view release on metacpan or  search on metacpan

lib/Captive/Portal/Role/Firewall.pm  view on Meta::CPAN

package Captive::Portal::Role::Firewall;

use strict;
use warnings;

=head1 NAME

Captive::Portal::Role::Firewall - firewall methods for Captive::Portal

=head1 DESCRIPTION

Does all stuff needed to dynamically update iptables and ipset.

=cut

our $VERSION = '4.10';

use Log::Log4perl qw(:easy);
use Try::Tiny;

use Role::Basic;
requires qw(
  cfg
  spawn_cmd
  list_sessions_from_disk
  get_session_lock_handle
  read_session_handle
  delete_session_from_disk
);

# Role::Basic exports ALL subroutines, there is currently no other way to
# prevent exporting private methods, sigh
#
my ($_fw_install_rules);

=head1 ROLES

=over

=item $capo->fw_start_session($ip_address, $mac_address)

Add tuple IP/MAC to the ipset named I<capo_sessions_ipset>. Members of this ipset have Internet access and are no longer redirected to the login/splash page crossing the gateway.

Also insert this IP into capo_activity_ipset, needed for stateful restarts.

=cut

sub fw_start_session {
  my $self = shift;

  my $ip = shift
    or LOGDIE("missing session IP");

  my $mac = shift
    or LOGDIE("missing session MAC");

  if ( $self->cfg->{MOCK_FIREWALL} ) {
    DEBUG 'MOCK_FIREWALL, mocking start session';
    return 1;
  }

  my @cmd1 = ( 'ipset', '-exist', 'add', 'capo_sessions_ipset', "$ip,$mac" );
  my @cmd2 = ( 'ipset', '-exist', 'add', 'capo_activity_ipset', "$ip" );

  my $error;
  try {
    $self->spawn_cmd(@cmd1);
    $self->spawn_cmd(@cmd2);
  }
  catch { $error = $_ };

  die "$error\n" if $error;

  return;
}

=item $capo->fw_stop_session($ip_address, $mac_address)

Delete tuple IP/MAC from the ipset named I<capo_sessions_ipset>.