X-Git-Url: http://git.madism.org/?a=blobdiff_plain;f=postlicyd%2Frbl.c;h=3651563a332c8a5ef5a70d095d11875bbb6d1647;hb=db33734000d10dde33e52777bc76b0ee398be406;hp=7bf63576d9e4a5073686b4ed99a689bf2713a76e;hpb=1488a5e58f31f263a38e1ad983a58b3d657b089e;p=apps%2Fpfixtools.git diff --git a/postlicyd/rbl.c b/postlicyd/rbl.c index 7bf6357..3651563 100644 --- a/postlicyd/rbl.c +++ b/postlicyd/rbl.c @@ -52,6 +52,8 @@ #define DEBUG(...) #endif +/* Implementation */ + enum { BALANCED = 0, LEFT_HEAVY = 1, @@ -62,6 +64,7 @@ struct rbldb_t { A(uint32_t) ips; bool locked; }; +ARRAY(rbldb_t) static int get_o(const char *s, const char **out) { @@ -170,23 +173,28 @@ rbldb_t *rbldb_create(const char *file, bool lock) return db; } +static void rbldb_wipe(rbldb_t *db) +{ + if (db->locked) { + array_unlock(db->ips); + } + array_wipe(db->ips); +} + void rbldb_delete(rbldb_t **db) { if (*db) { - if ((*db)->locked) { - array_unlock((*db)->ips); - } - array_wipe((*db)->ips); + rbldb_wipe(*db); p_delete(&(*db)); } } -uint32_t rbldb_stats(rbldb_t *rbl) +uint32_t rbldb_stats(const rbldb_t *rbl) { return rbl->ips.len; } -bool rbldb_ipv4_lookup(rbldb_t *db, uint32_t ip) +bool rbldb_ipv4_lookup(const rbldb_t *db, uint32_t ip) { int l = 0, r = db->ips.len; @@ -204,3 +212,187 @@ bool rbldb_ipv4_lookup(rbldb_t *db, uint32_t ip) } return false; } + + +/* postlicyd filter declaration */ + +#include "filter.h" + +typedef struct rbl_filter_t { + PA(rbldb_t) rbls; + A(int) weights; + + int32_t hard_threshold; + int32_t soft_threshold; +} rbl_filter_t; + +static rbl_filter_t *rbl_filter_new(void) +{ + return p_new(rbl_filter_t, 1); +} + +static void rbl_filter_delete(rbl_filter_t **rbl) +{ + if (*rbl) { + array_deep_wipe((*rbl)->rbls, rbldb_delete); + array_wipe((*rbl)->weights); + p_delete(rbl); + } +} + + +static bool rbl_filter_constructor(filter_t *filter) +{ + rbl_filter_t *data = rbl_filter_new(); + +#define PARSE_CHECK(Expr, Str, ...) \ + if (!(Expr)) { \ + syslog(LOG_ERR, Str, ##__VA_ARGS__); \ + rbl_filter_delete(&data); \ + return false; \ + } + + foreach (filter_param_t *param, filter->params) { + switch (param->type) { + /* file parameter is: + * [no]lock:weight:filename + * valid options are: + * - lock: memlock the database in memory. + * - nolock: don't memlock the database in memory [default]. + * - \d+: a number describing the weight to give to the match + * the given list [mandatory] + * the file pointed by filename MUST be a valid ip list issued from + * the rsync (or equivalent) service of a (r)bl. + */ + case ATK_FILE: { + bool lock = false; + int weight = 0; + rbldb_t *rbl = NULL; + const char *current = param->value; + const char *p = m_strchrnul(param->value, ':'); + char *next = NULL; + for (int i = 0 ; i < 3 ; ++i) { + PARSE_CHECK(i == 2 || *p, + "file parameter must contains a locking state " + "and a weight option"); + switch (i) { + case 0: + if ((p - current) == 4 && strncmp(current, "lock", 4) == 0) { + lock = true; + } else if ((p - current) == 6 + && strncmp(current, "nolock", 6) == 0) { + lock = false; + } else { + PARSE_CHECK(false, "illegal locking state %.*s", + p - current, current); + } + break; + + case 1: + weight = strtol(current, &next, 10); + PARSE_CHECK(next == p && weight >= 0 && weight <= 1024, + "illegal weight value %.*s", + (p - current), current); + break; + + case 2: + rbl = rbldb_create(current, lock); + PARSE_CHECK(rbl != NULL, + "cannot load rbl db from %s", current); + array_add(data->rbls, rbl); + array_add(data->weights, weight); + break; + } + current = p + 1; + p = m_strchrnul(current, ':'); + } + } break; + + /* hard_threshold parameter is an integer. + * If the matching score is greater than this threshold, + * the hook "hard_match" is called. + * hard_threshold = 0 means, that all matches are hard matches. + * default is 0; + */ + case ATK_HARD_THRESHOLD: { + char *next; + data->hard_threshold = strtol(param->value, &next, 10); + PARSE_CHECK(*next, "invalid threshold value %s", param->value); + } break; + + /* soft_threshold parameter is an integer. + * if the matching score is greater than this threshold + * and smaller or equal than the hard_threshold, the hook "soft_match" + * is called. + * default is 0; + */ + case ATK_SOFT_THRESHOLD: { + char *next; + data->soft_threshold = strtol(param->value, &next, 10); + PARSE_CHECK(*next, "invalid threshold value %s", param->value); + } break; + + default: break; + } + }} + + PARSE_CHECK(data->rbls.len, + "no file parameter in the filter %s", filter->name); + filter->data = data; + return true; +} + +static void rbl_filter_destructor(filter_t *filter) +{ + rbl_filter_t *data = filter->data; + rbl_filter_delete(&data); + filter->data = data; +} + +static filter_result_t rbl_filter(const filter_t *filter, const query_t *query) +{ + uint32_t ip; + int32_t sum = 0; + const char *end = NULL; + const rbl_filter_t *data = filter->data; + + if (parse_ipv4(query->client_address, &end, &ip) != 0) { + syslog(LOG_WARNING, "invalid client address: %s, expected ipv4", + query->client_address); + return HTK_ERROR; + } + for (int i = 0 ; i < data->rbls.len ; ++i) { + const rbldb_t *rbl = array_elt(data->rbls, i); + int weight = array_elt(data->weights, i); + if (rbldb_ipv4_lookup(rbl, ip)) { + sum += weight; + } + } + if (sum > data->hard_threshold) { + return HTK_HARD_MATCH; + } else if (sum > data->soft_threshold) { + return HTK_SOFT_MATCH; + } else { + return HTK_FAIL; + } +} + +static int rbl_init(void) +{ + filter_type_t type = filter_register("rbl", rbl_filter_constructor, + rbl_filter_destructor, rbl_filter); + /* Hooks. + */ + (void)filter_hook_register(type, "error"); + (void)filter_hook_register(type, "fail"); + (void)filter_hook_register(type, "hard_match"); + (void)filter_hook_register(type, "soft_match"); + + /* Parameters. + */ + (void)filter_param_register(type, "file"); + (void)filter_param_register(type, "hard_threshold"); + (void)filter_param_register(type, "soft_threshold"); + return 0; +} +module_init(rbl_init);