X-Git-Url: http://git.sameswireless.fr/l2tpns.git/blobdiff_plain/72346a7226a9f6b67d4f3e3f488914f691070893..5bcf1eb45ac0d39caa05e4d8e6b5de4faa88df7b:/garden.c diff --git a/garden.c b/garden.c index 41e46a2..ff8978d 100644 --- a/garden.c +++ b/garden.c @@ -9,9 +9,9 @@ /* walled garden */ -char const *cvs_id = "$Id: garden.c,v 1.12 2004/11/09 08:05:02 bodea Exp $"; +char const *cvs_id = "$Id: garden.c,v 1.20.2.1 2005/05/07 03:51:20 bodea Exp $"; -int __plugin_api_version = PLUGIN_API_VERSION; +int plugin_api_version = PLUGIN_API_VERSION; static struct pluginfuncs *p = 0; static int iam_master = 0; // We're all slaves! Slaves I tell you! @@ -23,7 +23,7 @@ char *up_commands[] = { "iptables -t nat -N garden_users >/dev/null 2>&1", // Empty chain, users added/removed by garden_session "iptables -t nat -F garden_users", "iptables -t nat -A PREROUTING -j garden_users", // DNAT any users on the garden_users chain - "sysctl -w net.ipv4.ip_conntrack_max=256000 >/dev/null", // lots of entries + "sysctl -w net.ipv4.ip_conntrack_max=512000 >/dev/null", // lots of entries NULL, }; @@ -40,6 +40,10 @@ char *down_commands[] = { NULL, }; +#define F_UNGARDEN 0 +#define F_GARDEN 1 +#define F_CLEANUP 2 + int garden_session(sessiont *s, int flag); int plugin_post_auth(struct param_post_auth *data) @@ -47,7 +51,7 @@ int plugin_post_auth(struct param_post_auth *data) // Ignore if user authentication was successful if (data->auth_allowed) return PLUGIN_RET_OK; - p->log(3, 0, 0, 0, "Walled Garden allowing login\n"); + p->log(3, p->get_id_by_session(data->s), data->s->tunnel, "Walled Garden allowing login\n"); data->auth_allowed = 1; data->s->walled_garden = 1; return PLUGIN_RET_OK; @@ -59,7 +63,7 @@ int plugin_new_session(struct param_new_session *data) return PLUGIN_RET_OK; // Slaves don't do walled garden processing. if (data->s->walled_garden) - garden_session(data->s, 1); + garden_session(data->s, F_GARDEN); return PLUGIN_RET_OK; } @@ -70,51 +74,73 @@ int plugin_kill_session(struct param_new_session *data) return PLUGIN_RET_OK; // Slaves don't do walled garden processing. if (data->s->walled_garden) - garden_session(data->s, 0); + garden_session(data->s, F_CLEANUP); return PLUGIN_RET_OK; } +char *plugin_control_help[] = { + " garden USER|SID Put user into the walled garden", + " ungarden SID Release session from garden", + 0 +}; + int plugin_control(struct param_control *data) { - sessiont *s; sessionidt session; + sessiont *s = 0; + int flag; + char *end; - if (!iam_master) // All garden processing happens on the master. + if (data->argc < 1) return PLUGIN_RET_OK; - if (data->type != PKT_GARDEN && data->type != PKT_UNGARDEN) - return PLUGIN_RET_OK; + if (strcmp(data->argv[0], "garden") && strcmp(data->argv[0], "ungarden")) + return PLUGIN_RET_OK; // not for us - if (!data->data && data->data_length) - return PLUGIN_RET_OK; + if (!iam_master) + return PLUGIN_RET_NOTMASTER; - session = atoi((char*)(data->data)); - if (!session) - return PLUGIN_RET_OK; + flag = data->argv[0][0] == 'g' ? F_GARDEN : F_UNGARDEN; - data->send_response = 1; - s = p->get_session_by_id(session); - if (!s || !s->ip) + if (data->argc != 2) { - char *errormsg = "Session not connected"; - *(short *)(data->response + 2) = ntohs(PKT_RESP_ERROR); - sprintf((data->response + data->response_length), "%s", errormsg); - data->response_length += strlen(errormsg) + 1; + data->response = NSCTL_RES_ERR; + data->additional = "one argument required: username or session id"; + return PLUGIN_RET_STOP; + } - p->log(3, 0, 0, 0, "Unknown session %d\n", session); + if (!(session = strtol(data->argv[1], &end, 10)) || *end) + { + if (flag) + session = p->get_session_by_username(data->argv[1]); + else + session = 0; // can't ungarden by username + } + + if (session) + s = p->get_session_by_id(session); + + if (!s || !s->ip) + { + data->response = NSCTL_RES_ERR; + data->additional = "session not found"; return PLUGIN_RET_STOP; } - *(short *)(data->response + 2) = ntohs(PKT_RESP_OK); - if (!(garden_session(s, (data->type == PKT_GARDEN)))) + if (s->walled_garden == flag) { - char *errormsg = "User not connected"; - *(short *)(data->response + 2) = ntohs(PKT_RESP_ERROR); - sprintf((data->response + data->response_length), "%s", errormsg); - data->response_length += strlen(errormsg) + 1; + data->response = NSCTL_RES_ERR; + data->additional = flag ? "already in walled garden" : "not in walled garden"; + return PLUGIN_RET_STOP; } + garden_session(s, flag); + p->session_changed(session); + + data->response = NSCTL_RES_OK; + data->additional = 0; + return PLUGIN_RET_STOP; } @@ -125,7 +151,7 @@ int plugin_become_master(void) for (i = 0; up_commands[i] && *up_commands[i]; i++) { - p->log(3, 0, 0, 0, "Running %s\n", up_commands[i]); + p->log(3, 0, 0, "Running %s\n", up_commands[i]); system(up_commands[i]); } @@ -133,10 +159,10 @@ int plugin_become_master(void) } // Called for each active session after becoming master -int plugin_new_session_master(sessiont * s) +int plugin_new_session_master(sessiont *s) { if (s->walled_garden) - garden_session(s, 1); + garden_session(s, F_GARDEN); return PLUGIN_RET_OK; } @@ -144,15 +170,17 @@ int plugin_new_session_master(sessiont * s) int garden_session(sessiont *s, int flag) { char cmd[2048]; + sessionidt sess; if (!s) return 0; if (!s->opened) return 0; - if (flag == 1) + sess = p->get_id_by_session(s); + if (flag == F_GARDEN) { - p->log(2, 0, 0, s->tunnel, "Garden user %s (%s)\n", s->user, p->inet_toa(htonl(s->ip))); - snprintf(cmd, sizeof(cmd), "iptables -t nat -A garden_users -s %s -j garden", p->inet_toa(htonl(s->ip))); - p->log(3, 0, 0, s->tunnel, "%s\n", cmd); + p->log(2, sess, s->tunnel, "Garden user %s (%s)\n", s->user, p->fmtaddr(htonl(s->ip), 0)); + snprintf(cmd, sizeof(cmd), "iptables -t nat -A garden_users -s %s -j garden", p->fmtaddr(htonl(s->ip), 0)); + p->log(3, sess, s->tunnel, "%s\n", cmd); system(cmd); s->walled_garden = 1; } @@ -162,7 +190,7 @@ int garden_session(sessiont *s, int flag) int count = 40; // Normal User - p->log(2, 0, 0, s->tunnel, "Un-Garden user %s (%s)\n", s->user, p->inet_toa(htonl(s->ip))); + p->log(2, sess, s->tunnel, "Un-Garden user %s (%s)\n", s->user, p->fmtaddr(htonl(s->ip), 0)); // Kick off any duplicate usernames // but make sure not to kick off ourself if (s->ip && !s->die && (other = p->get_session_by_username(s->user)) && s != p->get_session_by_id(other)) { @@ -172,8 +200,8 @@ int garden_session(sessiont *s, int flag) s->cin = s->cout = 0; s->pin = s->pout = 0; - snprintf(cmd, sizeof(cmd), "iptables -t nat -D garden_users -s %s -j garden", p->inet_toa(htonl(s->ip))); - p->log(3, 0, 0, s->tunnel, "%s\n", cmd); + snprintf(cmd, sizeof(cmd), "iptables -t nat -D garden_users -s %s -j garden", p->fmtaddr(htonl(s->ip), 0)); + p->log(3, sess, s->tunnel, "%s\n", cmd); while (--count) { int status = system(cmd); @@ -182,13 +210,14 @@ int garden_session(sessiont *s, int flag) s->walled_garden = 0; - if (!s->die) { + if (flag != F_CLEANUP) + { /* OK, we're up! */ - u16 r = p->radiusnew(p->get_id_by_session(s)); - p->radiussend(r, RADIUSSTART); + uint16_t r = p->radiusnew(p->get_id_by_session(s)); + if (r) p->radiussend(r, RADIUSSTART); } } - s->walled_garden = flag; + return 1; } @@ -217,7 +246,7 @@ int plugin_init(struct pluginfuncs *funcs) int i; for (i = 0; down_commands[i] && *down_commands[i]; i++) { - p->log(3, 0, 0, 0, "Running %s\n", down_commands[i]); + p->log(3, 0, 0, "Running %s\n", down_commands[i]); system(down_commands[i]); } } @@ -234,7 +263,7 @@ void plugin_done() for (i = 0; down_commands[i] && *down_commands[i]; i++) { - p->log(3, 0, 0, 0, "Running %s\n", down_commands[i]); + p->log(3, 0, 0, "Running %s\n", down_commands[i]); system(down_commands[i]); } }