Flow of Opengate
Following is the flow of the Opengate system.
-
An user on the client machine accesses to some URL such as [eg., http://www.some.site/ or http://www.some.site/some/path].
-
Suppose that some URL has an IPv6 address and an IPv4 address. The client machine gives priority to IPv6 HTTP and use it. But ip6fw is closed. IPv6 HTTP is timeout.
-
The client machine retries to access with IPv4 HTTP.
-
Ipfw checks the packet passing though the gateway. For packets from closed client, the forward rule as [ipfw add 60000 fwd localhost tcp from 192.168.1.0/16 to any http] is applied.
-
The web server in localhost(gateway) receives the packet as [GET / or /some/path]
-
The root index file [index.html.var] is accessed in both cases, because the httpd.conf
is set as [ErrorDocument 404 /]
- The [index.html.var] file invokes a CGI program [opengatefwd.cgi?en] where the option is the language prefered by client[en].
- The CGI program [opengatefwd.cgi] gets client IPv4 address from [REMOTE_ADDR], encodes the address, reads in [topindex.html], replaces keywords(encoded IPv4 address and others) in the file, and sends back [topindex.html].
-
The browser receives the reply [topindex.html]. But the browser misunderstands that the reply is returned from www.some.site.
-
To remove this misunderstanding, the [topindex.html] is described to jump to gateway URL as [META HTTP-EQUIV="Refresh" CONTENT="1; URL=http://opengate.og.saga-u.ac.jp/cgi-bin/opengateauth.cgi?333333333-3-11111111&en"], where option [333333333-3-11111111] is the encoded IPv4 address(include check code) and [en] is the prefered language. By [refresh] code, the browser accesses the URL automatically.
- The CGI program [opengateauth.cgi] gets the options, reads [index.html], replaces the keywords in the file, and send back [index.html].
-
The browser receives the authentication request page[index.html]. The encoded IPv4 address and language are descibed with hidden tag in the page.
-
The user enters userid and password to this page, and clicks button to call Opengate main CGI [FORM METHOD="POST" ACTION="http://opengate.saga-u.ac.jp/cgi-bin/opengate/opengatesrv.cgi"]. If IPv6 is enabled, the acess is done by IPv6. If not, done by IPv4.
-
The Opengate main CGI[opengatesrv.cgi] starts and processes the following.
-
The CGI gets the userid[eg., user1 or user1@id1], password, encoded IPv4 address[eg., 333333333-3] , language and watchmode[J or H or T] from POST data. The CGI also gets IPv6 address[eg., 2001:e38:10::111] from [REMOTE_ADDR].
CGI gets MAC address from NDP or ARP.
-
CGI reads configuration file[opengatesrv.conf] and gets the information about the authentication server[default](at [user1]) or [id1](at [user1@id1]).
-
CGI sends userid[user1] and password to the authentication server indexed as [default] (or [id1]).
-
After passing the authentication, CGI inserts IPv4 firewall rule [ipfw add 10000 allow ip from 192.168.1.111 to any] and [ipfw add 10000 allow ip from any to 192.168.1.111], and inserts IPv6 firewall rule [ip6fw add 10000 allow ipv6 from 2001:e38:10::111 to any] and [ip6fw add 10000 allow ipv6 from any to 2001:e38:10::111]. The rules indicate the pass of packet to/from the client.
-
CGI reports to syslog that the firewall is opened
[Jun 16 19:14:11 ... START: user user1 use IPv6 and IPv4 at 00:00:00:00:00:00],
[Jun 16 19:14:11 ... OPEN: user user1 from 192.168.1.111...] and
[Jun 16 19:14:11 ... OPEN: user user1 from 2001:e38:10::111].
-
Depending on watchmode, CGI reads one of accept reply page files [accept-http.html/accept-java.html/accept-time.html], replaces keywords, and sends it to the client. ([accept-java.html] or [accept-http.html].)
- Case of accept-http, the page gets the http-keep page from the opengate port. The http-keep page includes the script to execute periodic XMLHttpRequest to the opengate port. The periodic request keeps a TCP connection with a watch process.
- Case of accept-java, the description to dowload java applet [applet code='Opengate.class'...] is executed. The java applet keeps connection with a watch process.
- Case of accept-time, the link to terminate usage is displayed.
-
CGI generates a watch process and exits.
-
The watch process waits for the java applet or http-keep script to connect.
-
If no connection in duration seconds, CGI removes the firewall rule [ipfw del 10000] and terminates.
To cope with hijacking and notting, the watch process executes periodic arp check and firewall packet inquiry between waiting.
(The watch process gets number of passed packets matched to the inserted rule from IPv4 and IPv6 firewall [ipfw -a list 10000], [ip6fw -a list 10000] every ActiveCheckInterval seconds.
If the packet count does not increase in NoPacketInterval seconds, the watch process removes the firewall rule and terminates.
The watch process also gets the list of mac and ip address by arp command every ActiveCheckInterval seconds,
and if the relation is changed, the watch process removes the firewall rule and terminates.)
-
If java applet or http-keep script is connected, the watch process watchs the TCP connection linked to the client.
When the TCP connection is closed, the watch process removes the firewall rule and terminates.
-
In java applet connection, the watch process sends 'hello' to the client every ActiveCheck/Interval seconds.
When no reply to hello, the watch process removes the firewall rule and terminates.
In http-keep script connection, the watch process reads 'GET /hello' and sends 'hello'.
When no hello-request during ActiveCheckInterval, the watch process removes the firewall rule and terminates.
-
At termination, the watch process reports the filewall close to syslog [Jun 16 22:11:55 ... CLOS: user user1 from 192.168.0.111...], [Jun 16 22:11:55 ... CLOS: user user1 from 2001:e38:10::111...] and [Jun 16 22:11:55 ... END: user user1 at 00:00:00:00:00:00].