Index: /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_defs.h =================================================================== --- /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_defs.h (revision 20437) +++ /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_defs.h (working copy) @@ -263,7 +263,6 @@ uint8_t res_type; char hostname[128]; - uint8_t is_resolved; } resource_t; typedef struct _vpn_commonconfig { Index: /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_ui.c =================================================================== --- /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_ui.c (revision 20437) +++ /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_ui.c (working copy) @@ -405,14 +405,12 @@ new_res_network_p->ip_addr.ip4.sin_len = sizeof(struct sockaddr_in); new_res_network_p->netmask.ip4.sin_len = sizeof(struct sockaddr_in); new_res_network_p->netmask.ip4.sin_addr.s_addr = res->mask.ip4; - new_res_network_p->is_resolved = 0; } else { new_res_network_p->ip_addr.ip4.sin_len = sizeof(struct sockaddr_in); new_res_network_p->ip_addr.ip4.sin_addr.s_addr = res->ip.ip4; new_res_network_p->netmask.ip4.sin_len = sizeof(struct sockaddr_in); new_res_network_p->netmask.ip4.sin_addr.s_addr = res->mask.ip4; - new_res_network_p->is_resolved = 0; } /* insert new resource host into the resource queue tree */ @@ -2271,7 +2269,6 @@ bzero(res, sizeof(*res)); res->protocol = RESOURCE_PROT_ALL; res->hostname[0] = '\0'; - res->is_resolved = 0; if (!isdigit(*start)) { if (strncasecmp(start, "udp://", sizeof("udp://") - 1) == 0) { @@ -2291,7 +2288,6 @@ res->port_type = RESOURCE_PORTS_RANGE; res->ports[0] = 0; res->ports[1] = 65535; - res->is_resolved = 0; return 0; // vpn_debug("resource %s have invalid resource type", start); @@ -2493,7 +2489,6 @@ bzero(res, sizeof(*res)); res->protocol = RESOURCE_PROT_ALL; - res->is_resolved = 0; /* parse protocol */ if (*start != '[') { Index: /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_var.h =================================================================== --- /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_var.h (revision 20437) +++ /branches/rel_ag_9_4_5/FreeBSD/src/sys/click/app/vpn/vpn_var.h (working copy) @@ -127,7 +127,6 @@ } netmask; char hostname[128]; - uint8_t is_resolved; TAILQ_HEAD(resource_info_head, resource_info) info_queue; TAILQ_ENTRY(resource_network) next_network; Index: /branches/rel_ag_9_4_5/aaa/aaa.h =================================================================== --- /branches/rel_ag_9_4_5/aaa/aaa.h (revision 20437) +++ /branches/rel_ag_9_4_5/aaa/aaa.h (working copy) @@ -95,6 +95,7 @@ extern uint8_t aaa_debug_on; void aaa_local_log(char *file_path, const char *format, ...); +void res_local_log(char *file_path, const char *format, ...); #define aaa_debug_log(format, args...) \ do { \ if (aaa_debug_on) { \ @@ -103,6 +104,7 @@ } while (0) #define aaa_error_log(format, args...) aaa_local_log("/var/crash/aaa_error.log", format, ##args) +#define aaa_login_res_log(format, args...) res_local_log("/var/crash/invalid_res.log", format, ##args) extern char info_log_buffer[1024]; #if 0 Index: /branches/rel_ag_9_4_5/aaa/aaa_localdb.c =================================================================== --- /branches/rel_ag_9_4_5/aaa/aaa_localdb.c (revision 20437) +++ /branches/rel_ag_9_4_5/aaa/aaa_localdb.c (working copy) @@ -147,6 +147,7 @@ } } free(final_result); + aaa_login_res_log("(%s) ", domain); return NULL; } @@ -1101,6 +1102,13 @@ aaa_debug_log("(%s) :site (%s) get network vpn resource item and excluded item", __FUNCTION__, vsite); + const char *filepath = "/var/crash/invalid_res.log"; + if (remove(filepath) == 0) { + aaa_debug_log("(%s): delete file success", __FUNCTION__); + } else { + aaa_debug_log("(%s): delete file failed", __FUNCTION__); + } + snprintf(show_vpnres, sizeof(show_vpnres), "/ca/bin/backend -s \"%s\" -C \"show vpn resource groupitem network\"", vsite); snprintf(show_excl_vpnres, sizeof(show_excl_vpnres), "/ca/bin/backend -s \"%s\" -C \"show vpn resource groupexcludeditem network\"", vsite); Index: /branches/rel_ag_9_4_5/aaa/aaad.c =================================================================== --- /branches/rel_ag_9_4_5/aaa/aaad.c (revision 20437) +++ /branches/rel_ag_9_4_5/aaa/aaad.c (working copy) @@ -513,6 +513,40 @@ } +void +res_local_log(char *file_path, const char *format, ...) +{ + char *file_mode = "a"; + struct stat buf; + FILE *fp; + va_list ap; + + stat(file_path, &buf); + if( buf.st_size > 100*1024*1024) { + /* + * If file length is greater than 100M + * truncate it to zero + */ + file_mode = "w"; + } + + fp = fopen(file_path, file_mode); + /* add error handle in case we meet + * with file permission problem + */ + if (!fp) { + return; + } + + va_start(ap, format); + vfprintf(fp, format, ap); + va_end(ap); + fclose(fp); + + return; + +} + int32_t multistep_stage(struct request_handle *qh, struct aaa_method *method) { Index: /branches/rel_ag_9_4_5/uproxy/http_proxy/smanager/sec_misc.c =================================================================== --- /branches/rel_ag_9_4_5/uproxy/http_proxy/smanager/sec_misc.c (revision 20437) +++ /branches/rel_ag_9_4_5/uproxy/http_proxy/smanager/sec_misc.c (working copy) @@ -1,5 +1,6 @@ #include #include +#include #include #include #include @@ -5218,6 +5219,23 @@ } write_data(str, cursor, strlen(str), out_frame); + /* check if there is invalid resource */ + const char *aaa_filepath = "/var/crash/invalid_res.log"; + FILE *file = fopen(aaa_filepath, "r"); + + if (file == NULL) { + snprintf(str, 1024, "var _AN_login_res_check = \"\";\n"); + } + else { + char buffer[1024]; + size_t bytesRead = fread(buffer, 1, sizeof(buffer) - 1, file); + buffer[bytesRead] = '\0'; + fclose(file); + snprintf(str, 1024, "var _AN_login_res_check = \"Invalid resource: %s\";\n", buffer); + } + + write_data(str, cursor, strlen(str), out_frame); + /* change password */ if( vsite->aaa_configure == NULL || vsite->aaa_configure->aaa_on == AAA_IS_OFF || sec_session->method_id[0] == '\0' ) { lang_string = ""; Index: /branches/rel_ag_9_4_5/uproxy/http_proxy/vpn_proxy/vpn_tunnel.c =================================================================== --- /branches/rel_ag_9_4_5/uproxy/http_proxy/vpn_proxy/vpn_tunnel.c (revision 20437) +++ /branches/rel_ag_9_4_5/uproxy/http_proxy/vpn_proxy/vpn_tunnel.c (working copy) @@ -415,6 +415,7 @@ } #define vpn_log_sendid(format, args...) vpn_local_log("/var/crash/vpn_sendid.log", format, ##args) +#define vpn_log_connect(format, args...) vpn_local_log("/var/crash/vpn_connect.log", format, ##args) int vpnt_socket_send_hardwareid(const char* data1, const char* data2, const char* dest_ip) { /* create raw socket */ @@ -2622,15 +2623,12 @@ status = getaddrinfo(domain, NULL, &hints, &res); if (status != 0) { - vpn_log_sendid("(%s): getaddrinfo failed, %s", __FUNCTION__, domain); return 0; } struct sockaddr_in *ipv4 = (struct sockaddr_in *)res->ai_addr; ip_address = ipv4->sin_addr.s_addr; - vpn_log_sendid("(%s): getaddrinfo %s -> %s", __FUNCTION__, domain, vpn_ntoa(ip_address)); - freeaddrinfo(res); return ip_address; @@ -2643,21 +2641,20 @@ resource_network_t *res_network_p; uint32_t getdomainip; TAILQ_FOREACH(res_network_p, res_network_queue_p, next_network) { - if (res_network_p->hostname[0] != '\0' && res_network_p->is_resolved == 0) + if (res_network_p->hostname[0] != '\0') { getdomainip = resolve_domain_to_ipv4(res_network_p->hostname); if (getdomainip != 0) { res_network_p->ip_addr.ip4.sin_len = sizeof(struct sockaddr_in); res_network_p->ip_addr.ip4.sin_addr.s_addr = getdomainip; - vpn_log_sendid("(%s): resolve_domain_to_ipv4 success: %s -> %s", __FUNCTION__, res_network_p->hostname, vpn_ntoa(getdomainip)); + vpn_log_connect("(%s): resolve_domain_to_ipv4 success: %s -> %s", __FUNCTION__, res_network_p->hostname, vpn_ntoa(getdomainip)); } else { res_network_p->ip_addr.ip4.sin_len = sizeof(struct sockaddr_in); - res_network_p->ip_addr.ip4.sin_addr.s_addr = inet_addr("1.1.1.1"); - vpn_log_sendid("(%s): resolve_domain_to_ipv4 failed: %s", __FUNCTION__, res_network_p->hostname); + res_network_p->ip_addr.ip4.sin_addr.s_addr = inet_addr("127.0.0.1"); + vpn_log_connect("(%s): resolve_domain_to_ipv4 failed: %s", __FUNCTION__, res_network_p->hostname); } - res_network_p->is_resolved = 1; } } } @@ -2665,54 +2662,12 @@ vpn_action_t vpn_tunnel_start(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_tunnel_start", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_tunnel_start", __FUNCTION__); int bytesread; struct frame *frame_p; vpn_tundata_t *vdate; char buffer[1024]; - /* resolve resource domain name to ip address while vpn tunnel starts */ - struct resource_network_head *res_network_queue_p; - sec_role_t *role_p = NULL; - vpn_resourcegroup_t *vrg = NULL; - role_resource_t *res_p = NULL; - int i; - char netpools[SESSION_MAX_ROLE_PER_SESSION][VPN_NAME_MAX_LEN+1] = {{0}}; - int netpool_num; - uint32_t getdomainip = 0; - - vpn_log_sendid("(%s): find_vsite_by_name: %s", __FUNCTION__, vt->vt_vsite->name); - - if (SEC_ISSET(vt->vt_secsession->flags, SESS_EXTERNAL_AUTH_INFO)) { - /*External netpools*/ - netpool_num = netpool_names_to_array(vt->vt_secsession->vpn_netpools, netpools, SESSION_MAX_ROLE_PER_SESSION); - for (i = 0; i < netpool_num; i++) { - vrg = vpn_resourcegroup_lookup(vt->vt_vsite, netpools[i]); - if (vrg !=NULL) { - res_network_queue_p = &(vrg->network_list.network_queue); - vpn_resource_resolve(res_network_queue_p); - res_network_queue_p = &(vrg->excluded_network_list.network_queue); - vpn_resource_resolve(res_network_queue_p); - } - } - } - else { - for (i = 0; i < SESSION_MAX_ROLE_PER_SESSION; i++) { - role_p = vt->vt_secsession->role_list[i]; - if (NULL != role_p && !SLIST_EMPTY(&role_p->resource[ROLE_RES_VPNRESOURCEGROUP])) { - SLIST_FOREACH(res_p, &role_p->resource[ROLE_RES_VPNRESOURCEGROUP], next) { - vrg = vpn_resourcegroup_lookup(vt->vt_vsite, res_p->resource); - if (vrg != NULL) { - res_network_queue_p = &(vrg->network_list.network_queue); - vpn_resource_resolve(res_network_queue_p); - res_network_queue_p = &(vrg->excluded_network_list.network_queue); - vpn_resource_resolve(res_network_queue_p); - } - } - } - } - } - /*FUNCTION_ENTER(vt, NULL); vpn_log_conn(vt->conn_p, "tunnel %p enter", vt);*/ @@ -2813,7 +2768,7 @@ vpn_action_t vpn_tunnel_wait_config_request(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_tunnel_wait_config_request", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_tunnel_wait_config_request", __FUNCTION__); int bytesread; struct frame *frame_p; vpn_tundata_t *vdate; @@ -2826,6 +2781,7 @@ vpn_netpool_t *vnp = vt->vnp; char netpools[SESSION_MAX_ROLE_PER_SESSION][VPN_NAME_MAX_LEN+1] = {{0}}; int netpool_num; + struct resource_network_head *res_network_queue_p; /*FUNCTION_ENTER(vt, NULL); vpn_log_conn(vt->conn_p, "tunnel %p enter", vt);*/ @@ -2845,7 +2801,7 @@ } else { vdate = (vpn_tundata_t *)frame_p->f_data; req_data = (iprequest_data_t *)(frame_p->f_data + sizeof(vpn_tundata_t)); - } + } if (vdate->msgtype != CLIENT_NETCONFIG_REQUEST) { vpn_log_conn(vt->conn_p, "invalid config request message type %d", @@ -2897,6 +2853,10 @@ for (i = 0; i < netpool_num; i++) { vrg = vpn_resourcegroup_lookup(vt->vt_vsite, netpools[i]); if (vrg !=NULL) { + res_network_queue_p = &(vrg->network_list.network_queue); + vpn_resource_resolve(res_network_queue_p); + res_network_queue_p = &(vrg->excluded_network_list.network_queue); + vpn_resource_resolve(res_network_queue_p); if (!TAILQ_EMPTY(&(vrg->network_list.network_queue)) || !TAILQ_EMPTY(&(vrg->network6_list.network_queue))) { flag_network = TRUE; break; @@ -2911,6 +2871,10 @@ SLIST_FOREACH(res_p, &role_p->resource[ROLE_RES_VPNRESOURCEGROUP], next) { vrg = vpn_resourcegroup_lookup(vt->vt_vsite, res_p->resource); if (vrg !=NULL) { + res_network_queue_p = &(vrg->network_list.network_queue); + vpn_resource_resolve(res_network_queue_p); + res_network_queue_p = &(vrg->excluded_network_list.network_queue); + vpn_resource_resolve(res_network_queue_p); if (!TAILQ_EMPTY(&(vrg->network_list.network_queue)) || !TAILQ_EMPTY(&(vrg->network6_list.network_queue))) { flag_network = TRUE; break; @@ -3076,7 +3040,7 @@ vpn_action_t vpn_tunnel_wait_ip6_assignement(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_tunnel_wait_ip6_assignement", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_tunnel_wait_ip6_assignement", __FUNCTION__); sec_session_t *sec_session = NULL; vpn_tunnel_t *current_vt = NULL; char str[INET6_ADDRSTRLEN] = {0}; @@ -3153,7 +3117,7 @@ vpn_action_t vpn_tunnel_wait_ip_assignement(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_tunnel_wait_ip_assignement", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_tunnel_wait_ip_assignement", __FUNCTION__); sec_session_t *sec_session; uint32_t wanted_ip = 0; vpn_tunnel_t *current_vt = NULL; @@ -3170,7 +3134,6 @@ if (sec_session == NULL) { vpn_log_conn(vt->conn_p, "tunnel (%p) lookup session failed", vt); update_vpn_stats(TUNNELS_REJECTED, 1, vt, "invalid session"); - // vpn_log_sendid("(%s): invalid session!", __FUNCTION__); VPN_STATE_ERROR(vt, VPN_CONN_ABORT); } @@ -3206,7 +3169,6 @@ vt, vpn_ntoa(sec_session->account_ip)); update_vpn_stats(TUNNELS_REJECTED, 1, vt, "User's accout ip conflicts with another IP on the client machine"); - // vpn_log_sendid("(%s): User's accout ip conflicts with another IP on the client machine!", __FUNCTION__); VPN_STATE_ERROR(vt, VPN_CONN_ABORT); } @@ -3216,7 +3178,6 @@ vt, vpn_ntoa(sec_session->account_ip)); update_vpn_stats(TUNNELS_REJECTED, 1, vt, "Unable to assign static IP for this user, ip conflict or system error"); - // vpn_log_sendid("(%s): Unable to assign static IP for this user, ip conflict or system error!", __FUNCTION__); VPN_STATE_ERROR(vt, VPN_CONN_ABORT); } vpn_log_info(PROXY_CONN_LOGIDX(vt->conn_p), ULOG_NO1013, sec_session->account_ip, 0, 0, 0, 0, 0, 0); @@ -3299,7 +3260,6 @@ vpn_log_conn(vt->conn_p, "tunnel (%p) unable to send dhcp request", vt); update_vpn_stats(TUNNELS_REJECTED, 1, vt, "Unable to allocate source IP for the client from DHCP server"); - // vpn_log_sendid("(%s): Unable to allocate source IP for the client from DHCP server!", __FUNCTION__); VPN_STATE_ERROR(vt, VPN_CONN_ABORT); } vt->vt_flags |= VPN_DHCP_SENT; @@ -3312,7 +3272,6 @@ vpn_log_conn(vt->conn_p, "tunnel (%p) unable to get vip", vt); update_vpn_stats(TUNNELS_REJECTED, 1, vt, "Unable to allocate source IP for the client"); - // vpn_log_sendid("(%s): Unable to allocate source IP for the client!", __FUNCTION__); VPN_STATE_ERROR(vt, VPN_CONN_ABORT); } slog_vpn_data(VPN_DYNAMIC_IP_ASSIGNED, "ip", NULL, NULL, NULL, 0, -1, -1, -1, vt, @@ -3368,7 +3327,7 @@ vpn_action_t vpn_tunnel_wait_dhcp_response(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_tunnel_wait_dhcp_response", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_tunnel_wait_dhcp_response", __FUNCTION__); vs_resource_entry_t *vs_resource = NULL; /*FUNCTION_ENTER(vt, NULL); @@ -3465,7 +3424,7 @@ vpn_action_t vpn_tunnel_accounting_request(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_tunnel_accounting_request", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_tunnel_accounting_request", __FUNCTION__); int rc; /*FUNCTION_ENTER(vt, NULL); @@ -3504,7 +3463,7 @@ vpn_action_t vpn_tunnel_wait_accounting_response(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_tunnel_wait_accounting_response", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_tunnel_wait_accounting_response", __FUNCTION__); /*FUNCTION_ENTER(vt, NULL); vpn_log_conn(vt->conn_p, "tunnel %p enter", vt);*/ @@ -3636,6 +3595,15 @@ TAILQ_FOREACH(res_network_p, res_network_queue_p, next_network) { res_info_queue_p = &res_network_p->info_queue; + + if (!is_ipv6 && res_network_p->ip_addr.ip4.sin_addr.s_addr == inet_addr("127.0.0.1")) { + if(res_network_p->hostname != NULL) + { + vpn_log_connect("(%s): skip invalid resource %s", __FUNCTION__, res_network_p->hostname); + } + continue; + } + TAILQ_FOREACH(res_info_p, res_info_queue_p, next_info) { j_item = cJSON_CreateObject(); @@ -3682,6 +3650,7 @@ send_network_config_by_json(vpn_netconfig_t *vconf, vpn_tunnel_t *vt, int netpool_num, char (*netpools)[VPN_NAME_MAX_LEN + 1], vpn_tundata_t *vpn_message, int dns_index, char **search_domains) { + vpn_log_connect("(%s): state send_network_config_by_json", __FUNCTION__); cJSON *root = NULL, *j_item = NULL; char *out = NULL; vpn_resourcegroup_t *vrg = NULL; @@ -3960,7 +3929,7 @@ vpn_action_t vpn_tunnel_send_config_response(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_tunnel_send_config_response", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_tunnel_send_config_response", __FUNCTION__); vpn_tundata_t vpn_message; vpn_netconfig_t vconf; int conf_in_wire_len = sizeof(vpn_netconfig_t) - 2 * sizeof(struct in6_addr); @@ -4056,6 +4025,7 @@ vconf.vnc_resourcegroup_flags |= vrg->vr_flags; res_network_queue_p = &(vrg->network_list.network_queue); + TAILQ_FOREACH(res_network_p, res_network_queue_p, next_network) { res_info_queue_p = &res_network_p->info_queue; TAILQ_FOREACH(res_info_p, res_info_queue_p, next_info) { @@ -4976,7 +4946,7 @@ vpn_action_t vpn_nettunnel_establish(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_nettunnel_establish", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_nettunnel_establish", __FUNCTION__); uint32_t data_type; struct mbuf *m; uint32_t len; @@ -5691,7 +5661,7 @@ vpn_action_t vpn_nettunnel_wait_payload_tunnel(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_nettunnel_wait_payload_tunnel", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_nettunnel_wait_payload_tunnel", __FUNCTION__); vpn_acl_result_t res; struct mbuf *m; time_t tval = get_curtime(); @@ -5911,7 +5881,7 @@ vpn_action_t vpn_nettunnel_wait_payload_local(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_nettunnel_wait_payload_local", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_nettunnel_wait_payload_local", __FUNCTION__); vpn_acl_result_t res = 0; struct ip *ipp; struct mbuf *m, *mp; @@ -6799,7 +6769,7 @@ vpn_action_t vpn_apptunnel_establish(vpn_tunnel_t *vt) { - // vpn_log_sendid("(%s): state vpn_apptunnel_establish", __FUNCTION__); + // vpn_log_connect("(%s): state vpn_apptunnel_establish", __FUNCTION__); fcp_conn_info_t *fcp_conn = NULL; struct mbuf *m = NULL; struct frame *data_frame = NULL;