Revision aea56408
Added by Ermal LUÇI over 12 years ago
| etc/inc/captiveportal.inc | ||
|---|---|---|
| 155 | 155 |
/* make sure ipfw is not on pfil hooks */ |
| 156 | 156 |
mwexec("/sbin/sysctl net.inet.ip.pfil.inbound=\"pf\" net.inet6.ip6.pfil.inbound=\"pf\"" .
|
| 157 | 157 |
" net.inet.ip.pfil.outbound=\"pf\" net.inet6.ip6.pfil.outbound=\"pf\""); |
| 158 |
/* Activate layer2 filtering */ |
|
| 159 |
mwexec("/sbin/sysctl net.link.ether.ipfw=1 net.inet.ip.fw.one_pass=1");
|
|
| 158 | 160 |
} |
| 159 |
/* Activate layer2 filtering */ |
|
| 160 |
mwexec("/sbin/sysctl net.link.ether.ipfw=1");
|
|
| 161 | 161 |
|
| 162 | 162 |
/* Always load dummynet now that even allowed ip and mac passthrough use it. */ |
| 163 | 163 |
if (!is_module_loaded("dummynet.ko")) {
|
| ... | ... | |
| 491 | 491 |
if ($reinit == false) |
| 492 | 492 |
$captiveportallck = lock("captiveportal{$cpzone}");
|
| 493 | 493 |
|
| 494 |
/* init dummynet/ipfw rules number database */ |
|
| 495 |
captiveportal_init_ipfw_ruleno(); |
|
| 496 |
|
|
| 497 | 494 |
$cprules = "add 65291 allow pfsync from any to any\n"; |
| 498 | 495 |
$cprules .= "add 65292 allow carp from any to any\n"; |
| 499 | 496 |
|
| ... | ... | |
| 531 | 528 |
$cprules .= "add {$rulenum} pass icmp from any to {$ips} in icmptype 8 \n";
|
| 532 | 529 |
$rulenum++; |
| 533 | 530 |
/* Allowed ips */ |
| 534 |
$cprules .= "add {$rulenum} allow ip from table(3) to any in\n";
|
|
| 535 |
$rulenum++; |
|
| 536 |
$cprules .= "add {$rulenum} allow ip from any to table(4) out\n";
|
|
| 537 |
$rulenum++; |
|
| 538 |
$cprules .= "add {$rulenum} pipe tablearg ip from table(5) to any in\n";
|
|
| 539 |
$rulenum++; |
|
| 540 |
$cprules .= "add {$rulenum} pipe tablearg ip from any to table(6) out\n";
|
|
| 541 |
$rulenum++; |
|
| 542 |
$cprules .= "add {$rulenum} allow ip from any to table(7) in\n";
|
|
| 531 |
$cprules .= "add {$rulenum} pipe tablearg ip from table(3) to any in\n";
|
|
| 543 | 532 |
$rulenum++; |
| 544 |
$cprules .= "add {$rulenum} allow ip from table(8) to any out\n";
|
|
| 545 |
$rulenum++; |
|
| 546 |
$cprules .= "add {$rulenum} pipe tablearg ip from any to table(9) in\n";
|
|
| 547 |
$rulenum++; |
|
| 548 |
$cprules .= "add {$rulenum} pipe tablearg ip from table(10) to any out\n";
|
|
| 533 |
$cprules .= "add {$rulenum} pipe tablearg ip from any to table(4) out\n";
|
|
| 549 | 534 |
$rulenum++; |
| 550 | 535 |
|
| 551 | 536 |
/* Authenticated users rules. */ |
| ... | ... | |
| 591 | 576 |
else {
|
| 592 | 577 |
$tmprules = "table 3 flush\n"; |
| 593 | 578 |
$tmprules .= "table 4 flush\n"; |
| 594 |
$tmprules .= "table 5 flush\n"; |
|
| 595 |
$tmprules .= "table 6 flush\n"; |
|
| 596 |
$tmprules .= "table 7 flush\n"; |
|
| 597 |
$tmprules .= "table 8 flush\n"; |
|
| 598 |
$tmprules .= "table 9 flush\n"; |
|
| 599 |
$tmprules .= "table 10 flush\n"; |
|
| 600 | 579 |
$tmprules .= "flush\n"; |
| 601 | 580 |
$cprules = "{$tmprules}\n{$cprules}";
|
| 602 | 581 |
} |
| ... | ... | |
| 609 | 588 |
|
| 610 | 589 |
if ($reinit == false) |
| 611 | 590 |
unlock($captiveportallck); |
| 612 |
|
|
| 613 |
/* activate ipfw(4) so CP can work */ |
|
| 614 |
mwexec("/sbin/sysctl net.link.ether.ipfw=1");
|
|
| 615 |
/* Make sure not re-entrancy is allowed in ipfw(4) */ |
|
| 616 |
mwexec("/sbin/sysctl net.inet.ip.fw.one_pass=1");
|
|
| 617 | 591 |
} |
| 618 | 592 |
|
| 619 | 593 |
/* |
| ... | ... | |
| 803 | 777 |
if (isset($tmpvoucherdb[$emac['username']])) {
|
| 804 | 778 |
$temac = $config['captiveportal'][$cpzone]['passthrumac'][$tmpvoucherdb[$emac['username']]]; |
| 805 | 779 |
$ruleno = captiveportal_get_ipfw_passthru_ruleno($temac['mac']); |
| 780 |
$pipeno = captiveportal_get_dn_passthru_ruleno($temac['mac']); |
|
| 806 | 781 |
if ($ruleno) {
|
| 807 |
captiveportal_free_ipfw_ruleno($ruleno, true);
|
|
| 782 |
captiveportal_free_ipfw_ruleno($ruleno); |
|
| 808 | 783 |
$macrules .= "delete {$ruleno}";
|
| 809 | 784 |
++$ruleno; |
| 810 | 785 |
$macrules .= "delete {$ruleno}";
|
| 811 | 786 |
} |
| 787 |
if ($pipeno) {
|
|
| 788 |
captiveportal_free_dn_ruleno($pipeno); |
|
| 789 |
$macrules .= "pipe delete {$pipeno}\n";
|
|
| 790 |
++$pipeno; |
|
| 791 |
$macrules .= "pipe delete {$pipeno}\n";
|
|
| 792 |
} |
|
| 812 | 793 |
$writecfg = true; |
| 813 | 794 |
captiveportal_logportalauth($temac['username'], $temac['mac'], $temac['ip'], "DUPLICATE {$temac['username']} LOGIN - TERMINATING OLD SESSION");
|
| 814 | 795 |
unset($config['captiveportal'][$cpzone]['passthrumac'][$tmpvoucherdb[$emac['username']]]); |
| ... | ... | |
| 816 | 797 |
$tmpvoucherdb[$emac['username']] = $eid; |
| 817 | 798 |
if (voucher_auth($emac['username']) <= 0) {
|
| 818 | 799 |
$ruleno = captiveportal_get_ipfw_passthru_ruleno($emac['mac']); |
| 800 |
$pipeno = captiveportal_get_dn_passthru_ruleno($emac['mac']); |
|
| 819 | 801 |
if ($ruleno) {
|
| 820 |
captiveportal_free_ipfw_ruleno($ruleno, true);
|
|
| 802 |
captiveportal_free_ipfw_ruleno($ruleno); |
|
| 821 | 803 |
$macrules .= "delete {$ruleno}";
|
| 822 | 804 |
++$ruleno; |
| 823 | 805 |
$macrules .= "delete {$ruleno}";
|
| 824 | 806 |
} |
| 807 |
if ($pipeno) {
|
|
| 808 |
captiveportal_free_dn_ruleno($pipeno); |
|
| 809 |
$macrules .= "pipe delete {$pipeno}\n";
|
|
| 810 |
++$pipeno; |
|
| 811 |
$macrules .= "pipe delete {$pipeno}\n";
|
|
| 812 |
} |
|
| 825 | 813 |
$writecfg = true; |
| 826 | 814 |
captiveportal_logportalauth($emac['username'], $emac['mac'], $emac['ip'], "EXPIRED {$emac['username']} LOGIN - TERMINATING SESSION");
|
| 827 | 815 |
unset($config['captiveportal'][$cpzone]['passthrumac'][$eid]); |
| ... | ... | |
| 873 | 861 |
* We could get an error if the pipe doesn't exist but everything should still be fine |
| 874 | 862 |
*/ |
| 875 | 863 |
if (!empty($dbent[1])) {
|
| 876 |
pfSense_pipe_action("pipe delete " . ($dbent[1]+20000));
|
|
| 877 |
pfSense_pipe_action("pipe delete " . ($dbent[1]+20001));
|
|
| 864 |
pfSense_pipe_action("pipe delete {$dbent[1]}");
|
|
| 865 |
pfSense_pipe_action("pipe delete " . ($dbent[1]+1));
|
|
| 878 | 866 |
|
| 879 | 867 |
/* Release the ruleno so it can be reallocated to new clients. */ |
| 880 |
captiveportal_free_ipfw_ruleno($dbent[1]);
|
|
| 868 |
captiveportal_free_dn_ruleno($dbent[1]);
|
|
| 881 | 869 |
} |
| 882 | 870 |
|
| 883 | 871 |
// XMLRPC Call over to the master Voucher node |
| ... | ... | |
| 942 | 930 |
} |
| 943 | 931 |
|
| 944 | 932 |
function captiveportal_passthrumac_configure_entry($macent) {
|
| 945 |
$rules = ""; |
|
| 946 |
$enBwup = isset($macent['bw_up']); |
|
| 947 |
$enBwdown = isset($macent['bw_down']); |
|
| 948 |
$actionup = "allow"; |
|
| 949 |
$actiondown = "allow"; |
|
| 933 |
|
|
| 934 |
$bwUp = empty($macent['bw_up']) ? 0 : $macent['bw_up']; |
|
| 935 |
$bwDown = empty($macent['bw_down']) ? 0 : $macent['bw_down']; |
|
| 950 | 936 |
|
| 951 | 937 |
$ruleno = captiveportal_get_next_ipfw_ruleno(); |
| 938 |
$pipeno = captiveportal_get_next_dn_ruleno(); |
|
| 952 | 939 |
|
| 953 |
if ($enBwup) {
|
|
| 954 |
$bw_up = $ruleno + 20000; |
|
| 955 |
$rules .= "pipe {$bw_up} config bw {$macent['bw_up']}Kbit/s queue 100\n";
|
|
| 956 |
$actionup = "pipe {$bw_up}";
|
|
| 957 |
} |
|
| 958 |
if ($enBwdown) {
|
|
| 959 |
$bw_down = $ruleno + 20001; |
|
| 960 |
$rules .= "pipe {$bw_down} config bw {$macent['bw_down']}Kbit/s queue 100\n";
|
|
| 961 |
$actiondown = "pipe {$bw_down}";
|
|
| 962 |
} |
|
| 963 |
$rules .= "add {$ruleno} {$actiondown} ip from any to any MAC {$macent['mac']} any\n";
|
|
| 940 |
$rules = ""; |
|
| 941 |
$pipeup = $pipeno; |
|
| 942 |
$rules .= "pipe {$pipeup} config bw {$bwUp}Kbit/s queue 100\n";
|
|
| 943 |
$pipedown = $pipeno + 1; |
|
| 944 |
$rules .= "pipe {$pipedown} config bw {$bwDown}Kbit/s queue 100\n";
|
|
| 945 |
$rules .= "add {$ruleno} pipe {$pipeup} ip from any to any MAC {$macent['mac']} any\n";
|
|
| 964 | 946 |
$ruleno++; |
| 965 |
$rules .= "add {$ruleno} {$actionup} ip from any to any MAC any {$macent['mac']}\n";
|
|
| 947 |
$rules .= "add {$ruleno} pipe {$pipedown} ip from any to any MAC any {$macent['mac']}\n";
|
|
| 966 | 948 |
|
| 967 | 949 |
return $rules; |
| 968 | 950 |
} |
| ... | ... | |
| 1016 | 998 |
} |
| 1017 | 999 |
|
| 1018 | 1000 |
$rules = ""; |
| 1019 |
$enBwup = intval($ipent['bw_up']); |
|
| 1020 |
$enBwdown = intval($ipent['bw_down']); |
|
| 1021 |
$bw_up = ""; |
|
| 1022 |
$bw_down = ""; |
|
| 1023 |
$tablein = array(); |
|
| 1024 |
$tableout = array(); |
|
| 1001 |
$enBwup = empty($ipent['bw_up']) ? 0 : intval($ipent['bw_up']); |
|
| 1002 |
$enBwdown = empty($ipent['bw_down']) ? 0 : intval($ipent['bw_down']); |
|
| 1025 | 1003 |
|
| 1026 |
$ruleno = captiveportal_get_next_ipfw_ruleno(); |
|
| 1027 |
|
|
| 1028 |
if ($ipent['dir'] == "from") {
|
|
| 1029 |
if ($enBwup) |
|
| 1030 |
$tablein[] = 5; |
|
| 1031 |
else |
|
| 1032 |
$tablein[] = 3; |
|
| 1033 |
if ($enBwdown) |
|
| 1034 |
$tableout[] = 6; |
|
| 1035 |
else |
|
| 1036 |
$tableout[] = 4; |
|
| 1037 |
} else if ($ipent['dir'] == "to") {
|
|
| 1038 |
if ($enBwup) |
|
| 1039 |
$tablein[] = 9; |
|
| 1040 |
else |
|
| 1041 |
$tablein[] = 7; |
|
| 1042 |
if ($enBwdown) |
|
| 1043 |
$tableout[] = 10; |
|
| 1044 |
else |
|
| 1045 |
$tableout[] = 8; |
|
| 1046 |
} else if ($ipent['dir'] == "both") {
|
|
| 1047 |
if ($enBwup) {
|
|
| 1048 |
$tablein[] = 5; |
|
| 1049 |
$tablein[] = 9; |
|
| 1050 |
} else {
|
|
| 1051 |
$tablein[] = 3; |
|
| 1052 |
$tablein[] = 7; |
|
| 1053 |
} |
|
| 1054 |
if ($enBwdown) {
|
|
| 1055 |
$tableout[] = 6; |
|
| 1056 |
$tableout[] = 10; |
|
| 1057 |
} else {
|
|
| 1058 |
$tableout[] = 4; |
|
| 1059 |
$tableout[] = 8; |
|
| 1060 |
} |
|
| 1061 |
} |
|
| 1062 |
if ($enBwup) {
|
|
| 1063 |
$bw_up = $ruleno + 20000; |
|
| 1064 |
$rules .= "pipe {$bw_up} config bw {$ipent['bw_up']}Kbit/s queue 100\n";
|
|
| 1065 |
} |
|
| 1004 |
$pipeno = captiveportal_get_next_dn_ruleno(); |
|
| 1005 |
$rules .= "pipe {$pipeno} config bw {$ipent['bw_up']}Kbit/s queue 100\n";
|
|
| 1006 |
$pipedown = $pipeno + 1; |
|
| 1007 |
$rules .= "pipe {$pipedown} config bw {$ipent['bw_down']}Kbit/s queue 100\n";
|
|
| 1066 | 1008 |
$subnet = ""; |
| 1067 | 1009 |
if (!empty($ipent['sn'])) |
| 1068 | 1010 |
$subnet = "/{$ipent['sn']}";
|
| 1069 |
foreach ($tablein as $table) |
|
| 1070 |
$rules .= "table {$table} add {$ipaddress}{$subnet} {$bw_up}\n";
|
|
| 1071 |
if ($enBwdown) {
|
|
| 1072 |
$bw_down = $ruleno + 20001; |
|
| 1073 |
$rules .= "pipe {$bw_down} config bw {$ipent['bw_down']}Kbit/s queue 100\n";
|
|
| 1074 |
} |
|
| 1075 |
foreach ($tableout as $table) |
|
| 1076 |
$rules .= "table {$table} add {$ipaddress}{$subnet} {$bw_down}\n";
|
|
| 1011 |
$rules .= "table 3 add {$ipaddress}{$subnet} {$pipeno}\n";
|
|
| 1012 |
$rules .= "table 4 add {$ipaddress}{$subnet} {$pipedown}\n";
|
|
| 1077 | 1013 |
|
| 1078 | 1014 |
return $rules; |
| 1079 | 1015 |
} |
| ... | ... | |
| 1262 | 1198 |
function radius($username,$password,$clientip,$clientmac,$type, $radiusctx = null) {
|
| 1263 | 1199 |
global $g, $config; |
| 1264 | 1200 |
|
| 1265 |
$ruleno = captiveportal_get_next_ipfw_ruleno();
|
|
| 1201 |
$pipeno = captiveportal_get_next_dn_ruleno();
|
|
| 1266 | 1202 |
|
| 1267 | 1203 |
/* If the pool is empty, return appropriate message and fail authentication */ |
| 1268 |
if (is_null($ruleno)) {
|
|
| 1204 |
if (is_null($pipeno)) {
|
|
| 1269 | 1205 |
$auth_list = array(); |
| 1270 | 1206 |
$auth_list['auth_val'] = 1; |
| 1271 | 1207 |
$auth_list['error'] = "System reached maximum login capacity"; |
| ... | ... | |
| 1282 | 1218 |
$radiusservers[$radiusctx], |
| 1283 | 1219 |
$clientip, |
| 1284 | 1220 |
$clientmac, |
| 1285 |
$ruleno);
|
|
| 1221 |
$pipeno);
|
|
| 1286 | 1222 |
|
| 1287 | 1223 |
if ($auth_list['auth_val'] == 2) {
|
| 1288 | 1224 |
captiveportal_logportalauth($username,$clientmac,$clientip,$type); |
| ... | ... | |
| 1291 | 1227 |
$username, |
| 1292 | 1228 |
$password, |
| 1293 | 1229 |
$auth_list, |
| 1294 |
$ruleno,
|
|
| 1230 |
$pipeno,
|
|
| 1295 | 1231 |
$radiusctx); |
| 1296 | 1232 |
} |
| 1297 | 1233 |
|
| ... | ... | |
| 1394 | 1330 |
return 0; |
| 1395 | 1331 |
} |
| 1396 | 1332 |
|
| 1397 |
function captiveportal_init_ipfw_ruleno($rulenos_start = 2000, $rulenos_range_max = 49899) {
|
|
| 1398 |
global $g, $cpzone;
|
|
| 1333 |
function captiveportal_get_next_dn_ruleno($rulenos_start = 2000, $rulenos_range_max = 64500) {
|
|
| 1334 |
global $config, $g;
|
|
| 1399 | 1335 |
|
| 1400 |
@unlink("{$g['vardb_path']}/captiveportal_{$cpzone}.rules");
|
|
| 1401 |
$rules = array_pad(array(), $rulenos_range_max - $rulenos_start, false); |
|
| 1402 |
file_put_contents("{$g['vardb_path']}/captiveportal_{$cpzone}.rules", serialize($rules));
|
|
| 1336 |
$cpruleslck = lock("captiveportalrulesdn", LOCK_EX);
|
|
| 1337 |
$ruleno = 0; |
|
| 1338 |
if (file_exists("{$g['vardb_path']}/captiveportaldn.rules")) {
|
|
| 1339 |
$rules = unserialize(file_get_contents("{$g['vardb_path']}/captiveportaldn.rules"));
|
|
| 1340 |
for ($ridx = $rulenos_start; $ridx < $rulenos_range_max; $ridx++) {
|
|
| 1341 |
if ($rules[$ridx]) {
|
|
| 1342 |
$ridx++; |
|
| 1343 |
continue; |
|
| 1344 |
} |
|
| 1345 |
$ruleno = $ridx; |
|
| 1346 |
$rules[$ridx] = "used"; |
|
| 1347 |
$rules[++$ridx] = "used"; |
|
| 1348 |
break; |
|
| 1349 |
} |
|
| 1350 |
} else {
|
|
| 1351 |
$rules = array_pad(array(), $rulenos_range_max - $rulenos_start, false); |
|
| 1352 |
$rules[$rulenos_start] = "used"; |
|
| 1353 |
$rules[++$rulenos_start] = "used"; |
|
| 1354 |
$ruleno = $rulenos_start; |
|
| 1355 |
} |
|
| 1356 |
file_put_contents("{$g['vardb_path']}/captiveportaldn.rules", serialize($rules));
|
|
| 1357 |
unlock($cpruleslck); |
|
| 1358 |
|
|
| 1359 |
return $ruleno; |
|
| 1360 |
} |
|
| 1361 |
|
|
| 1362 |
function captiveportal_free_dn_ruleno($ruleno) {
|
|
| 1363 |
global $config, $g; |
|
| 1364 |
|
|
| 1365 |
$cpruleslck = lock("captiveportalrulesdn", LOCK_EX);
|
|
| 1366 |
if (file_exists("{$g['vardb_path']}/captiveportal_{$cpzone}.rules")) {
|
|
| 1367 |
$rules = unserialize(file_get_contents("{$g['vardb_path']}/captiveportaldn.rules"));
|
|
| 1368 |
$rules[$ruleno] = false; |
|
| 1369 |
$rules[++$ruleno] = false; |
|
| 1370 |
file_put_contents("{$g['vardb_path']}/captiveportaldn.rules", serialize($rules));
|
|
| 1371 |
} |
|
| 1372 |
unlock($cpruleslck); |
|
| 1373 |
} |
|
| 1374 |
|
|
| 1375 |
function captiveportal_get_dn_passthru_ruleno($value) {
|
|
| 1376 |
global $config, $g, $cpzone; |
|
| 1377 |
|
|
| 1378 |
$cpcfg = $config['captiveportal'][$cpzone]; |
|
| 1379 |
if(!isset($cpcfg['enable'])) |
|
| 1380 |
return NULL; |
|
| 1381 |
|
|
| 1382 |
$cpruleslck = lock("captiveportalrules{$cpzone}", LOCK_EX);
|
|
| 1383 |
if (file_exists("{$g['vardb_path']}/captiveportal_{$cpzone}.rules")) {
|
|
| 1384 |
$rules = unserialize(file_get_contents("{$g['vardb_path']}/captiveportal_{$cpzone}.rules"));
|
|
| 1385 |
captiveportal_ipfw_set_context($cpzone); |
|
| 1386 |
$ruleno = intval(`/sbin/ipfw show | /usr/bin/grep {$value} | /usr/bin/grep -v grep | /usr/bin/cut -d " " -f 5 | /usr/bin/head -n 1`);
|
|
| 1387 |
if ($rules[$ruleno]) {
|
|
| 1388 |
unlock($cpruleslck); |
|
| 1389 |
return $ruleno; |
|
| 1390 |
} |
|
| 1391 |
} |
|
| 1392 |
|
|
| 1393 |
unlock($cpruleslck); |
|
| 1394 |
return NULL; |
|
| 1403 | 1395 |
} |
| 1404 | 1396 |
|
| 1405 | 1397 |
/* |
| ... | ... | |
| 1407 | 1399 |
* within the range specified based on the actual logged on users |
| 1408 | 1400 |
* |
| 1409 | 1401 |
*/ |
| 1410 |
function captiveportal_get_next_ipfw_ruleno($rulenos_start = 2000, $rulenos_range_max = 49899) {
|
|
| 1402 |
function captiveportal_get_next_ipfw_ruleno($rulenos_start = 2, $rulenos_range_max = 64500) {
|
|
| 1411 | 1403 |
global $config, $g, $cpzone; |
| 1412 | 1404 |
|
| 1413 | 1405 |
$cpcfg = $config['captiveportal'][$cpzone]; |
| ... | ... | |
| 1434 | 1426 |
} |
| 1435 | 1427 |
} else {
|
| 1436 | 1428 |
$rules = array_pad(array(), $rulenos_range_max - $rulenos_start, false); |
| 1437 |
$rules[2] = "used"; |
|
| 1429 |
$rules[$rulenos_start] = "used"; |
|
| 1430 |
$rules[++$rulenos_start] = "used"; |
|
| 1438 | 1431 |
$ruleno = 2; |
| 1439 | 1432 |
} |
| 1440 | 1433 |
file_put_contents("{$g['vardb_path']}/captiveportal_{$cpzone}.rules", serialize($rules));
|
| ... | ... | |
| 1442 | 1435 |
return $ruleno; |
| 1443 | 1436 |
} |
| 1444 | 1437 |
|
| 1445 |
function captiveportal_free_ipfw_ruleno($ruleno, $usedbw = false) {
|
|
| 1438 |
function captiveportal_free_ipfw_ruleno($ruleno) {
|
|
| 1446 | 1439 |
global $config, $g, $cpzone; |
| 1447 | 1440 |
|
| 1448 | 1441 |
$cpcfg = $config['captiveportal'][$cpzone]; |
| ... | ... | |
| 1676 | 1669 |
$dwfaultbw_down = isset($config['captiveportal'][$cpzone]['bwdefaultdn']) ? $config['captiveportal'][$cpzone]['bwdefaultdn'] : 0; |
| 1677 | 1670 |
$bw_up = isset($attributes['bw_up']) ? round(intval($attributes['bw_up'])/1000, 2) : $dwfaultbw_up; |
| 1678 | 1671 |
$bw_down = isset($attributes['bw_down']) ? round(intval($attributes['bw_down'])/1000, 2) : $dwfaultbw_down; |
| 1679 |
$bw_up_pipeno = $cpentry[1]+20000;
|
|
| 1680 |
$bw_down_pipeno = $cpentry[1]+20001;
|
|
| 1672 |
$bw_up_pipeno = $cpentry[1]; |
|
| 1673 |
$bw_down_pipeno = $cpentry[1]+1; |
|
| 1681 | 1674 |
|
| 1682 | 1675 |
pfSense_pipe_action("pipe {$bw_up_pipeno} config bw {$bw_up}Kbit/s queue 100");
|
| 1683 | 1676 |
pfSense_pipe_action("pipe {$bw_down_pipeno} config bw {$bw_down}Kbit/s queue 100");
|
| 1684 | 1677 |
//captiveportal_logportalauth($cpentry[4], $cpentry[3], $cpentry[2], "RADIUS_BANDWIDTH_REAPPLY", "{$bw_up}/{$bw_down}");
|
| 1685 | 1678 |
|
| 1686 |
unset($bw_up_pipeno, $bw_Down_pipeno, $bw_up, $bw_down);
|
|
| 1679 |
unset($bw_up_pipeno, $bw_down_pipeno, $bw_up, $bw_down);
|
|
| 1687 | 1680 |
} |
| 1688 | 1681 |
|
| 1689 |
function portal_allow($clientip,$clientmac,$username,$password = null, $attributes = null, $ruleno = null, $radiusctx = null) {
|
|
| 1682 |
function portal_allow($clientip,$clientmac,$username,$password = null, $attributes = null, $pipeno = null, $radiusctx = null) {
|
|
| 1690 | 1683 |
|
| 1691 | 1684 |
global $redirurl, $g, $config, $type, $passthrumac, $_POST, $cpzone; |
| 1692 | 1685 |
|
| 1693 |
/* See if a ruleno is passed, if not start sessions because this means there isn't one atm */ |
|
| 1694 |
if ($ruleno == null) |
|
| 1695 |
$ruleno = captiveportal_get_next_ipfw_ruleno(); |
|
| 1696 |
|
|
| 1697 |
/* if the pool is empty, return appropriate message and exit */ |
|
| 1698 |
if (is_null($ruleno)) {
|
|
| 1699 |
portal_reply_page($redirurl, "error", "System reached maximum login capacity"); |
|
| 1700 |
log_error("WARNING! Captive portal has reached maximum login capacity");
|
|
| 1701 |
exit; |
|
| 1702 |
} |
|
| 1703 |
|
|
| 1704 | 1686 |
// Ensure we create an array if we are missing attributes |
| 1705 | 1687 |
if (!is_array($attributes)) |
| 1706 | 1688 |
$attributes = array(); |
| ... | ... | |
| 1729 | 1711 |
if ($macent['mac'] == $mac['mac']) {
|
| 1730 | 1712 |
$macrules = ""; |
| 1731 | 1713 |
$ruleno = captiveportal_get_ipfw_passthru_ruleno($mac['mac']); |
| 1714 |
$pipeno = captiveportal_get_dn_passthru_ruleno($mac['mac']); |
|
| 1732 | 1715 |
if ($ruleno) {
|
| 1733 |
captiveportal_free_ipfw_ruleno($ruleno, true);
|
|
| 1716 |
captiveportal_free_ipfw_ruleno($ruleno); |
|
| 1734 | 1717 |
$macrules .= "delete {$ruleno}\n";
|
| 1735 | 1718 |
++$ruleno; |
| 1736 | 1719 |
$macrules .= "delete {$ruleno}\n";
|
| 1737 | 1720 |
} |
| 1721 |
if ($pipeno) {
|
|
| 1722 |
captiveportal_free_dn_ruleno($pipeno); |
|
| 1723 |
$macrules .= "pipe delete {$pipeno}\n";
|
|
| 1724 |
++$pipeno; |
|
| 1725 |
$macrules .= "pipe delete {$pipeno}\n";
|
|
| 1726 |
} |
|
| 1738 | 1727 |
unset($config['captiveportal'][$cpzone]['passthrumac'][$idx]); |
| 1739 | 1728 |
$mac['mac'] = $clientmac; |
| 1740 | 1729 |
$config['captiveportal'][$cpzone]['passthrumac'][] = $mac; |
| ... | ... | |
| 1751 | 1740 |
portal_reply_page($redirurl, "error", "Username: {$username} is already authenticated using another MAC address.",
|
| 1752 | 1741 |
$clientmac, $clientip, $username, $password); |
| 1753 | 1742 |
unlock($cpdblck); |
| 1754 |
exit;
|
|
| 1743 |
return;
|
|
| 1755 | 1744 |
} |
| 1756 | 1745 |
} |
| 1757 | 1746 |
} |
| ... | ... | |
| 1835 | 1824 |
mwexec("/sbin/ipfw -q {$g['tmp_path']}/macentry_{$cpzone}.rules.tmp");
|
| 1836 | 1825 |
$writecfg = true; |
| 1837 | 1826 |
} else {
|
| 1838 |
$bw_up_pipeno = $ruleno + 20000; |
|
| 1839 |
$bw_down_pipeno = $ruleno + 20001; |
|
| 1827 |
/* See if a pipeno is passed, if not start sessions because this means there isn't one atm */ |
|
| 1828 |
if (is_null($pipeno)) |
|
| 1829 |
$pipeno = captiveportal_get_next_dn_ruleno(); |
|
| 1830 |
|
|
| 1831 |
/* if the pool is empty, return appropriate message and exit */ |
|
| 1832 |
if (is_null($pipeno)) {
|
|
| 1833 |
portal_reply_page($redirurl, "error", "System reached maximum login capacity"); |
|
| 1834 |
log_error("WARNING! Captive portal has reached maximum login capacity");
|
|
| 1835 |
unlock($cpdblck); |
|
| 1836 |
return; |
|
| 1837 |
} |
|
| 1838 |
|
|
| 1839 |
$bw_up_pipeno = $pipeno; |
|
| 1840 |
$bw_down_pipeno = $pipeno + 1; |
|
| 1840 | 1841 |
//$bw_up /= 1000; // Scale to Kbit/s |
| 1841 | 1842 |
pfSense_pipe_action("pipe {$bw_up_pipeno} config bw {$bw_up}Kbit/s queue 100");
|
| 1842 | 1843 |
pfSense_pipe_action("pipe {$bw_down_pipeno} config bw {$bw_down}Kbit/s queue 100");
|
| ... | ... | |
| 1857 | 1858 |
|
| 1858 | 1859 |
/* encode password in Base64 just in case it contains commas */ |
| 1859 | 1860 |
$bpassword = base64_encode($password); |
| 1860 |
$cpdb[] = array($allow_time, $ruleno, $clientip, $clientmac, $username, $sessionid, $bpassword,
|
|
| 1861 |
$cpdb[] = array($allow_time, $pipeno, $clientip, $clientmac, $username, $sessionid, $bpassword,
|
|
| 1861 | 1862 |
$attributes['session_timeout'], $attributes['idle_timeout'], $attributes['session_terminate_time'], $radiusctx); |
| 1862 | 1863 |
|
| 1863 | 1864 |
/* rewrite information to database */ |
| ... | ... | |
| 1865 | 1866 |
unlock($cpdblck); |
| 1866 | 1867 |
|
| 1867 | 1868 |
if (isset($config['captiveportal'][$cpzone]['radacct_enable']) && !empty($radiusservers[$radiusctx])) {
|
| 1868 |
$acct_val = RADIUS_ACCOUNTING_START($ruleno,
|
|
| 1869 |
$acct_val = RADIUS_ACCOUNTING_START($pipeno,
|
|
| 1869 | 1870 |
$username, $sessionid, $radiusservers[$radiusctx], $clientip, $clientmac); |
| 1870 | 1871 |
if ($acct_val == 1) |
| 1871 | 1872 |
captiveportal_logportalauth($username,$clientmac,$clientip,$type,"RADIUS ACCOUNTING FAILED"); |
Also available in: Unified diff
Separate ipfw rule no db from limiter ones. Since ipfw has per instance feature while dummynet/limiters is a single instance.