garden.c

   1 #include <string.h>
   2 #include <malloc.h>
   3 #include <stdlib.h>
   4 #include <sys/wait.h>
   5 #include <sys/types.h>
   6 #include "l2tpns.h"
   7 #include "plugin.h"
   8 #include "control.h"
   9
  10 /* walled garden */
  11
  12 int plugin_api_version = PLUGIN_API_VERSION;
  13 static struct pluginfuncs *f = 0;
  14
  15 static int iam_master = 0;      // We're all slaves! Slaves I tell you!
  16
  17 char *up_commands[] = {
  18     "iptables -t nat -N garden >/dev/null 2>&1",                // Create a chain that all gardened users will go through
  19     "iptables -t nat -F garden",
  20     ". " PLUGINCONF "/build-garden",                            // Populate with site-specific DNAT rules
  21     "iptables -t nat -N garden_users >/dev/null 2>&1",          // Empty chain, users added/removed by garden_session
  22     "iptables -t nat -F garden_users",
  23     "iptables -t nat -A PREROUTING -j garden_users",            // DNAT any users on the garden_users chain
  24     "sysctl -w net.ipv4.netfilter.ip_conntrack_max=512000"      // lots of entries
  25              " net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=18000 >/dev/null", // 5hrs
  26     NULL,
  27 };
  28
  29 char *down_commands[] = {
  30     "iptables -t nat -F PREROUTING",
  31     "iptables -t nat -F garden_users",
  32     "iptables -t nat -X garden_users",
  33     "iptables -t nat -F garden",
  34     "iptables -t nat -X garden",
  35     "rmmod iptable_nat",        // Should also remove ip_conntrack, but
  36                                 // doing so can take hours...  literally.
  37                                 // If a master is re-started as a slave,
  38                                 // either rmmod manually, or reboot.
  39     NULL,
  40 };
  41
  42 #define F_UNGARDEN      0
  43 #define F_GARDEN        1
  44 #define F_CLEANUP       2
  45
  46 int garden_session(sessiont *s, int flag, char *newuser);
  47
  48 int plugin_post_auth(struct param_post_auth *data)
  49 {
  50     // Ignore if user authentication was successful
  51     if (data->auth_allowed)
  52         return PLUGIN_RET_OK;
  53
  54     f->log(3, f->get_id_by_session(data->s), data->s->tunnel,
  55         "Walled Garden allowing login\n");
  56
  57     data->auth_allowed = 1;
  58     data->s->walled_garden = 1;
  59     return PLUGIN_RET_OK;
  60 }
  61
  62 int plugin_new_session(struct param_new_session *data)
  63 {
  64     if (!iam_master)
  65         return PLUGIN_RET_OK;   // Slaves don't do walled garden processing.
  66
  67     if (data->s->walled_garden)
  68         garden_session(data->s, F_GARDEN, 0);
  69
  70     return PLUGIN_RET_OK;
  71 }
  72
  73 int plugin_kill_session(struct param_new_session *data)
  74 {
  75     if (!iam_master)
  76         return PLUGIN_RET_OK;   // Slaves don't do walled garden processing.
  77
  78     if (data->s->walled_garden)
  79         garden_session(data->s, F_CLEANUP, 0);
  80
  81     return PLUGIN_RET_OK;
  82 }
  83
  84 char *plugin_control_help[] = {
  85     "  garden USER|SID                             Put user into the walled garden",
  86     "  ungarden SID [USER]                         Release session from garden",
  87     0
  88 };
  89
  90 int plugin_control(struct param_control *data)
  91 {
  92     sessionidt session;
  93     sessiont *s = 0;
  94     int flag;
  95     char *end;
  96
  97     if (data->argc < 1)
  98         return PLUGIN_RET_OK;
  99
 100     if (strcmp(data->argv[0], "garden") && strcmp(data->argv[0], "ungarden"))
 101         return PLUGIN_RET_OK; // not for us
 102
 103     if (!iam_master)
 104         return PLUGIN_RET_NOTMASTER;
 105
 106     flag = data->argv[0][0] == 'g' ? F_GARDEN : F_UNGARDEN;
 107
 108     if (data->argc < 2 || data->argc > 3 || (data->argc > 2 && flag == F_GARDEN))
 109     {
 110         data->response = NSCTL_RES_ERR;
 111         data->additional = flag == F_GARDEN
 112             ? "requires username or session id"
 113             : "requires session id and optional username";
 114
 115         return PLUGIN_RET_STOP;
 116     }
 117
 118     if (!(session = strtol(data->argv[1], &end, 10)) || *end)
 119     {
 120         if (flag)
 121             session = f->get_session_by_username(data->argv[1]);
 122         else
 123             session = 0; // can't ungarden by username
 124     }
 125
 126     if (session)
 127         s = f->get_session_by_id(session);
 128
 129     if (!s || !s->ip)
 130     {
 131         data->response = NSCTL_RES_ERR;
 132         data->additional = "session not found";
 133         return PLUGIN_RET_STOP;
 134     }
 135
 136     if (s->walled_garden == flag)
 137     {
 138         data->response = NSCTL_RES_ERR;
 139         data->additional = flag ? "already in walled garden" : "not in walled garden";
 140         return PLUGIN_RET_STOP;
 141     }
 142
 143     garden_session(s, flag, data->argc > 2 ? data->argv[2] : 0);
 144     f->session_changed(session);
 145
 146     data->response = NSCTL_RES_OK;
 147     data->additional = 0;
 148
 149     return PLUGIN_RET_STOP;
 150 }
 151
 152 int plugin_become_master(void)
 153 {
 154     int i;
 155     iam_master = 1;     // We just became the master. Wow!
 156
 157     for (i = 0; up_commands[i] && *up_commands[i]; i++)
 158     {
 159         f->log(3, 0, 0, "Running %s\n", up_commands[i]);
 160         if (-1 == system(up_commands[i])) f->log(0, 0, 0, "error command %s\n", up_commands[i]);
 161     }
 162
 163     return PLUGIN_RET_OK;
 164 }
 165
 166 // Called for each active session after becoming master
 167 int plugin_new_session_master(sessiont *s)
 168 {
 169     if (s->walled_garden)
 170         garden_session(s, F_GARDEN, 0);
 171
 172     return PLUGIN_RET_OK;
 173 }
 174
 175 int garden_session(sessiont *s, int flag, char *newuser)
 176 {
 177     char cmd[2048];
 178     sessionidt sess;
 179         int status;
 180
 181     if (!s) return 0;
 182     if (!s->opened) return 0;
 183
 184     sess = f->get_id_by_session(s);
 185     if (flag == F_GARDEN)
 186     {
 187         f->log(2, sess, s->tunnel, "Garden user %s (%s)\n", s->user,
 188             f->fmtaddr(htonl(s->ip), 0));
 189
 190         snprintf(cmd, sizeof(cmd),
 191             "iptables -t nat -A garden_users -s %s -j garden",
 192             f->fmtaddr(htonl(s->ip), 0));
 193
 194         f->log(3, sess, s->tunnel, "%s\n", cmd);
 195         status = system(cmd);
 196         s->walled_garden = 1;
 197     }
 198     else
 199     {
 200         sessionidt other;
 201         int count = 40;
 202
 203         // Normal User
 204         f->log(2, sess, s->tunnel, "Un-Garden user %s (%s)\n", s->user, f->fmtaddr(htonl(s->ip), 0));
 205         if (newuser)
 206         {
 207             snprintf(s->user, MAXUSER, "%s", newuser);
 208             f->log(2, sess, s->tunnel, "  Setting username to %s\n", s->user);
 209         }
 210
 211         // Kick off any duplicate usernames
 212         // but make sure not to kick off ourself
 213         if (s->ip && !s->die && (other = f->get_session_by_username(s->user)) &&
 214             s != f->get_session_by_id(other))
 215         {
 216             f->sessionkill(other,
 217                 "Duplicate session when user released from walled garden");
 218         }
 219
 220         /* Clean up counters */
 221         s->pin = s->pout = 0;
 222         s->cin = s->cout = 0;
 223         s->cin_delta = s->cout_delta = 0;
 224         s->cin_wrap = s->cout_wrap = 0;
 225
 226         snprintf(cmd, sizeof(cmd),
 227             "iptables -t nat -D garden_users -s %s -j garden",
 228             f->fmtaddr(htonl(s->ip), 0));
 229
 230         f->log(3, sess, s->tunnel, "%s\n", cmd);
 231         while (--count)
 232         {
 233             status = system(cmd);
 234             if (WEXITSTATUS(status) != 0) break;
 235         }
 236
 237         s->walled_garden = 0;
 238
 239         if (flag != F_CLEANUP)
 240         {
 241             /* OK, we're up! */
 242             uint16_t r = f->radiusnew(f->get_id_by_session(s));
 243             if (r) f->radiussend(r, RADIUSSTART);
 244         }
 245     }
 246
 247     return 1;
 248 }
 249
 250 int plugin_init(struct pluginfuncs *funcs)
 251 {
 252     FILE *tables;
 253     int found_nat = 0;
 254
 255     if (!funcs)
 256         return 0;
 257
 258     f = funcs;
 259
 260     if ((tables = fopen("/proc/net/ip_tables_names", "r")))
 261     {
 262         char buf[1024];
 263         while (fgets(buf, sizeof(buf), tables) && !found_nat)
 264             found_nat = !strcmp(buf, "nat\n");
 265
 266         fclose(tables);
 267     }
 268
 269     /* master killed/crashed? */
 270     if (found_nat)
 271     {
 272         int i;
 273         for (i = 0; down_commands[i] && *down_commands[i]; i++)
 274         {
 275             f->log(3, 0, 0, "Running %s\n", down_commands[i]);
 276             if (-1 == system(down_commands[i])) f->log(0, 0, 0, "error command %s\n", down_commands[i]);
 277         }
 278     }
 279
 280     return 1;
 281 }
 282
 283 void plugin_done()
 284 {
 285     int i;
 286
 287     if (!iam_master)    // Never became master. nothing to do.
 288         return;
 289
 290     for (i = 0; down_commands[i] && *down_commands[i]; i++)
 291     {
 292         f->log(3, 0, 0, "Running %s\n", down_commands[i]);
 293         if (-1 == system(down_commands[i])) f->log(0, 0, 0, "error command %s\n", down_commands[i]);
 294     }
 295 }
 296