wirelessctrl: Silence error messages when no BLUE device is configured.
[people/teissler/ipfire-2.x.git] / src / misc-progs / wirelessctrl.c
CommitLineData
900832fa
CS
1/* IPCop helper program - wirelessctrl
2 *
3 * This program is distributed under the terms of the GNU General Public
4 * Licence. See the file COPYING for details.
5 *
6 * (c) Alan Hourihane, 2003
0a56f193 7 *
900832fa
CS
8 */
9
10#include "libsmooth.h"
11#include <stdio.h>
12#include <stdlib.h>
13#include <unistd.h>
14#include <fcntl.h>
15#include <string.h>
16#include <sys/types.h>
17#include <sys/stat.h>
18#include <signal.h>
19#include "setuid.h"
42dc0090 20#include <errno.h>
900832fa
CS
21
22FILE *fd = NULL;
23char blue_dev[STRING_SIZE] = "";
24char command[STRING_SIZE];
25
d69bf619
MT
26void exithandler(void) {
27 /* added comment mark to the drop rules to be able to collect the bytes by the collectd */
28 if (strlen(blue_dev) > 0) {
29 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
30 safe_system(command);
31 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
32 safe_system(command);
33 }
34
35 if (fd)
36 fclose(fd);
0a56f193
CS
37}
38
d69bf619
MT
39int main(void) {
40 char green_dev[STRING_SIZE] = "";
41 char buffer[STRING_SIZE];
42 char *index, *ipaddress, *macaddress, *enabled;
43 struct keyvalue *kv = NULL;
44
45 if (!(initsetuid()))
46 exit(1);
47
48 /* flush wireless iptables */
49 safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null");
50 safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null");
51
52 memset(buffer, 0, STRING_SIZE);
53
54 /* Init the keyvalue structure */
55 kv=initkeyvalues();
56
57 /* Read in the current values */
58 if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
59 fprintf(stderr, "Cannot read ethernet settings\n");
60 exit(1);
61 }
62
63 /* Read in the firewall values */
64 if (!readkeyvalues(kv, CONFIG_ROOT "/optionsfw/settings")) {
65 fprintf(stderr, "Cannot read optionsfw settings\n");
66 exit(1);
67 }
68
69 /* Get the GREEN interface details */
27ba58fb
MT
70 if (findkey(kv, "GREEN_DEV", green_dev) > 0) {
71 if (!VALID_DEVICE(green_dev)) {
72 fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
73 exit(1);
74 }
d69bf619
MT
75 }
76
77 /* Get the BLUE interface details */
27ba58fb
MT
78 if (findkey(kv, "BLUE_DEV", blue_dev) > 0) {
79 if ((strlen(blue_dev) > 0) && !VALID_DEVICE(blue_dev)) {
80 fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
81 exit(1);
82 }
d69bf619
MT
83 }
84
27ba58fb 85 if (strlen(blue_dev) == 0) {
d69bf619
MT
86 exit(0);
87 }
88
89 if ((fd = fopen(CONFIG_ROOT "/wireless/nodrop", "r")))
90 return 0;
91
92 /* register exit handler to ensure the block rule is always present */
93 atexit(exithandler);
94
95 if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r"))) {
96 exit(0);
97 }
98
99 /* restrict blue access tp the proxy port */
100 if (findkey(kv, "DROPPROXY", buffer) && strcmp(buffer,"off") == 0) {
101 /* Read the proxy values */
102 if (!readkeyvalues(kv, CONFIG_ROOT "/proxy/settings") || !(findkey(kv, "PROXY_PORT", buffer))) {
103 fprintf(stderr, "Cannot read proxy settings\n");
104 exit(1);
105 }
106
107 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev, buffer);
108 safe_system(command);
109 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev, buffer);
110 safe_system(command);
111 }
112
113 /* not allow blue to acces a samba server running on local fire*/
114 if(findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer,"off")){
115 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
116 safe_system(command);
117 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
118 safe_system(command);
119 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
120 safe_system(command);
121 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
122 safe_system(command);
123 }
124
125 while (fgets(buffer, STRING_SIZE, fd)) {
126 buffer[strlen(buffer) - 1] = 0;
127
128 index = strtok(buffer, ",");
129 ipaddress = strtok(NULL, ",");
130 macaddress = strtok(NULL, ",");
131 enabled = strtok(NULL, ",");
132
133 if (strncmp(enabled, "on", 2) != 0) {
134 /* both specified, added security */
135 if ((strlen(macaddress) == 17) && (VALID_IP_AND_MASK(ipaddress))) {
136 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
137 safe_system(command);
138 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress, ipaddress, blue_dev);
139 safe_system(command);
140 } else {
141 /* correctly formed mac address is 17 chars */
142 if (strlen(macaddress) == 17) {
143 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
144 safe_system(command);
145 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j RETURN", macaddress, blue_dev);
146 safe_system(command);
0aaef8e9
CS
147 }
148
d69bf619
MT
149 if (VALID_IP_AND_MASK(ipaddress)) {
150 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
151 safe_system(command);
152 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j RETURN", ipaddress, blue_dev);
153 safe_system(command);
0aaef8e9 154 }
d69bf619
MT
155 }
156 }
157 }
158
159 /* with this rule you can disable the logging of the dropped wireless input packets*/
160 if (!findkey(kv, "DROPWIRELESSINPUT", buffer) || strcmp(buffer,"off") == 0) {
161 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev);
162 safe_system(command);
163 }
164
165 /* with this rule you can disable the logging of the dropped wireless forward packets*/
166 if (!findkey(kv, "DROPWIRELESSFORWARD", buffer) || strcmp(buffer,"off") == 0) {
167 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev);
168 safe_system(command);
169 }
170
171 return 0;
900832fa 172}