Merge pull request #414 from nodogsplash/v4.0.2beta

V4.0.2beta numerous fixes and enhancements

docs/source/fas.rst

@@ -92,6 +92,8 @@ Example FAS Query strings
 
    `ndsctl json $clientip | grep token | cut -c 10- | cut -c -8`
 
+  A more sophisticated json parser could be used to extract all the client variables supplied by ndsctl, an example can be found in the default PreAuth Login script in /usr/lib/nogogsplash/login.sh.
+
   **Level 2** (fas_secure_enabled = 2), NDS sends enrypted information to FAS.
 
   `http://fasremotefqdn:fasport/faspath?fas=[aes-256-cbc data]&iv=[random initialisation vector]`

docs/source/preauth.rst

@@ -9,9 +9,9 @@ Overview
 **PreAuth** is a pre-authentication process that enables NDS to directly serve dynamic web content generated by a script or executable program.
 
 .. note::
- From version 3.3.1 onwards, a PreAuth login script is preinstalled. This generates a page asking for username and email address. Logins are recorded in a log file. It is enabled by uncommenting just 3 lines in the config file.
+ From version 3.3.1 onwards, a PreAuth login script is preinstalled. This generates a page asking for username and email address. Logins are recorded in a log file. It is enabled by uncommenting just 3 lines in the config file. **From version 4.0.2 onwards** it is enabled by a single line in the config file that overrides any other FAS configuration. 
 
-**PreAuth is enabled** by configuring NDS FAS to point to a virtual URL in the NDS web root instead of an independent FAS server. In addition, NDS is configured with the location of the PreAuth script or program.
+**PreAuth is enabled** by configuring NDS FAS to point to a virtual URL in the NDS web root instead of an independent FAS server. The location of the PreAuth script or program is provided in the config file.
 
 **The PreAuth script** can be a shell script or any other script type that an interpreter is available for (for example, PHP-cli, Python etc.).
 
@@ -19,10 +19,19 @@ A PreAuth program could be, for example, a compiled program written in C or any
 
 The PreAuth script or program will parse the url encoded command line (query string) passed to it and output html depending on the contents of the query string it receives from NDS. In turn, NDS will serve this html to the client device that is attempting to access the Internet.
 
+Using PreAuth version 4.0.2 onwards
+***********************************
+From version 4.0.2 onwards, PreAuth is enabled with a single line in the config files setting "option preauth".
+This option overrides any other FAS configuration and takes the form of the path to the PreAuth script.
+The path to the preinstalled login script is included in option preauth in the default config files, for example in OpenWrt:
 
-Using PreAuth
-*************
-PreAuth is set up using the standard NDS configuration for FAS
+`#option preauth '/usr/lib/nodogsplash/login.sh'`
+
+The "#" symbol means the line is commented. To activate, remove the "#". save and restart Nodogsplash.
+
+Using PreAuth version 3.3.1 to version 4.0.1
+********************************************
+From version 3.3.1 to version 4.0.1, PreAuth is set up using the standard NDS configuration for FAS
 (See the **Forwarding Authentication Service (FAS)** section of this documentation).
 
 In addition a single PreAuth configuration option is required to inform NDS of the location of the PreAuth script or program.
@@ -42,11 +51,11 @@ In OpenWrt this will be of the form
 option preauth /etc/nodogsplash/demo-preauth.sh
 For other Linux distributions this is set in the nodogsplash.conf file.
 
-Enabling the Preinstalled UserName/Email-address Login Script
-*************************************************************
+Enabling the Preinstalled Login Script (v3.3.1 to 4.0.1)
+********************************************************
 
 .. note::
- From version 3.1.1 onwards, this example PreAuth script is preinstalled.
+ From version 3.3.1 onwards, this example PreAuth script is preinstalled.
 
 **Enabling the Preinstalled Script**
 
@@ -70,6 +79,9 @@ For other operating systems edit the equivalent lines in the /etc/nodogsplash/no
 
 After making the change, save the file and restart the router.
 
+What Does the Example Login Script Do?
+**************************************
+
 **This example shell script** generates html output for NDS to serve as a dynamic splash page.
 
 The example asks the client user to enter their name and email address.

forward_authentication_service/PreAuth/demo-preauth-remote-image.sh

@@ -1,4 +1,7 @@
 #!/bin/sh
+#Copyright © The Nodogsplash Contributors 2004-2019
+#Copyright © Blue Wave Projects and Services 2015-2019
+#This software is released under the GNU GPL license.
 
 ### functions
 
@@ -142,12 +145,11 @@ imageurl="https://avatars0.githubusercontent.com/u/4403602"
 get_image_file
 
 footer="
-	<img src=\"/images/remote/$filename\" alt=\"Splash Page: For access to the Internet.\">
-	<hr>
+	<img style=\"height:60px; width:60px; float:left;\" src=\"/images/remote/$filename\" alt=\"Splash Page: For access to the Internet.\">
+
 	<copy-right>
+		<br><br>
 		Nodogsplash $version.
-		Copyright &copy; The Nodogsplash Contributors 2004-$year.
-		This software is released under the GNU GPL license.
 	</copy-right>
 	</div>
 	</div>
@@ -155,6 +157,18 @@ footer="
 	</html>
 "
 
+# Define a login form
+login_form="
+	<form action=\"/nodogsplash_preauth/\" method=\"get\">
+	<input type=\"hidden\" name=\"clientip\" value=\"$clientip\">
+	<input type=\"hidden\" name=\"gatewayname\" value=\"$gatewayname\">
+	<input type=\"hidden\" name=\"redir\" value=\"$requested\">
+	<input type=\"text\" name=\"username\" value=\"$username\" autocomplete=\"on\" ><br>:Name<br><br>
+	<input type=\"email\" name=\"emailaddr\" value=\"$emailaddr\" autocomplete=\"on\" ><br>:Email<br><br>
+	<input type=\"submit\" value=\"Continue\" >
+	</form><hr>
+"
+
 # Output the page common header
 echo -e $header
 
@@ -179,26 +193,49 @@ fi
 #
 if [ -z $username ] || [ -z $emailaddr ]; then
 	echo "<big-red>Welcome!</big-red><italic-black> To access the Internet you must enter your Name and Email Address</italic-black><hr>"
-	echo "<form action=\"/nodogsplash_preauth/\" method=\"get\">"
-	echo "<input type=\"hidden\" name=\"clientip\" value=\"$clientip\">"
-	echo "<input type=\"hidden\" name=\"gatewayname\" value=\"$gatewayname\">"
-	echo "<input type=\"hidden\" name=\"redir\" value=\"$requested\">"
-	echo "<input type=\"text\" name=\"username\" value=\"$username\" autocomplete=\"on\" >:Name<br><br>"
-	echo "<input type=\"email\" name=\"emailaddr\" value=\"$emailaddr\" autocomplete=\"on\" >:Email<br><br>"
-	echo "<input type=\"submit\" value=\"Continue\" >"
-	echo "</form><hr>"
+	echo -e $login_form
 else
-	# We have both fields, so get the token and in this case also the mac address
-	tok="$(ndsctl json $clientip | grep token | cut -c 10- | cut -c -8)"
-	clientmac="$(ndsctl json $clientip | grep mac | cut -c 8- | cut -c -17)"
+	# If we got here, we have both the username and emailaddr fields as completed on the login page on the client,
+	# so we will now call ndsctl to get client data we need to authenticate and add to our log.
+
+	# Variables returned from ndsctl are listed in $varlist.
+
+	# We at least need the client token to authenticate.
+	# In this example we will also log the client mac address.
+
+	varlist="id ip mac added active duration token state downloaded avg_down_speed uploaded avg_up_speed"
+	clientinfo=$(ndsctl json $clientip)
+
+	if [ -z $clientinfo ]; then
+		echo "<big-red>Sorry!</big-red><italic-black> The portal is busy, please try again.</italic-black><hr>"
+		echo -e $login_form
+		echo -e $footer
+		exit 0
+	else
+		for var in $varlist; do
+			eval $var=$(echo "$clientinfo" | grep $var | awk -F'"' '{print $4}')
+		done
+	fi
+
+	tok=$token
+	clientmac=$mac
+
+	# We now output the "Thankyou page" with a "Continue" button.
+
+	# This is the place to include information or advertising on this page,
+	# as this page will stay open until the client user taps or clicks "Continue"
 
-	# Output the "Thankyou page" with a continue button
-	# You could include information or advertising on this page
 	# Be aware that many devices will close the login browser as soon as
-	# the client taps continue, so now is the time to deliver your message.
+	# the client user continues, so now is the time to deliver your message.
+
 	echo "<big-red>Thankyou!</big-red>"
 	echo "<br><b>Welcome $username</b>"
+
+	# Add your message here:
+	# You could retrieve text or images from a remote server using wget or curl
+	# as this router has Internet access whilst the client device does not (yet).
 	echo "<br><italic-black> Your News or Advertising could be here, contact the owners of this Hotspot to find out how!</italic-black>"
+
 	echo "<form action=\"/nodogsplash_auth/\" method=\"get\">"
 	echo "<input type=\"hidden\" name=\"tok\" value=\"$tok\">"
 	echo "<input type=\"hidden\" name=\"redir\" value=\"$requested\"><br>"

forward_authentication_service/PreAuth/demo-preauth.sh

@@ -1,4 +1,8 @@
 #!/bin/sh
+#Copyright © The Nodogsplash Contributors 2004-2019
+#Copyright © Blue Wave Projects and Services 2015-2019
+#This software is released under the GNU GPL license.
+
 # Get the urlencoded querystring
 query_enc="$1"
 
@@ -113,12 +117,11 @@ header="
 version="$(ndsctl status | grep Version)"
 year="$(date | awk -F ' ' '{print $(6)}')"
 footer="
-	<img src=\"/images/splash.jpg\" alt=\"Splash Page: For access to the Internet.\">
-	<hr>
+	<img style=\"height:60px; width:60px; float:left;\" src=\"/images/splash.jpg\" alt=\"Splash Page: For access to the Internet.\">
+
 	<copy-right>
+		<br><br>
 		Nodogsplash $version.
-		Copyright &copy; The Nodogsplash Contributors 2004-$year.
-		This software is released under the GNU GPL license.
 	</copy-right>
 	</div>
 	</div>
@@ -126,6 +129,18 @@ footer="
 	</html>
 "
 
+# Define a login form
+login_form="
+	<form action=\"/nodogsplash_preauth/\" method=\"get\">
+	<input type=\"hidden\" name=\"clientip\" value=\"$clientip\">
+	<input type=\"hidden\" name=\"gatewayname\" value=\"$gatewayname\">
+	<input type=\"hidden\" name=\"redir\" value=\"$requested\">
+	<input type=\"text\" name=\"username\" value=\"$username\" autocomplete=\"on\" ><br>:Name<br><br>
+	<input type=\"email\" name=\"emailaddr\" value=\"$emailaddr\" autocomplete=\"on\" ><br>:Email<br><br>
+	<input type=\"submit\" value=\"Continue\" >
+	</form><hr>
+"
+
 # Output the page common header
 echo -e $header
 
@@ -150,26 +165,49 @@ fi
 #
 if [ -z $username ] || [ -z $emailaddr ]; then
 	echo "<big-red>Welcome!</big-red><italic-black> To access the Internet you must enter your Name and Email Address</italic-black><hr>"
-	echo "<form action=\"/nodogsplash_preauth/\" method=\"get\">"
-	echo "<input type=\"hidden\" name=\"clientip\" value=\"$clientip\">"
-	echo "<input type=\"hidden\" name=\"gatewayname\" value=\"$gatewayname\">"
-	echo "<input type=\"hidden\" name=\"redir\" value=\"$requested\">"
-	echo "<input type=\"text\" name=\"username\" value=\"$username\" autocomplete=\"on\" >:Name<br><br>"
-	echo "<input type=\"email\" name=\"emailaddr\" value=\"$emailaddr\" autocomplete=\"on\" >:Email<br><br>"
-	echo "<input type=\"submit\" value=\"Continue\" >"
-	echo "</form><hr>"
+	echo -e $login_form
 else
-	# We have both fields, so get the token and in this case also the mac address
-	tok="$(ndsctl json $clientip | grep token | cut -c 10- | cut -c -8)"
-	clientmac="$(ndsctl json $clientip | grep mac | cut -c 8- | cut -c -17)"
+	# If we got here, we have both the username and emailaddr fields as completed on the login page on the client,
+	# so we will now call ndsctl to get client data we need to authenticate and add to our log.
+
+	# Variables returned from ndsctl are listed in $varlist.
+
+	# We at least need the client token to authenticate.
+	# In this example we will also log the client mac address.
+
+	varlist="id ip mac added active duration token state downloaded avg_down_speed uploaded avg_up_speed"
+	clientinfo=$(ndsctl json $clientip)
+
+	if [ -z $clientinfo ]; then
+		echo "<big-red>Sorry!</big-red><italic-black> The portal is busy, please try again.</italic-black><hr>"
+		echo -e $login_form
+		echo -e $footer
+		exit 0
+	else
+		for var in $varlist; do
+			eval $var=$(echo "$clientinfo" | grep $var | awk -F'"' '{print $4}')
+		done
+	fi
+
+	tok=$token
+	clientmac=$mac
+
+	# We now output the "Thankyou page" with a "Continue" button.
+
+	# This is the place to include information or advertising on this page,
+	# as this page will stay open until the client user taps or clicks "Continue"
 
-	# Output the "Thankyou page" with a continue button
-	# You could include information or advertising on this page
 	# Be aware that many devices will close the login browser as soon as
-	# the client taps continue, so now is the time to deliver your message.
+	# the client user continues, so now is the time to deliver your message.
+
 	echo "<big-red>Thankyou!</big-red>"
 	echo "<br><b>Welcome $username</b>"
+
+	# Add your message here:
+	# You could retrieve text or images from a remote server using wget or curl
+	# as this router has Internet access whilst the client device does not (yet).
 	echo "<br><italic-black> Your News or Advertising could be here, contact the owners of this Hotspot to find out how!</italic-black>"
+
 	echo "<form action=\"/nodogsplash_auth/\" method=\"get\">"
 	echo "<input type=\"hidden\" name=\"tok\" value=\"$tok\">"
 	echo "<input type=\"hidden\" name=\"redir\" value=\"$requested\"><br>"

openwrt/nodogsplash/files/etc/config/nodogsplash

@@ -10,6 +10,15 @@ config nodogsplash
   # This hook is needed as a restart of Firewall overwrites nodogsplash iptables entries.
   option fwhook_enabled '1'
 
+  # Nodogsplash comes preconfigured for two basic modes of operation
+  # 1. A simple static splash page (splash.html) with template variables and click to continue (enabled by default)
+  # 2. A simple login page requiring username and email address to be entered. (enabled by uncommenting the following line)
+
+  #option preauth '/usr/lib/nodogsplash/login.sh'
+
+  # Both modes may be customised or a full custom system can be developed using FAS and BinAuth
+  # See documentation at: https://nodogsplashdocs.readthedocs.io/
+
   # WebRoot
   # Default: /etc/nodogsplash/htdocs
   #
@@ -157,17 +166,15 @@ config nodogsplash
   # Enable PreAuth Support.
   # PreAuth support allows FAS to call a local program or script with html served by NDS
   #
-  # A functional preauth script is installed by default providing
-  # username/emailaddress login as an alternative to the basic splash page. 
+  # A PreAuth login script is installed by default providing
+  # username/emailaddress login as an alternative to the basic splash page.
+  #
   # This generates a login page asking for usename and email address.
   # User logins are recorded in the log file /tmp/ndslog.log
   # Details of how the script works are contained in comments in the script itself.
   #
   # If set, a program/script is called by the NDS FAS handler
-  # when all three of the following conditions are met:
-  # 1. fasremoteip is NOT set,
-  # 2. fasport is set to the gateway port
-  # 3. faspath is set to /nodogsplash_preauth/
+  # All other FAS settings will be overidden.
   #
   # Initially FAS appends its query string to faspath.
   #
@@ -179,15 +186,18 @@ config nodogsplash
   #
   # The Preauth program should append at least the client ip to the query string
   # (using html input type hidden) for all calls to /nodogsplash_preauth/
-  # It must also obtain the client token using ndsctl (or the original query string if fas_secure_enabled=0)
+  # It must also obtain the client token using ndsctl
   # for NDS authentication when calling /nodogsplash_auth/
   #
-  # Enable username/emailaddress login.
-  # Note: fasport must be set to the same value as gatewayport (default = 2050)
-  # Enable by uncommenting the following three lines
-  #option fasport '2050'
-  #option faspath '/nodogsplash_preauth/'
+
+  ################################################################################
+  # Enable Default PreAuth login script
+  ################################################################################
+  # Enable by uncommenting the following line.
   #option preauth '/usr/lib/nodogsplash/login.sh'
+  ################################################################################
+  #
+  ################################################################################
 
   # Your router may have several interfaces, and you
   # probably want to keep them private from the gatewayinterface.

resources/nodogsplash.conf

@@ -12,6 +12,21 @@
 #
 GatewayInterface br-lan
 
+
+# Nodogsplash comes preconfigured for two basic modes of operation
+# 1. A simple static splash page (splash.html) with template variables and click to continue (enabled by default)
+# 2. A simple login page requiring username and email address to be entered. (enabled by uncommenting the following line)
+
+# For OpenWrt:
+# preauth /usr/lib/nodogsplash/login.sh
+#
+# OR for Debian and other Linux distributions:
+# preauth /etc/nodogsplash/login.sh
+
+# Both modes may be customised or a full custom system can be developed using FAS and BinAuth
+# See documentation at: https://nodogsplashdocs.readthedocs.io/
+
+
 # Option: WebRoot
 # Default: /etc/nodogsplash/htdocs
 #
@@ -412,47 +427,44 @@ FirewallRuleSet users-to-router {
 #
 #fas_secure_enabled 0
 
-# Option: PreAuth
-#
 # Enable PreAuth Support.
 # PreAuth support allows FAS to call a local program or script with html served by NDS
 #
-# A functional preauth script is installed by default providing
-# username/emailaddress login as an alternative to the basic splash page. 
+# A PreAuth login script is installed by default providing
+# username/emailaddress login as an alternative to the basic splash page.
+#
 # This generates a login page asking for usename and email address.
 # User logins are recorded in the log file /tmp/ndslog.log
 # Details of how the script works are contained in comments in the script itself.
 #
 # If set, a program/script is called by the NDS FAS handler
-# when all three of the following conditions are met:
-# 1. fasremoteip is NOT set,
-# 2. fasport is set to the gateway port
-# 3. faspath is set to /nodogsplash_preauth/
+# All other FAS settings will be overidden.
 #
 # Initially FAS appends its query string to faspath.
 #
 # The Preauth program will output html code that will be served to the client by NDS
-# Using html GET, the Preauth program may call:
+# Using html GET the Preauth program may call:
 # /nodogsplash_preauth/ to ask the client for more information
 # or
 # /nodogsplash_auth/ to authenticate the client
 #
 # The Preauth program should append at least the client ip to the query string
 # (using html input type hidden) for all calls to /nodogsplash_preauth/
-# It must also obtain the client token using ndsctl (or the original query string if fas_secure_enabled=0)
+# It must also obtain the client token using ndsctl
 # for NDS authentication when calling /nodogsplash_auth/
 #
-# Enable username/emailaddress login.
-# Note: fasport must be set to the same value as gatewayport (default = 2050)
-# Enable by uncommenting the following two lines
-# fasport 2050
-# faspath /nodogsplash_preauth/
-#
-# PLUS this line for OpenWrt:
+
+################################################################################
+# Enable Default PreAuth login script
+################################################################################
+# Enable by uncommenting the following line.
+# For OpenWrt:
 # preauth /usr/lib/nodogsplash/login.sh
-#
-# OR this line for Debian and other Linux distributions:
+# OR for Debian and other Linux distributions:
 # preauth /etc/nodogsplash/login.sh
+################################################################################
+#
+################################################################################
 
 # Option: BinAuth
 #

resources/splash.css

@@ -1,97 +1,79 @@
-body {
-	background-color: lightgrey;
-	color: black;
-	margin-left: 5%;
-	margin-right: 5%;
-	text-align: left;
-}
+	body {
+		background-color: lightgrey;
+		color: black;
+		margin-left: 5%;
+		margin-right: 5%;
+		text-align: left;
+	}
 
-hr {
-	display:block;
-	margin-top:0.5em;
-	margin-bottom:0.5em;
-	margin-left:auto;
-	margin-right:auto;
-	border-style:inset;
-	border-width:5px;
-} 
+	hr {
+		display:block;
+		margin-top:0.5em;
+		margin-bottom:0.5em;
+		margin-left:auto;
+		margin-right:auto;
+		border-style:inset;
+		border-width:5px;
+	} 
 
-.offset {
-	background: rgba(300, 300, 300, 0.6);
-	margin-left:auto;
-	margin-right:auto;
-	max-width:600px;
-	min-width:200px;
-	padding: 5px;
-}
+	.offset {
+		background: rgba(300, 300, 300, 0.6);
+		margin-left:auto;
+		margin-right:auto;
+		max-width:600px;
+		min-width:200px;
+		padding: 5px;
+	}
 
-.insert
-{
-	background: rgba(350, 350, 350, 0.7);
-	border: 2px solid #aaa;
-	border-radius: 4px;
-	min-width:200px;
-	max-width:100%;
-	padding: 5px;
-}
+	.insert {
+		background: rgba(350, 350, 350, 0.7);
+		border: 2px solid #aaa;
+		border-radius: 4px;
+		min-width:200px;
+		max-width:100%;
+		padding: 5px;
+	}
 
-img {
-	width: 40%;
-	max-width: 180px;
-	margin-left: 0%;
-	margin-right: 5%;
-}
+	img {
+		width: 40%;
+		max-width: 180px;
+		margin-left: 0%;
+		margin-right: 5%;
+	}
 
-input[type=text], input[type=email], input[type=number] {
-	color: black;
-	background: white;
-	margin-left: 0%;
-	margin-right: 5%;
-	text-align: left;
-	font-size: 1.0em;
-	line-height: 2.0em;
-	font-weight: bold;
-	border: 3px;
-	border-style: inset;
-}
+	input[type=text], input[type=email] {
+		color: black;
+		background: lightgrey;
+	}
 
-input[type=submit] {
-	color: white;
-	background: green;
-	margin-left: 0%;
-	margin-right: 5%;
-	text-align: left;
-	font-size: 1.0em;
-	line-height: 2.5em;
-	font-weight: bold;
-	border: 3px;
-	border-style: inset;
-}
+	input[type=submit], input[type=button] {
+		color: black;
+		background: lightblue;
+	}
 
-med-blue {
-	font-size: 1.2em;
-	color: blue;
-	font-weight: bold;
-	font-style: normal;
-}
+	med-blue {
+		font-size: 1.2em;
+		color: blue;
+		font-weight: bold;
+		font-style: normal;
+	}
 
-big-red {
-	font-size: 1.5em;
-	color: red;
-	font-weight: bold;
-}
+	big-red {
+		font-size: 1.5em;
+		color: red;
+		font-weight: bold;
+	}
 
-italic-black {
-	font-size: 1.0em;
-	color: black;
-	font-weight: bold;
-	font-style: italic;
-}
-
-copy-right {
-	font-size: 0.7em;
-	color: darkgrey;
-	font-weight: bold;
-	font-style:italic;
-}
+	italic-black {
+		font-size: 1.0em;
+		color: black;
+		font-weight: bold;
+		font-style: italic;
+	}
 
+	copy-right {
+		font-size: 0.7em;
+		color: darkgrey;
+		font-weight: bold;
+		font-style:italic;
+	}

src/http_microhttpd.c

@@ -708,9 +708,8 @@ static int encode_and_redirect_to_splashpage(struct MHD_Connection *connection,
 		// Generate secure query string or authaction url
 		// Note: config->fas_path contains a leading / as it is the path from the FAS web root.
 		if (config->fas_secure_enabled == 0) {
-			safe_asprintf(&splashpageurl, "http://%s:%u%s?authaction=http://%s/%s/%s&redir=%s",
-				config->fas_remoteip, config->fas_port, config->fas_path, 
-				config->gw_address, config->authdir, querystr, originurl);
+			safe_asprintf(&splashpageurl, "%s?authaction=http://%s/%s/%s&redir=%s",
+				config->fas_url, config->gw_address, config->authdir, querystr, originurl);
 		} else if (config->fas_secure_enabled == 1) {
 			safe_asprintf(&splashpageurl, "%s%s&redir=%s",
 				config->fas_url, querystr, originurl);

src/main.c

@@ -225,6 +225,7 @@ main_loop(void)
 	char *fasurl = NULL;
 	char *fasssl = NULL;
 	char *phpcmd = NULL;
+	char *preauth_dir = NULL;
 
 	config = config_get_config();
 
@@ -272,7 +273,23 @@ main_loop(void)
 	/* TODO: set listening socket */
 	debug(LOG_NOTICE, "Created web server on %s", config->gw_address);
 
+	if (config->preauth) {
+		debug(LOG_NOTICE, "Preauth is Enabled - Overiding FAS configuration.\n");
+		debug(LOG_NOTICE, "Preauth Script is %s\n", config->preauth);
+
+		//override all other FAS settings
+		config->fas_remoteip = safe_strdup(config->gw_ip);
+		config->fas_remotefqdn = NULL;
+		config->fas_key = NULL;
+		config->fas_port = config->gw_port;
+		safe_asprintf(&preauth_dir, "/%s/", config->preauthdir);
+		config->fas_path = safe_strdup(preauth_dir);
+		config->fas_secure_enabled = 1;
+		free(preauth_dir);
+	}
+
 	if (config->fas_port) {
+
 		if (config->fas_remoteip) {
 			if (is_addr(config->fas_remoteip) == 1) {
 				debug(LOG_INFO, "fasremoteip - %s - is a valid IPv4 address...", config->fas_remoteip);
@@ -331,6 +348,7 @@ main_loop(void)
 		}
 
 		debug(LOG_NOTICE, "Forwarding Authentication is Enabled.\n");
+
 		if (config->fas_remotefqdn) {
 			safe_asprintf(&fasurl, "http://%s:%u%s",
 				config->fas_remotefqdn, config->fas_port, config->fas_path);
@@ -348,11 +366,6 @@ main_loop(void)
 		}
 	}
 
-	if (config->preauth) {
-		debug(LOG_NOTICE, "Preauth is Enabled.\n");
-		debug(LOG_NOTICE, "Preauth Script is %s\n", config->preauth);
-	}
-
 	if (config->binauth) {
 		debug(LOG_NOTICE, "Binauth is Enabled.\n");
 		debug(LOG_NOTICE, "Binauth Script is %s\n", config->binauth);

src/util.c

@@ -628,15 +628,15 @@ ndsctl_json_client(FILE *fp, const t_client *client, time_t now)
 	unsigned long int durationsecs;
 	unsigned long long int download_bytes, upload_bytes;
 
-	fprintf(fp, "\"id\":%d,\n", client->id);
+	fprintf(fp, "\"id\":\"%d\",\n", client->id);
 	fprintf(fp, "\"ip\":\"%s\",\n", client->ip);
 	fprintf(fp, "\"mac\":\"%s\",\n", client->mac);
-	fprintf(fp, "\"added\":%lld,\n", (long long) client->session_start);
-	fprintf(fp, "\"active\":%lld,\n", (long long) client->counters.last_updated);
+	fprintf(fp, "\"added\":\"%lld\",\n", (long long) client->session_start);
+	fprintf(fp, "\"active\":\"%lld\",\n", (long long) client->counters.last_updated);
 	if (client->session_start) {
-		fprintf(fp, "\"duration\":%lu,\n", now - client->session_start);
+		fprintf(fp, "\"duration\":\"%lu\",\n", now - client->session_start);
 	} else {
-		fprintf(fp, "\"duration\":%lu,\n", 0ul);
+		fprintf(fp, "\"duration\":\"%lu\",\n", 0ul);
 	}
 	fprintf(fp, "\"token\":\"%s\",\n", client->token ? client->token : "none");
 	fprintf(fp, "\"state\":\"%s\",\n", fw_connection_state_as_string(client->fw_connection_state));
@@ -645,10 +645,10 @@ ndsctl_json_client(FILE *fp, const t_client *client, time_t now)
 	download_bytes = client->counters.incoming;
 	upload_bytes = client->counters.outgoing;
 
-	fprintf(fp, "\"downloaded\":%llu,\n", download_bytes / 1000);
-	fprintf(fp, "\"avg_down_speed\":%.2f,\n", ((double)download_bytes) / 125 / durationsecs);
-	fprintf(fp, "\"uploaded\":%llu,\n", upload_bytes / 1000);
-	fprintf(fp, "\"avg_up_speed\":%.2f\n", ((double)upload_bytes)/ 125 / durationsecs);
+	fprintf(fp, "\"downloaded\":\"%llu\",\n", download_bytes / 1000);
+	fprintf(fp, "\"avg_down_speed\":\"%.2f\",\n", ((double)download_bytes) / 125 / durationsecs);
+	fprintf(fp, "\"uploaded\":\"%llu\",\n", upload_bytes / 1000);
+	fprintf(fp, "\"avg_up_speed\":\"%.2f\"\n", ((double)upload_bytes)/ 125 / durationsecs);
 }
 
 static void
@@ -690,7 +690,7 @@ ndsctl_json_all(FILE *fp)
 
 	LOCK_CLIENT_LIST();
 
-	fprintf(fp, "{\n\"client_length\": %d,\n", get_client_list_length());
+	fprintf(fp, "{\n\"client_list_length\": \"%d\",\n", get_client_list_length());
 
 	client = client_get_first_client();