pfSense

 * voucher.inc

 * Copyright (c) 2007-2013 BSD Perimeter

 * Copyright (c) 2014-2024 Rubicon Communications, LLC (Netgate)

 * Copyright (c) 2007 Marcel Wiget <mwiget@mac.com>

 * All rights reserved.

 * Copyright (c) 2003-2004 Manuel Kasper <mk@neon1.net>.

 * All rights reserved.

 * Licensed under the Apache License, Version 2.0 (the "License");

 *

 * http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 */

/* include all configuration functions */

if (!function_exists('captiveportal_syslog')) {

	require_once("captiveportal.inc");

}

function captiveportal_xmlrpc_sync_get_details(&$syncip, &$port, &$username, &$password, $carp_loop = false) {

	global $cpzone;

	if (config_path_enabled("captiveportal/{$cpzone}", "enablebackwardsync") && !$carp_loop

	    && captiveportal_ha_is_node_in_backup_mode($cpzone)) {

		$syncip = config_get_path("captiveportal/{$cpzone}/backwardsyncip");

		$port = config_get_path('system/webgui/port');

		if (empty($port)) { // if port is empty lets rely on the protocol selection

			if (config_get_path('system/webgui/protocol') == "http") {

				$port = "80";

		return true;

	if (empty(config_get_path('hasync/synchronizetoip')) ||

	    $carp_loop == true) {

		return false;

	$syncip = config_get_path('hasync/synchronizetoip');

	if (empty(config_get_path('hasync/username'))) {

		$username = "admin";

		$username = config_get_path('hasync/username');

	}

	$port = config_get_path('system/webgui/port');

	if (empty($port)) {

		if (config_get_path('system/webgui/protocol') == "http") {

			$port = "80";

function voucher_expire($voucher_received, $carp_loop = false) {

	global $g, $cpzone, $cpzoneid;

	$voucherlck = lock("voucher{$cpzone}", LOCK_EX);

	// read rolls into assoc array with rollid as key and minutes as value

	foreach (config_get_path("voucher/{$cpzone}/roll", []) as $rollent) {

	}

	$a_vouchers_received = preg_split("/[\t\n\r ]+/s", $voucher_received);

	$active_dirty = false;

	$unsetindexes = array();

	// go through all received vouchers, check their valid and extract

		if (strlen($voucher) < 5) {

			captiveportal_syslog("{$voucher} invalid: Too short!");

			continue;   // seems too short to be a voucher!

		}

		unset($output);

		if ($status == "OK") {

			// check if we have this ticket on a registered roll for this ticket

			if ($tickets_per_roll[$roll] && ($nr <= $tickets_per_roll[$roll])) {

				// voucher is from a registered roll.

					$active_vouchers[$roll] = voucher_read_active_db($roll);

				}

				// valid voucher. Store roll# and ticket#

				if (!isset($bitstring[$roll])) {

					$bitstring[$roll] = voucher_read_used_db($roll);

				}

				$pos = $nr >> 3; // divide by 8 -> octet

				if (!(ord($bitstring[$roll][$pos]) & $mask)) {

					$bitstring[$roll][$pos] = chr(ord($bitstring[$roll][$pos]) | $mask);

				}

				captiveportal_syslog("{$voucher} ({$roll}/{$nr}) forced to expire");

				$cpentry = captiveportal_read_db("WHERE username = '{$voucher}'");

				if (!empty($cpentry) && !empty($cpentry[0])) {

					if (empty($cpzoneid) && !empty(config_get_path("captiveportal/{$cpzone}"))) {

						$cpzoneid = config_get_path("captiveportal/{$cpzone}/zoneid");

					}

					$cpentry = $cpentry[0];

					captiveportal_disconnect($cpentry, 13);

					captiveportal_logportalauth($cpentry[4], $cpentry[3], $cpentry[2], "FORCEFULLY TERMINATING VOUCHER {$voucher} SESSION");

					$unsetindexes[] = $cpentry[5];

				}

			} else {

				captiveportal_syslog(sprintf(gettext('%1$s (%2$s/%3$s): not found on any registered Roll'), $voucher, $roll, $nr));

			}

			// hmm, thats weird ... not what I expected

			captiveportal_syslog(sprintf(gettext('%1$s invalid: %2$s!!'), $voucher, $output[0]));

		}

	}

		foreach ($active_vouchers as $roll => $active) {

			voucher_write_active_db($roll, $active);

		}

		/* perform in-use vouchers expiration using check_reload_status */

		send_event("service sync vouchers");

	} else {

	}

			if (is_array($used)) {

					voucher_write_used_db($roll, base64_encode($u));

				}

			} else {

	/* Write database */

	if (!empty($unsetindexes)) {

		captiveportal_remove_entries($unsetindexes);

	}

	// XMLRPC Call over to the other node

	return true;

/*

 * Authenticate a voucher and return the remaining time credit in minutes

 * if $test is set, don't mark the voucher as used nor add it to the list

 * If $test is set, simply test the voucher. Don't change anything

 */

function voucher_auth($voucher_received, $test = 0, $carp_loop = false) {

	global $g, $cpzone, $dbc;

	if (!config_path_enabled("voucher/{$cpzone}")) {

		return 0;

	}

	$voucherlck = lock("voucher{$cpzone}", LOCK_EX);

	// read rolls into assoc array with rollid as key and minutes as value

	foreach (config_get_path("voucher/{$cpzone}/roll", []) as $rollent) {

	}

	// split into an array. Useful for multiple vouchers given

	$a_vouchers_received = preg_split("/[\t\n\r ]+/s", $voucher_received);

	$error = 0;

		if (strlen($voucher) < 5) {

			$voucher_err_text = sprintf(gettext("%s invalid: Too short!"), $voucher);

			$error++;

			continue;   // seems too short to be a voucher!

		}

		$result = exec("/usr/local/bin/voucher -c {$g['varetc_path']}/voucher_{$cpzone}.cfg -k {$g['varetc_path']}/voucher_{$cpzone}.public -- $v");

		list($status, $roll, $nr) = explode(" ", $result);

			// check if we have this ticket on a registered roll for this ticket

			if ($tickets_per_roll[$roll] && ($nr <= $tickets_per_roll[$roll])) {

				// voucher is from a registered roll.

					$active_vouchers[$roll] = voucher_read_active_db($roll);

				}

				// valid voucher. Store roll# and ticket#

					list($timestamp, $minutes) = explode(",", $active_vouchers[$roll][$voucher]);

					// we have an already active voucher here.

					$test_result[] = sprintf(gettext('%1$s (%2$s/%3$s) active and good for %4$d Minutes'), $voucher, $roll, $nr, $remaining);

					$total_minutes += $remaining;

					if (!isset($bitstring[$roll])) {

						$bitstring[$roll] = voucher_read_used_db($roll);

					}

					$pos = $nr >> 3; // divide by 8 -> octet

						$voucher_err_text = sprintf(gettext('%1$s (%2$s/%3$s) already used and expired'), $voucher, $roll, $nr);

						$total_minutes = -1;    // voucher expired

						$test_result[] = sprintf(gettext('%1$s (%2$s/%3$s) good for %4$s Minutes'), $voucher, $roll, $nr, $minutes_per_roll[$roll]);

						$total_minutes += $minutes_per_roll[$roll];

				$voucher_err_text = sprintf(gettext('%1$s (%2$s/%3$s): not found on any registered Roll'), $voucher, $roll, $nr);

			}

			$voucher_err_text = sprintf(gettext('%1$s invalid: %2$s !!'), $voucher, $result);

			$error++;

	// if this was a test call, we're done. Return the result.

			$test_result[] = gettext("Access denied!");

		} else {

			$test_result[] = sprintf(gettext("Access granted for %d Minutes in total."), $total_minutes);

		}

		return $test_result;

	// if we had an error (one of the vouchers is invalid), return 0.

		unlock($voucherlck);

		if ($total_minutes > 0) {   // probably not needed, but want to make sure

			$total_minutes = 0;     // we only report -1 (expired) or 0 (no access)

		}

		return $total_minutes;       // well, at least one voucher had errors. Say NO ACCESS

	// All given vouchers were valid and this isn't simply a test.

	if (is_array($bitstring)) {

			if (is_array($used)) {

					voucher_write_used_db($roll, base64_encode($u));

				}

			} else {

	// Active DB: we only add the first voucher if multiple given

	$active_vouchers[$first_voucher_roll][$first_voucher] = "$timestamp,$minutes";

	voucher_write_active_db($first_voucher_roll, $active_vouchers[$first_voucher_roll]);

	// XMLRPC Call over to the other node

	/* perform in-use vouchers expiration using check_reload_status */

	send_event("service sync vouchers");

	unlock($voucherlck);

	return $total_minutes;

}

function voucher_configure() {

	global $g, $cpzone;

	foreach (config_get_path('voucher', []) as $voucherzone => $vcfg) {

			}

		}

function voucher_configure_zone() {

	global $g, $cpzone;

	if (!config_path_enabled("voucher/{$cpzone}")) {

		return 0;

	}

	$voucherlck = lock("voucher{$cpzone}", LOCK_EX);

	/* write public key used to verify vouchers */

	$pubkey = base64_decode(config_get_path("voucher/{$cpzone}/publickey"));

	$fd = fopen("{$g['varetc_path']}/voucher_{$cpzone}.public", "w");

		captiveportal_syslog("Voucher error: cannot write voucher.public");

		unlock($voucherlck);

	$voucher_config = config_get_path("voucher/{$cpzone}");

	fclose($fd);

	unlock($voucherlck);

	return 0;

}

/* write bitstring of used vouchers to ramdisk.

 * Bitstring must already be base64_encoded!

	global $g, $cpzone;

	$fd = fopen("{$g['vardb_path']}/voucher_{$cpzone}_used_$roll.db", "w");

	if ($fd) {

	} else {

		voucher_log(LOG_ERR, sprintf(gettext('cant write %1$s/voucher_%2$s_used_%3$s.db'), g_get('vardb_path'), $cpzone, $roll));

	}

}

 * voucher is index.

 */

	global $g, $cpzone;

	$file = "{$g['vardb_path']}/voucher_{$cpzone}_active_$roll.db";

	if (file_exists($file)) {

					list($voucher, $timestamp, $minutes) = explode(",", $line); // voucher,timestamp

					if ((($timestamp + (60*$minutes)) - time()) > 0) {

						$active[$voucher] = "$timestamp,$minutes";

					} else {

						$dirty=1;

					}

				}

			if ($dirty) { // if we found expired entries, lets remove them

				voucher_write_active_db($roll, $active);

			}

		}

}

	global $g, $cpzone;

	if (!is_array($active)) {

		return;

	}

}

	global $g, $cpzone;

}

	global $g, $cpzone;

			voucher_log(LOG_ERR, sprintf(gettext('cant read %1$s/voucher_%2$s_used_%3$s.db'), g_get('vardb_path'), $cpzone, $roll));

		}

}

	global $g, $cpzone;

}

	$message = trim($message);

	syslog($priority, sprintf(gettext("Voucher: %s"), $message));

	closelog();

}

/* Perform natural expiration of vouchers

 * Called during reboot -> system_reboot_cleanup() and every active voucher change

 */

	global $g;

			}

		}

}

?>