Merge "bouncer: a bouncer for commmon room WiFi"
diff --git a/Makefile b/Makefile
index 9a3c478..cdc600d 100644
--- a/Makefile
+++ b/Makefile
@@ -15,11 +15,12 @@
BUILD_CRYPTDEV?= # default off: needs libdevmapper
BUILD_SIGNING?= # default off: needs libgtest
BUILD_JSONPOLL?=n
+BUILD_BOUNCER?= # default off: costly
BUILD_PRESTERASTATS?=n
export BUILD_HNVRAM BUILD_SSDP BUILD_DNSSD BUILD_LOGUPLOAD \
BUILD_BLUETOOTH BUILD_WAVEGUIDE BUILD_DVBUTILS BUILD_SYSMGR \
BUILD_STATUTILS BUILD_CRYPTDEV BUILD_SIGNING BUILD_JSONPOLL \
- BUILD_PRESTERASTATS BUILD_CACHE_WARMING
+ BUILD_PRESTERASTATS BUILD_CACHE_WARMING BUILD_BOUNCER
# note: libgpio is not built here. It's conditionally built
# via buildroot/packages/google/google_platform/google_platform.mk
@@ -73,6 +74,10 @@
DIRS+=craftui
endif
+ifeq ($(BUILD_BOUNCER),y)
+DIRS+=bouncer
+endif
+
ifeq ($(BR2_TARGET_GENERIC_PLATFORM_NAME),gfsc100)
DIRS+=diags
endif
diff --git a/bouncer/.gitignore b/bouncer/.gitignore
new file mode 100644
index 0000000..d82d8f5
--- /dev/null
+++ b/bouncer/.gitignore
@@ -0,0 +1,4 @@
+authorizer
+host-authorizer
+http_bouncer
+host-http_bouncer
diff --git a/bouncer/Makefile b/bouncer/Makefile
new file mode 100644
index 0000000..f579e10
--- /dev/null
+++ b/bouncer/Makefile
@@ -0,0 +1,49 @@
+default: all
+
+BINDIR=$(DESTDIR)/bin
+GPYLINT=$(shell \
+ if which gpylint >/dev/null; then \
+ echo gpylint; \
+ else \
+ echo 'echo "(gpylint-missing)" >&2'; \
+ fi \
+)
+
+TARGETS=authorizer http_bouncer
+
+HOST_TARGETS=$(addprefix host-,$(TARGETS))
+
+all: $(TARGETS) $(HOST_TARGETS)
+
+install:
+ mkdir -p $(BINDIR)
+ cp $(TARGETS) $(BINDIR)
+
+install-libs:
+ @echo "No libs to install."
+
+%: %.py
+ ln -s $< $@
+
+host-%: %.py
+ ln -s $< $@
+
+TESTS = $(wildcard test-*.sh) $(wildcard test-*.py) $(wildcard *_test.py)
+runtests: all $(TESTS)
+ set -e; \
+ for d in $(TESTS); do \
+ echo Running $$d; \
+ ./$$d; \
+ done
+
+lint: $(filter-out options.py,$(wildcard *.py))
+ $(GPYLINT) $^
+
+test: all $(TESTS)
+ ./wvtest/wvtestrun $(MAKE) runtests
+
+clean:
+ rm -f *.o $(TARGETS) \
+ $(HOST_TARGETS) \
+ *~ .*~ */*.pyc test_file *.pb.* *.tmp.*
+ rm -rf test_dir
diff --git a/bouncer/authorizer.py b/bouncer/authorizer.py
new file mode 100755
index 0000000..54c1fd2
--- /dev/null
+++ b/bouncer/authorizer.py
@@ -0,0 +1,156 @@
+#!/usr/bin/python
+# Copyright 2016 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+"""authorizer: processes Terms of Service acceptance for users."""
+
+import logging
+import re
+import subprocess
+import sys
+import time
+
+import options
+import tornado.escape
+import tornado.httpclient
+import tornado.ioloop
+import tornado.netutil
+
+
+optspec = """
+authorizer [options...]
+--
+c,filter-chain= iptables chain to operate on [captive-portal-guests]
+C,ca-certs= path to CA certificates [/etc/ssl/certs/ca-certificates.crt]
+d,dry-run don't modify iptables
+m,max-age= oldest acceptance to consider as valid, in days [60]
+n,nat-chain= iptables NAT chain to operate on [captive-portal-guests-nat]
+U,unix-path= Unix socket to listen on [/tmp/authorizer.sock]
+u,url= URL to query for authentication [https://fiber-managed-wifi-tos.appspot.com/tos-accepted?id=%(mac)s]
+"""
+
+MAX_TRIES = 300
+
+known_users = {}
+
+
+def ip46tables(*args):
+ if opt.dry_run:
+ return 0
+
+ x = subprocess.call(['iptables'] + list(args))
+ y = subprocess.call(['ip6tables'] + list(args))
+ return x | y
+
+
+class Checker(object):
+ """Manage checking and polling for Terms of Service acceptance."""
+
+ def __init__(self, mac_addr, url):
+ self.mac_addr = mac_addr
+ self.url = url % {'mac': mac_addr}
+ self.tries = 0
+ self.callback = None
+
+ def check(self):
+ """Check if a remote service knows about a device with a supplied MAC."""
+ logging.info('Checking TOS for %s', self.mac_addr)
+ http_client = tornado.httpclient.HTTPClient()
+ response = http_client.fetch(self.url, ca_certs=opt.ca_certs)
+ response_obj = tornado.escape.json_decode(response.body)
+ accepted_time = response_obj.get('accepted')
+ self.tries += 1
+
+ accepted = False
+ if accepted_time:
+ if accepted_time + (opt.max_age * 86400) > time.time():
+ accepted = True
+ if self.callback: self.callback.stop()
+ logging.info('TOS accepted for %s', self.mac_addr)
+
+ known_users[self.mac_addr] = response_obj
+ result = ip46tables('-A', opt.filter_chain, '-m', 'mac',
+ '--mac-source', self.mac_addr, '-j', 'ACCEPT')
+ result |= ip46tables('-t', 'nat', '-A', opt.nat_chain, '-m', 'mac',
+ '--mac-source', self.mac_addr, '-j', 'ACCEPT')
+ if result:
+ logging.error('Could not update firewall for device %s',
+ self.mac_addr)
+ else:
+ logging.info('TOS accepted too long ago for %s: %r', self.mac_addr,
+ accepted_time)
+
+ elif self.callback and self.tries > MAX_TRIES:
+ if not accepted:
+ logging.info('TOS not accepted for %s before timeout.', self.mac_addr)
+ self.callback.stop()
+
+ return response, accepted
+
+ def poll(self):
+ self.callback = tornado.ioloop.PeriodicCallback(self.check, 1000)
+ self.callback.start()
+
+
+def accept(connection, unused_address):
+ """Accept a MAC address and find out if it's authorized."""
+ cf = connection.makefile()
+
+ maybe_mac_addr = cf.readline().strip()
+ if re.match('([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$', maybe_mac_addr):
+ mac_addr = maybe_mac_addr.lower()
+ else:
+ logging.warning('can only check authorization for a MAC address.')
+ cf.write('{}')
+ return
+
+ if mac_addr in known_users:
+ logging.info('TOS accepted (cached) for %s', mac_addr)
+ cached_response = known_users[mac_addr]
+ cached_response['cached'] = True
+ cf.write(tornado.escape.json_encode(cached_response))
+ return
+
+ checker = Checker(mac_addr, opt.url)
+ response, accepted = checker.check()
+ if not accepted:
+ checker.poll()
+
+ cf.write(response.body)
+
+
+if __name__ == '__main__':
+ o = options.Options(optspec)
+ opt, flags, extra = o.parse(sys.argv[1:])
+
+ if not opt.unix_path:
+ o.fatal('unix-path is required\n')
+
+ if not (opt.filter_chain and opt.nat_chain) and not opt.dry_run:
+ o.fatal('(filter-chain and nat-chain) or dry-run is required\n')
+
+ # work whether or not Tornado has configured the root logger already
+ logging.basicConfig(level=logging.INFO)
+ logging.getLogger().setLevel(logging.INFO)
+
+ ip46tables('-F', opt.filter_chain)
+ ip46tables('-t', 'nat', '-F', opt.nat_chain)
+
+ sock = tornado.netutil.bind_unix_socket(opt.unix_path)
+ ioloop = tornado.ioloop.IOLoop.instance()
+ tornado.netutil.add_accept_handler(sock, accept, ioloop)
+
+ logging.info('Started authorizer.')
+ ioloop.start()
+
diff --git a/bouncer/http_bouncer.py b/bouncer/http_bouncer.py
new file mode 100755
index 0000000..3e9e138
--- /dev/null
+++ b/bouncer/http_bouncer.py
@@ -0,0 +1,118 @@
+#!/usr/bin/python
+# Copyright 2016 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+"""Redirects all HTTP requests to the specified URL."""
+
+import logging
+import socket
+import subprocess
+import sys
+import urllib2
+
+import options
+import tornado.httpclient
+import tornado.ioloop
+import tornado.web
+
+
+optspec = """
+http_bouncer [options...]
+--
+p,port= TCP port to listen on [8888]
+u,url= URL to redirect ("bounce") users to. Include the format specifier %(mac)s to write the users' MAC address into the URL when bouncing. []
+U,unix-path= Unix socket to use for authorization checking [/tmp/authorizer.sock]
+"""
+
+PKI_HOSTS = set(['pki.google.com', 'clients1.google.com'])
+
+
+def mac_for_ip(remote_ip):
+ arp_response = subprocess.check_output(['arp', remote_ip])
+ return arp_response.split()[3]
+
+
+class Redirector(tornado.web.RequestHandler):
+ """Redirect users' HTTP connections to a captive portal landing page."""
+
+ def initialize(self, substitute_mac):
+ self.substitute_mac = substitute_mac
+ self._http_client = tornado.httpclient.HTTPClient()
+
+ def get(self):
+ if self._is_crl_request():
+ # proxy CRL/OCSP requests. Workaround for b/19825798.
+ url = '%s://%s%s' % (self.request.protocol, self.request.host,
+ self.request.uri)
+ logging.info('Forwarding request to %s', url)
+ response = self._http_client.fetch(url)
+ for (name, value) in response.headers.get_all():
+ self.set_header(name, value)
+
+ if response.body:
+ self.set_header('Content-Length', len(response.body))
+ self.write(response.body)
+ else:
+ if self.substitute_mac:
+ mac = mac_for_ip(self.request.remote_ip)
+ self.redirect(opt.url % {'mac': mac})
+
+ if opt.unix_path:
+ try:
+ s = socket.socket(socket.AF_UNIX)
+ s.connect(opt.unix_path)
+ s.sendall('%s\n' % mac)
+ s.close()
+ except socket.error:
+ logging.warning('Could not contact authorizer.')
+ else:
+ self.redirect(opt.url)
+
+ def _is_crl_request(self):
+ uri = self.request.uri
+ return self.request.host in PKI_HOSTS and (uri.startswith('/ocsp/')
+ or uri.endswith('.crl'))
+
+if __name__ == '__main__':
+ o = options.Options(optspec)
+ opt, flags, extra = o.parse(sys.argv[1:])
+
+ if not opt.port or not opt.url:
+ o.fatal('port and url are required\n')
+
+ # work whether or not Tornado has configured the root logger already
+ logging.basicConfig(level=logging.INFO)
+ logging.getLogger().setLevel(logging.INFO)
+
+ try:
+ formatted_url = opt.url % {'mac': '00:00:00:00:00:00'}
+ urllib2.urlopen(formatted_url).getcode()
+ except (TypeError, ValueError, urllib2.URLError):
+ o.fatal('url must be a URL.')
+
+ url_needs_mac = formatted_url != opt.url
+ if url_needs_mac and not opt.unix_path:
+ o.fatal('unix-path missing but URL requested MAC-based authorization')
+
+ application = tornado.web.Application([
+ (r'.*', Redirector, dict(substitute_mac=url_needs_mac)),
+ ])
+
+ try:
+ application.listen(opt.port)
+ except socket.gaierror:
+ o.fatal('port must be a TCP port, and we must be able to bind it.')
+
+ logging.info('Starting http_bouncer.')
+ tornado.ioloop.IOLoop.instance().start()
diff --git a/bouncer/options.py b/bouncer/options.py
new file mode 120000
index 0000000..3508154
--- /dev/null
+++ b/bouncer/options.py
@@ -0,0 +1 @@
+../options.py
\ No newline at end of file
diff --git a/bouncer/test-http_bouncer.sh b/bouncer/test-http_bouncer.sh
new file mode 100755
index 0000000..dedd742
--- /dev/null
+++ b/bouncer/test-http_bouncer.sh
@@ -0,0 +1,55 @@
+#!/bin/bash
+#
+# Copyright 2015 Google Inc. All Rights Reserved.
+#
+
+. ./wvtest/wvtest.sh
+
+HTTP_BOUNCER=./host-http_bouncer
+PORT="1337"
+URL="http://example.com"
+
+# command substition strips off trailing newlines, so we add a one-character
+# sentinel to the command's output
+SENTINEL="X"
+
+function run_http_bouncer() {
+ $HTTP_BOUNCER -u $URL -p $PORT &
+ pid=$!
+ trap 'kill $pid' EXIT
+}
+
+function wait_for_socket() {
+ i=0
+ retries=100
+ while ! nc -z localhost $PORT && [ $i -lt $retries ] ; do sleep 0.1; i=$(expr $i + 1); done
+}
+
+WVSTART "http_bouncer test"
+
+# fail with no arguments
+WVFAIL $HTTP_BOUNCER
+# fail with extra arguments
+WVFAIL $HTTP_BOUNCER -u $URL -p $PORT --EXTRA_ARGUMENT
+# fail with invalid port
+WVFAIL $HTTP_BOUNCER -p $URL -u $PORT
+
+run_http_bouncer
+wait_for_socket
+
+redirect0=$(printf "< HTTP/1.0 302 Found\r\n< Location: $URL\r")
+redirect1=$(printf "< HTTP/1.1 302 Found\r\n< Location: $URL\r")
+
+WVPASSEQ "$(curl -0vH 'Host: google.com' "localhost:$PORT" 2>&1 |\
+ egrep '< HTTP|< Location')" "$redirect0"
+
+WVPASSEQ "$(curl -vH 'Host: google.com' "localhost:$PORT/path?arg" 2>&1 |\
+ egrep '< HTTP|< Location')" "$redirect1"
+
+WVPASSEQ "$(curl -0vH '' "localhost:$PORT" 2>&1 |\
+ egrep '< HTTP|< Location')" "$redirect0"
+
+# Make sure we can download a CRL even through the bouncer.
+# Some Internet Explorer versions will refuse to connect if we can't.
+WVPASS curl -H 'Host: pki.google.com' 'http://localhost:1337/GIAG2.crl' |\
+ openssl crl -inform DER
diff --git a/bouncer/wvtest b/bouncer/wvtest
new file mode 120000
index 0000000..75927a5
--- /dev/null
+++ b/bouncer/wvtest
@@ -0,0 +1 @@
+../cmds/wvtest
\ No newline at end of file
