]>
git.ipfire.org Git - people/mfischer/ipfire-2.x.git/blob - src/misc-progs/wirelessctrl.c
1 /* IPCop helper program - wirelessctrl
3 * This program is distributed under the terms of the GNU General Public
4 * Licence. See the file COPYING for details.
6 * (c) Alan Hourihane, 2003
10 #include "libsmooth.h"
16 #include <sys/types.h>
25 char blue_dev
[STRING_SIZE
] = "";
26 char command
[STRING_SIZE
];
28 void exithandler(void) {
29 /* added comment mark to the drop rules to be able to collect the bytes by the collectd */
30 if (strlen(blue_dev
) > 0) {
31 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev
);
33 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev
);
42 char buffer
[STRING_SIZE
];
43 char *index
, *ipaddress
, *macaddress
, *enabled
;
44 struct keyvalue
*kv
= NULL
;
45 struct keyvalue
* captive_settings
= NULL
;
50 /* flush wireless iptables */
51 safe_system("/sbin/iptables --wait -F WIRELESSINPUT > /dev/null 2> /dev/null");
52 safe_system("/sbin/iptables --wait -F WIRELESSFORWARD > /dev/null 2> /dev/null");
54 memset(buffer
, 0, STRING_SIZE
);
56 /* Init the keyvalue structure */
59 /* Read in the current values */
60 if (!readkeyvalues(kv
, CONFIG_ROOT
"/ethernet/settings")) {
61 fprintf(stderr
, "Cannot read ethernet settings\n");
65 /* Read in the firewall values */
66 if (!readkeyvalues(kv
, CONFIG_ROOT
"/optionsfw/settings")) {
67 fprintf(stderr
, "Cannot read optionsfw settings\n");
71 // Read captive portal settings
72 captive_settings
= initkeyvalues();
73 if (!readkeyvalues(captive_settings
, CONFIG_ROOT
"/captive/settings")) {
74 fprintf(stderr
, "Could not read captive portal settings\n");
78 /* Get the BLUE interface details */
79 if (findkey(kv
, "BLUE_DEV", blue_dev
) > 0) {
80 if ((strlen(blue_dev
) > 0) && !VALID_DEVICE(blue_dev
)) {
81 fprintf(stderr
, "Bad BLUE_DEV: %s\n", blue_dev
);
86 if (strlen(blue_dev
) == 0) {
90 // Check if the captive portal is enabled on blue. If so, we will
91 // just keep the chains flushed and do not add any rules.
92 char captive_enabled
[STRING_SIZE
];
93 if (findkey(captive_settings
, "ENABLE_BLUE", captive_enabled
) > 0) {
94 if (strcmp(captive_enabled
, "on") == 0) {
99 if ((fd
= fopen(CONFIG_ROOT
"/wireless/nodrop", "r")))
102 /* register exit handler to ensure the block rule is always present */
105 if (!(fd
= fopen(CONFIG_ROOT
"/wireless/config", "r"))) {
109 /* restrict blue access tp the proxy port */
110 if (findkey(kv
, "DROPPROXY", buffer
) && strcmp(buffer
, "on") == 0) {
111 /* Read the proxy values */
112 if (!readkeyvalues(kv
, CONFIG_ROOT
"/proxy/settings") || !(findkey(kv
, "PROXY_PORT", buffer
))) {
113 fprintf(stderr
, "Cannot read proxy settings\n");
117 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev
, buffer
);
118 safe_system(command
);
119 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev
, buffer
);
120 safe_system(command
);
123 /* not allow blue to acces a samba server running on local fire*/
124 if (findkey(kv
, "DROPSAMBA", buffer
) && strcmp(buffer
, "on") == 0) {
125 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev
);
126 safe_system(command
);
127 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev
);
128 safe_system(command
);
129 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev
);
130 safe_system(command
);
131 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev
);
132 safe_system(command
);
135 while (fgets(buffer
, STRING_SIZE
, fd
)) {
136 buffer
[strlen(buffer
) - 1] = 0;
138 index
= strtok(buffer
, ",");
139 ipaddress
= strtok(NULL
, ",");
140 macaddress
= strtok(NULL
, ",");
141 enabled
= strtok(NULL
, ",");
143 if (strcmp(enabled
, "on") == 0) {
144 /* both specified, added security */
145 if ((strlen(macaddress
) == 17) && (VALID_IP_AND_MASK(ipaddress
))) {
146 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress
, ipaddress
, blue_dev
);
147 safe_system(command
);
148 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress
, ipaddress
, blue_dev
);
149 safe_system(command
);
151 /* correctly formed mac address is 17 chars */
152 if (strlen(macaddress
) == 17) {
153 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSINPUT -m mac --mac-source %s -i %s -j RETURN", macaddress
, blue_dev
);
154 safe_system(command
);
155 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j RETURN", macaddress
, blue_dev
);
156 safe_system(command
);
159 if (VALID_IP_AND_MASK(ipaddress
)) {
160 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSINPUT -s %s -i %s -j RETURN", ipaddress
, blue_dev
);
161 safe_system(command
);
162 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSFORWARD -s %s -i %s -j RETURN", ipaddress
, blue_dev
);
163 safe_system(command
);
169 /* with this rule you can disable the logging of the dropped wireless input packets*/
170 if (findkey(kv
, "DROPWIRELESSINPUT", buffer
) && strcmp(buffer
, "on") == 0) {
171 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev
);
172 safe_system(command
);
175 /* with this rule you can disable the logging of the dropped wireless forward packets*/
176 if (findkey(kv
, "DROPWIRELESSFORWARD", buffer
) && strcmp(buffer
, "on") == 0) {
177 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev
);
178 safe_system(command
);