garden.c

   1 #include <string.h>
   2 #include <malloc.h>
   3 #include <stdlib.h>
   4 #include <sys/wait.h>
   5 #include <sys/types.h>
   6 #include <linux/rtnetlink.h>
   7 #include <netinet/ip6.h>
   8
   9 #include "dhcp6.h"
  10 #include "l2tpns.h"
  11 #include "plugin.h"
  12 #include "control.h"
  13
  14 /* walled garden */
  15
  16 int plugin_api_version = PLUGIN_API_VERSION;
  17 static struct pluginfuncs *f = 0;
  18
  19 static int iam_master = 0;      // We're all slaves! Slaves I tell you!
  20
  21 char *up_commands[] = {
  22     "iptables -t nat -N garden >/dev/null 2>&1",                // Create a chain that all gardened users will go through
  23     "iptables -t nat -F garden",
  24     ". " PLUGINCONF "/build-garden",                            // Populate with site-specific DNAT rules
  25     "iptables -t nat -N garden_users >/dev/null 2>&1",          // Empty chain, users added/removed by garden_session
  26     "iptables -t nat -F garden_users",
  27     "iptables -t nat -A PREROUTING -j garden_users",            // DNAT any users on the garden_users chain
  28     "sysctl -w net.ipv4.netfilter.ip_conntrack_max=512000"      // lots of entries
  29              " net.ipv4.netfilter.ip_conntrack_tcp_timeout_established=18000 >/dev/null", // 5hrs
  30     NULL,
  31 };
  32
  33 char *down_commands[] = {
  34     "iptables -t nat -F PREROUTING",
  35     "iptables -t nat -F garden_users",
  36     "iptables -t nat -X garden_users",
  37     "iptables -t nat -F garden",
  38     "iptables -t nat -X garden",
  39     "rmmod iptable_nat",        // Should also remove ip_conntrack, but
  40                                 // doing so can take hours...  literally.
  41                                 // If a master is re-started as a slave,
  42                                 // either rmmod manually, or reboot.
  43     NULL,
  44 };
  45
  46 #define F_UNGARDEN      0
  47 #define F_GARDEN        1
  48 #define F_CLEANUP       2
  49
  50 int garden_session(sessiont *s, int flag, char *newuser);
  51
  52 int plugin_post_auth(struct param_post_auth *data)
  53 {
  54     // Ignore if user authentication was successful
  55     if (data->auth_allowed)
  56         return PLUGIN_RET_OK;
  57
  58     f->log(3, f->get_id_by_session(data->s), data->s->tunnel,
  59         "Walled Garden allowing login\n");
  60
  61     data->auth_allowed = 1;
  62     data->s->walled_garden = 1;
  63     return PLUGIN_RET_OK;
  64 }
  65
  66 int plugin_new_session(struct param_new_session *data)
  67 {
  68     if (!iam_master)
  69         return PLUGIN_RET_OK;   // Slaves don't do walled garden processing.
  70
  71     if (data->s->walled_garden)
  72         garden_session(data->s, F_GARDEN, 0);
  73
  74     return PLUGIN_RET_OK;
  75 }
  76
  77 int plugin_kill_session(struct param_new_session *data)
  78 {
  79     if (!iam_master)
  80         return PLUGIN_RET_OK;   // Slaves don't do walled garden processing.
  81
  82     if (data->s->walled_garden)
  83         garden_session(data->s, F_CLEANUP, 0);
  84
  85     return PLUGIN_RET_OK;
  86 }
  87
  88 char *plugin_control_help[] = {
  89     "  garden USER|SID                             Put user into the walled garden",
  90     "  ungarden SID [USER]                         Release session from garden",
  91     0
  92 };
  93
  94 int plugin_control(struct param_control *data)
  95 {
  96     sessionidt session;
  97     sessiont *s = 0;
  98     int flag;
  99     char *end;
 100
 101     if (data->argc < 1)
 102         return PLUGIN_RET_OK;
 103
 104     if (strcmp(data->argv[0], "garden") && strcmp(data->argv[0], "ungarden"))
 105         return PLUGIN_RET_OK; // not for us
 106
 107     if (!iam_master)
 108         return PLUGIN_RET_NOTMASTER;
 109
 110     flag = data->argv[0][0] == 'g' ? F_GARDEN : F_UNGARDEN;
 111
 112     if (data->argc < 2 || data->argc > 3 || (data->argc > 2 && flag == F_GARDEN))
 113     {
 114         data->response = NSCTL_RES_ERR;
 115         data->additional = flag == F_GARDEN
 116             ? "requires username or session id"
 117             : "requires session id and optional username";
 118
 119         return PLUGIN_RET_STOP;
 120     }
 121
 122     if (!(session = strtol(data->argv[1], &end, 10)) || *end)
 123     {
 124         if (flag)
 125             session = f->get_session_by_username(data->argv[1]);
 126         else
 127             session = 0; // can't ungarden by username
 128     }
 129
 130     if (session)
 131         s = f->get_session_by_id(session);
 132
 133     if (!s || !s->ip)
 134     {
 135         data->response = NSCTL_RES_ERR;
 136         data->additional = "session not found";
 137         return PLUGIN_RET_STOP;
 138     }
 139
 140     if (s->walled_garden == flag)
 141     {
 142         data->response = NSCTL_RES_ERR;
 143         data->additional = flag ? "already in walled garden" : "not in walled garden";
 144         return PLUGIN_RET_STOP;
 145     }
 146
 147     garden_session(s, flag, data->argc > 2 ? data->argv[2] : 0);
 148     f->session_changed(session);
 149
 150     data->response = NSCTL_RES_OK;
 151     data->additional = 0;
 152
 153     return PLUGIN_RET_STOP;
 154 }
 155
 156 int plugin_become_master(void)
 157 {
 158     int i;
 159     iam_master = 1;     // We just became the master. Wow!
 160
 161     for (i = 0; up_commands[i] && *up_commands[i]; i++)
 162     {
 163         f->log(3, 0, 0, "Running %s\n", up_commands[i]);
 164         if (-1 == system(up_commands[i])) f->log(0, 0, 0, "error command %s\n", up_commands[i]);
 165     }
 166
 167     return PLUGIN_RET_OK;
 168 }
 169
 170 // Called for each active session after becoming master
 171 int plugin_new_session_master(sessiont *s)
 172 {
 173     if (s->walled_garden)
 174         garden_session(s, F_GARDEN, 0);
 175
 176     return PLUGIN_RET_OK;
 177 }
 178
 179 int garden_session(sessiont *s, int flag, char *newuser)
 180 {
 181     char cmd[2048];
 182     sessionidt sess;
 183         int status;
 184
 185     if (!s) return 0;
 186     if (!s->opened) return 0;
 187
 188     sess = f->get_id_by_session(s);
 189     if (flag == F_GARDEN)
 190     {
 191         f->log(2, sess, s->tunnel, "Garden user %s (%s)\n", s->user,
 192             f->fmtaddr(htonl(s->ip), 0));
 193
 194         snprintf(cmd, sizeof(cmd),
 195             "iptables -t nat -A garden_users -s %s -j garden",
 196             f->fmtaddr(htonl(s->ip), 0));
 197
 198         f->log(3, sess, s->tunnel, "%s\n", cmd);
 199         status = system(cmd);
 200         s->walled_garden = 1;
 201     }
 202     else
 203     {
 204         sessionidt other;
 205         int count = 40;
 206
 207         // Normal User
 208         f->log(2, sess, s->tunnel, "Un-Garden user %s (%s)\n", s->user, f->fmtaddr(htonl(s->ip), 0));
 209         if (newuser)
 210         {
 211             snprintf(s->user, MAXUSER, "%s", newuser);
 212             f->log(2, sess, s->tunnel, "  Setting username to %s\n", s->user);
 213         }
 214
 215         // Kick off any duplicate usernames
 216         // but make sure not to kick off ourself
 217         if (s->ip && !s->die && (other = f->get_session_by_username(s->user)) &&
 218             s != f->get_session_by_id(other))
 219         {
 220             f->sessionkill(other,
 221                 "Duplicate session when user released from walled garden");
 222         }
 223
 224         /* Clean up counters */
 225         s->pin = s->pout = 0;
 226         s->cin = s->cout = 0;
 227         s->cin_delta = s->cout_delta = 0;
 228         s->cin_wrap = s->cout_wrap = 0;
 229
 230         snprintf(cmd, sizeof(cmd),
 231             "iptables -t nat -D garden_users -s %s -j garden",
 232             f->fmtaddr(htonl(s->ip), 0));
 233
 234         f->log(3, sess, s->tunnel, "%s\n", cmd);
 235         while (--count)
 236         {
 237             status = system(cmd);
 238             if (WEXITSTATUS(status) != 0) break;
 239         }
 240
 241         s->walled_garden = 0;
 242
 243         if (flag != F_CLEANUP)
 244         {
 245             /* OK, we're up! */
 246             uint16_t r = f->radiusnew(f->get_id_by_session(s));
 247             if (r) f->radiussend(r, RADIUSSTART);
 248         }
 249     }
 250
 251     return 1;
 252 }
 253
 254 int plugin_init(struct pluginfuncs *funcs)
 255 {
 256     FILE *tables;
 257     int found_nat = 0;
 258
 259     if (!funcs)
 260         return 0;
 261
 262     f = funcs;
 263
 264     if ((tables = fopen("/proc/net/ip_tables_names", "r")))
 265     {
 266         char buf[1024];
 267         while (fgets(buf, sizeof(buf), tables) && !found_nat)
 268             found_nat = !strcmp(buf, "nat\n");
 269
 270         fclose(tables);
 271     }
 272
 273     /* master killed/crashed? */
 274     if (found_nat)
 275     {
 276         int i;
 277         for (i = 0; down_commands[i] && *down_commands[i]; i++)
 278         {
 279             f->log(3, 0, 0, "Running %s\n", down_commands[i]);
 280             if (-1 == system(down_commands[i])) f->log(0, 0, 0, "error command %s\n", down_commands[i]);
 281         }
 282     }
 283
 284     return 1;
 285 }
 286
 287 void plugin_done()
 288 {
 289     int i;
 290
 291     if (!iam_master)    // Never became master. nothing to do.
 292         return;
 293
 294     for (i = 0; down_commands[i] && *down_commands[i]; i++)
 295     {
 296         f->log(3, 0, 0, "Running %s\n", down_commands[i]);
 297         if (-1 == system(down_commands[i])) f->log(0, 0, 0, "error command %s\n", down_commands[i]);
 298     }
 299 }
 300