c3ce34a39aba1ba1eb216f695305bc0b0845e98c
10 int __plugin_api_version
= 1;
13 char *init_commands
[] = {
14 // This is for incoming connections to a gardened user
15 "iptables -t nat -N garden_users 2>&1 >/dev/null",
16 "iptables -t nat -F garden_users",
17 "iptables -t nat -N garden 2>&1", /* Don't flush - init script sets this up */
18 "iptables -t nat -A l2tpns -j garden_users",
22 char *done_commands
[] = {
23 "iptables -t nat -F garden_users 2>&1 >/dev/null",
24 "iptables -t nat -D l2tpns -j garden_users",
28 int garden_session(sessiont
*s
, int flag
);
30 int plugin_post_auth(struct param_post_auth
*data
)
32 // Ignore if user authentication was successful
33 if (data
->auth_allowed
) return PLUGIN_RET_OK
;
35 p
.log(3, 0, 0, 0, "Walled Garden allowing login\n");
36 data
->auth_allowed
= 1;
37 data
->s
->walled_garden
= 1;
41 int plugin_new_session(struct param_new_session
*data
)
43 if (data
->s
->walled_garden
) garden_session(data
->s
, 1);
47 int plugin_kill_session(struct param_new_session
*data
)
49 if (data
->s
->walled_garden
) garden_session(data
->s
, 0);
53 int plugin_control(struct param_control
*data
)
58 if (data
->type
!= PKT_GARDEN
&& data
->type
!= PKT_UNGARDEN
) return PLUGIN_RET_OK
;
59 if (!data
->data
&& data
->data_length
) return PLUGIN_RET_OK
;
60 session
= atoi((char*)(data
->data
));
61 if (!session
) return PLUGIN_RET_OK
; // Really?
62 data
->send_response
= 1;
63 s
= p
.get_session_by_id(session
);
66 char *errormsg
= "Session not connected";
67 *(short *)(data
->response
+ 2) = ntohs(PKT_RESP_ERROR
);
68 sprintf((data
->response
+ data
->response_length
), "%s", errormsg
);
69 data
->response_length
+= strlen(errormsg
) + 1;
71 p
.log(3, 0, 0, 0, "Unknown session %d\n", session
);
72 return PLUGIN_RET_STOP
;
74 *(short *)(data
->response
+ 2) = ntohs(PKT_RESP_OK
);
76 if (!(garden_session(s
, (data
->type
== PKT_GARDEN
))))
78 char *errormsg
= "User not connected";
79 *(short *)(data
->response
+ 2) = ntohs(PKT_RESP_ERROR
);
80 sprintf((data
->response
+ data
->response_length
), "%s", errormsg
);
81 data
->response_length
+= strlen(errormsg
) + 1;
83 return PLUGIN_RET_STOP
;
86 int garden_session(sessiont
*s
, int flag
)
91 if (!s
->opened
) return 0;
93 /* Note that we don't handle throttling/snooping/etc here
94 * To do that, we'd need to send an end accounting record
95 * then a radius auth, then start accouting again.
96 * That means that we need the password (which garden has)
97 * and a lot of code to check that the new set of params
98 * (routes, IP, ACLs, etc) 'matched' the old one in a
99 * 'compatable' way. (ie user's system doesn't need to be told
102 * Thats a lot of pain/code for very little gain.
103 * If we want them redone from scratch, just sessionkill them -
104 * a user on garden isn't going to have any open TCP
105 * connections which are worth caring about, anyway.
107 * Note that the user will be rethrottled shortly by the scan
108 * script thingy if appropriate.
110 * Currently, garden only directly ungardens someone if
111 * they haven't paid their bill, and then subsequently do so
112 * online. This isn't something which can be set up by a malicious
118 p
.log(2, 0, 0, s
->tunnel
, "Trap user %s (%s) in walled garden\n", s
->user
, p
.inet_toa(ntohl(s
->ip
)));
119 snprintf(cmd
, 2048, "iptables -t nat -A garden_users -s %s -j garden", p
.inet_toa(ntohl(s
->ip
)));
120 p
.log(3, 0, 0, s
->tunnel
, "%s\n", cmd
);
122 s
->walled_garden
= 1;
130 p
.log(2, 0, 0, s
->tunnel
, "Release user %s (%s) from walled garden\n", s
->user
, p
.inet_toa(ntohl(s
->ip
)));
131 // Kick off any duplicate usernames
132 // but make sure not to kick off ourself
133 if (s
->ip
&& !s
->die
&& (other
= p
.get_session_by_username(s
->user
)) && s
!= p
.get_session_by_id(other
)) {
134 p
.sessionkill(other
, "Duplicate session when user un-gardened");
136 /* Clean up counters */
137 s
->cin
= s
->cout
= 0;
138 s
->pin
= s
->pout
= 0;
140 snprintf(cmd
, 2048, "iptables -t nat -D garden_users -s %s -j garden", p
.inet_toa(ntohl(s
->ip
)));
141 p
.log(3, 0, 0, s
->tunnel
, "%s\n", cmd
);
144 int status
= system(cmd
);
145 if (WEXITSTATUS(status
) != 0) break;
148 s
->walled_garden
= 0;
152 u16 r
= p
.radiusnew(p
.get_id_by_session(s
));
153 p
.radiussend(r
, RADIUSSTART
);
156 s
->walled_garden
= flag
;
160 int plugin_init(struct pluginfuncs
*funcs
)
164 if (!funcs
) return 0;
165 memcpy(&p
, funcs
, sizeof(p
));
167 for (i
= 0; init_commands
[i
] && *init_commands
[i
]; i
++)
169 p
.log(3, 0, 0, 0, "Running %s\n", init_commands
[i
]);
170 system(init_commands
[i
]);
179 for (i
= 0; done_commands
[i
] && *done_commands
[i
]; i
++)
181 p
.log(3, 0, 0, 0, "Running %s\n", done_commands
[i
]);
182 system(done_commands
[i
]);