]>
git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blob - src/misc-progs/wirelessctrl.c
1 /* IPCop helper program - wirelessctrl
3 * This program is distributed under the terms of the GNU General Public
4 * Licence. See the file COPYING for details.
6 * (c) Alan Hourihane, 2003
8 * $Id: wirelessctrl.c,v 1.2.2.5 2005/07/11 10:56:47 franck78 Exp $
12 #include "libsmooth.h"
18 #include <sys/types.h>
25 char blue_dev
[STRING_SIZE
] = "";
26 char command
[STRING_SIZE
];
28 void exithandler(void)
30 /* added comment mark to the drop rules to be able to collect the bytes by the collectd */
33 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev
);
35 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev
);
45 char green_dev
[STRING_SIZE
] = "";
46 char buffer
[STRING_SIZE
];
47 char *index
, *ipaddress
, *macaddress
, *enabled
;
48 struct keyvalue
*kv
= NULL
;
53 /* flush wireless iptables */
54 safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null");
55 safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null");
57 memset(buffer
, 0, STRING_SIZE
);
59 /* Init the keyvalue structure */
62 /* Read in the current values */
63 if (!readkeyvalues(kv
, CONFIG_ROOT
"/ethernet/settings"))
65 fprintf(stderr
, "Cannot read ethernet settings\n");
69 /* Read in the firewall values */
70 if (!readkeyvalues(kv
, CONFIG_ROOT
"/optionsfw/settings"))
72 fprintf(stderr
, "Cannot read optionsfw settings\n");
76 /* Get the GREEN interface details */
77 if(!findkey(kv
, "GREEN_DEV", green_dev
))
79 fprintf(stderr
, "Cannot read GREEN_DEV\n");
82 if (!VALID_DEVICE(green_dev
))
84 fprintf(stderr
, "Bad GREEN_DEV: %s\n", green_dev
);
87 /* Get the BLUE interface details */
88 if(!findkey(kv
, "BLUE_DEV", blue_dev
))
90 fprintf(stderr
, "Cannot read BLUE_DEV\n");
93 if (strlen(blue_dev
) && !VALID_DEVICE(blue_dev
))
95 fprintf(stderr
, "Bad BLUE_DEV: %s\n", blue_dev
);
98 if(! strlen(blue_dev
) > 0)
100 fprintf(stderr
, "No BLUE interface\n");
104 if ((fd
= fopen(CONFIG_ROOT
"/wireless/nodrop", "r")))
107 /* register exit handler to ensure the block rule is always present */
110 if (!(fd
= fopen(CONFIG_ROOT
"/wireless/config", "r")))
115 /* restrict blue access tp the proxy port */
116 if(findkey(kv
, "DROPPROXY", buffer
) && strcmp(buffer
,"off")){
117 /* Read the proxy values */
118 if (!readkeyvalues(kv
, CONFIG_ROOT
"/proxy/settings") || !(findkey(kv
, "PROXY_PORT", buffer
)))
120 fprintf(stderr
, "Cannot read proxy settings\n");
123 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev
, buffer
);
124 safe_system(command
);
125 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev
, buffer
);
126 safe_system(command
);
129 /* not allow blue to acces a samba server running on local fire*/
130 if(findkey(kv
, "DROPSAMBA", buffer
) && strcmp(buffer
,"off")){
131 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev
);
132 safe_system(command
);
133 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev
);
134 safe_system(command
);
135 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev
);
136 safe_system(command
);
137 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev
);
138 safe_system(command
);
141 while (fgets(buffer
, STRING_SIZE
, fd
))
143 buffer
[strlen(buffer
) - 1] = 0;
145 index
= strtok(buffer
, ",");
146 ipaddress
= strtok(NULL
, ",");
147 macaddress
= strtok(NULL
, ",");
148 enabled
= strtok(NULL
, ",");
150 if (!strncmp(enabled
, "on", 2)) {
152 /* both specified, added security */
153 if ((strlen(macaddress
) == 17) &&
154 (VALID_IP_AND_MASK(ipaddress
))) {
155 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress
, ipaddress
, blue_dev
);
156 safe_system(command
);
157 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s ! -o %s -j ACCEPT", macaddress
, ipaddress
, blue_dev
, green_dev
);
158 safe_system(command
);
159 /*snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j DMZHOLES", macaddress, ipaddress, blue_dev);
160 safe_system(command);*/
163 /* correctly formed mac address is 17 chars */
164 if (strlen(macaddress
) == 17) {
165 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress
, blue_dev
);
166 safe_system(command
);
167 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s ! -o %s -j ACCEPT", macaddress
, blue_dev
, green_dev
);
168 safe_system(command
);
169 /*snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j DMZHOLES", macaddress, blue_dev);
170 safe_system(command);*/
173 if (VALID_IP_AND_MASK(ipaddress
)) {
174 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress
, blue_dev
);
175 safe_system(command
);
176 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s ! -o %s -j ACCEPT", ipaddress
, blue_dev
, green_dev
);
177 safe_system(command
);
178 /*snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j DMZHOLES", ipaddress, blue_dev);
179 safe_system(command);*/
185 /* with this rule you can disable the logging of the dropped wireless input packets*/
186 if(!findkey(kv
, "DROPWIRELESSINPUT", buffer
) || strcmp(buffer
,"off")){
187 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev
);
188 safe_system(command
);
190 /* with this rule you can disable the logging of the dropped wireless forward packets*/
191 if(!findkey(kv
, "DROPWIRELESSFORWARD", buffer
) || strcmp(buffer
,"off")){
192 snprintf(command
, STRING_SIZE
-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev
);
193 safe_system(command
);