garden.c

   1 #include <string.h>
   2 #include <malloc.h>
   3 #include <stdlib.h>
   4 #include <sys/wait.h>
   5 #include <sys/types.h>
   6 #include "l2tpns.h"
   7 #include "plugin.h"
   8 #include "control.h"
   9
  10 int __plugin_api_version = 1;
  11 struct pluginfuncs p;
  12
  13 int garden_session(sessiont *s, int flag);
  14
  15 char *init_commands[] = {
  16         // This is for incoming connections to a gardened user
  17         "iptables -t nat -N garden_users 2>&1 >/dev/null",
  18         "iptables -t nat -F garden_users 2>&1 >/dev/null",
  19         "iptables -t nat -N garden 2>&1 >/dev/null",
  20         "iptables -t nat -A l2tpns -j garden_users",
  21         NULL
  22 };
  23
  24 char *done_commands[] = {
  25         "iptables -t nat -F garden_users 2>&1 >/dev/null",
  26         "iptables -t nat -D l2tpns -j garden_users 2>&1 >/dev/null",
  27         NULL
  28 };
  29
  30 int plugin_post_auth(struct param_post_auth *data)
  31 {
  32         // Ignore if user authentication was successful
  33         if (data->auth_allowed) return PLUGIN_RET_OK;
  34
  35         p.log(3, 0, 0, 0, "User allowed into walled garden\n");
  36         data->auth_allowed = 1;
  37         data->s->walled_garden = 1;
  38         return PLUGIN_RET_OK;
  39 }
  40
  41 int plugin_new_session(struct param_new_session *data)
  42 {
  43         if (data->s->walled_garden) garden_session(data->s, 1);
  44         return PLUGIN_RET_OK;
  45 }
  46
  47 int plugin_kill_session(struct param_new_session *data)
  48 {
  49         if (data->s->walled_garden) garden_session(data->s, 0);
  50         return PLUGIN_RET_OK;
  51 }
  52
  53 int plugin_control(struct param_control *data)
  54 {
  55         sessiont *s;
  56         sessionidt session;
  57
  58         if (data->type != PKT_GARDEN && data->type != PKT_UNGARDEN) return PLUGIN_RET_OK;
  59         if (!data->data && data->data_length) return PLUGIN_RET_OK;
  60         session = atoi((char*)(data->data));
  61
  62         if (!session)
  63                 return PLUGIN_RET_OK;
  64
  65         data->send_response = 1;
  66         s = p.get_session_by_id(session);
  67         if (!s || !s->ip)
  68         {
  69                 char *errormsg = "Session not connected";
  70                 *(short *)(data->response + 2) = ntohs(PKT_RESP_ERROR);
  71                 sprintf((data->response + data->response_length), "%s", errormsg);
  72                 data->response_length += strlen(errormsg) + 1;
  73
  74                 p.log(3, 0, 0, 0, "Unknown session %s\n", session);
  75                 return PLUGIN_RET_STOP;
  76         }
  77         *(short *)(data->response + 2) = ntohs(PKT_RESP_OK);
  78
  79         if (!(garden_session(s, (data->type == PKT_GARDEN))))
  80         {
  81                 char *errormsg = "User not connected";
  82                 *(short *)(data->response + 2) = ntohs(PKT_RESP_ERROR);
  83                 sprintf((data->response + data->response_length), "%s", errormsg);
  84                 data->response_length += strlen(errormsg) + 1;
  85         }
  86         return PLUGIN_RET_STOP;
  87 }
  88
  89 int plugin_config(struct param_config *data)
  90 {
  91         return PLUGIN_RET_OK;
  92 }
  93
  94 int garden_session(sessiont *s, int flag)
  95 {
  96         char cmd[2048];
  97
  98         if (!s) return 0;
  99         if (!s->opened) return 0;
 100
 101         if (flag == 1)
 102         {
 103                 p.log(2, 0, 0, s->tunnel, "Trap user %s (%s) in walled garden\n", s->user, p.inet_toa(ntohl(s->ip)));
 104                 snprintf(cmd, 2048, "iptables -t nat -A garden_users -s %s -j garden", p.inet_toa(ntohl(s->ip)));
 105                 p.log(3, 0, 0, s->tunnel, "%s\n", cmd);
 106                 system(cmd);
 107                 s->walled_garden = 1;
 108         }
 109         else
 110         {
 111                 sessionidt other;
 112                 int count = 10;
 113
 114                 // Normal User
 115                 p.log(2, 0, 0, s->tunnel, "Release user %s (%s) from walled garden\n", s->user, p.inet_toa(ntohl(s->ip)));
 116                 // Kick off any duplicate usernames
 117                 // but make sure not to kick off ourself
 118                 if (s->ip && !s->die && (other = p.get_session_by_username(s->user)) && s != p.get_session_by_id(other)) {
 119                         p.sessionkill(other, "Duplicate session when user ungardened");
 120                 }
 121                 /* Clean up counters */
 122                 s->cin = s->cout = 0;
 123                 s->pin = s->pout = 0;
 124
 125                 snprintf(cmd, 2048, "iptables -t nat -D garden_users -s %s -j garden", p.inet_toa(ntohl(s->ip)));
 126                 p.log(3, 0, 0, s->tunnel, "%s\n", cmd);
 127                 while (--count)
 128                 {
 129                         int status = system(cmd);
 130                         if (WEXITSTATUS(status) != 0) break;
 131                 }
 132
 133                 s->walled_garden = 0;
 134
 135                 if (!s->die) {
 136                         /* OK, we're up! */
 137                         u8 r = p.radiusnew(p.get_id_by_session(s));
 138                         p.radiussend(r, RADIUSSTART);
 139                 }
 140         }
 141         s->walled_garden = flag;
 142         return 1;
 143 }
 144
 145 int plugin_init(struct pluginfuncs *funcs)
 146 {
 147         int i;
 148
 149         if (!funcs) return 0;
 150         memcpy(&p, funcs, sizeof(p));
 151
 152         p.log(1, 0, 0, 0, "Enabling walled garden service\n");
 153
 154         for (i = 0; init_commands[i] && *init_commands[i]; i++)
 155         {
 156                 p.log(4, 0, 0, 0, "Running %s\n", init_commands[i]);
 157                 system(init_commands[i]);
 158         }
 159
 160         return 1;
 161 }
 162
 163 void plugin_done()
 164 {
 165         int i;
 166         for (i = 0; done_commands[i] && *done_commands[i]; i++)
 167         {
 168                 p.log(4, 0, 0, 0, "Running %s\n", done_commands[i]);
 169                 system(done_commands[i]);
 170         }
 171 }
 172