]>
Commit | Line | Data |
---|---|---|
900832fa CS |
1 | /* IPCop helper program - wirelessctrl |
2 | * | |
3 | * This program is distributed under the terms of the GNU General Public | |
4 | * Licence. See the file COPYING for details. | |
5 | * | |
6 | * (c) Alan Hourihane, 2003 | |
7 | * | |
8 | * $Id: wirelessctrl.c,v 1.2.2.5 2005/07/11 10:56:47 franck78 Exp $ | |
9 | * | |
10 | */ | |
11 | ||
12 | #include "libsmooth.h" | |
13 | #include <stdio.h> | |
14 | #include <stdlib.h> | |
15 | #include <unistd.h> | |
16 | #include <fcntl.h> | |
17 | #include <string.h> | |
18 | #include <sys/types.h> | |
19 | #include <sys/stat.h> | |
20 | #include <signal.h> | |
21 | #include "setuid.h" | |
22 | ||
23 | FILE *fd = NULL; | |
24 | char blue_dev[STRING_SIZE] = ""; | |
25 | char command[STRING_SIZE]; | |
26 | ||
27 | void exithandler(void) | |
28 | { | |
29 | if(strlen(blue_dev)) | |
30 | { | |
31 | snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG_DROP", blue_dev); | |
32 | safe_system(command); | |
33 | snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG_DROP", blue_dev); | |
34 | safe_system(command); | |
35 | } | |
36 | ||
37 | if (fd) | |
38 | fclose(fd); | |
39 | } | |
40 | ||
41 | int main(void) | |
42 | { | |
43 | char green_dev[STRING_SIZE] = ""; | |
44 | char buffer[STRING_SIZE]; | |
45 | char *index, *ipaddress, *macaddress, *enabled; | |
46 | struct keyvalue *kv = NULL; | |
47 | ||
48 | if (!(initsetuid())) | |
49 | exit(1); | |
50 | ||
51 | /* flush wireless iptables */ | |
52 | safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null"); | |
53 | safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null"); | |
54 | ||
55 | memset(buffer, 0, STRING_SIZE); | |
56 | ||
57 | /* Init the keyvalue structure */ | |
58 | kv=initkeyvalues(); | |
59 | ||
60 | /* Read in the current values */ | |
61 | if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) | |
62 | { | |
63 | fprintf(stderr, "Cannot read ethernet settings\n"); | |
64 | exit(1); | |
65 | } | |
66 | ||
67 | /* Get the GREEN interface details */ | |
68 | if(!findkey(kv, "GREEN_DEV", green_dev)) | |
69 | { | |
70 | fprintf(stderr, "Cannot read GREEN_DEV\n"); | |
71 | exit(1); | |
72 | } | |
73 | if (!VALID_DEVICE(green_dev)) | |
74 | { | |
75 | fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev); | |
76 | exit(1); | |
77 | } | |
78 | /* Get the BLUE interface details */ | |
79 | if(!findkey(kv, "BLUE_DEV", blue_dev)) | |
80 | { | |
81 | fprintf(stderr, "Cannot read BLUE_DEV\n"); | |
82 | exit(1); | |
83 | } | |
84 | if (strlen(blue_dev) && !VALID_DEVICE(blue_dev)) | |
85 | { | |
86 | fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev); | |
87 | exit(1); | |
88 | } | |
89 | if(! strlen(blue_dev) > 0) | |
90 | { | |
91 | fprintf(stderr, "No BLUE interface\n"); | |
92 | exit(0); | |
93 | } | |
94 | ||
95 | /* register exit handler to ensure the block rule is always present */ | |
96 | atexit(exithandler); | |
97 | ||
98 | if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r"))) | |
99 | { | |
100 | exit(0); | |
101 | } | |
102 | while (fgets(buffer, STRING_SIZE, fd)) | |
103 | { | |
104 | buffer[strlen(buffer) - 1] = 0; | |
105 | ||
106 | index = strtok(buffer, ","); | |
107 | ipaddress = strtok(NULL, ","); | |
108 | macaddress = strtok(NULL, ","); | |
109 | enabled = strtok(NULL, ","); | |
110 | ||
111 | if (!strncmp(enabled, "on", 2)) { | |
112 | ||
113 | /* both specified, added security */ | |
114 | if ((strlen(macaddress) == 17) && | |
115 | (VALID_IP(ipaddress))) { | |
116 | snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev); | |
117 | safe_system(command); | |
118 | snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -o ! %s -j ACCEPT", macaddress, ipaddress, blue_dev, green_dev); | |
119 | safe_system(command); | |
120 | snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j DMZHOLES", macaddress, ipaddress, blue_dev); | |
121 | safe_system(command); | |
122 | } else { | |
123 | ||
124 | /* correctly formed mac address is 17 chars */ | |
125 | if (strlen(macaddress) == 17) { | |
126 | snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev); | |
127 | safe_system(command); | |
128 | snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -o ! %s -j ACCEPT", macaddress, blue_dev, green_dev); | |
129 | safe_system(command); | |
130 | snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j DMZHOLES", macaddress, blue_dev); | |
131 | safe_system(command); | |
132 | } | |
133 | ||
134 | if (VALID_IP(ipaddress)) { | |
135 | snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev); | |
136 | safe_system(command); | |
137 | snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -o ! %s -j ACCEPT", ipaddress, blue_dev, green_dev); | |
138 | safe_system(command); | |
139 | snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j DMZHOLES", ipaddress, blue_dev); | |
140 | safe_system(command); | |
141 | } | |
142 | } | |
143 | } | |
144 | } | |
145 | ||
146 | return 0; | |
147 | } |