From d44bccc7982b44096fbaab81794fccbeca405e02 Mon Sep 17 00:00:00 2001 From: Scott Ullrich Date: Tue, 27 Feb 2007 16:59:54 +0000 Subject: Sync w/ m0n0wall --- etc/inc/captiveportal.inc | 291 +++++++++++++++++++++++----------------------- 1 file changed, 147 insertions(+), 144 deletions(-) (limited to 'etc/inc/captiveportal.inc') diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc index 572a9c3..1b2bfca 100644 --- a/etc/inc/captiveportal.inc +++ b/etc/inc/captiveportal.inc @@ -181,11 +181,6 @@ EOD; chdir($g['captiveportal_path']); - /* TEMPORARY! FAST_CGI reports _FALSE_ client ip - * addresses. - */ - $use_fastcgi = false; - if ($config['captiveportal']['maxproc']) $maxproc = $config['captiveportal']['maxproc']; else @@ -365,22 +360,30 @@ add 1305 set 1 pass tcp from $cpip 8001 to any out EOD; } - $cprules .= << 19899) - $ruleno = 10000; - } + /* insert ipfw rule to allow ip thru */ + if ($ipent['dir'] == "from") { + mwexec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from " . $ipent['ip'] . " to any in"); + mwexec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from any to " . $ipent['ip'] . " out"); + } else { + mwexec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from any to " . $ipent['ip'] . " in"); + mwexec("/sbin/ipfw add $ruleno set 2 skipto 50000 ip from " . $ipent['ip'] . " to any out"); + } - fclose($fd); + } - /* write next rule number */ - $fd = @fopen("{$g['vardb_path']}/captiveportal.nextrule", "w"); - if ($fd) { - fwrite($fd, $ruleno); - fclose($fd); - } - } + fclose($fd); + } - captiveportal_unlock(); - return 0; + captiveportal_unlock(); + return 0; } /* get last activity timestamp given ipfw rule number */ @@ -834,45 +839,45 @@ function captiveportal_logportalauth($user,$mac,$ip,$status, $message = null) { } function radius($username,$password,$clientip,$clientmac,$type) { - global $g, $config; + global $g, $config; - $next_ruleno = get_next_ipfw_ruleno(); - $radiusservers = captiveportal_get_radius_servers(); - $radacct_enable = isset($config['captiveportal']['radacct_enable']); - - $auth_list = RADIUS_AUTHENTICATION($username, - $password, - $radiusservers, - $clientip, - $clientmac, - $next_ruleno); - - if ($auth_list['auth_val'] == 2) { - captiveportal_logportalauth($username,$clientmac,$clientip,$type); - $sessionid = portal_allow($clientip, - $clientmac, - $username, - $password, - $auth_list['session_timeout'], - $auth_list['idle_timeout'], - $auth_list['url_redirection'], - $auth_list['session_terminate_time']); - - if ($radacct_enable) { - $auth_list['acct_val'] = RADIUS_ACCOUNTING_START($next_ruleno, - $username, - $sessionid, - $radiusservers[0]['ipaddr'], - $radiusservers[0]['acctport'], - $radiusservers[0]['key'], - $clientip, - $clientmac); - if ($auth_list['acct_val'] == 1) - captiveportal_logportalauth($username,$clientmac,$clientip,$type,"RADIUS ACCOUNTING FAILED"); - } - } + /* Start locking from the beginning of an authentication session */ + captiveportal_lock(); + + $ruleno = captiveportal_get_next_ipfw_ruleno(); + + /* if the pool is empty, return apprioriate message and fail authentication */ + if (is_null($ruleno)) { + $auth_list = array(); + $auth_list['auth_val'] = 1; + $auth_list['error'] = "System reached maximum login capacity"; + captiveportal_unlock(); + return $auth_list; + } + + $radiusservers = captiveportal_get_radius_servers(); + + $auth_list = RADIUS_AUTHENTICATION($username, + $password, + $radiusservers, + $clientip, + $clientmac, + $ruleno); + + if ($auth_list['auth_val'] == 2) { + captiveportal_logportalauth($username,$clientmac,$clientip,$type); + $sessionid = portal_allow($clientip, + $clientmac, + $username, + $password, + $auth_list, + $ruleno); + } + else { + captiveportal_unlock(); + } - return $auth_list; + return $auth_list; } @@ -897,79 +902,77 @@ function captiveportal_read_db() { /* write captive portal DB */ function captiveportal_write_db($cpdb) { - + global $g; - + $fd = @fopen("{$g['vardb_path']}/captiveportal.db", "w"); - if ($fd) { + if ($fd) { foreach ($cpdb as $cpent) { fwrite($fd, join(",", $cpent) . "\n"); - } + } fclose($fd); - } + } } function captiveportal_write_elements() { - global $g, $config; - - /* delete any existing elements */ - if (is_dir($g['captiveportal_element_path'])) { - $dh = opendir($g['captiveportal_element_path']); - while (($file = readdir($dh)) !== false) { - if ($file != "." && $file != "..") - unlink($g['captiveportal_element_path'] . "/" . $file); - } - closedir($dh); - } else { - mkdir($g['captiveportal_element_path']); - } - - if (is_array($config['captiveportal']['element'])) { - conf_mount_rw(); - foreach ($config['captiveportal']['element'] as $data) { - $fd = @fopen($g['captiveportal_element_path'] . '/' . $data['name'], "wb"); - if (!$fd) { - printf("Error: cannot open '{$data['name']}' in captiveportal_write_elements().\n"); - return 1; - } - $decoded = base64_decode($data['content']); - fwrite($fd,$decoded); - fclose($fd); - unlink_if_exists("{$g['captiveportal_path']}/{$data['name']}"); - unlink_if_exists("{$g['captiveportal_path']}/{$data['name']}"); - mwexec("cd {$g['captiveportal_path']}/ && ln -s {$g['captiveportal_element_path']}/{$data['name']} {$data['name']}"); - } - conf_mount_ro(); - } - - return 0; + global $g, $config; + + /* delete any existing elements */ + if (is_dir($g['captiveportal_element_path'])) { + $dh = opendir($g['captiveportal_element_path']); + while (($file = readdir($dh)) !== false) { + if ($file != "." && $file != "..") + unlink($g['captiveportal_element_path'] . "/" . $file); + } + closedir($dh); + } else { + mkdir($g['captiveportal_element_path']); + } + + if (is_array($config['captiveportal']['element'])) { + + foreach ($config['captiveportal']['element'] as $data) { + $fd = @fopen($g['captiveportal_element_path'] . '/' . $data['name'], "wb"); + if (!$fd) { + printf("Error: cannot open '{$data['name']}' in captiveportal_write_elements().\n"); + return 1; + } + $decoded = base64_decode($data['content']); + fwrite($fd,$decoded); + fclose($fd); + } + } + + return 0; } -/* + +/** * This function will calculate the lowest free firewall ruleno * within the range specified based on the actual installed rules * */ -function get_next_ipfw_ruleno($rulenos_start = 10000, $rulenos_range_max = 9899) { +function captiveportal_get_next_ipfw_ruleno($rulenos_start = 10000, $rulenos_range_max = 9899) { $fwrules = ""; $matches = ""; - exec("/sbin/ipfw show", $fwrules); - foreach ($fwrules as $fwrule) { - preg_match("/^(\d+)\s+/", $fwrule, $matches); - $rulenos_used[] = $matches[1]; - } - $rulenos_used = array_unique($rulenos_used); - $rulenos_range = count($rulenos_used); - if ($rulenos_range > $rulenos_range_max) { - return NULL; - } - $rulenos_pool = range($rulenos_start, ($rulenos_start + $rulenos_range)); - $rulenos_free = array_diff($rulenos_pool, $rulenos_used); - $ruleno = array_shift($rulenos_free); - return $ruleno; + exec("/sbin/ipfw show", $fwrules); + foreach ($fwrules as $fwrule) { + preg_match("/^(\d+)\s+/", $fwrule, $matches); + $rulenos_used[] = $matches[1]; + } + $rulenos_used = array_unique($rulenos_used); + $rulenos_range = count($rulenos_used); + if ($rulenos_range > $rulenos_range_max) { + return NULL; + } + $rulenos_pool = range($rulenos_start, ($rulenos_start + $rulenos_range)); + $rulenos_free = array_diff($rulenos_pool, $rulenos_used); + $ruleno = array_shift($rulenos_free); + + return $ruleno; } /* -- cgit v1.1