#include <sys/types.h>
#include <sys/stat.h>
#include <signal.h>
-#include "setuid.h"
#include <errno.h>
+#include "setuid.h"
+#include "netutil.h"
+
FILE *fd = NULL;
char blue_dev[STRING_SIZE] = "";
char command[STRING_SIZE];
}
/* Get the GREEN interface details */
- if (!findkey(kv, "GREEN_DEV", green_dev)) {
- fprintf(stderr, "Cannot read GREEN_DEV\n");
- exit(1);
- }
-
- if (!VALID_DEVICE(green_dev)) {
- fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
- exit(1);
+ if (findkey(kv, "GREEN_DEV", green_dev) > 0) {
+ if (!VALID_DEVICE(green_dev)) {
+ fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
+ exit(1);
+ }
}
/* Get the BLUE interface details */
- if (!findkey(kv, "BLUE_DEV", blue_dev)) {
- fprintf(stderr, "Cannot read BLUE_DEV\n");
- exit(1);
- }
-
- if ((strlen(blue_dev) > 0) && !VALID_DEVICE(blue_dev)) {
- fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
- exit(1);
+ if (findkey(kv, "BLUE_DEV", blue_dev) > 0) {
+ if ((strlen(blue_dev) > 0) && !VALID_DEVICE(blue_dev)) {
+ fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
+ exit(1);
+ }
}
- if (!strlen(blue_dev) > 0) {
- fprintf(stderr, "No BLUE interface\n");
+ if (strlen(blue_dev) == 0) {
exit(0);
}
}
/* restrict blue access tp the proxy port */
- if (findkey(kv, "DROPPROXY", buffer) && strcmp(buffer,"off") == 0) {
+ if (findkey(kv, "DROPPROXY", buffer) && strcmp(buffer, "on") == 0) {
/* Read the proxy values */
if (!readkeyvalues(kv, CONFIG_ROOT "/proxy/settings") || !(findkey(kv, "PROXY_PORT", buffer))) {
fprintf(stderr, "Cannot read proxy settings\n");
}
/* not allow blue to acces a samba server running on local fire*/
- if(findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer,"off")){
+ if (findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer, "on") == 0) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
macaddress = strtok(NULL, ",");
enabled = strtok(NULL, ",");
- if (strncmp(enabled, "on", 2) != 0) {
+ if (strcmp(enabled, "on") == 0) {
/* both specified, added security */
if ((strlen(macaddress) == 17) && (VALID_IP_AND_MASK(ipaddress))) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
}
/* with this rule you can disable the logging of the dropped wireless input packets*/
- if (!findkey(kv, "DROPWIRELESSINPUT", buffer) || strcmp(buffer,"off") == 0) {
+ if (findkey(kv, "DROPWIRELESSINPUT", buffer) && strcmp(buffer, "on") == 0) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
}
/* with this rule you can disable the logging of the dropped wireless forward packets*/
- if (!findkey(kv, "DROPWIRELESSFORWARD", buffer) || strcmp(buffer,"off") == 0) {
+ if (findkey(kv, "DROPWIRELESSFORWARD", buffer) && strcmp(buffer, "on") == 0) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
}