0x254 -j wifidog_locked
+${IPTABLES} -t nat -A wifidog_class -i ${GW_INTERFACE} -j wifidog_unknown
 
 ${IPTABLES} -t mangle -N wifidog_mark
-${IPTABLES} -t mangle -A wifidog_mark -j MARK --set-mark 0x1
 
 ${IPTABLES} -t mangle -I PREROUTING 1 -i ${GW_INTERFACE} -j wifidog_mark

trunk/wifidog/src/gateway.c

@@ -36 +36 @@
 {
         struct timeval tv;
-        time_t last_checked;
         httpd * webserver;
         int result;
@@ -63 +62 @@
 
         // Reset the firewall
+        fw_destroy();
         fw_init();
 
@@ -124 +124 @@
         config_validate();
 
-        init_userclasses(0);
-        
         if (config.daemon) {
                 int childPid;

trunk/wifidog/src/http.c

@@ -37 +37 @@
         char *newlocation;
 
-        if (asprintf(&newlocation, "Location: %s?gw_address=%s&gw_port=%d&"
+        if ((asprintf(&newlocation, "Location: %s?gw_address=%s&gw_port=%d&"
                         "gw_id=%s", config.authserv_loginurl, 
                         config.gw_address, config.gw_port, 
-                        config.gw_id) == -1) {
+                        config.gw_id)) == -1) {
                 debug(LOG_ERR, "Failed to asprintf newlocation");
                 httpdOutput(webserver, "Internal error occurred");
@@ -78 +78 @@
         char    *mac,
                 *ip;
-        int profile;
-        int temp;
         pthread_t tid;
 
-        if (token = httpdGetVariableByName(webserver, "token")) {
+        if ((token = httpdGetVariableByName(webserver, "token"))) {
                 // They supplied variable "token"
                 if (!(mac = arp_get(webserver->clientAddr))) {
@@ -104 +102 @@
                                 debug(LOG_DEBUG, "Node for %s already "
                                         "exists", node->ip);
-                                if (node->rights != NULL) {
-                                        /* log off if logged in */
-                                        debug(LOG_DEBUG, "Logging off %s "
-                                                "because they tried a new "
-                                                "token", node->ip);
-                                        fw_deny(node->ip, node->mac,
-                                                node->rights->profile);
-                                }
                         }