webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-24 01:42:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fifteen' of ssh://git.ipfire.org/pub/git/ipfire-2.x into fifteen

Browse Source
This commit is contained in:
Arne Fitzenreiter
2013-09-08 15:26:47 +02:00
parent 0ec5f231e4 095cbf430f
commit ff6f40b1f5
9 changed files with 150 additions and 167 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
config/kernel/kernel.config.armv5tel-ipfire-kirkwood
View File

@@ -299,7 +299,7 @@ CONFIG_ARCH_KIRKWOOD=y
# CONFIG_ARCH_DAVINCI is not set
# CONFIG_ARCH_OMAP1 is not set
# CONFIG_GPIO_PCA953X is not set
CONFIG_KEYBOARD_GPIO_POLLED=m
CONFIG_KEYBOARD_GPIO_POLLED=y
#
# Marvell Kirkwood Implementations
@@ -2221,7 +2221,7 @@ CONFIG_KEYBOARD_ATKBD=y
# CONFIG_KEYBOARD_QT1070 is not set
# CONFIG_KEYBOARD_QT2160 is not set
# CONFIG_KEYBOARD_LKKBD is not set
CONFIG_KEYBOARD_GPIO=m
CONFIG_KEYBOARD_GPIO=y
# CONFIG_KEYBOARD_TCA6416 is not set
# CONFIG_KEYBOARD_TCA8418 is not set
# CONFIG_KEYBOARD_MATRIX is not set
@@ -2258,8 +2258,8 @@ CONFIG_MOUSE_SYNAPTICS_USB=m
# CONFIG_INPUT_TABLET is not set
# CONFIG_INPUT_TOUCHSCREEN is not set
CONFIG_INPUT_MISC=y
CONFIG_INPUT_88PM860X_ONKEY=m
CONFIG_INPUT_88PM80X_ONKEY=m
# CONFIG_INPUT_88PM860X_ONKEY is not set
# CONFIG_INPUT_88PM80X_ONKEY is not set
# CONFIG_INPUT_AD714X is not set
# CONFIG_INPUT_BMA150 is not set
# CONFIG_INPUT_MMA8450 is not set

2
config/kernel/kernel.config.armv5tel-ipfire-rpi
View File

@@ -1746,7 +1746,7 @@ CONFIG_INPUT_MOUSEDEV=y
CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
# CONFIG_INPUT_JOYDEV is not set
# CONFIG_INPUT_EVDEV is not set
CONFIG_INPUT_EVDEV=y
# CONFIG_INPUT_EVBUG is not set
#

3
config/rootfiles/core/fifteen/filelists/files
View File

@@ -2,8 +2,11 @@ etc/system-release
etc/issue
etc/rc.d/init.d/network
srv/web/ipfire/cgi-bin/index.cgi
srv/web/ipfire/cgi-bin/netinternal.cgi
srv/web/ipfire/cgi-bin/ovpnmain.cgi
srv/web/ipfire/cgi-bin/proxy.cgi
srv/web/ipfire/cgi-bin/upnp.cgi
srv/web/ipfire/cgi-bin/speed.cgi
srv/web/ipfire/cgi-bin/vpnmain.cgi
var/ipfire/backup/bin/backup.pl
var/ipfire/backup/exclude

4
html/cgi-bin/netinternal.cgi
View File

@@ -61,8 +61,8 @@ if ( $querry[0] =~ /wireless/ ){
&Header::openbigbox('100%', 'left');
push (@graphs, ($netsettings{'GREEN_DEV'}));
if ($netsettings{'BLUE_DEV'}) {push (@graphs, ($netsettings{'BLUE_DEV'})); }
if ($netsettings{'ORANGE_DEV'}) {push (@graphs, ($netsettings{'ORANGE_DEV'})); }
if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {push (@graphs, ($netsettings{'BLUE_DEV'})); }
if (&Header::orange_used() && $netsettings{'ORANGE_DEV'}) {push (@graphs, ($netsettings{'ORANGE_DEV'})); }
my @wirelessgraphs = `ls -dA /var/log/rrd/collectd/localhost/wireless* 2>/dev/null`;
foreach (@wirelessgraphs){

4
html/cgi-bin/proxy.cgi
View File

@@ -180,8 +180,8 @@ close(FILE);
&General::readhash("${General::swroot}/main/settings", \%mainsettings);
my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}\/$netsettings{'GREEN_NETMASK'}");
my $blue_cidr = "# Blue not defined";
if ($netsettings{'BLUE_DEV'}) {
my $blue_cidr = "";
if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {
$blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}\/$netsettings{'BLUE_NETMASK'}");
}

5
html/cgi-bin/speed.cgi
View File

@@ -36,9 +36,8 @@ foreach $field (@fields) {
}
}
my $interface = `cat /var/ipfire/red/iface`;
my @data_now = `ip -s link show $interface`;
my $interface = `cat /var/ipfire/red/iface 2>/dev/null`;
my @data_now = `ip -s link show $interface 2>/dev/null`;
my $lastline;
my $rxb_now = 0;

4
html/cgi-bin/vpnmain.cgi
View File

@@ -61,11 +61,11 @@ my %mainsettings = ();
my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}");
my $blue_cidr = "# Blue not defined";
if ($netsettings{'BLUE_DEV'}) {
if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {
$blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}");
}
my $orange_cidr = "# Orange not defined";
if ($netsettings{'ORANGE_DEV'}) {
if (&Header::orange_used() && $netsettings{'ORANGE_DEV'}) {
$orange_cidr = &General::ipcidr("$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}");
}

4
lfs/configroot
View File

@@ -122,8 +122,8 @@ $(TARGET) :
echo "FWPOLICY2=DROP" >> $(CONFIG_ROOT)/optionsfw/settings
echo "DROPPORTSCAN=on" >> $(CONFIG_ROOT)/optionsfw/settings
echo "DROPOUTGOING=on" >> $(CONFIG_ROOT)/optionsfw/settings
echo "DROPSAMBA=on" >> $(CONFIG_ROOT)/optionsfw/settings
echo "DROPPROXY=on" >> $(CONFIG_ROOT)/optionsfw/settings
echo "DROPSAMBA=off" >> $(CONFIG_ROOT)/optionsfw/settings
echo "DROPPROXY=off" >> $(CONFIG_ROOT)/optionsfw/settings
echo "SHOWREMARK=on" >> $(CONFIG_ROOT)/optionsfw/settings
echo "SHOWCOLORS=on" >> $(CONFIG_ROOT)/optionsfw/settings
echo "SHOWTABLES=off" >> $(CONFIG_ROOT)/optionsfw/settings

283
src/misc-progs/wirelessctrl.c
View File

@@ -5,8 +5,6 @@
*
* (c) Alan Hourihane, 2003
*
* $Id: wirelessctrl.c,v 1.2.2.5 2005/07/11 10:56:47 franck78 Exp $
*
*/
#include "libsmooth.h"
@@ -25,167 +23,150 @@ FILE *fd = NULL;
char blue_dev[STRING_SIZE] = "";
char command[STRING_SIZE];
void exithandler(void)
{
/* added comment mark to the drop rules to be able to collect the bytes by the collectd */
if(strlen(blue_dev))
{
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
}
void exithandler(void) {
/* added comment mark to the drop rules to be able to collect the bytes by the collectd */
if (strlen(blue_dev) > 0) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
}
if (fd)
fclose(fd);
if (fd)
fclose(fd);
}
int main(void)
{
char green_dev[STRING_SIZE] = "";
char buffer[STRING_SIZE];
char *index, *ipaddress, *macaddress, *enabled;
struct keyvalue *kv = NULL;
int main(void) {
char green_dev[STRING_SIZE] = "";
char buffer[STRING_SIZE];
char *index, *ipaddress, *macaddress, *enabled;
struct keyvalue *kv = NULL;
if (!(initsetuid()))
exit(1);
if (!(initsetuid()))
exit(1);
/* flush wireless iptables */
safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null");
safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null");
/* flush wireless iptables */
safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null");
safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null");
memset(buffer, 0, STRING_SIZE);
memset(buffer, 0, STRING_SIZE);
/* Init the keyvalue structure */
kv=initkeyvalues();
/* Init the keyvalue structure */
kv=initkeyvalues();
/* Read in the current values */
if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
{
fprintf(stderr, "Cannot read ethernet settings\n");
exit(1);
/* Read in the current values */
if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
fprintf(stderr, "Cannot read ethernet settings\n");
exit(1);
}
/* Read in the firewall values */
if (!readkeyvalues(kv, CONFIG_ROOT "/optionsfw/settings")) {
fprintf(stderr, "Cannot read optionsfw settings\n");
exit(1);
}
/* Get the GREEN interface details */
if (findkey(kv, "GREEN_DEV", green_dev) > 0) {
if (!VALID_DEVICE(green_dev)) {
fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
exit(1);
}
}
/* Get the BLUE interface details */
if (findkey(kv, "BLUE_DEV", blue_dev) > 0) {
if ((strlen(blue_dev) > 0) && !VALID_DEVICE(blue_dev)) {
fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
exit(1);
}
}
if (strlen(blue_dev) == 0) {
exit(0);
}
if ((fd = fopen(CONFIG_ROOT "/wireless/nodrop", "r")))
return 0;
/* register exit handler to ensure the block rule is always present */
atexit(exithandler);
if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r"))) {
exit(0);
}
/* restrict blue access tp the proxy port */
if (findkey(kv, "DROPPROXY", buffer) && strcmp(buffer,"off") == 0) {
/* Read the proxy values */
if (!readkeyvalues(kv, CONFIG_ROOT "/proxy/settings") || !(findkey(kv, "PROXY_PORT", buffer))) {
fprintf(stderr, "Cannot read proxy settings\n");
exit(1);
}
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev, buffer);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev, buffer);
safe_system(command);
}
/* not allow blue to acces a samba server running on local fire*/
if(findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer,"off")){
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
}
while (fgets(buffer, STRING_SIZE, fd)) {
buffer[strlen(buffer) - 1] = 0;
index = strtok(buffer, ",");
ipaddress = strtok(NULL, ",");
macaddress = strtok(NULL, ",");
enabled = strtok(NULL, ",");
if (strncmp(enabled, "on", 2) != 0) {
/* both specified, added security */
if ((strlen(macaddress) == 17) && (VALID_IP_AND_MASK(ipaddress))) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress, ipaddress, blue_dev);
safe_system(command);
} else {
/* correctly formed mac address is 17 chars */
if (strlen(macaddress) == 17) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j RETURN", macaddress, blue_dev);
safe_system(command);
}
/* Read in the firewall values */
if (!readkeyvalues(kv, CONFIG_ROOT "/optionsfw/settings"))
{
fprintf(stderr, "Cannot read optionsfw settings\n");
exit(1);
if (VALID_IP_AND_MASK(ipaddress)) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j RETURN", ipaddress, blue_dev);
safe_system(command);
}
}
}
}
/* Get the GREEN interface details */
if(!findkey(kv, "GREEN_DEV", green_dev))
{
fprintf(stderr, "Cannot read GREEN_DEV\n");
exit(1);
}
if (!VALID_DEVICE(green_dev))
{
fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
exit(1);
}
/* Get the BLUE interface details */
if(!findkey(kv, "BLUE_DEV", blue_dev))
{
fprintf(stderr, "Cannot read BLUE_DEV\n");
exit(1);
}
if (strlen(blue_dev) && !VALID_DEVICE(blue_dev))
{
fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
exit(1);
}
if(! strlen(blue_dev) > 0)
{
fprintf(stderr, "No BLUE interface\n");
exit(0);
}
/* with this rule you can disable the logging of the dropped wireless input packets*/
if (!findkey(kv, "DROPWIRELESSINPUT", buffer) || strcmp(buffer,"off") == 0) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
}
if ((fd = fopen(CONFIG_ROOT "/wireless/nodrop", "r")))
return 0;
/* with this rule you can disable the logging of the dropped wireless forward packets*/
if (!findkey(kv, "DROPWIRELESSFORWARD", buffer) || strcmp(buffer,"off") == 0) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
}
/* register exit handler to ensure the block rule is always present */
atexit(exithandler);
if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r")))
{
exit(0);
}
/* restrict blue access tp the proxy port */
if(findkey(kv, "DROPPROXY", buffer) && strcmp(buffer,"off")){
/* Read the proxy values */
if (!readkeyvalues(kv, CONFIG_ROOT "/proxy/settings") || !(findkey(kv, "PROXY_PORT", buffer)))
{
fprintf(stderr, "Cannot read proxy settings\n");
exit(1);
}
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev, buffer);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev, buffer);
safe_system(command);
}
/* not allow blue to acces a samba server running on local fire*/
if(findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer,"off")){
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
}
while (fgets(buffer, STRING_SIZE, fd))
{
buffer[strlen(buffer) - 1] = 0;
index = strtok(buffer, ",");
ipaddress = strtok(NULL, ",");
macaddress = strtok(NULL, ",");
enabled = strtok(NULL, ",");
if (!strncmp(enabled, "on", 2)) {
/* both specified, added security */
if ((strlen(macaddress) == 17) &&
(VALID_IP_AND_MASK(ipaddress))) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress, ipaddress, blue_dev);
safe_system(command);
} else {
/* correctly formed mac address is 17 chars */
if (strlen(macaddress) == 17) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j RETURN", macaddress, blue_dev);
safe_system(command);
}
if (VALID_IP_AND_MASK(ipaddress)) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j RETURN", ipaddress, blue_dev);
safe_system(command);
}
}
}
}
/* with this rule you can disable the logging of the dropped wireless input packets*/
if(!findkey(kv, "DROPWIRELESSINPUT", buffer) || strcmp(buffer,"off")){
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
}
/* with this rule you can disable the logging of the dropped wireless forward packets*/
if(!findkey(kv, "DROPWIRELESSFORWARD", buffer) || strcmp(buffer,"off")){
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
}
return 0;
return 0;
}