src/misc-progs/restartwireless.c

   1 /* IPCop helper program - restartwireless
   2  *
   3  * This program is distributed under the terms of the GNU General Public
   4  * Licence.  See the file COPYING for details.
   5  *
   6  * (c) Alan Hourihane, 2003
   7  *
   8  * $Id: restartwireless.c,v 1.2.2.5 2005/07/11 10:56:47 franck78 Exp $
   9  *
  10  */
  11
  12 #include "libsmooth.h"
  13 #include <stdio.h>
  14 #include <stdlib.h>
  15 #include <unistd.h>
  16 #include <fcntl.h>
  17 #include <string.h>
  18 #include <sys/types.h>
  19 #include <sys/stat.h>
  20 #include <signal.h>
  21 #include "setuid.h"
  22
  23 FILE *fd = NULL;
  24 char blue_dev[STRING_SIZE] = "";
  25 char command[STRING_SIZE];
  26
  27 void exithandler(void)
  28 {
  29         if(strlen(blue_dev))
  30         {
  31                 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG_DROP", blue_dev);
  32                 safe_system(command);
  33                 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG_DROP", blue_dev);
  34                 safe_system(command);
  35         }
  36
  37         if (fd)
  38                 fclose(fd);
  39 }
  40
  41 int main(void)
  42 {
  43         char green_dev[STRING_SIZE] = "";
  44         char buffer[STRING_SIZE];
  45         char *index, *ipaddress, *macaddress, *enabled;
  46         struct keyvalue *kv = NULL;
  47
  48         if (!(initsetuid()))
  49                 exit(1);
  50
  51         /* flush wireless iptables */
  52         safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null");
  53         safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null");
  54
  55         memset(buffer, 0, STRING_SIZE);
  56
  57         /* Init the keyvalue structure */
  58         kv=initkeyvalues();
  59
  60         /* Read in the current values */
  61         if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
  62         {
  63                 fprintf(stderr, "Cannot read ethernet settings\n");
  64                 exit(1);
  65         }
  66
  67         /* Get the GREEN interface details */
  68         if(!findkey(kv, "GREEN_DEV", green_dev))
  69         {
  70                 fprintf(stderr, "Cannot read GREEN_DEV\n");
  71                 exit(1);
  72         }
  73         if (!VALID_DEVICE(green_dev))
  74         {
  75                 fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
  76                 exit(1);
  77         }
  78         /* Get the BLUE interface details */
  79         if(!findkey(kv, "BLUE_DEV", blue_dev))
  80         {
  81                 fprintf(stderr, "Cannot read BLUE_DEV\n");
  82                 exit(1);
  83         }
  84         if (strlen(blue_dev) && !VALID_DEVICE(blue_dev))
  85         {
  86                 fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
  87                 exit(1);
  88         }
  89         if(! strlen(blue_dev) > 0)
  90         {
  91                 fprintf(stderr, "No BLUE interface\n");
  92                 exit(0);
  93         }
  94
  95         /* register exit handler to ensure the block rule is always present */
  96         atexit(exithandler);
  97
  98         if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r")))
  99         {
 100                 exit(0);
 101         }
 102         while (fgets(buffer, STRING_SIZE, fd))
 103         {
 104                 buffer[strlen(buffer) - 1] = 0;
 105
 106                 index = strtok(buffer, ",");
 107                 ipaddress = strtok(NULL, ",");
 108                 macaddress = strtok(NULL, ",");
 109                 enabled = strtok(NULL, ",");
 110
 111                 if (!strncmp(enabled, "on", 2)) {
 112
 113                         /* both specified, added security */
 114                         if ((strlen(macaddress) == 17) &&
 115                             (VALID_IP(ipaddress))) {
 116                                 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
 117                                 safe_system(command);
 118                                 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -o ! %s -j ACCEPT", macaddress, ipaddress, blue_dev, green_dev);
 119                                 safe_system(command);
 120                                 snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j DMZHOLES", macaddress, ipaddress, blue_dev);
 121                                 safe_system(command);
 122                         } else {
 123
 124                                 /* correctly formed mac address is 17 chars */
 125                                 if (strlen(macaddress) == 17) {
 126                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
 127                                         safe_system(command);
 128                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -o ! %s -j ACCEPT", macaddress, blue_dev, green_dev);
 129                                         safe_system(command);
 130                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j DMZHOLES", macaddress, blue_dev);
 131                                         safe_system(command);
 132                                 }
 133
 134                                 if (VALID_IP(ipaddress)) {
 135                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
 136                                         safe_system(command);
 137                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -o ! %s -j ACCEPT", ipaddress, blue_dev, green_dev);
 138                                         safe_system(command);
 139                                         snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j DMZHOLES", ipaddress, blue_dev);
 140                                         safe_system(command);
 141                                 }
 142                         }
 143                 }
 144         }
 145
 146         return 0;
 147 }