1 /******************************************************************************/
2 /* pfixtools: a collection of postfix related tools */
4 /* ________________________________________________________________________ */
6 /* Redistribution and use in source and binary forms, with or without */
7 /* modification, are permitted provided that the following conditions */
10 /* 1. Redistributions of source code must retain the above copyright */
11 /* notice, this list of conditions and the following disclaimer. */
12 /* 2. Redistributions in binary form must reproduce the above copyright */
13 /* notice, this list of conditions and the following disclaimer in the */
14 /* documentation and/or other materials provided with the distribution. */
15 /* 3. The names of its contributors may not be used to endorse or promote */
16 /* products derived from this software without specific prior written */
19 /* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND */
20 /* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE */
21 /* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR */
22 /* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS */
23 /* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR */
24 /* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF */
25 /* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS */
26 /* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN */
27 /* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) */
28 /* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF */
29 /* THE POSSIBILITY OF SUCH DAMAGE. */
30 /******************************************************************************/
33 * Copyright © 2007 Pierre Habouzit
34 * Copyright © 2008 Florent Bruneau
37 #include <arpa/inet.h>
38 #include <netinet/in.h>
46 #include "resources.h"
50 #define IPv4_PREFIX(ip) ((uint32_t)(ip) >> IPv4_BITS)
51 #define IPv4_SUFFIX(ip) ((uint32_t)(ip) & ((1 << IPv4_BITS) - 1))
52 #define NODE(db, i) ((db)->tree + (i))
71 typedef struct rbldb_resource_t {
74 A(uint16_t) ips[1 << 16];
77 static void rbldb_resource_wipe(rbldb_resource_t *res)
79 for (int i = 0 ; i < 1 << 16 ; ++i) {
80 array_wipe(res->ips[i]);
85 static int get_o(const char *s, const char **out)
89 if (*s < '0' || *s > '9')
93 if (*s < '0' || *s > '9')
96 res = res * 10 + *s++ - '0';
97 if (*s < '0' || *s > '9')
100 res = res * 10 + *s++ - '0';
101 if (!(*s < '0' || *s > '9') || res < 100)
109 static int parse_ipv4(const char *s, const char **out, uint32_t *ip)
114 if ((o & ~0xff) || *s++ != '.')
119 if ((o & ~0xff) || *s++ != '.')
124 if ((o & ~0xff) || *s++ != '.')
137 rbldb_t *rbldb_create(const char *file, bool lock)
144 if (!file_map_open(&map, file, false)) {
148 rbldb_resource_t *res = resource_get("iplist", file);
150 debug("No resource found");
151 res = p_new(rbldb_resource_t, 1);
152 resource_set("iplist", file, res, (resource_destructor_t)rbldb_resource_wipe);
155 db = p_new(rbldb_t, 1);
156 db->filename = m_strdup(file);
158 if (map.st.st_size == res->size && map.st.st_mtime == res->mtime) {
159 info("rbl %s up to date", file);
160 file_map_close(&map);
163 debug("mtime %d/%d, size %d/%d", (int)map.st.st_mtime, (int)res->mtime, (int)map.st.st_size, (int)res->size);
164 res->size = map.st.st_size;
165 res->mtime = map.st.st_mtime;
169 while (end > p && end[-1] != '\n') {
172 if (end != map.end) {
173 warn("file %s miss a final \\n, ignoring last line",
180 while (*p == ' ' || *p == '\t' || *p == '\r')
183 if (parse_ipv4(p, &p, &ip) < 0) {
184 p = (char *)memchr(p, '\n', end - p) + 1;
186 array_add(res->ips[ip >> 16], ip & 0xffff);
190 file_map_close(&map);
192 /* Lookup may perform serveral I/O, so avoid swap.
194 for (int i = 0 ; i < 1 << 16 ; ++i) {
195 array_adjust(res->ips[i]);
196 if (lock && !array_lock(res->ips[i])) {
199 if (res->ips[i].len) {
200 # define QSORT_TYPE uint16_t
201 # define QSORT_BASE res->ips[i].data
202 # define QSORT_NELT res->ips[i].len
203 # define QSORT_LT(a,b) *a < *b
208 info("rbl %s loaded, %d IPs", file, ips);
212 static void rbldb_wipe(rbldb_t *db)
214 resource_release("iplist", db->filename);
215 p_delete(&db->filename);
219 void rbldb_delete(rbldb_t **db)
227 uint32_t rbldb_stats(const rbldb_t *rbl)
230 for (int i = 0 ; i < 1 << 16 ; ++i) {
231 ips += array_len(rbl->ips[i]);
236 bool rbldb_ipv4_lookup(const rbldb_t *db, uint32_t ip)
238 const uint16_t hip = ip >> 16;
239 const uint16_t lip = ip & 0xffff;
240 int l = 0, r = db->ips[hip].len;
245 if (array_elt(db->ips[hip], i) == lip)
248 if (lip < array_elt(db->ips[hip], i)) {
258 /* postlicyd filter declaration */
262 typedef struct iplist_filter_t {
269 int32_t hard_threshold;
270 int32_t soft_threshold;
273 typedef struct iplist_async_data_t {
274 A(rbl_result_t) results;
278 } iplist_async_data_t;
280 static filter_type_t filter_type = FTK_UNKNOWN;
282 static iplist_filter_t *iplist_filter_new(void)
284 return p_new(iplist_filter_t, 1);
287 static void iplist_filter_delete(iplist_filter_t **rbl)
290 array_deep_wipe((*rbl)->rbls, rbldb_delete);
291 array_wipe((*rbl)->weights);
292 array_wipe((*rbl)->hosts);
293 array_wipe((*rbl)->host_offsets);
294 array_wipe((*rbl)->host_weights);
300 static bool iplist_filter_constructor(filter_t *filter)
302 iplist_filter_t *data = iplist_filter_new();
304 #define PARSE_CHECK(Expr, Str, ...) \
306 err(Str, ##__VA_ARGS__); \
307 iplist_filter_delete(&data); \
311 data->hard_threshold = 1;
312 data->soft_threshold = 1;
313 foreach (filter_param_t *param, filter->params) {
314 switch (param->type) {
315 /* file parameter is:
316 * [no]lock:weight:filename
318 * - lock: memlock the database in memory.
319 * - nolock: don't memlock the database in memory [default].
320 * - \d+: a number describing the weight to give to the match
321 * the given list [mandatory]
322 * the file pointed by filename MUST be a valid ip list issued from
323 * the rsync (or equivalent) service of a (r)bl.
325 case ATK_FILE: case ATK_RBLDNS: {
329 const char *current = param->value;
330 const char *p = m_strchrnul(param->value, ':');
332 for (int i = 0 ; i < 3 ; ++i) {
333 PARSE_CHECK(i == 2 || *p,
334 "file parameter must contains a locking state "
335 "and a weight option");
338 if ((p - current) == 4 && strncmp(current, "lock", 4) == 0) {
340 } else if ((p - current) == 6
341 && strncmp(current, "nolock", 6) == 0) {
344 PARSE_CHECK(false, "illegal locking state %.*s",
345 (int)(p - current), current);
350 weight = strtol(current, &next, 10);
351 PARSE_CHECK(next == p && weight >= 0 && weight <= 1024,
352 "illegal weight value %.*s",
353 (int)(p - current), current);
357 rbl = rbldb_create(current, lock);
358 PARSE_CHECK(rbl != NULL,
359 "cannot load rbl db from %s", current);
360 array_add(data->rbls, rbl);
361 array_add(data->weights, weight);
366 p = m_strchrnul(current, ':');
373 * define a RBL to use through DNS resolution.
377 const char *current = param->value;
378 const char *p = m_strchrnul(param->value, ':');
380 for (int i = 0 ; i < 2 ; ++i) {
381 PARSE_CHECK(i == 1 || *p,
382 "host parameter must contains a weight option");
385 weight = strtol(current, &next, 10);
386 PARSE_CHECK(next == p && weight >= 0 && weight <= 1024,
387 "illegal weight value %.*s",
388 (int)(p - current), current);
392 array_add(data->host_offsets, array_len(data->hosts));
393 array_append(data->hosts, current, strlen(current) + 1);
394 array_add(data->host_weights, weight);
399 p = m_strchrnul(current, ':');
404 /* hard_threshold parameter is an integer.
405 * If the matching score is greater or equal than this threshold,
406 * the hook "hard_match" is called.
407 * hard_threshold = 1 means, that all matches are hard matches.
410 FILTER_PARAM_PARSE_INT(HARD_THRESHOLD, data->hard_threshold);
412 /* soft_threshold parameter is an integer.
413 * if the matching score is greater or equal than this threshold
414 * and smaller or equal than the hard_threshold, the hook "soft_match"
418 FILTER_PARAM_PARSE_INT(SOFT_THRESHOLD, data->soft_threshold);
424 PARSE_CHECK(data->rbls.len || data->host_offsets.len,
425 "no file parameter in the filter %s", filter->name);
430 static void iplist_filter_destructor(filter_t *filter)
432 iplist_filter_t *data = filter->data;
433 iplist_filter_delete(&data);
437 static void iplist_filter_async(rbl_result_t *result, void *arg)
439 filter_context_t *context = arg;
440 const filter_t *filter = context->current_filter;
441 const iplist_filter_t *data = filter->data;
442 iplist_async_data_t *async = context->contexts[filter_type];
445 if (*result != RBL_ERROR) {
446 async->error = false;
450 debug("got asynchronous request result for filter %s, rbl %d, still awaiting %d answers",
451 filter->name, (int)(result - array_ptr(async->results, 0)), async->awaited);
453 if (async->awaited == 0) {
454 filter_result_t res = HTK_FAIL;
458 for (uint32_t i = 0 ; i < array_len(data->host_offsets) ; ++i) {
459 int weight = array_elt(data->host_weights, i);
461 switch (array_elt(async->results, i)) {
463 crit("no more awaited answer but result is ASYNC");
466 async->sum += weight;
472 if (async->sum >= (uint32_t)data->hard_threshold) {
473 res = HTK_HARD_MATCH;
474 } else if (async->sum >= (uint32_t)data->soft_threshold) {
475 res = HTK_SOFT_MATCH;
478 debug("answering to filter %s", filter->name);
479 filter_post_async_result(context, res);
483 static filter_result_t iplist_filter(const filter_t *filter, const query_t *query,
484 filter_context_t *context)
488 const char *end = NULL;
489 const iplist_filter_t *data = filter->data;
492 if (parse_ipv4(query->client_address, &end, &ip) != 0) {
493 if (strchr(query->client_address, ':')) {
494 /* iplist only works on IPv4 */
497 warn("invalid client address: %s, expected ipv4",
498 query->client_address);
501 for (uint32_t i = 0 ; i < data->rbls.len ; ++i) {
502 const rbldb_t *rbl = array_elt(data->rbls, i);
503 int weight = array_elt(data->weights, i);
504 if (rbldb_ipv4_lookup(rbl, ip)) {
506 if (sum >= data->hard_threshold) {
507 return HTK_HARD_MATCH;
512 if (array_len(data->host_offsets) > 0) {
513 iplist_async_data_t* async = context->contexts[filter_type];
514 array_ensure_exact_capacity(async->results, array_len(data->host_offsets));
517 for (uint32_t i = 0 ; i < data->host_offsets.len ; ++i) {
518 const char *rbl = array_ptr(data->hosts, array_elt(data->host_offsets, i));
519 if (rbl_check(rbl, ip, array_ptr(async->results, i),
520 iplist_filter_async, context)) {
525 debug("filter %s awaiting %d asynchronous queries", filter->name, async->awaited);
526 async->error = error;
530 err("filter %s: all the rbl returned an error", filter->name);
533 if (sum >= data->hard_threshold) {
534 return HTK_HARD_MATCH;
535 } else if (sum >= data->soft_threshold) {
536 return HTK_SOFT_MATCH;
542 static void *iplist_context_constructor(void)
544 return p_new(iplist_async_data_t, 1);
547 static void iplist_context_destructor(void *data)
549 iplist_async_data_t *ctx = data;
550 array_wipe(ctx->results);
554 static int iplist_init(void)
556 filter_type = filter_register("iplist", iplist_filter_constructor,
557 iplist_filter_destructor, iplist_filter,
558 iplist_context_constructor,
559 iplist_context_destructor);
562 (void)filter_hook_register(filter_type, "abort");
563 (void)filter_hook_register(filter_type, "error");
564 (void)filter_hook_register(filter_type, "fail");
565 (void)filter_hook_register(filter_type, "hard_match");
566 (void)filter_hook_register(filter_type, "soft_match");
567 (void)filter_hook_register(filter_type, "async");
571 (void)filter_param_register(filter_type, "file");
572 (void)filter_param_register(filter_type, "rbldns");
573 (void)filter_param_register(filter_type, "dns");
574 (void)filter_param_register(filter_type, "hard_threshold");
575 (void)filter_param_register(filter_type, "soft_threshold");
578 module_init(iplist_init);