summaryrefslogtreecommitdiff
path: root/ot_accesslist.c
blob: cdb964d1d4876de22b10f77bc127f77c75b6c6bd (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
/* This software was written by Dirk Engling <erdgeist@erdgeist.org>
   It is considered beerware. Prost. Skol. Cheers or whatever.

   $id$ */

/* System */
#include <pthread.h>
#include <stdlib.h>
#include <string.h>
#include <stdio.h>
#include <signal.h>
#include <unistd.h>

/* Libowfat */
#include "byte.h"
#include "scan.h"
#include "ip6.h"
#include "mmap.h"

/* Opentracker */
#include "trackerlogic.h"
#include "ot_accesslist.h"
#include "ot_vector.h"

/* GLOBAL VARIABLES */
#ifdef WANT_ACCESSLIST
       char    *g_accesslist_filename;
static ot_hash *g_accesslist;
static size_t   g_accesslist_size;
static pthread_mutex_t g_accesslist_mutex;

static int vector_compare_hash(const void *hash1, const void *hash2 ) {
  return memcmp( hash1, hash2, OT_HASH_COMPARE_SIZE );
}

/* Read initial access list */
static void accesslist_readfile( void ) {
  ot_hash *info_hash, *accesslist_new = NULL;
  char    *map, *map_end, *read_offs;
  size_t   maplen;

  if( ( map = mmap_read( g_accesslist_filename, &maplen ) ) == NULL ) {
    char *wd = getcwd( NULL, 0 );
    fprintf( stderr, "Warning: Can't open accesslist file: %s (but will try to create it later, if necessary and possible).\nPWD: %s\n", g_accesslist_filename, wd );
    free( wd );
    return;
  }

  /* You need at least 41 bytes to pass an info_hash, make enough room
     for the maximum amount of them */
  info_hash = accesslist_new = malloc( ( maplen / 41 ) * 20 );
  if( !accesslist_new ) {
    fprintf( stderr, "Warning: Not enough memory to allocate %zd bytes for accesslist buffer. May succeed later.\n", ( maplen / 41 ) * 20 );
    return;
  }

  /* No use to scan if there's not enough room for another full info_hash */
  map_end = map + maplen - 40;
  read_offs = map;

  /* We do ignore anything that is not of the form "^[:xdigit:]{40}[^:xdigit:].*" */
  while( read_offs <= map_end ) {
    int i;
    for( i=0; i<(int)sizeof(ot_hash); ++i ) {
      int eger1 = scan_fromhex( read_offs[ 2*i ] );
      int eger2 = scan_fromhex( read_offs[ 1 + 2*i ] );
      if( eger1 < 0 || eger2 < 0 )
        break;
      (*info_hash)[i] = eger1 * 16 + eger2;
    }

    if( i == sizeof(ot_hash) ) {
      read_offs += 40;

      /* Append accesslist to accesslist vector */
      if( read_offs == map_end || scan_fromhex( *read_offs ) < 0 )
        ++info_hash;
    }

    /* Find start of next line */
    while( read_offs <= map_end && *(read_offs++) != '\n' );
  }
#ifdef _DEBUG
  fprintf( stderr, "Added %zd info_hashes to accesslist\n", (size_t)(info_hash - accesslist_new) );
#endif

  mmap_unmap( map, maplen);

  qsort( accesslist_new, info_hash - accesslist_new, sizeof( *info_hash ), vector_compare_hash );

  /* Now exchange the accesslist vector in the least race condition prone way */
  pthread_mutex_lock(&g_accesslist_mutex);
  free( g_accesslist );
  g_accesslist      = accesslist_new;
  g_accesslist_size = info_hash - accesslist_new;
  pthread_mutex_unlock(&g_accesslist_mutex);
}

int accesslist_hashisvalid( ot_hash hash ) {
  void *exactmatch;

  /* Lock should hardly ever be contended */
  pthread_mutex_lock(&g_accesslist_mutex);
  exactmatch = bsearch( hash, g_accesslist, g_accesslist_size, OT_HASH_COMPARE_SIZE, vector_compare_hash );
  pthread_mutex_unlock(&g_accesslist_mutex);

#ifdef WANT_ACCESSLIST_BLACK
  return exactmatch == NULL;
#else
  return exactmatch != NULL;
#endif
}

static void * accesslist_worker( void * args ) {
  int sig;
  sigset_t   signal_mask;

  sigemptyset(&signal_mask);
  sigaddset(&signal_mask, SIGHUP);

  (void)args;

  while( 1 ) {

    /* Initial attempt to read accesslist */
    accesslist_readfile( );

    /* Wait for signals */
    while( sigwait (&signal_mask, &sig) != 0 && sig != SIGHUP );
  }
  return NULL;
}

static pthread_t thread_id;
void accesslist_init( ) {
  pthread_mutex_init(&g_accesslist_mutex, NULL);
  pthread_create( &thread_id, NULL, accesslist_worker, NULL );
}

void accesslist_deinit( void ) {
  pthread_cancel( thread_id );
  pthread_mutex_destroy(&g_accesslist_mutex);
  free( g_accesslist );
  g_accesslist = 0;
  g_accesslist_size = 0;
}
#endif

int address_in_net( const ot_ip6 address, const ot_net *net ) {
  int bits = net->bits;
  int result = memcmp( address, &net->address, bits >> 3 );
  if( !result && ( bits & 7 ) )
    result = ( ( 0x7f00 >> ( bits & 7 ) ) & address[bits>>3] ) - net->address[bits>>3];
  return result == 0;
}

void *set_value_for_net( const ot_net *net, ot_vector *vector, const void *value, const size_t member_size ) {
  size_t i;
  int exactmatch;

  /* Caller must have a concept of ot_net in it's member */
  if( member_size < sizeof(ot_net) )
    return 0;

  /* Check each net in vector for overlap */
  uint8_t *member = ((uint8_t*)vector->data);
  for( i=0; i<vector->size; ++i ) {
    if( address_in_net( *(ot_ip6*)member, net ) ||
        address_in_net( net->address, (ot_net*)member ) )
      return 0;
    member += member_size;
  }

  member = vector_find_or_insert( vector, (void*)net, member_size, sizeof(ot_net), &exactmatch );
  if( member ) {
    memcpy( member, net, sizeof(ot_net));
    memcpy( member + sizeof(ot_net), value, member_size - sizeof(ot_net));
  }

  return member;
}

/* Takes a vector filled with { ot_net net, uint8_t[x] value };
   Returns value associated with the net, or NULL if not found */
void *get_value_for_net( const ot_ip6 address, const ot_vector *vector, const size_t member_size ) {
  int exactmatch;
  /* This binary search will return a pointer to the first non-containing network... */
  ot_net *net = binary_search( address, vector->data, vector->size, member_size, sizeof(ot_ip6), &exactmatch );
  if( !net )
    return NULL;
  /* ... so we'll need to move back one step unless we've exactly hit the first address in network */
  if( !exactmatch && ( (void*)net > vector->data ) )
    --net;
  if( !address_in_net( address, net ) )
    return NULL;
  return (void*)net;
}

#ifdef WANT_FULLLOG_NETWORKS
static ot_vector g_lognets_list;
ot_log *g_logchain_first, *g_logchain_last;

static pthread_mutex_t g_lognets_list_mutex = PTHREAD_MUTEX_INITIALIZER;
void loglist_add_network( const ot_net *net ) {
  pthread_mutex_lock(&g_lognets_list_mutex);
  set_value_for_net( net, &g_lognets_list, NULL, sizeof(ot_net));
  pthread_mutex_unlock(&g_lognets_list_mutex);
}

void loglist_reset( ) {
  pthread_mutex_lock(&g_lognets_list_mutex);
  free( g_lognets_list.data );
  g_lognets_list.data = 0;
  g_lognets_list.size = g_lognets_list.space = 0;
  pthread_mutex_unlock(&g_lognets_list_mutex);    
}

int loglist_check_address( const ot_ip6 address ) {
  int result;
  pthread_mutex_lock(&g_lognets_list_mutex);
  result = ( NULL != get_value_for_net( address, &g_lognets_list, sizeof(ot_net)) );
  pthread_mutex_unlock(&g_lognets_list_mutex);
  return result;
}
#endif

#ifdef WANT_IP_FROM_PROXY
typedef struct {
  ot_net    *proxy;
  ot_vector  networks;
} ot_proxymap;

static ot_vector g_proxies_list;
static pthread_mutex_t g_proxies_list_mutex = PTHREAD_MUTEX_INITIALIZER;

int proxylist_add_network( const ot_net *proxy, const ot_net *net ) {
  ot_proxymap *map;
  int exactmatch, result = 1;
  pthread_mutex_lock(&g_proxies_list_mutex);

  /* If we have a direct hit, use and extend the vector there */
  map = binary_search( proxy, g_proxies_list.data, g_proxies_list.size, sizeof(ot_proxymap), sizeof(ot_net), &exactmatch );

  if( !map || !exactmatch ) {
    /* else see, if we've got overlapping networks
       and get a new empty vector if not */
    ot_vector empty;
    memset( &empty, 0, sizeof( ot_vector ) );
    map = set_value_for_net( proxy, &g_proxies_list, &empty, sizeof(ot_proxymap));
  }

  if( map && set_value_for_net( net, &map->networks, NULL, sizeof(ot_net) ) )
       result = 1;

  pthread_mutex_unlock(&g_proxies_list_mutex);
  return result;
}

int proxylist_check_proxy( const ot_ip6 proxy, const ot_ip6 address ) {
  int result = 0;
  ot_proxymap *map;

  pthread_mutex_lock(&g_proxies_list_mutex);

  if( ( map = get_value_for_net( proxy, &g_proxies_list, sizeof(ot_proxymap) ) ) )
    if( !address || get_value_for_net( address, &map->networks, sizeof(ot_net) ) ) 
      result = 1;

  pthread_mutex_unlock(&g_proxies_list_mutex);
  return result;
}

#endif

static ot_ip6         g_adminip_addresses[OT_ADMINIP_MAX];
static ot_permissions g_adminip_permissions[OT_ADMINIP_MAX];
static unsigned int   g_adminip_count = 0;

int accesslist_blessip( ot_ip6 ip, ot_permissions permissions ) {
  if( g_adminip_count >= OT_ADMINIP_MAX )
    return -1;

  memcpy(g_adminip_addresses + g_adminip_count,ip,sizeof(ot_ip6));
  g_adminip_permissions[ g_adminip_count++ ] = permissions;

#ifdef _DEBUG
  {
    char _debug[512];
    int off = snprintf( _debug, sizeof(_debug), "Blessing ip address " );
    off += fmt_ip6c(_debug+off, ip );

    if( permissions & OT_PERMISSION_MAY_STAT       ) off += snprintf( _debug+off, 512-off, " may_fetch_stats" );
    if( permissions & OT_PERMISSION_MAY_LIVESYNC   ) off += snprintf( _debug+off, 512-off, " may_sync_live" );
    if( permissions & OT_PERMISSION_MAY_FULLSCRAPE ) off += snprintf( _debug+off, 512-off, " may_fetch_fullscrapes" );
    if( permissions & OT_PERMISSION_MAY_PROXY      ) off += snprintf( _debug+off, 512-off, " may_proxy" );
    if( !permissions ) off += snprintf( _debug+off, sizeof(_debug)-off, " nothing\n" );
    _debug[off++] = '.';
    write( 2, _debug, off );
  }
#endif

  return 0;
}

int accesslist_isblessed( ot_ip6 ip, ot_permissions permissions ) {
  unsigned int i;
  for( i=0; i<g_adminip_count; ++i )
    if( !memcmp( g_adminip_addresses + i, ip, sizeof(ot_ip6)) && ( g_adminip_permissions[ i ] & permissions ) )
      return 1;
  return 0;
}

const char *g_version_accesslist_c = "$Source$: $Revision$\n";