contrib/blacklist/bin/blacklistd.c

   1 /*      $NetBSD: blacklistd.c,v 1.35 2016/09/26 19:43:43 christos Exp $ */
   2
   3 /*-
   4  * Copyright (c) 2015 The NetBSD Foundation, Inc.
   5  * All rights reserved.
   6  *
   7  * This code is derived from software contributed to The NetBSD Foundation
   8  * by Christos Zoulas.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
  20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  29  * POSSIBILITY OF SUCH DAMAGE.
  30  */
  31 #ifdef HAVE_CONFIG_H
  32 #include "config.h"
  33 #endif
  34 #include <sys/cdefs.h>
  35 __RCSID("$NetBSD: blacklistd.c,v 1.35 2016/09/26 19:43:43 christos Exp $");
  36
  37 #include <sys/types.h>
  38 #include <sys/socket.h>
  39 #include <sys/queue.h>
  40
  41 #ifdef HAVE_LIBUTIL_H
  42 #include <libutil.h>
  43 #endif
  44 #ifdef HAVE_UTIL_H
  45 #include <util.h>
  46 #endif
  47 #include <string.h>
  48 #include <signal.h>
  49 #include <netdb.h>
  50 #include <stdio.h>
  51 #include <stdbool.h>
  52 #include <string.h>
  53 #include <inttypes.h>
  54 #include <syslog.h>
  55 #include <ctype.h>
  56 #include <limits.h>
  57 #include <errno.h>
  58 #include <poll.h>
  59 #include <fcntl.h>
  60 #include <err.h>
  61 #include <stdlib.h>
  62 #include <unistd.h>
  63 #include <time.h>
  64 #include <ifaddrs.h>
  65 #include <netinet/in.h>
  66
  67 #include "bl.h"
  68 #include "internal.h"
  69 #include "conf.h"
  70 #include "run.h"
  71 #include "state.h"
  72 #include "support.h"
  73
  74 static const char *configfile = _PATH_BLCONF;
  75 static DB *state;
  76 static const char *dbfile = _PATH_BLSTATE;
  77 static sig_atomic_t readconf;
  78 static sig_atomic_t done;
  79 static int vflag;
  80
  81 static void
  82 sigusr1(int n __unused)
  83 {
  84         debug++;
  85 }
  86
  87 static void
  88 sigusr2(int n __unused)
  89 {
  90         debug--;
  91 }
  92
  93 static void
  94 sighup(int n __unused)
  95 {
  96         readconf++;
  97 }
  98
  99 static void
 100 sigdone(int n __unused)
 101 {
 102         done++;
 103 }
 104
 105 static __dead void
 106 usage(int c)
 107 {
 108         if (c)
 109                 warnx("Unknown option `%c'", (char)c);
 110         fprintf(stderr, "Usage: %s [-vdfr] [-c <config>] [-R <rulename>] "
 111             "[-P <sockpathsfile>] [-C <controlprog>] [-D <dbfile>] "
 112             "[-s <sockpath>] [-t <timeout>]\n", getprogname());
 113         exit(EXIT_FAILURE);
 114 }
 115
 116 static int
 117 getremoteaddress(bl_info_t *bi, struct sockaddr_storage *rss, socklen_t *rsl)
 118 {
 119         *rsl = sizeof(*rss);
 120         memset(rss, 0, *rsl);
 121
 122         if (getpeername(bi->bi_fd, (void *)rss, rsl) != -1)
 123                 return 0;
 124
 125         if (errno != ENOTCONN) {
 126                 (*lfun)(LOG_ERR, "getpeername failed (%m)");
 127                 return -1;
 128         }
 129
 130         if (bi->bi_slen == 0) {
 131                 (*lfun)(LOG_ERR, "unconnected socket with no peer in message");
 132                 return -1;
 133         }
 134
 135         switch (bi->bi_ss.ss_family) {
 136         case AF_INET:
 137                 *rsl = sizeof(struct sockaddr_in);
 138                 break;
 139         case AF_INET6:
 140                 *rsl = sizeof(struct sockaddr_in6);
 141                 break;
 142         default:
 143                 (*lfun)(LOG_ERR, "bad client passed socket family %u",
 144                     (unsigned)bi->bi_ss.ss_family);
 145                 return -1;
 146         }
 147
 148         if (*rsl != bi->bi_slen) {
 149                 (*lfun)(LOG_ERR, "bad client passed socket length %u != %u",
 150                     (unsigned)*rsl, (unsigned)bi->bi_slen);
 151                 return -1;
 152         }
 153
 154         memcpy(rss, &bi->bi_ss, *rsl);
 155
 156 #ifdef HAVE_STRUCT_SOCKADDR_SA_LEN
 157         if (*rsl != rss->ss_len) {
 158                 (*lfun)(LOG_ERR,
 159                     "bad client passed socket internal length %u != %u",
 160                     (unsigned)*rsl, (unsigned)rss->ss_len);
 161                 return -1;
 162         }
 163 #endif
 164         return 0;
 165 }
 166
 167 static void
 168 process(bl_t bl)
 169 {
 170         struct sockaddr_storage rss;
 171         socklen_t rsl;
 172         char rbuf[BUFSIZ];
 173         bl_info_t *bi;
 174         struct conf c;
 175         struct dbinfo dbi;
 176         struct timespec ts;
 177
 178         if (clock_gettime(CLOCK_REALTIME, &ts) == -1) {
 179                 (*lfun)(LOG_ERR, "clock_gettime failed (%m)");
 180                 return;
 181         }
 182
 183         if ((bi = bl_recv(bl)) == NULL) {
 184                 (*lfun)(LOG_ERR, "no message (%m)");
 185                 return;
 186         }
 187
 188         if (getremoteaddress(bi, &rss, &rsl) == -1)
 189                 goto out;
 190
 191         if (debug) {
 192                 sockaddr_snprintf(rbuf, sizeof(rbuf), "%a:%p", (void *)&rss);
 193                 (*lfun)(LOG_DEBUG, "processing type=%d fd=%d remote=%s msg=%s"
 194                     " uid=%lu gid=%lu", bi->bi_type, bi->bi_fd, rbuf,
 195                     bi->bi_msg, (unsigned long)bi->bi_uid,
 196                     (unsigned long)bi->bi_gid);
 197         }
 198
 199         if (conf_find(bi->bi_fd, bi->bi_uid, &rss, &c) == NULL) {
 200                 (*lfun)(LOG_DEBUG, "no rule matched");
 201                 goto out;
 202         }
 203
 204
 205         if (state_get(state, &c, &dbi) == -1)
 206                 goto out;
 207
 208         if (debug) {
 209                 char b1[128], b2[128];
 210                 (*lfun)(LOG_DEBUG, "%s: initial db state for %s: count=%d/%d "
 211                     "last=%s now=%s", __func__, rbuf, dbi.count, c.c_nfail,
 212                     fmttime(b1, sizeof(b1), dbi.last),
 213                     fmttime(b2, sizeof(b2), ts.tv_sec));
 214         }
 215
 216         switch (bi->bi_type) {
 217         case BL_ADD:
 218                 dbi.count++;
 219                 dbi.last = ts.tv_sec;
 220                 if (dbi.id[0]) {
 221                         /*
 222                          * We should not be getting this since the rule
 223                          * should have blocked the address. A possible
 224                          * explanation is that someone removed that rule,
 225                          * and another would be that we got another attempt
 226                          * before we added the rule. In anycase, we remove
 227                          * and re-add the rule because we don't want to add
 228                          * it twice, because then we'd lose track of it.
 229                          */
 230                         (*lfun)(LOG_DEBUG, "rule exists %s", dbi.id);
 231                         (void)run_change("rem", &c, dbi.id, 0);
 232                         dbi.id[0] = '\0';
 233                 }
 234                 if (c.c_nfail != -1 && dbi.count >= c.c_nfail) {
 235                         int res = run_change("add", &c, dbi.id, sizeof(dbi.id));
 236                         if (res == -1)
 237                                 goto out;
 238                         sockaddr_snprintf(rbuf, sizeof(rbuf), "%a",
 239                             (void *)&rss);
 240                         (*lfun)(LOG_INFO,
 241                             "blocked %s/%d:%d for %d seconds",
 242                             rbuf, c.c_lmask, c.c_port, c.c_duration);
 243
 244                 }
 245                 break;
 246         case BL_DELETE:
 247                 if (dbi.last == 0)
 248                         goto out;
 249                 dbi.count = 0;
 250                 dbi.last = 0;
 251                 break;
 252         default:
 253                 (*lfun)(LOG_ERR, "unknown message %d", bi->bi_type);
 254         }
 255         state_put(state, &c, &dbi);
 256
 257 out:
 258         close(bi->bi_fd);
 259
 260         if (debug) {
 261                 char b1[128], b2[128];
 262                 (*lfun)(LOG_DEBUG, "%s: final db state for %s: count=%d/%d "
 263                     "last=%s now=%s", __func__, rbuf, dbi.count, c.c_nfail,
 264                     fmttime(b1, sizeof(b1), dbi.last),
 265                     fmttime(b2, sizeof(b2), ts.tv_sec));
 266         }
 267 }
 268
 269 static void
 270 update_interfaces(void)
 271 {
 272         struct ifaddrs *oifas, *nifas;
 273
 274         if (getifaddrs(&nifas) == -1)
 275                 return;
 276
 277         oifas = ifas;
 278         ifas = nifas;
 279
 280         if (oifas)
 281                 freeifaddrs(oifas);
 282 }
 283
 284 static void
 285 update(void)
 286 {
 287         struct timespec ts;
 288         struct conf c;
 289         struct dbinfo dbi;
 290         unsigned int f, n;
 291         char buf[128];
 292         void *ss = &c.c_ss;
 293
 294         if (clock_gettime(CLOCK_REALTIME, &ts) == -1) {
 295                 (*lfun)(LOG_ERR, "clock_gettime failed (%m)");
 296                 return;
 297         }
 298
 299 again:
 300         for (n = 0, f = 1; state_iterate(state, &c, &dbi, f) == 1;
 301             f = 0, n++)
 302         {
 303                 time_t when = c.c_duration + dbi.last;
 304                 if (debug > 1) {
 305                         char b1[64], b2[64];
 306                         sockaddr_snprintf(buf, sizeof(buf), "%a:%p", ss);
 307                         (*lfun)(LOG_DEBUG, "%s:[%u] %s count=%d duration=%d "
 308                             "last=%s " "now=%s", __func__, n, buf, dbi.count,
 309                             c.c_duration, fmttime(b1, sizeof(b1), dbi.last),
 310                             fmttime(b2, sizeof(b2), ts.tv_sec));
 311                 }
 312                 if (c.c_duration == -1 || when >= ts.tv_sec)
 313                         continue;
 314                 if (dbi.id[0]) {
 315                         run_change("rem", &c, dbi.id, 0);
 316                         sockaddr_snprintf(buf, sizeof(buf), "%a", ss);
 317                         syslog(LOG_INFO, "released %s/%d:%d after %d seconds",
 318                             buf, c.c_lmask, c.c_port, c.c_duration);
 319                 }
 320                 state_del(state, &c);
 321                 goto again;
 322         }
 323 }
 324
 325 static void
 326 addfd(struct pollfd **pfdp, bl_t **blp, size_t *nfd, size_t *maxfd,
 327     const char *path)
 328 {
 329         bl_t bl = bl_create(true, path, vflag ? vdlog : vsyslog);
 330         if (bl == NULL || !bl_isconnected(bl))
 331                 exit(EXIT_FAILURE);
 332         if (*nfd >= *maxfd) {
 333                 *maxfd += 10;
 334                 *blp = realloc(*blp, sizeof(**blp) * *maxfd);
 335                 if (*blp == NULL)
 336                         err(EXIT_FAILURE, "malloc");
 337                 *pfdp = realloc(*pfdp, sizeof(**pfdp) * *maxfd);
 338                 if (*pfdp == NULL)
 339                         err(EXIT_FAILURE, "malloc");
 340         }
 341
 342         (*pfdp)[*nfd].fd = bl_getfd(bl);
 343         (*pfdp)[*nfd].events = POLLIN;
 344         (*blp)[*nfd] = bl;
 345         *nfd += 1;
 346 }
 347
 348 static void
 349 uniqueadd(struct conf ***listp, size_t *nlist, size_t *mlist, struct conf *c)
 350 {
 351         struct conf **list = *listp;
 352
 353         if (c->c_name[0] == '\0')
 354                 return;
 355         for (size_t i = 0; i < *nlist; i++) {
 356                 if (strcmp(list[i]->c_name, c->c_name) == 0)
 357                         return;
 358         }
 359         if (*nlist == *mlist) {
 360                 *mlist += 10;
 361                 void *p = realloc(*listp, *mlist * sizeof(*list));
 362                 if (p == NULL)
 363                         err(EXIT_FAILURE, "Can't allocate for rule list");
 364                 list = *listp = p;
 365         }
 366         list[(*nlist)++] = c;
 367 }
 368
 369 static void
 370 rules_flush(void)
 371 {
 372         struct conf **list;
 373         size_t nlist, mlist;
 374
 375         list = NULL;
 376         mlist = nlist = 0;
 377         for (size_t i = 0; i < rconf.cs_n; i++)
 378                 uniqueadd(&list, &nlist, &mlist, &rconf.cs_c[i]);
 379         for (size_t i = 0; i < lconf.cs_n; i++)
 380                 uniqueadd(&list, &nlist, &mlist, &lconf.cs_c[i]);
 381
 382         for (size_t i = 0; i < nlist; i++)
 383                 run_flush(list[i]);
 384         free(list);
 385 }
 386
 387 static void
 388 rules_restore(void)
 389 {
 390         struct conf c;
 391         struct dbinfo dbi;
 392         unsigned int f;
 393
 394         for (f = 1; state_iterate(state, &c, &dbi, f) == 1; f = 0) {
 395                 if (dbi.id[0] == '\0')
 396                         continue;
 397                 (void)run_change("rem", &c, dbi.id, 0);
 398                 (void)run_change("add", &c, dbi.id, sizeof(dbi.id));
 399         }
 400 }
 401
 402 int
 403 main(int argc, char *argv[])
 404 {
 405         int c, tout, flags, flush, restore, ret;
 406         const char *spath, *blsock;
 407
 408         setprogname(argv[0]);
 409
 410         spath = NULL;
 411         blsock = _PATH_BLSOCK;
 412         flush = 0;
 413         restore = 0;
 414         tout = 0;
 415         flags = O_RDWR|O_EXCL|O_CLOEXEC;
 416         while ((c = getopt(argc, argv, "C:c:D:dfP:rR:s:t:v")) != -1) {
 417                 switch (c) {
 418                 case 'C':
 419                         controlprog = optarg;
 420                         break;
 421                 case 'c':
 422                         configfile = optarg;
 423                         break;
 424                 case 'D':
 425                         dbfile = optarg;
 426                         break;
 427                 case 'd':
 428                         debug++;
 429                         break;
 430                 case 'f':
 431                         flush++;
 432                         break;
 433                 case 'P':
 434                         spath = optarg;
 435                         break;
 436                 case 'R':
 437                         rulename = optarg;
 438                         break;
 439                 case 'r':
 440                         restore++;
 441                         break;
 442                 case 's':
 443                         blsock = optarg;
 444                         break;
 445                 case 't':
 446                         tout = atoi(optarg) * 1000;
 447                         break;
 448                 case 'v':
 449                         vflag++;
 450                         break;
 451                 default:
 452                         usage(c);
 453                 }
 454         }
 455
 456         argc -= optind;
 457         if (argc)
 458                 usage(0);
 459
 460         signal(SIGHUP, sighup);
 461         signal(SIGINT, sigdone);
 462         signal(SIGQUIT, sigdone);
 463         signal(SIGTERM, sigdone);
 464         signal(SIGUSR1, sigusr1);
 465         signal(SIGUSR2, sigusr2);
 466
 467         openlog(getprogname(), LOG_PID, LOG_DAEMON);
 468
 469         if (debug) {
 470                 lfun = dlog;
 471                 if (tout == 0)
 472                         tout = 5000;
 473         } else {
 474                 if (tout == 0)
 475                         tout = 15000;
 476         }
 477
 478         update_interfaces();
 479         conf_parse(configfile);
 480         if (flush) {
 481                 rules_flush();
 482                 flags |= O_TRUNC;
 483         }
 484
 485         struct pollfd *pfd = NULL;
 486         bl_t *bl = NULL;
 487         size_t nfd = 0;
 488         size_t maxfd = 0;
 489
 490         if (spath == NULL)
 491                 addfd(&pfd, &bl, &nfd, &maxfd, blsock);
 492         else {
 493                 FILE *fp = fopen(spath, "r");
 494                 char *line;
 495                 if (fp == NULL)
 496                         err(EXIT_FAILURE, "Can't open `%s'", spath);
 497                 for (; (line = fparseln(fp, NULL, NULL, NULL, 0)) != NULL;
 498                     free(line))
 499                         addfd(&pfd, &bl, &nfd, &maxfd, line);
 500                 fclose(fp);
 501         }
 502
 503         state = state_open(dbfile, flags, 0600);
 504         if (state == NULL)
 505                 state = state_open(dbfile,  flags | O_CREAT, 0600);
 506         if (state == NULL)
 507                 return EXIT_FAILURE;
 508
 509         if (restore)
 510                 rules_restore();
 511
 512         if (!debug) {
 513                 if (daemon(0, 0) == -1)
 514                         err(EXIT_FAILURE, "daemon failed");
 515                 if (pidfile(NULL) == -1)
 516                         err(EXIT_FAILURE, "Can't create pidfile");
 517         }
 518
 519         for (size_t t = 0; !done; t++) {
 520                 if (readconf) {
 521                         readconf = 0;
 522                         conf_parse(configfile);
 523                 }
 524                 ret = poll(pfd, (nfds_t)nfd, tout);
 525                 if (debug)
 526                         (*lfun)(LOG_DEBUG, "received %d from poll()", ret);
 527                 switch (ret) {
 528                 case -1:
 529                         if (errno == EINTR)
 530                                 continue;
 531                         (*lfun)(LOG_ERR, "poll (%m)");
 532                         return EXIT_FAILURE;
 533                 case 0:
 534                         state_sync(state);
 535                         break;
 536                 default:
 537                         for (size_t i = 0; i < nfd; i++)
 538                                 if (pfd[i].revents & POLLIN)
 539                                         process(bl[i]);
 540                 }
 541                 if (t % 100 == 0)
 542                         state_sync(state);
 543                 if (t % 10000 == 0)
 544                         update_interfaces();
 545                 update();
 546         }
 547         state_close(state);
 548         return 0;
 549 }