src/misc-progs/wirelessctrl.c

   1 /* IPCop helper program - wirelessctrl
   2  *
   3  * This program is distributed under the terms of the GNU General Public
   4  * Licence.  See the file COPYING for details.
   5  *
   6  * (c) Alan Hourihane, 2003
   7  *
   8  */
   9
  10 #include "libsmooth.h"
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <unistd.h>
  14 #include <fcntl.h>
  15 #include <string.h>
  16 #include <sys/types.h>
  17 #include <sys/stat.h>
  18 #include <signal.h>
  19 #include <errno.h>
  20
  21 #include "setuid.h"
  22 #include "netutil.h"
  23
  24 FILE *fd = NULL;
  25 char blue_dev[STRING_SIZE] = "";
  26 char command[STRING_SIZE];
  27
  28 void exithandler(void) {
  29         /* added comment mark to the drop rules to be able to collect the bytes by the collectd */
  30         if (strlen(blue_dev) > 0) {
  31                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
  32                 safe_system(command);
  33                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
  34                 safe_system(command);
  35         }
  36
  37         if (fd)
  38                 fclose(fd);
  39 }
  40
  41 int main(void) {
  42         char buffer[STRING_SIZE];
  43         char *index, *ipaddress, *macaddress, *enabled;
  44         struct keyvalue *kv = NULL;
  45
  46         if (!(initsetuid()))
  47                 exit(1);
  48
  49         /* flush wireless iptables */
  50         safe_system("/sbin/iptables --wait -F WIRELESSINPUT > /dev/null 2> /dev/null");
  51         safe_system("/sbin/iptables --wait -F WIRELESSFORWARD > /dev/null 2> /dev/null");
  52
  53         memset(buffer, 0, STRING_SIZE);
  54
  55         /* Init the keyvalue structure */
  56         kv=initkeyvalues();
  57
  58         /* Read in the current values */
  59         if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
  60                 fprintf(stderr, "Cannot read ethernet settings\n");
  61                 exit(1);
  62         }
  63
  64         /* Read in the firewall values */
  65         if (!readkeyvalues(kv, CONFIG_ROOT "/optionsfw/settings")) {
  66                 fprintf(stderr, "Cannot read optionsfw settings\n");
  67                 exit(1);
  68         }
  69
  70         /* Get the BLUE interface details */
  71         if (findkey(kv, "BLUE_DEV", blue_dev) > 0) {
  72                 if ((strlen(blue_dev) > 0) && !VALID_DEVICE(blue_dev)) {
  73                         fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
  74                         exit(1);
  75                 }
  76         }
  77
  78         if (strlen(blue_dev) == 0) {
  79                 exit(0);
  80         }
  81
  82         if ((fd = fopen(CONFIG_ROOT "/wireless/nodrop", "r")))
  83                 return 0;
  84
  85         /* register exit handler to ensure the block rule is always present */
  86         atexit(exithandler);
  87
  88         if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r"))) {
  89                 exit(0);
  90         }
  91
  92         /* restrict blue access tp the proxy port */
  93         if (findkey(kv, "DROPPROXY", buffer) && strcmp(buffer, "on") == 0) {
  94                 /* Read the proxy values */
  95                 if (!readkeyvalues(kv, CONFIG_ROOT "/proxy/settings") || !(findkey(kv, "PROXY_PORT", buffer))) {
  96                         fprintf(stderr, "Cannot read proxy settings\n");
  97                         exit(1);
  98                 }
  99
 100                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p tcp  ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev, buffer);
 101                 safe_system(command);
 102                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p tcp  ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev, buffer);
 103                 safe_system(command);
 104         }
 105
 106         /* not allow blue to acces a samba server running on local fire*/
 107         if (findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer, "on") == 0) {
 108                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
 109                 safe_system(command);
 110                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
 111                 safe_system(command);
 112                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
 113                 safe_system(command);
 114                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
 115                 safe_system(command);
 116         }
 117
 118         while (fgets(buffer, STRING_SIZE, fd)) {
 119                 buffer[strlen(buffer) - 1] = 0;
 120
 121                 index = strtok(buffer, ",");
 122                 ipaddress = strtok(NULL, ",");
 123                 macaddress = strtok(NULL, ",");
 124                 enabled = strtok(NULL, ",");
 125
 126                 if (strcmp(enabled, "on") == 0) {
 127                         /* both specified, added security */
 128                         if ((strlen(macaddress) == 17) && (VALID_IP_AND_MASK(ipaddress))) {
 129                                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress, ipaddress, blue_dev);
 130                                 safe_system(command);
 131                                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress, ipaddress, blue_dev);
 132                                 safe_system(command);
 133                         } else {
 134                                 /* correctly formed mac address is 17 chars */
 135                                 if (strlen(macaddress) == 17) {
 136                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -m mac --mac-source %s -i %s -j RETURN", macaddress, blue_dev);
 137                                         safe_system(command);
 138                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j RETURN", macaddress, blue_dev);
 139                                         safe_system(command);
 140                                 }
 141
 142                                 if (VALID_IP_AND_MASK(ipaddress)) {
 143                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -s %s -i %s -j RETURN", ipaddress, blue_dev);
 144                                         safe_system(command);
 145                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -s %s -i %s -j RETURN", ipaddress, blue_dev);
 146                                         safe_system(command);
 147                                 }
 148                         }
 149                 }
 150         }
 151
 152         /* with this rule you can disable the logging of the dropped wireless input packets*/
 153         if (findkey(kv, "DROPWIRELESSINPUT", buffer) && strcmp(buffer, "on") == 0) {
 154                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev);
 155                 safe_system(command);
 156         }
 157
 158         /* with this rule you can disable the logging of the dropped wireless forward packets*/
 159         if (findkey(kv, "DROPWIRELESSFORWARD", buffer) && strcmp(buffer, "on") == 0) {
 160                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev);
 161                 safe_system(command);
 162         }
 163
 164         return 0;
 165 }