webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-24 01:42:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

corrected because micha said so :D

Browse Source 
git-svn-id: http://svn.ipfire.org/svn/ipfire/branches/2.1/trunk@1224 ea5c0bd1-69bd-2848-81d8-4f18e57aeed8
This commit is contained in:
maniacikarus
2008-02-19 20:41:37 +00:00
parent 87f7ed9683
commit 0a56f193d3
1 changed files with 123 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files

236
src/misc-progs/wirelessctrl.c
View File

@@ -4,7 +4,7 @@
* Licence. See the file COPYING for details.
*
* (c) Alan Hourihane, 2003
*
*
* $Id: wirelessctrl.c,v 1.2.2.5 2005/07/11 10:56:47 franck78 Exp $
*
*/
@@ -25,133 +25,143 @@ FILE *fd = NULL;
char blue_dev[STRING_SIZE] = "";
char command[STRING_SIZE];
void exithandler(void)
{
/* added comment mark to the drop rules to be able to collect the bytes by the collectd */
if(strlen(blue_dev))
{
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
}
if (fd)
fclose(fd);
}
int main(void)
{
char green_dev[STRING_SIZE] = "";
char buffer[STRING_SIZE];
char *index, *ipaddress, *macaddress, *enabled;
struct keyvalue *kv = NULL;
char green_dev[STRING_SIZE] = "";
char buffer[STRING_SIZE];
char *index, *ipaddress, *macaddress, *enabled;
struct keyvalue *kv = NULL;
if (!(initsetuid()))
exit(1);
if (!(initsetuid()))
exit(1);
/* flush wireless iptables */
safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null");
safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null");
/* flush wireless iptables */
safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null");
safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null");
memset(buffer, 0, STRING_SIZE);
memset(buffer, 0, STRING_SIZE);
/* Init the keyvalue structure */
kv=initkeyvalues();
/* Init the keyvalue structure */
kv=initkeyvalues();
/* Read in the current values */
if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
{
fprintf(stderr, "Cannot read ethernet settings\n");
exit(1);
}
/* Read in the current values */
if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
{
fprintf(stderr, "Cannot read ethernet settings\n");
exit(1);
}
/* Read in the firewall values */
if (!readkeyvalues(kv, CONFIG_ROOT "/optionsfw/settings"))
{
fprintf(stderr, "Cannot read optionsfw settings\n");
exit(1);
}
/* Read in the firewall values */
if (!readkeyvalues(kv, CONFIG_ROOT "/optionsfw/settings"))
{
fprintf(stderr, "Cannot read optionsfw settings\n");
exit(1);
}
/* Get the GREEN interface details */
if(!findkey(kv, "GREEN_DEV", green_dev))
{
fprintf(stderr, "Cannot read GREEN_DEV\n");
exit(1);
}
if (!VALID_DEVICE(green_dev))
{
fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
exit(1);
}
/* Get the BLUE interface details */
if(!findkey(kv, "BLUE_DEV", blue_dev))
{
fprintf(stderr, "Cannot read BLUE_DEV\n");
exit(1);
}
if (strlen(blue_dev) && !VALID_DEVICE(blue_dev))
{
fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
exit(1);
}
if(! strlen(blue_dev) > 0)
{
fprintf(stderr, "No BLUE interface\n");
exit(0);
}
/* Get the GREEN interface details */
if(!findkey(kv, "GREEN_DEV", green_dev))
{
fprintf(stderr, "Cannot read GREEN_DEV\n");
exit(1);
}
if (!VALID_DEVICE(green_dev))
{
fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
exit(1);
}
/* Get the BLUE interface details */
if(!findkey(kv, "BLUE_DEV", blue_dev))
{
fprintf(stderr, "Cannot read BLUE_DEV\n");
exit(1);
}
if (strlen(blue_dev) && !VALID_DEVICE(blue_dev))
{
fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
exit(1);
}
if(! strlen(blue_dev) > 0)
{
fprintf(stderr, "No BLUE interface\n");
exit(0);
}
if(strlen(blue_dev))
{
if(findkey(kv, "DROPWIRELESSINPUT", buffer) && !strcmp(buffer,"on")){
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
}
if(findkey(kv, "DROPWIRELESSFORWARD", buffer) && !strcmp(buffer,"on")){
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
}
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
}
/* with this rule you can disable the logging of the dropped wireless input packets*/
if(findkey(kv, "DROPWIRELESSINPUT", buffer) && !strcmp(buffer,"on")){
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
}
/* with this rule you can disable the logging of the dropped wireless forward packets*/
if(findkey(kv, "DROPWIRELESSFORWARD", buffer) && !strcmp(buffer,"on")){
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
}
if (fd)
fclose(fd);
/* register exit handler to ensure the block rule is always present */
atexit(exithandler);
if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r")))
{
exit(0);
}
while (fgets(buffer, STRING_SIZE, fd))
{
buffer[strlen(buffer) - 1] = 0;
if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r")))
{
exit(0);
}
while (fgets(buffer, STRING_SIZE, fd))
{
buffer[strlen(buffer) - 1] = 0;
index = strtok(buffer, ",");
ipaddress = strtok(NULL, ",");
macaddress = strtok(NULL, ",");
enabled = strtok(NULL, ",");
index = strtok(buffer, ",");
ipaddress = strtok(NULL, ",");
macaddress = strtok(NULL, ",");
enabled = strtok(NULL, ",");
if (!strncmp(enabled, "on", 2)) {
/* both specified, added security */
if ((strlen(macaddress) == 17) &&
(VALID_IP(ipaddress))) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -o ! %s -j ACCEPT", macaddress, ipaddress, blue_dev, green_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j DMZHOLES", macaddress, ipaddress, blue_dev);
safe_system(command);
} else {
if (!strncmp(enabled, "on", 2)) {
/* correctly formed mac address is 17 chars */
if (strlen(macaddress) == 17) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -o ! %s -j ACCEPT", macaddress, blue_dev, green_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j DMZHOLES", macaddress, blue_dev);
safe_system(command);
}
/* both specified, added security */
if ((strlen(macaddress) == 17) &&
(VALID_IP(ipaddress))) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -o ! %s -j ACCEPT", macaddress, ipaddress, blue_dev, green_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j DMZHOLES", macaddress, ipaddress, blue_dev);
safe_system(command);
} else {
if (VALID_IP(ipaddress)) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -o ! %s -j ACCEPT", ipaddress, blue_dev, green_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j DMZHOLES", ipaddress, blue_dev);
safe_system(command);
}
}
}
}
/* correctly formed mac address is 17 chars */
if (strlen(macaddress) == 17) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -o ! %s -j ACCEPT", macaddress, blue_dev, green_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j DMZHOLES", macaddress, blue_dev);
safe_system(command);
}
return 0;
if (VALID_IP(ipaddress)) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -o ! %s -j ACCEPT", ipaddress, blue_dev, green_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j DMZHOLES", ipaddress, blue_dev);
safe_system(command);
}
}
}
}
return 0;
}