Chinaunix首页 | 论坛 | 博客

信仰年轻

首页　| 　博文目录　| 　关于我

Garfield_Trump

  • 博客访问： 1855175
  • 博文数量： 317
  • 博客积分： 1557
  • 博客等级： 上尉
  • 技术积分： 1208
  • 用 户 组： 普通用户
  • 注册时间： 2008-02-26 23:38
个人简介

如果想出发，就不要等到明天！

文章分类

全部博文（317）

文章存档

2016年（1）

2015年（41）

2014年（152）

2013年（114）

2012年（4）

2011年（1）

2009年（4）

我的朋友
最近访客
推荐博文
相关博文
wifidog源码分析 - 用户连接过程

分类： 嵌入式

2015-03-22 16:22:27

原文地址：wifidog源码分析 - 用户连接过程 作者：lwfbibi

main_loop

　　此函数几乎相当于我们写程序的main函数，主要功能都是在这里面实现的，函数主要实现了主循环，并启动了三个线程，这三个线程的功能具体见wifidog源码分析 - wifidog原理，在此函数最后主循环中会等待用户连接，新用户只要通过浏览器打开非认证服务器网页时主循环就会监听到，监听到后会启动一个处理线程。其流程为

  • 设置程序启动时间
  • 获取网关信息
  • 绑定http端口（80重定向到了2060）
  • 设置关键路径和404错误的回调函数
  • 重新建立iptables规则
  • 启动客户端检测线程 （稍后文章分析）
  • 启动wdctrl交互线程 （稍后文章分析）
  • 认证服务器心跳检测线程 （稍后文章分析）
  • 循环等待用户http请求，为每个请求启动一个处理线程。（代码片段1.2 代码片段1.3 代码片段1.4）
代码片段1.1

  1. static void
  2. main_loop(void)
  3. {
  4.     int result;
  5.     pthread_t tid;
  6.     s_config *config = config_get_config();
  7.     request *r;
  8.     void **params;

  10.     /* 设置启动时间 */
  11.     if (!started_time) {
  12.         debug(LOG_INFO, "Setting started_time");
  13.         started_time = time(NULL);
  14.     }
  15.     else if (started_time < MINIMUM_STARTED_TIME) {
  16.         debug(LOG_WARNING, "Detected possible clock skew - re-setting started_time");
  17.         started_time = time(NULL);
  18.     }

  20.     /* 获取网关IP，失败退出程序 */
  21.     if (!config->gw_address) {
  22.         debug(LOG_DEBUG, "Finding IP address of %s", config->gw_interface);
  23.         if ((config->gw_address = get_iface_ip(config->gw_interface)) == NULL) {
  24.             debug(LOG_ERR, "Could not get IP address information of %s, exiting...", config->gw_interface);
  25.             exit(1);
  26.         }
  27.         debug(LOG_DEBUG, "%s = %s", config->gw_interface, config->gw_address);
  28.     }

  30.     /* 获取网关ID，失败退出程序 */
  31.     if (!config->gw_id) {
  32.         debug(LOG_DEBUG, "Finding MAC address of %s", config->gw_interface);
  33.         if ((config->gw_id = get_iface_mac(config->gw_interface)) == NULL) {
  34.             debug(LOG_ERR, "Could not get MAC address information of %s, exiting...", config->gw_interface);
  35.             exit(1);
  36.         }
  37.         debug(LOG_DEBUG, "%s = %s", config->gw_interface, config->gw_id);
  38.     }

  40.     /* 初始化监听网关2060端口的socket */
  41.     debug(LOG_NOTICE, "Creating web server on %s:%d", config->gw_address, config->gw_port);
  42.     
  43.     if ((webserver = httpdCreate(config->gw_address, config->gw_port)) == NULL) {
  44.         debug(LOG_ERR, "Could not create web server: %s", strerror(errno));
  45.         exit(1);
  46.     }

  48.     debug(LOG_DEBUG, "Assigning callbacks to web server");
  49.     /* 设置关键路径及其回调函数，在代码片段1.2中会使用到 */
  50.     httpdAddCContent(webserver, "/", "wifidog", 0, NULL, http_callback_wifidog);
  51.     httpdAddCContent(webserver, "/wifidog", "", 0, NULL, http_callback_wifidog);
  52.     httpdAddCContent(webserver, "/wifidog", "about", 0, NULL, http_callback_about);
  53.     httpdAddCContent(webserver, "/wifidog", "status", 0, NULL, http_callback_status);
  54.     httpdAddCContent(webserver, "/wifidog", "auth", 0, NULL, http_callback_auth);
  55.     /* 设置404错误回调函数，在里面实现了重定向至认证服务器 */
  56.     httpdAddC404Content(webserver, http_callback_404);

  58.     /* 清除iptables规则 */
  59.     fw_destroy();
  60.     /* 重新设置iptables规则 */
  61.     if (!fw_init()) {
  62.         debug(LOG_ERR, "FATAL: Failed to initialize firewall");
  63.         exit(1);
  64.     }

  66.     /* 客户端检测线程 */
  67.     result = pthread_create(&tid_fw_counter, NULL, (void *)thread_client_timeout_check, NULL);
  68.     if (result != 0) {
  69.         debug(LOG_ERR, "FATAL: Failed to create a new thread (fw_counter) - exiting");
  70.         termination_handler(0);
  71.     }
  72.     pthread_detach(tid_fw_counter);

  74.     /* wdctrl交互线程 */
  75.     result = pthread_create(&tid, NULL, (void *)thread_wdctl, (void *)safe_strdup(config->wdctl_sock));
  76.     if (result != 0) {
  77.         debug(LOG_ERR, "FATAL: Failed to create a new thread (wdctl) - exiting");
  78.         termination_handler(0);
  79.     }
  80.     pthread_detach(tid);
  81.     
  82.     /* 认证服务器心跳检测线程 */
  83.     result = pthread_create(&tid_ping, NULL, (void *)thread_ping, NULL);
  84.     if (result != 0) {
  85.         debug(LOG_ERR, "FATAL: Failed to create a new thread (ping) - exiting");
  86.         termination_handler(0);
  87.     }
  88.     pthread_detach(tid_ping);
  89.     
  90.     debug(LOG_NOTICE, "Waiting for connections");
  91.     while(1) {
  92.         /* 监听2060端口等待用户http请求 */
  93.         r = httpdGetConnection(webserver, NULL);

  95.         /* 错误处理 */
  96.         if (webserver->lastError == -1) {
  97.             /* Interrupted system call */
  98.             continue; /* restart loop */
  99.         }
  100.         else if (webserver->lastError < -1) {
  101.             debug(LOG_ERR, "FATAL: httpdGetConnection returned unexpected value %d, exiting.", webserver->lastError);
  102.             termination_handler(0);
  103.         }
  104.         else if (r != NULL) {
  105.             /* 用户http请求接收成功 */
  106.             debug(LOG_INFO, "Received connection from %s, spawning worker thread", r->clientAddr);
  107.             params = safe_malloc(2 * sizeof(void *));
  108.             *params = webserver;
  109.             *(params + 1) = r;

  111.             /* 开启http请求处理线程 */
  112.             result = pthread_create(&tid, NULL, (void *)thread_httpd, (void *)params);
  113.             if (result != 0) {
  114.                 debug(LOG_ERR, "FATAL: Failed to create a new thread (httpd) - exiting");
  115.                 termination_handler(0);
  116.             }
  117.             pthread_detach(tid);
  118.         }
  119.         else {
  120.             ;
  121.         }
  122.     }

  124.     /* never reached */
  125. }

用户连接启动线程（void thread_httpd(void * args)）

代码片段1.2

此段代码是当有新用户（未认证的用户 代码片段1.3，已在认证服务器上认证但没有在wifidog认证的用户 代码片段1.4）连接时创建的线程，其主要功能为

  • 获取用户浏览器发送过来的http报头
  • 分析http报头，分析是否包含关键路径
  • 不包含关键路径则调用404回调函数
  • 包含关键路径则执行关键路径回调函数（这里主要讲解"/wifidog/auth"路径）

  1. void
  2. thread_httpd(void *args)
  3. {
  4.     void **params;
  5.     httpd *webserver;
  6.     request *r;
  7.     
  8.     params = (void **)args;
  9.     webserver = *params;
  10.     r = *(params + 1);
  11.     free(params);
  12.     
  13.     /* 获取http报文 */
  14.     if (httpdReadRequest(webserver, r) == 0) {
  15.         debug(LOG_DEBUG, "Processing request from %s", r->clientAddr);
  16.         debug(LOG_DEBUG, "Calling httpdProcessRequest() for %s", r->clientAddr);
  17.         /* 分析http报文 */
  18.         httpdProcessRequest(webserver, r);
  19.         debug(LOG_DEBUG, "Returned from httpdProcessRequest() for %s", r->clientAddr);
  20.     }
  21.     else {
  22.         debug(LOG_DEBUG, "No valid request received from %s", r->clientAddr);
  23.     }
  24.     debug(LOG_DEBUG, "Closing connection with %s", r->clientAddr);
  25.     httpdEndRequest(r);
  26. }



  30. /* 被thread_httpd调用 */
  31. void httpdProcessRequest(httpd *server, request *r)
  32. {
  33.     char dirName[HTTP_MAX_URL],
  34.         entryName[HTTP_MAX_URL],
  35.         *cp;
  36.     httpDir *dir;
  37.     httpContent *entry;

  39.     r->response.responseLength = 0;
  40.     strncpy(dirName, httpdRequestPath(r), HTTP_MAX_URL);
  41.     dirName[HTTP_MAX_URL-1]=0;
  42.     cp = rindex(dirName, '/');
  43.     if (cp == NULL)
  44.     {
  45.         printf("Invalid request path '%s'\n",dirName);
  46.         return;
  47.     }
  48.     strncpy(entryName, cp + 1, HTTP_MAX_URL);
  49.     entryName[HTTP_MAX_URL-1]=0;
  50.     if (cp != dirName)
  51.         *cp = 0;
  52.     else
  53.         *(cp+1) = 0;

  55.      /* 获取http报文中的关键路径，在main_loop中已经设置 */
  56.     dir = _httpd_findContentDir(server, dirName, HTTP_FALSE);
  57.     if (dir == NULL)
  58.     {
  59.         /* http报文中未包含关键路径，执行404回调函数（在404回调函数中新用户被重定向到认证服务器），见代码片段1.3 */
  60.         _httpd_send404(server, r);
  61.         _httpd_writeAccessLog(server, r);
  62.         return;
  63.     }
  64.     /* 获取关键路径内容描述符 */
  65.     entry = _httpd_findContentEntry(r, dir, entryName);
  66.     if (entry == NULL)
  67.     {
  68.         _httpd_send404(server, r);
  69.         _httpd_writeAccessLog(server, r);
  70.         return;
  71.     }
  72.     if (entry->preload)
  73.     {
  74.         if ((entry->preload)(server) < 0)
  75.         {
  76.             _httpd_writeAccessLog(server, r);
  77.             return;
  78.         }
  79.     }
  80.     switch(entry->type)
  81.     {
  82.         case HTTP_C_FUNCT:
  83.         case HTTP_C_WILDCARD:
  84.             /* 如果是被认证服务器重定向到网关的用户，此处的关键路径为"/wifidog/auth"，并执行回调函数 */
  85.             (entry->function)(server, r);
  86.             break;

  88.         case HTTP_STATIC:
  89.             _httpd_sendStatic(server, r, entry->data);
  90.             break;

  92.         case HTTP_FILE:
  93.             _httpd_sendFile(server, r, entry->path);
  94.             break;

  96.         case HTTP_WILDCARD:
  97.             if (_httpd_sendDirectoryEntry(server, r, entry,
  98.                         entryName)<0)
  99.             {
  100.                 _httpd_send404(server, r);
  101.             }
  102.             break;
  103.     }
  104.     _httpd_writeAccessLog(server, r);
  105. }

代码片段1.3

此段代码表示wifidog是如何通过http 404回调函数实现客户端重定向了，实际上就是在404回调函数中封装了一个307状态的http报头，http的307状态在http协议中就是用于重定向的，封装完成后通过已经与客户端连接的socket返回给客户端。步骤流程为

  • 判断本机是否处于离线状态
  • 判断认证服务器是否在线
  • 封装http 307报文
  • 发送于目标客户端

  1. void
  2. http_callback_404(httpd *webserver, request *r)
  3. {
  4.     char tmp_url[MAX_BUF],
  5.             *url;
  6.     s_config *config = config_get_config();
  7.     t_auth_serv *auth_server = get_auth_server();

  9.     memset(tmp_url, 0, sizeof(tmp_url));

  11.         snprintf(tmp_url, (sizeof(tmp_url) - 1), "http://%s%s%s%s",
  12.                         r->request.host,
  13.                         r->request.path,
  14.                         r->request.query[0] ? "?" : "",
  15.                         r->request.query);
  16.     url = httpdUrlEncode(tmp_url);

  18.     if (!is_online()) {
  19.         /* 本机处于离线状态，此函数调用结果由认证服务器检测线程设置 */
  20.         char * buf;
  21.         safe_asprintf(&buf,
  22.             "

    We apologize, but it seems that the internet connection that powers this hotspot is temporarily unavailable.


    "
  23.             "

    If at all possible, please notify the owners of this hotspot that the internet connection is out of service.


    "
  24.             "

    The maintainers of this network are aware of this disruption. We hope that this situation will be resolved soon.


    "
  25.             "

    In a while please click here to try your request again.


    "    , tmp_url);

  27.                 send_http_page(r, "Uh oh! Internet access unavailable!", buf);
  28.         free(buf);
  29.         debug(LOG_INFO, "Sent %s an apology since I am not online - no point sending them to auth server", r->clientAddr);
  30.     }
  31.     else if (!is_auth_online()) {
  32.         /* 认证服务器处于离线状态 */
  33.         char * buf;
  34.         safe_asprintf(&buf,
  35.             "

    We apologize, but it seems that we are currently unable to re-direct you to the login screen.


    "
  36.             "

    The maintainers of this network are aware of this disruption. We hope that this situation will be resolved soon.


    "
  37.             "

    In a couple of minutes please click here to try your request again.


    ", tmp_url);

  39.                 send_http_page(r, "Uh oh! Login screen unavailable!", buf);
  40.         free(buf);
  41.         debug(LOG_INFO, "Sent %s an apology since auth server not online - no point sending them to auth server", r->clientAddr);
  42.     }
  43.     else {
  44.         /* 本机与认证服务器都在线，返回重定向包于客户端 */
  45.         char *urlFragment;
  46.         safe_asprintf(&urlFragment, "%sgw_address=%s&gw_port=%d&gw_id=%s&url=%s",
  47.             auth_server->authserv_login_script_path_fragment,
  48.             config->gw_address,
  49.             config->gw_port,
  50.             config->gw_id,
  51.             url);
  52.         debug(LOG_INFO, "Captured %s requesting [%s] and re-directing them to login page", r->clientAddr, url);
  53.         http_send_redirect_to_auth(r, urlFragment, "Redirect to login page"); /* 实际上此函数中通过socket返回一个307状态的http报头给客户端，里面包含有认证服务器地址 */
  54.         free(urlFragment);
  55.     }
  56.     free(url);
  57. }


代码片段1.4

此段表明当客户端已经在认证服务器确认登陆，认证服务器将客户端重新重定向回网关，并在重定向包中包含关键路径"/wifidog/auth"和token，认证服务器所执行的操作。


  1. void
  2. http_callback_auth(httpd *webserver, request *r)
  3. {
  4.     t_client *client;
  5.     httpVar * token;
  6.     char *mac;
  7.     /* 判断http报文是否包含登出logout */
  8.     httpVar *logout = httpdGetVariableByName(r, "logout");
  9.     if ((token = httpdGetVariableByName(r, "token"))) {
  10.         /* 获取http报文中的token */
  11.         if (!(mac = arp_get(r->clientAddr))) {
  12.             /* 获取客户端mac地址失败 */
  13.             debug(LOG_ERR, "Failed to retrieve MAC address for ip %s", r->clientAddr);
  14.             send_http_page(r, "WiFiDog Error", "Failed to retrieve your MAC address");
  15.         } else {
  16.             LOCK_CLIENT_LIST();
  17.             /* 判断客户端是否存在于列表中 */
  18.             if ((client = client_list_find(r->clientAddr, mac)) == NULL) {
  19.                 debug(LOG_DEBUG, "New client for %s", r->clientAddr);
  20.                 /* 将此客户端添加到客户端列表 */
  21.                 client_list_append(r->clientAddr, mac, token->value);
  22.             } else if (logout) {
  23.                 /* http报文为登出 */
  24.                 t_authresponse authresponse;
  25.                 s_config *config = config_get_config();
  26.                 unsigned long long incoming = client->counters.incoming;
  27.                 unsigned long long outgoing = client->counters.outgoing;
  28.                 char *ip = safe_strdup(client->ip);
  29.                 char *urlFragment = NULL;
  30.                 t_auth_serv *auth_server = get_auth_server();
  31.                 /* 修改iptables禁止客户端访问外网 */
  32.                 fw_deny(client->ip, client->mac, client->fw_connection_state);
  33.                 /* 从客户端列表中删除此客户端 */
  34.                 client_list_delete(client);
  35.                 debug(LOG_DEBUG, "Got logout from %s", client->ip);
  36.                 
  37.                 if (config->auth_servers != NULL) {
  38.                     UNLOCK_CLIENT_LIST();
  39.                     /* 发送登出认证包给认证服务器 */
  40.                     auth_server_request(&authresponse, REQUEST_TYPE_LOGOUT, ip, mac, token->value,
  41.                                         incoming, outgoing);
  42.                     LOCK_CLIENT_LIST();
  43.                     
  44.                     /* 将客户端重定向到认证服务器 */
  45.                     debug(LOG_INFO, "Got manual logout from client ip %s, mac %s, token %s"
  46.                     "- redirecting them to logout message", client->ip, client->mac, client->token);
  47.                     safe_asprintf(&urlFragment, "%smessage=%s",
  48.                         auth_server->authserv_msg_script_path_fragment,
  49.                         GATEWAY_MESSAGE_ACCOUNT_LOGGED_OUT
  50.                     );
  51.                     http_send_redirect_to_auth(r, urlFragment, "Redirect to logout message");
  52.                     free(urlFragment);
  53.                 }
  54.                 free(ip);
  55.              }
  56.              else {
  57.                 debug(LOG_DEBUG, "Client for %s is already in the client list", client->ip);
  58.             }
  59.             UNLOCK_CLIENT_LIST();
  60.             if (!logout) {
  61.                 /* 通过认证服务器认证此客户端token */
  62.                 authenticate_client(r);
  63.             }
  64.             free(mac);
  65.         }
  66.     } else {
  67.         send_http_page(r, "WiFiDog error", "Invalid token");
  68.     }
  69. }

  71. /* 此函数用于提交token到认证服务器进行认证 */
  72. void
  73. authenticate_client(request *r)
  74. {
  75.     t_client *client;
  76.     t_authresponse auth_response;
  77.     char *mac,
  78.         *token;
  79.     char *urlFragment = NULL;
  80.     s_config *config = NULL;
  81.     t_auth_serv *auth_server = NULL;

  83.     LOCK_CLIENT_LIST();

  85.     client = client_list_find_by_ip(r->clientAddr);
  86.     /* 判断此客户端是否在列表中 */
  87.     if (client == NULL) {
  88.         debug(LOG_ERR, "Could not find client for %s", r->clientAddr);
  89.         UNLOCK_CLIENT_LIST();
  90.         return;
  91.     }
  92.     
  93.     mac = safe_strdup(client->mac);
  94.     token = safe_strdup(client->token);
  95.     
  96.     UNLOCK_CLIENT_LIST();
  97.     
  98.     /* 提交token、客户端ip、客户端mac至认证服务器 */
  99.     auth_server_request(&auth_response, REQUEST_TYPE_LOGIN, r->clientAddr, mac, token, 0, 0);
  100.     
  101.     LOCK_CLIENT_LIST();
  102.     
  103.     /*再次判断客户端是否存在于列表中，保险起见，因为有可能在于认证服务器认证过程中，客户端检测线程把此客户端下线 */
  104.     client = client_list_find(r->clientAddr, mac);
  105.     
  106.     if (client == NULL) {
  107.         debug(LOG_ERR, "Could not find client node for %s (%s)", r->clientAddr, mac);
  108.         UNLOCK_CLIENT_LIST();
  109.         free(token);
  110.         free(mac);
  111.         return;
  112.     }
  113.     
  114.     free(token);
  115.     free(mac);

  117.     config = config_get_config();
  118.     auth_server = get_auth_server();

  120.         /* 判断认证服务器认证结果 */
  121.     switch(auth_response.authcode) {

  123.     case AUTH_ERROR:
  124.         /* 认证错误 */
  125.         debug(LOG_ERR, "Got %d from central server authenticating token %s from %s at %s", auth_response, client->token, client->ip, client->mac);
  126.         send_http_page(r, "Error!", "Error: We did not get a valid answer from the central server");
  127.         break;

  129.     case AUTH_DENIED:
  130.         /* 认证服务器拒绝此客户端 */
  131.         debug(LOG_INFO, "Got DENIED from central server authenticating token %s from %s at %s - redirecting them to denied message", client->token, client->ip, client->mac);
  132.         safe_asprintf(&urlFragment, "%smessage=%s",
  133.             auth_server->authserv_msg_script_path_fragment,
  134.             GATEWAY_MESSAGE_DENIED
  135.         );
  136.         http_send_redirect_to_auth(r, urlFragment, "Redirect to denied message");
  137.         free(urlFragment);
  138.         break;

  140.     case AUTH_VALIDATION:
  141.         /* 认证服务器处于等待此客户端电子邮件确认回执状态 */
  142.         debug(LOG_INFO, "Got VALIDATION from central server authenticating token %s from %s at %s"
  143.                 "- adding to firewall and redirecting them to activate message", client->token,
  144.                 client->ip, client->mac);
  145.         client->fw_connection_state = FW_MARK_PROBATION;
  146.         fw_allow(client->ip, client->mac, FW_MARK_PROBATION);
  147.         safe_asprintf(&urlFragment, "%smessage=%s",
  148.             auth_server->authserv_msg_script_path_fragment,
  149.             GATEWAY_MESSAGE_ACTIVATE_ACCOUNT
  150.         );
  151.         http_send_redirect_to_auth(r, urlFragment, "Redirect to activate message");
  152.         free(urlFragment);
  153.         break;

  155.     case AUTH_ALLOWED:
  156.         /* 认证通过 */
  157.         debug(LOG_INFO, "Got ALLOWED from central server authenticating token %s from %s at %s - "
  158.                 "adding to firewall and redirecting them to portal", client->token, client->ip, client->mac);
  159.         client->fw_connection_state = FW_MARK_KNOWN;
  160.         fw_allow(client->ip, client->mac, FW_MARK_KNOWN);
  161.         served_this_session++;
  162.         safe_asprintf(&urlFragment, "%sgw_id=%s",
  163.             auth_server->authserv_portal_script_path_fragment,
  164.             config->gw_id
  165.         );
  166.         http_send_redirect_to_auth(r, urlFragment, "Redirect to portal");
  167.         free(urlFragment);
  168.         break;

  170.     case AUTH_VALIDATION_FAILED:
  171.          /* 电子邮件确认回执超时 */
  172.         debug(LOG_INFO, "Got VALIDATION_FAILED from central server authenticating token %s from %s at %s "
  173.                 "- redirecting them to failed_validation message", client->token, client->ip, client->mac);
  174.         safe_asprintf(&urlFragment, "%smessage=%s",
  175.             auth_server->authserv_msg_script_path_fragment,
  176.             GATEWAY_MESSAGE_ACCOUNT_VALIDATION_FAILED
  177.         );
  178.         http_send_redirect_to_auth(r, urlFragment, "Redirect to failed validation message");
  179.         free(urlFragment);
  180.         break;

  182.     default:
  183.         debug(LOG_WARNING, "I don't know what the validation code %d means for token %s from %s at %s - sending error message", auth_response.authcode, client->token, client->ip, client->mac);
  184.         send_http_page(r, "Internal Error", "We can not validate your request at this time");
  185.         break;

  187.     }

  189.     UNLOCK_CLIENT_LIST();
  190.     return;
  191. }


阅读(5619) | 评论(0) | 转发(0) |
0

上一篇：wifidog源码分析 - 初始化阶段

下一篇：wifidog源码分析 - 客户端检测线程

给主人留下些什么吧！~~
关于我们 | 关于IT168 | 联系方式 | 广告合作 | 法律声明 | 免费注册

Copyright 2001-2010 ChinaUnix.net All Rights Reserved 北京皓辰网域网络信息技术有限公司. 版权所有

感谢所有关心和支持过ChinaUnix的朋友们

16024965号-6