Flow of Opengate
Following is the flow of the
Opengate system.
-
An user on the client machine accesses to some URL such as [eg., http://www.some.site/ or http://www.some.site/some/path].
-
Suppose that some URL has an IPv6 address and an IPv4 address. The client machine gives priority to IPv6 HTTP and use it. But ip6fw is closed. IPv6 HTTP is timeout.
-
The client machine retries to access with IPv4 HTTP.
-
Ipfw checks the packet passing though the gateway. For packets from closed client, the forward rule as [ipfw add 60000 fwd localhost tcp from 192.168.1.0/16 to any http] is applied.
-
The web server in localhost(gateway) receives the packet as [GET / or /some/path]
-
The root index file [index.html.var] is accessed in both cases, because the httpd.conf
is set as [ErrorDocument 404 /]
- The [index.html.var] file invokes a CGI program [opengatefwd.cgi?en] where the option is the language prefered by client[en].
- The CGI program [opengatefwd.cgi] gets client IPv4 address from [REMOTE_ADDR], encodes the address, reads in [topindex.html], replaces keywords(encoded IPv4 address and others) in the file, and sends back [topindex.html].
-
The browser receives the reply [topindex.html]. But the browser misunderstands that the reply is returned from www.some.site.
-
To remove this misunderstanding, the [topindex.html] is described to jump to gateway URL as [META HTTP-EQUIV="Refresh" CONTENT="1; URL=http://opengate.og.saga-u.ac.jp/cgi-bin/opengateauth.cgi?333333333-3-11111111&en"], where option [333333333-3-11111111] is the encoded IPv4 address(include check code) and [en] is the prefered language. By [refresh] code, the browser accesses the URL automatically.
- The CGI program [opengateauth.cgi] gets the options, reads [index.html], replaces the keywords in the file, and send back [index.html].
-
The browser receives the authentication request page[index.html]. The encoded IPv4 address and language are descibed with hidden tag in the page.
-
The user enters userid and password to this page, and clicks button to call Opengate main CGI [FORM METHOD="POST" ACTION="http://opengate.saga-u.ac.jp/cgi-bin/opengate/opengatesrv.cgi"]. If IPv6 is enabled, the acess is done by IPv6. If not, done by IPv4.
-
The Opengate main CGI[opengatesrv.cgi] starts and processes the following.
-
The CGI gets the userid[eg., user1 or user1@id1], password, encoded IPv4 address[eg., 333333333-3] , and language from POST data. The CGI also gets IPv6 address[eg., 2001:e38:10::111] from [REMOTE_ADDR].
CGI gets MAC address from NDP or ARP.
-
CGI reads configuration file[opengatesrv.conf] and gets the information about the authentication server[default](at [user1]) or [id1](at [user1@id1]).
-
CGI sends userid[user1] and password to the authentication server indexed as [default] (or [id1]).
-
After passing the authentication, CGI inserts IPv4 firewall rule [ipfw add 10000 allow ip from 192.168.1.111 to any] and [ipfw add 10000 allow ip from any to 192.168.1.111], and inserts IPv6 firewall rule [ip6fw add 10000 allow ipv6 from 2001:e38:10::111 to any] and [ip6fw add 10000 allow ipv6 from any to 2001:e38:10::111]. The rules indicate the pass of packet to/from the client. The perl script can be used for more flexible ipfw control.
-
CGI reports to syslog that the firewall is opened
[Jun 16 19:14:11 ... START: user user1 use IPv6 and IPv4 at 00:00:00:00:00:00],
[Jun 16 19:14:11 ... OPEN: user user1 from 192.168.1.111...] and
[Jun 16 19:14:11 ... OPEN: user user1 from 2001:e38:10::111].
-
CGI reads reply page file [accept.html], replaces keywords, and sends it to the client.
- The browser receives the page [accept.html] describing the dowloading of java applet [applet code='Opengate.class'...] and the opening of second page
[window.open("http://.../accept2.html")].
- The browser opens the second page [accept2.html] for browsing.
-
CGI generates a watch process and exits.
-
The watch process waits for the java applet to connect.
-
If no connection in DURATIONDEFAULT seconds, CGI removes the firewall rule {ipfw del 10000] and terminates. If duration is entered in auth page, the time is extended to the time. To cope with hijacking and notting, periodical execution of arp check and firewall packet inquiry.
-
If connected, the watch process watchs the TCP connection linked to the client. When the TCP connection is closed, the watch process removes the firewall rule and terminates.
-
The watch process sends 'hello' to the client every ACTIVECHECKINTERVAL seconds. If no reply in HELLOWAITTIMEOUT seconds, the watch process removes the firewall rule and terminates.
-
The watch process gets number of passed packets matched to the inserted rule from IPv4 and IPv6 firewall
[ipfw -a list 10000], [ip6fw -a list 10000] every ACTIVECHECKINTERVAL seconds. If the packet count does not increase in NOPACKETINTERVAL seconds, the watch process removes the firewall rule and terminates.
-
At termination, the watch process reports the filewall close to syslog [Jun 16 22:11:55 ... CLOS: user user1 from 192.168.0.111...], [Jun 16 22:11:55 ... CLOS: user user1 from 2001:e38:10::111...] and [Jun 16 22:11:55 ... END: user user1 at 00:00:00:00:00:00].