openvpn: Properly remove all RRDs after a connection is removed

[ipfire-2.x.git] / src / misc-progs / wirelessctrl.c

diff --git a/src/misc-progs/wirelessctrl.c b/src/misc-progs/wirelessctrl.c
index dc77ec18584d315685053a279a74763afe98a7f3..4a2e6dc862d371f6cb9647766de2a9fd809df11b 100644 (file)
--- a/src/misc-progs/wirelessctrl.c
+++ b/src/misc-progs/wirelessctrl.c
@@ -16,9 +16,11 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <signal.h>
-#include "setuid.h"
 #include <errno.h>
 
+#include "setuid.h"
+#include "netutil.h"
+
 FILE *fd = NULL;
 char blue_dev[STRING_SIZE] = "";
 char command[STRING_SIZE];
@@ -26,9 +28,9 @@ char command[STRING_SIZE];
 void exithandler(void) {
        /* added comment mark to the drop rules to be able to collect the bytes by the collectd */
        if (strlen(blue_dev) > 0) {
-               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
+               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
                safe_system(command);
-               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
+               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
                safe_system(command);
        }
 
@@ -46,8 +48,8 @@ int main(void) {
                exit(1);
 
        /* flush wireless iptables */
-       safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null");
-       safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null");
+       safe_system("/sbin/iptables --wait -F WIRELESSINPUT > /dev/null 2> /dev/null");
+       safe_system("/sbin/iptables --wait -F WIRELESSFORWARD > /dev/null 2> /dev/null");
 
        memset(buffer, 0, STRING_SIZE);
 
@@ -67,29 +69,22 @@ int main(void) {
        }
 
        /* Get the GREEN interface details */
-       if (!findkey(kv, "GREEN_DEV", green_dev)) {
-               fprintf(stderr, "Cannot read GREEN_DEV\n");
-               exit(1);
-       }
-
-       if (!VALID_DEVICE(green_dev)) {
-               fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
-               exit(1);
+       if (findkey(kv, "GREEN_DEV", green_dev) > 0) {
+               if (!VALID_DEVICE(green_dev)) {
+                       fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
+                       exit(1);
+               }
        }
 
        /* Get the BLUE interface details */
-       if (!findkey(kv, "BLUE_DEV", blue_dev)) {
-               fprintf(stderr, "Cannot read BLUE_DEV\n");
-               exit(1);
-       }
-
-       if ((strlen(blue_dev) > 0) && !VALID_DEVICE(blue_dev)) {
-               fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
-               exit(1);
+       if (findkey(kv, "BLUE_DEV", blue_dev) > 0) {
+               if ((strlen(blue_dev) > 0) && !VALID_DEVICE(blue_dev)) {
+                       fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
+                       exit(1);
+               }
        }
 
-       if (!strlen(blue_dev) > 0) {
-               fprintf(stderr, "No BLUE interface\n");
+       if (strlen(blue_dev) == 0) {
                exit(0);
        }
 
@@ -104,28 +99,28 @@ int main(void) {
        }
 
        /* restrict blue access tp the proxy port */
-       if (findkey(kv, "DROPPROXY", buffer) && strcmp(buffer,"off") == 0) {
+       if (findkey(kv, "DROPPROXY", buffer) && strcmp(buffer, "on") == 0) {
                /* Read the proxy values */
                if (!readkeyvalues(kv, CONFIG_ROOT "/proxy/settings") || !(findkey(kv, "PROXY_PORT", buffer))) {
                        fprintf(stderr, "Cannot read proxy settings\n");
                        exit(1);
                }
 
-               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp  ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev, buffer);
+               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p tcp  ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev, buffer);
                safe_system(command);
-               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp  ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev, buffer);
+               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p tcp  ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev, buffer);
                safe_system(command);
        }
 
        /* not allow blue to acces a samba server running on local fire*/
-       if(findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer,"off")){
-               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
+       if (findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer, "on") == 0) {
+               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
                safe_system(command);
-               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
+               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
                safe_system(command);
-               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
+               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
                safe_system(command);
-               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
+               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
                safe_system(command);
        }
 
@@ -137,26 +132,26 @@ int main(void) {
                macaddress = strtok(NULL, ",");
                enabled = strtok(NULL, ",");
 
-               if (strncmp(enabled, "on", 2) != 0) {
+               if (strcmp(enabled, "on") == 0) {
                        /* both specified, added security */
                        if ((strlen(macaddress) == 17) && (VALID_IP_AND_MASK(ipaddress))) {
-                               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
+                               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
                                safe_system(command);
-                               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress, ipaddress, blue_dev);
+                               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress, ipaddress, blue_dev);
                                safe_system(command);
                        } else {
                                /* correctly formed mac address is 17 chars */
                                if (strlen(macaddress) == 17) {
-                                       snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
+                                       snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
                                        safe_system(command);
-                                       snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j RETURN", macaddress, blue_dev);
+                                       snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j RETURN", macaddress, blue_dev);
                                        safe_system(command);
                                }
 
                                if (VALID_IP_AND_MASK(ipaddress)) {
-                                       snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
+                                       snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
                                        safe_system(command);
-                                       snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j RETURN", ipaddress, blue_dev);
+                                       snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -s %s -i %s -j RETURN", ipaddress, blue_dev);
                                        safe_system(command);
                                }
                        }
@@ -164,14 +159,14 @@ int main(void) {
        }
 
        /* with this rule you can disable the logging of the dropped wireless input packets*/
-       if (!findkey(kv, "DROPWIRELESSINPUT", buffer) || strcmp(buffer,"off") == 0) {
-               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev);
+       if (findkey(kv, "DROPWIRELESSINPUT", buffer) && strcmp(buffer, "on") == 0) {
+               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev);
                safe_system(command);
        }
 
        /* with this rule you can disable the logging of the dropped wireless forward packets*/
-       if (!findkey(kv, "DROPWIRELESSFORWARD", buffer) || strcmp(buffer,"off") == 0) {
-               snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev);
+       if (findkey(kv, "DROPWIRELESSFORWARD", buffer) && strcmp(buffer, "on") == 0) {
+               snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev);
                safe_system(command);
        }