12 int plugin_api_version
= PLUGIN_API_VERSION
;
13 static struct pluginfuncs
*f
= 0;
15 static int iam_master
= 0; // We're all slaves! Slaves I tell you!
17 char *up_commands
[] = {
18 "iptables -t nat -N garden >/dev/null 2>&1", // Create a chain that all gardened users will go through
19 "iptables -t nat -F garden",
20 ". " PLUGINCONF
"/build-garden", // Populate with site-specific DNAT rules
21 "iptables -t nat -N garden_users >/dev/null 2>&1", // Empty chain, users added/removed by garden_session
22 "iptables -t nat -F garden_users",
23 "iptables -t nat -A PREROUTING -j garden_users", // DNAT any users on the garden_users chain
24 "sysctl -w net.ipv4.netfilter.ip_conntrack_max=512000" // lots of entries
25 " net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=18000 >/dev/null", // 5hrs
29 char *down_commands
[] = {
30 "iptables -t nat -F PREROUTING",
31 "iptables -t nat -F garden_users",
32 "iptables -t nat -X garden_users",
33 "iptables -t nat -F garden",
34 "iptables -t nat -X garden",
35 "rmmod iptable_nat", // Should also remove ip_conntrack, but
36 // doing so can take hours... literally.
37 // If a master is re-started as a slave,
38 // either rmmod manually, or reboot.
46 int garden_session(sessiont
*s
, int flag
, char *newuser
);
48 int plugin_post_auth(struct param_post_auth
*data
)
50 // Ignore if user authentication was successful
51 if (data
->auth_allowed
)
54 f
->log(3, f
->get_id_by_session(data
->s
), data
->s
->tunnel
,
55 "Walled Garden allowing login\n");
57 data
->auth_allowed
= 1;
58 data
->s
->walled_garden
= 1;
62 int plugin_new_session(struct param_new_session
*data
)
65 return PLUGIN_RET_OK
; // Slaves don't do walled garden processing.
67 if (data
->s
->walled_garden
)
68 garden_session(data
->s
, F_GARDEN
, 0);
73 int plugin_kill_session(struct param_new_session
*data
)
76 return PLUGIN_RET_OK
; // Slaves don't do walled garden processing.
78 if (data
->s
->walled_garden
)
79 garden_session(data
->s
, F_CLEANUP
, 0);
84 char *plugin_control_help
[] = {
85 " garden USER|SID Put user into the walled garden",
86 " ungarden SID [USER] Release session from garden",
90 int plugin_control(struct param_control
*data
)
100 if (strcmp(data
->argv
[0], "garden") && strcmp(data
->argv
[0], "ungarden"))
101 return PLUGIN_RET_OK
; // not for us
104 return PLUGIN_RET_NOTMASTER
;
106 flag
= data
->argv
[0][0] == 'g' ? F_GARDEN
: F_UNGARDEN
;
108 if (data
->argc
< 2 || data
->argc
> 3 || (data
->argc
> 2 && flag
== F_GARDEN
))
110 data
->response
= NSCTL_RES_ERR
;
111 data
->additional
= flag
== F_GARDEN
112 ? "requires username or session id"
113 : "requires session id and optional username";
115 return PLUGIN_RET_STOP
;
118 if (!(session
= strtol(data
->argv
[1], &end
, 10)) || *end
)
121 session
= f
->get_session_by_username(data
->argv
[1]);
123 session
= 0; // can't ungarden by username
127 s
= f
->get_session_by_id(session
);
131 data
->response
= NSCTL_RES_ERR
;
132 data
->additional
= "session not found";
133 return PLUGIN_RET_STOP
;
136 if (s
->walled_garden
== flag
)
138 data
->response
= NSCTL_RES_ERR
;
139 data
->additional
= flag
? "already in walled garden" : "not in walled garden";
140 return PLUGIN_RET_STOP
;
143 garden_session(s
, flag
, data
->argc
> 2 ? data
->argv
[2] : 0);
144 f
->session_changed(session
);
146 data
->response
= NSCTL_RES_OK
;
147 data
->additional
= 0;
149 return PLUGIN_RET_STOP
;
152 int plugin_become_master(void)
155 iam_master
= 1; // We just became the master. Wow!
157 for (i
= 0; up_commands
[i
] && *up_commands
[i
]; i
++)
159 f
->log(3, 0, 0, "Running %s\n", up_commands
[i
]);
160 int status
= system(up_commands
[i
]);
163 return PLUGIN_RET_OK
;
166 // Called for each active session after becoming master
167 int plugin_new_session_master(sessiont
*s
)
169 if (s
->walled_garden
)
170 garden_session(s
, F_GARDEN
, 0);
172 return PLUGIN_RET_OK
;
175 int garden_session(sessiont
*s
, int flag
, char *newuser
)
182 if (!s
->opened
) return 0;
184 sess
= f
->get_id_by_session(s
);
185 if (flag
== F_GARDEN
)
187 f
->log(2, sess
, s
->tunnel
, "Garden user %s (%s)\n", s
->user
,
188 f
->fmtaddr(htonl(s
->ip
), 0));
190 snprintf(cmd
, sizeof(cmd
),
191 "iptables -t nat -A garden_users -s %s -j garden",
192 f
->fmtaddr(htonl(s
->ip
), 0));
194 f
->log(3, sess
, s
->tunnel
, "%s\n", cmd
);
195 status
= system(cmd
);
196 s
->walled_garden
= 1;
204 f
->log(2, sess
, s
->tunnel
, "Un-Garden user %s (%s)\n", s
->user
, f
->fmtaddr(htonl(s
->ip
), 0));
207 snprintf(s
->user
, MAXUSER
, "%s", newuser
);
208 f
->log(2, sess
, s
->tunnel
, " Setting username to %s\n", s
->user
);
211 // Kick off any duplicate usernames
212 // but make sure not to kick off ourself
213 if (s
->ip
&& !s
->die
&& (other
= f
->get_session_by_username(s
->user
)) &&
214 s
!= f
->get_session_by_id(other
))
216 f
->sessionkill(other
,
217 "Duplicate session when user released from walled garden");
220 /* Clean up counters */
221 s
->pin
= s
->pout
= 0;
222 s
->cin
= s
->cout
= 0;
223 s
->cin_delta
= s
->cout_delta
= 0;
224 s
->cin_wrap
= s
->cout_wrap
= 0;
226 snprintf(cmd
, sizeof(cmd
),
227 "iptables -t nat -D garden_users -s %s -j garden",
228 f
->fmtaddr(htonl(s
->ip
), 0));
230 f
->log(3, sess
, s
->tunnel
, "%s\n", cmd
);
233 status
= system(cmd
);
234 if (WEXITSTATUS(status
) != 0) break;
237 s
->walled_garden
= 0;
239 if (flag
!= F_CLEANUP
)
242 uint16_t r
= f
->radiusnew(f
->get_id_by_session(s
));
243 if (r
) f
->radiussend(r
, RADIUSSTART
);
250 int plugin_init(struct pluginfuncs
*funcs
)
260 if ((tables
= fopen("/proc/net/ip_tables_names", "r")))
263 while (fgets(buf
, sizeof(buf
), tables
) && !found_nat
)
264 found_nat
= !strcmp(buf
, "nat\n");
269 /* master killed/crashed? */
273 for (i
= 0; down_commands
[i
] && *down_commands
[i
]; i
++)
275 f
->log(3, 0, 0, "Running %s\n", down_commands
[i
]);
276 int status
= system(down_commands
[i
]);
287 if (!iam_master
) // Never became master. nothing to do.
290 for (i
= 0; down_commands
[i
] && *down_commands
[i
]; i
++)
292 f
->log(3, 0, 0, "Running %s\n", down_commands
[i
]);
293 int status
= system(down_commands
[i
]);