X-Git-Url: http://git.madism.org/?a=blobdiff_plain;f=postlicyd%2Frbl.c;h=a84f73ef905d0ca044ba99ca68ed461b2694543b;hb=a3eac0731ffb3a31b57f9feed0256678f187f2a1;hp=bb0dda0316c5fdc06ba11759313dfaabb90b98f3;hpb=193694fdba386a89b4b2a83ce803764302995e89;p=apps%2Fpfixtools.git

diff --git a/postlicyd/rbl.c b/postlicyd/rbl.c
index bb0dda0..a84f73e 100644
--- a/postlicyd/rbl.c
+++ b/postlicyd/rbl.c
@@ -42,6 +42,7 @@
 #include "rbl.h"
 #include "str.h"
 #include "file.h"
+#include "array.h"
 
 #define IPv4_BITS        5
 #define IPv4_PREFIX(ip)  ((uint32_t)(ip) >> IPv4_BITS)
@@ -51,6 +52,8 @@
 #define DEBUG(...)
 #endif
 
+/* Implementation */
+
 enum {
     BALANCED    = 0,
     LEFT_HEAVY  = 1,
@@ -58,10 +61,9 @@ enum {
 };
 
 struct rbldb_t {
-    uint32_t len, size;
-    uint32_t *ips;
-    bool     locked;
+    A(uint32_t) ips;
 };
+ARRAY(rbldb_t)
 
 static int get_o(const char *s, const char **out)
 {
@@ -131,8 +133,8 @@ rbldb_t *rbldb_create(const char *file, bool lock)
         --end;
     }
     if (end != map.end) {
-        syslog(LOG_WARNING, "file %s miss a final \\n, ignoring last line",
-               file);
+        warn("file %s miss a final \\n, ignoring last line",
+             file);
     }
 
     db = p_new(rbldb_t, 1);
@@ -145,61 +147,59 @@ rbldb_t *rbldb_create(const char *file, bool lock)
         if (parse_ipv4(p, &p, &ip) < 0) {
             p = (char *)memchr(p, '\n', end - p) + 1;
         } else {
-            if (db->len >= db->size) {
-                db->size += 64 * 1024;
-                p_realloc(&db->ips, db->size);
-            }
-            db->ips[db->len++] = ip;
+            array_add(db->ips, ip);
         }
     }
     file_map_close(&map);
 
     /* Lookup may perform serveral I/O, so avoid swap.
      */
-    db->locked = lock && mlock(db->ips, db->len * sizeof(*(db->ips))) == 0;
-    if (lock && !db->locked) {
+    array_adjust(db->ips);
+    if (lock && !array_lock(db->ips)) {
         UNIXERR("mlock");
     }
 
-    if (db->len) {
+    if (db->ips.len) {
 #       define QSORT_TYPE uint32_t
-#       define QSORT_BASE db->ips
-#       define QSORT_NELT db->len
+#       define QSORT_BASE db->ips.data
+#       define QSORT_NELT db->ips.len
 #       define QSORT_LT(a,b) *a < *b
 #       include "qsort.c"
     }
 
-    syslog(LOG_INFO, "rbl %s loaded, %d IPs", file, db->len);
+    info("rbl %s loaded, %d IPs", file, db->ips.len);
     return db;
 }
 
+static void rbldb_wipe(rbldb_t *db)
+{
+    array_wipe(db->ips);
+}
+
 void rbldb_delete(rbldb_t **db)
 {
     if (*db) {
-        if ((*db)->locked) {
-            (void)munlock((*db)->ips, (*db)->len * sizeof(*(*db)->ips));
-        }
-        p_delete(&(*db)->ips);
+        rbldb_wipe(*db);
         p_delete(&(*db));
     }
 }
 
-uint32_t rbldb_stats(rbldb_t *rbl)
+uint32_t rbldb_stats(const rbldb_t *rbl)
 {
-    return rbl->len;
+    return rbl->ips.len;
 }
 
-bool rbldb_ipv4_lookup(rbldb_t *db, uint32_t ip)
+bool rbldb_ipv4_lookup(const rbldb_t *db, uint32_t ip)
 {
-    int l = 0, r = db->len;
+    int l = 0, r = db->ips.len;
 
     while (l < r) {
         int i = (r + l) / 2;
 
-        if (db->ips[i] == ip)
+        if (array_elt(db->ips, i) == ip)
             return true;
 
-        if (ip < db->ips[i]) {
+        if (ip < array_elt(db->ips, i)) {
             r = i;
         } else {
             l = i + 1;
@@ -207,3 +207,227 @@ bool rbldb_ipv4_lookup(rbldb_t *db, uint32_t ip)
     }
     return false;
 }
+
+
+/* postlicyd filter declaration */
+
+#include "filter.h"
+
+typedef struct rbl_filter_t {
+    PA(rbldb_t) rbls;
+    A(int)      weights;
+    A(char)     hosts;
+    A(int)      host_offsets;
+    A(int)      host_weights;
+
+    int32_t     hard_threshold;
+    int32_t     soft_threshold;
+} rbl_filter_t;
+
+static rbl_filter_t *rbl_filter_new(void)
+{
+    return p_new(rbl_filter_t, 1);
+}
+
+static void rbl_filter_delete(rbl_filter_t **rbl)
+{
+    if (*rbl) {
+        array_deep_wipe((*rbl)->rbls, rbldb_delete);
+        array_wipe((*rbl)->weights);
+        array_wipe((*rbl)->hosts);
+        array_wipe((*rbl)->host_offsets);
+        array_wipe((*rbl)->host_weights);
+        p_delete(rbl);
+    }
+}
+
+
+static bool rbl_filter_constructor(filter_t *filter)
+{
+    rbl_filter_t *data = rbl_filter_new();
+
+#define PARSE_CHECK(Expr, Str, ...)                                            \
+    if (!(Expr)) {                                                             \
+        err(Str, ##__VA_ARGS__);                                               \
+        rbl_filter_delete(&data);                                              \
+        return false;                                                          \
+    }
+
+    data->hard_threshold = 1;
+    data->soft_threshold = 1;
+    foreach (filter_param_t *param, filter->params) {
+        switch (param->type) {
+          /* file parameter is:
+           *  [no]lock:weight:filename
+           *  valid options are:
+           *    - lock:   memlock the database in memory.
+           *    - nolock: don't memlock the database in memory [default].
+           *    - \d+:    a number describing the weight to give to the match
+           *              the given list [mandatory]
+           *  the file pointed by filename MUST be a valid ip list issued from
+           *  the rsync (or equivalent) service of a (r)bl.
+           */
+          case ATK_FILE: {
+            bool lock = false;
+            int  weight = 0;
+            rbldb_t *rbl = NULL;
+            const char *current = param->value;
+            const char *p = m_strchrnul(param->value, ':');
+            char *next = NULL;
+            for (int i = 0 ; i < 3 ; ++i) {
+                PARSE_CHECK(i == 2 || *p,
+                            "file parameter must contains a locking state "
+                            "and a weight option");
+                switch (i) {
+                  case 0:
+                    if ((p - current) == 4 && strncmp(current, "lock", 4) == 0) {
+                        lock = true;
+                    } else if ((p - current) == 6
+                               && strncmp(current, "nolock", 6) == 0) {
+                        lock = false;
+                    } else {
+                        PARSE_CHECK(false, "illegal locking state %.*s",
+                                    p - current, current);
+                    }
+                    break;
+
+                  case 1:
+                    weight = strtol(current, &next, 10);
+                    PARSE_CHECK(next == p && weight >= 0 && weight <= 1024,
+                                "illegal weight value %.*s",
+                                (p - current), current);
+                    break;
+
+                  case 2:
+                    rbl = rbldb_create(current, lock);
+                    PARSE_CHECK(rbl != NULL,
+                                "cannot load rbl db from %s", current);
+                    array_add(data->rbls, rbl);
+                    array_add(data->weights, weight);
+                    break;
+                }
+                if (i != 2) {
+                    current = p + 1;
+                    p = m_strchrnul(current, ':');
+                }
+            }
+          } break;
+
+          /* host parameter.
+           *  weight:hostname.
+           * define a RBL to use through DNS resolution.
+           */
+          case ATK_HOST: {
+            int  weight = 0;
+            const char *current = param->value;
+            const char *p = m_strchrnul(param->value, ':');
+            char *next = NULL;
+            for (int i = 0 ; i < 2 ; ++i) {
+                PARSE_CHECK(i == 1 || *p,
+                            "host parameter must contains a weight option");
+                switch (i) {
+                  case 0:
+                    weight = strtol(current, &next, 10);
+                    PARSE_CHECK(next == p && weight >= 0 && weight <= 1024,
+                                "illegal weight value %.*s",
+                                (p - current), current);
+                    break;
+
+                  case 1:
+                    array_add(data->host_offsets, array_len(data->hosts));
+                    array_append(data->hosts, current, strlen(current) + 1);
+                    array_add(data->host_weights, weight);
+                    break;
+                }
+                if (i != 1) {
+                    current = p + 1;
+                    p = m_strchrnul(current, ':');
+                }
+            }
+          } break;
+
+          /* hard_threshold parameter is an integer.
+           *  If the matching score is greater or equal than this threshold,
+           *  the hook "hard_match" is called.
+           * hard_threshold = 1 means, that all matches are hard matches.
+           * default is 1;
+           */
+          FILTER_PARAM_PARSE_INT(HARD_THRESHOLD, data->hard_threshold);
+
+          /* soft_threshold parameter is an integer.
+           *  if the matching score is greater or equal than this threshold
+           *  and smaller or equal than the hard_threshold, the hook "soft_match"
+           *  is called.
+           * default is 1;
+           */
+          FILTER_PARAM_PARSE_INT(SOFT_THRESHOLD, data->soft_threshold);
+
+          default: break;
+        }
+    }}
+
+    PARSE_CHECK(data->rbls.len, 
+                "no file parameter in the filter %s", filter->name);
+    filter->data = data;
+    return true;
+}
+
+static void rbl_filter_destructor(filter_t *filter)
+{
+    rbl_filter_t *data = filter->data;
+    rbl_filter_delete(&data);
+    filter->data = data;
+}
+
+static filter_result_t rbl_filter(const filter_t *filter, const query_t *query)
+{
+    uint32_t ip;
+    int32_t sum = 0;
+    const char *end = NULL;
+    const rbl_filter_t *data = filter->data;
+
+    if (parse_ipv4(query->client_address, &end, &ip) != 0) {
+        warn("invalid client address: %s, expected ipv4",
+             query->client_address);
+        return HTK_ERROR;
+    }
+    for (uint32_t i = 0 ; i < data->rbls.len ; ++i) {
+        const rbldb_t *rbl = array_elt(data->rbls, i);
+        int weight   = array_elt(data->weights, i);
+        if (rbldb_ipv4_lookup(rbl, ip)) {
+            sum += weight;
+            if (sum >= data->hard_threshold) {
+                return HTK_HARD_MATCH;
+            }
+        }
+    }
+    if (sum >= data->hard_threshold) {
+        return HTK_HARD_MATCH;
+    } else if (sum >= data->soft_threshold) {
+        return HTK_SOFT_MATCH;
+    } else {
+        return HTK_FAIL;
+    }
+}
+
+static int rbl_init(void)
+{
+    filter_type_t type =  filter_register("iplist", rbl_filter_constructor,
+                                          rbl_filter_destructor, rbl_filter);
+    /* Hooks.
+     */
+    (void)filter_hook_register(type, "abort");
+    (void)filter_hook_register(type, "error");
+    (void)filter_hook_register(type, "fail");
+    (void)filter_hook_register(type, "hard_match");
+    (void)filter_hook_register(type, "soft_match");
+
+    /* Parameters.
+     */
+    (void)filter_param_register(type, "file");
+    (void)filter_param_register(type, "host");
+    (void)filter_param_register(type, "hard_threshold");
+    (void)filter_param_register(type, "soft_threshold");
+    return 0;
+}
+module_init(rbl_init);