int main(int argc, char *argv[]) {
char configtype[STRING_SIZE];
char redtype[STRING_SIZE] = "";
struct keyvalue *kv = NULL;
if (argc < 2) {
usage();
exit(1);
}
if (!(initsetuid()))
exit(1);
FILE *file = NULL;
if (strcmp(argv[1], "I") == 0) {
safe_system("/usr/sbin/ipsec status");
exit(0);
}
if (strcmp(argv[1], "R") == 0) {
safe_system("/usr/sbin/ipsec reload >/dev/null 2>&1");
exit(0);
}
/* FIXME: workaround for pclose() issue - still no real idea why
* this is happening */
signal(SIGCHLD, SIG_DFL);
/* handle operations that doesn't need start the ipsec system */
if (argc == 2) {
if (strcmp(argv[1], "D") == 0) {
safe_system("/usr/sbin/ipsec stop >/dev/null 2>&1");
ipsec_norules();
exit(0);
}
}
/* read vpn config */
kv=initkeyvalues();
if (!readkeyvalues(kv, CONFIG_ROOT "/vpn/settings"))
{
fprintf(stderr, "Cannot read vpn settings\n");
exit(1);
}
/* check is the vpn system is enabled */
{
char s[STRING_SIZE];
findkey(kv, "ENABLED", s);
freekeyvalues(kv);
if (strcmp (s, "on") != 0)
exit(0);
}
/* read interface settings */
kv=initkeyvalues();
if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
{
fprintf(stderr, "Cannot read ethernet settings\n");
exit(1);
}
if (!findkey(kv, "CONFIG_TYPE", configtype))
{
fprintf(stderr, "Cannot read CONFIG_TYPE\n");
exit(1);
}
findkey(kv, "RED_TYPE", redtype);
/* Loop through the config file to find physical interface that will accept IPSEC */
int enable_red=0; // states 0: not used
int enable_green=0; // 1: error condition
int enable_orange=0; // 2: good
int enable_blue=0;
char if_red[STRING_SIZE] = "";
char if_green[STRING_SIZE] = "";
char if_orange[STRING_SIZE] = "";
char if_blue[STRING_SIZE] = "";
char s[STRING_SIZE];
// when RED is up, find interface name in special file
FILE *ifacefile = NULL;
if ((ifacefile = fopen(CONFIG_ROOT "/red/iface", "r"))) {
if (fgets(if_red, STRING_SIZE, ifacefile)) {
if (if_red[strlen(if_red) - 1] == '\n')
if_red[strlen(if_red) - 1] = '\0';
}
fclose (ifacefile);
if (VALID_DEVICE(if_red))
enable_red++;
}
// Check if GREEN is enabled.
findkey(kv, "GREEN_DEV", if_green);
if (VALID_DEVICE(if_green))
enable_green++;
// Check if ORANGE is enabled.
findkey(kv, "ORANGE_DEV", if_orange);
if (VALID_DEVICE(if_orange))
enable_orange++;
// Check if BLUE is enabled.
findkey(kv, "BLUE_DEV", if_blue);
if (VALID_DEVICE(if_blue))
enable_blue++;
freekeyvalues(kv);
// exit if nothing to do
if ((enable_red+enable_green+enable_orange+enable_blue) == 0)
exit(0);
// open needed ports
if (enable_red > 0)
open_physical(if_red, 4500);
if (enable_green > 0)
open_physical(if_green, 4500);
if (enable_orange > 0)
open_physical(if_orange, 4500);
if (enable_blue > 0)
open_physical(if_blue, 4500);
// start the system
if ((argc == 2) && strcmp(argv[1], "S") == 0) {
safe_system("/usr/sbin/ipsec restart >/dev/null");
exit(0);
}
// it is a selective start or stop
// second param is only a number 'key'
if ((argc == 2) || strspn(argv[2], NUMBERS) != strlen(argv[2])) {
fprintf(stderr, "Bad arg: %s\n", argv[2]);
usage();
exit(1);
}
// search the vpn pointed by 'key'
if (!(file = fopen(CONFIG_ROOT "/vpn/config", "r"))) {
fprintf(stderr, "Couldn't open vpn settings file");
exit(1);
}
while (fgets(s, STRING_SIZE, file) != NULL) {
char *key;
char *name;
char *type;
if (!decode_line(s,&key,&name,&type))
continue;
// is it the 'key' requested ?
if (strcmp(argv[2], key) != 0)
continue;
// Start or Delete this Connection
if (strcmp(argv[1], "S") == 0)
turn_connection_on (name, type);
else if (strcmp(argv[1], "D") == 0)
turn_connection_off (name);
else {
fprintf(stderr, "Bad command\n");
exit(1);
}
}
fclose(file);
return 0;
}
int main(void) {
char green_dev[STRING_SIZE] = "";
char buffer[STRING_SIZE];
char *index, *ipaddress, *macaddress, *enabled;
struct keyvalue *kv = NULL;
if (!(initsetuid()))
exit(1);
/* flush wireless iptables */
safe_system("/sbin/iptables --wait -F WIRELESSINPUT > /dev/null 2> /dev/null");
safe_system("/sbin/iptables --wait -F WIRELESSFORWARD > /dev/null 2> /dev/null");
memset(buffer, 0, STRING_SIZE);
/* Init the keyvalue structure */
kv=initkeyvalues();
/* Read in the current values */
if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings")) {
fprintf(stderr, "Cannot read ethernet settings\n");
exit(1);
}
/* Read in the firewall values */
if (!readkeyvalues(kv, CONFIG_ROOT "/optionsfw/settings")) {
fprintf(stderr, "Cannot read optionsfw settings\n");
exit(1);
}
/* Get the GREEN interface details */
if (findkey(kv, "GREEN_DEV", green_dev) > 0) {
if (!VALID_DEVICE(green_dev)) {
fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
exit(1);
}
}
/* Get the BLUE interface details */
if (findkey(kv, "BLUE_DEV", blue_dev) > 0) {
if ((strlen(blue_dev) > 0) && !VALID_DEVICE(blue_dev)) {
fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
exit(1);
}
}
if (strlen(blue_dev) == 0) {
exit(0);
}
if ((fd = fopen(CONFIG_ROOT "/wireless/nodrop", "r")))
return 0;
/* register exit handler to ensure the block rule is always present */
atexit(exithandler);
if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r"))) {
exit(0);
}
/* restrict blue access tp the proxy port */
if (findkey(kv, "DROPPROXY", buffer) && strcmp(buffer, "on") == 0) {
/* Read the proxy values */
if (!readkeyvalues(kv, CONFIG_ROOT "/proxy/settings") || !(findkey(kv, "PROXY_PORT", buffer))) {
fprintf(stderr, "Cannot read proxy settings\n");
exit(1);
}
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev, buffer);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p tcp ! --dport %s -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev, buffer);
safe_system(command);
}
/* not allow blue to acces a samba server running on local fire*/
if (findkey(kv, "DROPSAMBA", buffer) && strcmp(buffer, "on") == 0) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p tcp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -p udp -m multiport --ports 135,137,138,139,445,1025 -j DROP -m comment --comment 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
}
while (fgets(buffer, STRING_SIZE, fd)) {
buffer[strlen(buffer) - 1] = 0;
index = strtok(buffer, ",");
ipaddress = strtok(NULL, ",");
macaddress = strtok(NULL, ",");
enabled = strtok(NULL, ",");
if (strcmp(enabled, "on") == 0) {
/* both specified, added security */
if ((strlen(macaddress) == 17) && (VALID_IP_AND_MASK(ipaddress))) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j RETURN", macaddress, ipaddress, blue_dev);
safe_system(command);
} else {
/* correctly formed mac address is 17 chars */
if (strlen(macaddress) == 17) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j RETURN", macaddress, blue_dev);
safe_system(command);
}
if (VALID_IP_AND_MASK(ipaddress)) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
safe_system(command);
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -s %s -i %s -j RETURN", ipaddress, blue_dev);
safe_system(command);
}
}
}
}
/* with this rule you can disable the logging of the dropped wireless input packets*/
if (findkey(kv, "DROPWIRELESSINPUT", buffer) && strcmp(buffer, "on") == 0) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSINPUT -i %s -j LOG --log-prefix 'DROP_Wirelessinput'", blue_dev);
safe_system(command);
}
/* with this rule you can disable the logging of the dropped wireless forward packets*/
if (findkey(kv, "DROPWIRELESSFORWARD", buffer) && strcmp(buffer, "on") == 0) {
snprintf(command, STRING_SIZE-1, "/sbin/iptables --wait -A WIRELESSFORWARD -i %s -j LOG --log-prefix 'DROP_Wirelessforward'", blue_dev);
safe_system(command);
}
return 0;
}
int main(void)
{
char s[STRING_SIZE];
char command[STRING_SIZE];
char red_netmask[STRING_SIZE];
char red_broadcast[STRING_SIZE];
char red_dev[STRING_SIZE];
char default_gateway[STRING_SIZE];
char *aliasip;
char *enabled;
char *sptr;
char *comment;
int alias;
int count;
if (!(initsetuid()))
{
fprintf(stderr, "Cannot run setuid\n");
exit(1);
}
atexit(exithandler);
/* Init the keyvalue structure */
kv=initkeyvalues();
/* Read in the current values */
if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
{
fprintf(stderr, "Cannot read ethernet settings\n");
exit(1);
}
/* Find the CONFIG_TYPE value */
if (!findkey(kv, "CONFIG_TYPE", s))
{
fprintf(stderr, "Cannot read CONFIG_TYPE\n");
exit(1);
}
/* Check for CONFIG_TYPE=2 or 3 i.e. RED ethernet present. If not,
* exit gracefully. This is not an error... */
if (!((strcmp(s, "1")==0) || (strcmp(s, "2")==0) || (strcmp(s, "3")==0) || (strcmp(s, "4")==0)))
exit(0);
/* Now check the RED_TYPE - aliases only work with STATIC.
* At least, that's what /etc/rc.d/rc.netaddress.up thinks.. */
/* Find the RED_TYPE value */
if (!findkey(kv, "RED_TYPE", s))
{
fprintf(stderr, "Cannot read RED_TYPE\n");
exit(1);
}
/* Make sure it's the right type */
if (!(strcmp(s, "STATIC")==0))
exit(0);
/* Get the RED interface details */
if((!findkey(kv, "RED_NETMASK", red_netmask)) || (!findkey(kv, "RED_BROADCAST", red_broadcast)) ||
(!findkey(kv, "RED_DEV", red_dev)) || (!findkey(kv, "DEFAULT_GATEWAY", default_gateway)))
{
fprintf(stderr, "Cannot read RED settings\n");
exit(1);
}
if (!VALID_DEVICE(red_dev))
{
fprintf(stderr, "Bad red_dev: %s\n", red_dev);
exit(1);
}
if (!VALID_IP(red_netmask))
{
fprintf(stderr, "Bad red_netmask : %s\n", red_netmask);
exit(1);
}
if (!VALID_IP(red_broadcast))
{
fprintf(stderr, "Bad red_broadcast : %s\n", red_broadcast);
exit(1);
}
if (!VALID_IP(default_gateway))
{
fprintf(stderr, "Bad default_gateway : %s\n", default_gateway);
exit(1);
}
/* down the aliases in turn until ifconfig complains */
alias=0;
do
{
memset(command, 0, STRING_SIZE);
snprintf(command, STRING_SIZE-1, "/sbin/ifconfig %s:%d down 2>/dev/null", red_dev, alias++);
} while (safe_system(command)==0);
/* Now set up the new aliases from the config file */
if (!(file = fopen(CONFIG_ROOT "/ethernet/aliases", "r")))
{
fprintf(stderr, "Unable to open aliases configuration file\n");
exit(1);
}
alias=0;
int linecounter = 0;
while (fgets(s, STRING_SIZE, file) != NULL)
{
linecounter++;
if (s[strlen(s) - 1] == '\n')
s[strlen(s) - 1] = '\0';
count = 0;
aliasip = NULL;
enabled = NULL;
comment = NULL;
sptr = strtok(s, ",");
while (sptr)
{
if (count == 0)
aliasip = sptr;
if (count == 1)
enabled = sptr;
else
comment = sptr;
count++;
sptr = strtok(NULL, ",");
}
if (!(aliasip && enabled)) {
fprintf(stderr, "Incomplete data line: in %s(%d)\n",
CONFIG_ROOT "/ethernet/aliases",
linecounter);
exit(1);
}
if (!strcmp(enabled, "on") == 0) /* disabled rule? */
continue;
if (!VALID_IP(aliasip))
{
fprintf(stderr, "Bad alias : %s in %s(%d)\n",
aliasip,
CONFIG_ROOT "/ethernet/aliases",
linecounter);
exit(1);
}
memset(command, 0, STRING_SIZE);
snprintf(command, STRING_SIZE-1,
"/sbin/ifconfig %s:%d %s netmask %s broadcast %s up",
red_dev, alias, aliasip, red_netmask, red_broadcast);
safe_system(command);
memset(command, 0, STRING_SIZE);
snprintf(command, STRING_SIZE-1,
"/usr/sbin/arping -q -c 1 -w 1 -i %s -S %s %s",
red_dev, aliasip, default_gateway);
safe_system(command);
alias++;
}
return 0;
}
