src/misc-progs/wirelessctrl.c

   1 /* IPCop helper program - wirelessctrl
   2  *
   3  * This program is distributed under the terms of the GNU General Public
   4  * Licence.  See the file COPYING for details.
   5  *
   6  * (c) Alan Hourihane, 2003
   7  *
   8  */
   9
  10 #include "libsmooth.h"
  11 #include <stdio.h>
  12 #include <stdlib.h>
  13 #include <unistd.h>
  14 #include <fcntl.h>
  15 #include <string.h>
  16 #include <sys/types.h>
  17 #include <sys/stat.h>
  18 #include <signal.h>
  19 #include <errno.h>
  20
  21 #include "setuid.h"
  22 #include "netutil.h"
  23
  24 FILE *fd = NULL;
  25 char blue_dev[STRING_SIZE] = "";
  26 char command[STRING_SIZE];
  27
  28 void exithandler(void) {
  29         /* added comment mark to the drop rules to be able to collect the bytes by the collectd */
  30         if (strlen(blue_dev) > 0) {
  31                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
  32                 safe_system(command);
  33                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
  34                 safe_system(command);
  35         }
  36
  37         if (fd)
  38                 fclose(fd);
  39 }
  40
  41 int main(void) {
  42         char green_dev[STRING_SIZE] = "";
  43         char buffer[STRING_SIZE];
  44         char *index, *ipaddress, *macaddress, *enabled;
  45         struct keyvalue *kv = NULL;
  46
  47         if (!(initsetuid()))
  48                 exit(1);
  49
  50         /* flush wireless iptables */
  51         safe_system("/sbin/iptables --wait -F WIRELESSINPUT > /dev/null 2> /dev/null");
  52         safe_system("/sbin/iptables --wait -F WIRELESSFORWARD > /dev/null 2> /dev/null");
  53
  54         memset(buffer, 0, STRING_SIZE);
  55
  56         /* Init the keyvalue structure */
  57         kv=initkeyvalues();
  58
  59         /* Read in the current values */
  60         if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
  61                 fprintf(stderr, "Cannot read ethernet settings\n");
  62                 exit(1);
  63         }
  64
  65         /* Read in the firewall values */
  66         if (!readkeyvalues(kv, CONFIG_ROOT "/optionsfw/settings")) {
  67                 fprintf(stderr, "Cannot read optionsfw settings\n");
  68                 exit(1);
  69         }
  70
  71         /* Get the GREEN interface details */
  72         if (findkey(kv, "GREEN_DEV", green_dev) > 0) {
  73                 if (!VALID_DEVICE(green_dev)) {
  74                         fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
  75                         exit(1);
  76                 }
  77         }
  78
  79         /* Get the BLUE interface details */
  80         if (findkey(kv, "BLUE_DEV", blue_dev) > 0) {
  81                 if ((strlen(blue_dev) > 0) && !VALID_DEVICE(blue_dev)) {
  82                         fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
  83                         exit(1);
  84                 }
  85         }
  86
  87         if (strlen(blue_dev) == 0) {
  88                 exit(0);
  89         }
  90
  91         if ((fd = fopen(CONFIG_ROOT "/wireless/nodrop", "r")))
  92                 return 0;
  93
  94         /* register exit handler to ensure the block rule is always present */
  95         atexit(exithandler);
  96
  97         if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r"))) {
  98                 exit(0);
  99         }
 100
 101         /* restrict blue access tp the proxy port */
 102         if (findkey(kv, "DROPPROXY", buffer) && strcmp(buffer, "on") == 0) {
 103                 /* Read the proxy values */
 104                 if (!readkeyvalues(kv, CONFIG_ROOT "/proxy/settings") || !(findkey(kv, "PROXY_PORT", buffer))) {
 105                         fprintf(stderr, "Cannot read proxy settings\n");
 106                         exit(1);
 107                 }
 108
 109                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p tcp  ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev, buffer);
 110                 safe_system(command);
 111                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p tcp  ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev, buffer);
 112                 safe_system(command);
 113         }
 114
 115         /* not allow blue to acces a samba server running on local fire*/
 116         if (findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer, "on") == 0) {
 117                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
 118                 safe_system(command);
 119                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
 120                 safe_system(command);
 121                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
 122                 safe_system(command);
 123                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
 124                 safe_system(command);
 125         }
 126
 127         while (fgets(buffer, STRING_SIZE, fd)) {
 128                 buffer[strlen(buffer) - 1] = 0;
 129
 130                 index = strtok(buffer, ",");
 131                 ipaddress = strtok(NULL, ",");
 132                 macaddress = strtok(NULL, ",");
 133                 enabled = strtok(NULL, ",");
 134
 135                 if (strcmp(enabled, "on") == 0) {
 136                         /* both specified, added security */
 137                         if ((strlen(macaddress) == 17) && (VALID_IP_AND_MASK(ipaddress))) {
 138                                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
 139                                 safe_system(command);
 140                                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress, ipaddress, blue_dev);
 141                                 safe_system(command);
 142                         } else {
 143                                 /* correctly formed mac address is 17 chars */
 144                                 if (strlen(macaddress) == 17) {
 145                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
 146                                         safe_system(command);
 147                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j RETURN", macaddress, blue_dev);
 148                                         safe_system(command);
 149                                 }
 150
 151                                 if (VALID_IP_AND_MASK(ipaddress)) {
 152                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
 153                                         safe_system(command);
 154                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -s %s -i %s -j RETURN", ipaddress, blue_dev);
 155                                         safe_system(command);
 156                                 }
 157                         }
 158                 }
 159         }
 160
 161         /* with this rule you can disable the logging of the dropped wireless input packets*/
 162         if (findkey(kv, "DROPWIRELESSINPUT", buffer) && strcmp(buffer, "on") == 0) {
 163                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev);
 164                 safe_system(command);
 165         }
 166
 167         /* with this rule you can disable the logging of the dropped wireless forward packets*/
 168         if (findkey(kv, "DROPWIRELESSFORWARD", buffer) && strcmp(buffer, "on") == 0) {
 169                 snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev);
 170                 safe_system(command);
 171         }
 172
 173         return 0;
 174 }