You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
668 lines
19 KiB
668 lines
19 KiB
/* Copyright 2016 Alex 'AdUser' Z (ad_user@runbox.com) |
|
* |
|
* This program is free software; you can redistribute it and/or modify |
|
* it under the terms of the GNU General Public License version 2 as |
|
* published by the Free Software Foundation. |
|
*/ |
|
#include "common.h" |
|
#include "log.h" |
|
#include "config.h" |
|
#include "appconfig.h" |
|
#include "matches.h" |
|
#include "ipaddr.h" |
|
#include "event.h" |
|
#include "source.h" |
|
#include "filter.h" |
|
#include "backend.h" |
|
#include "statefile.h" |
|
#include "mod-defs.h" |
|
#include "jail.h" |
|
|
|
#define DEFAULT_BANTIME 3600 /* in seconds, 1 hour */ |
|
#define DEFAULT_FINDTIME 300 /* in seconds, 5 min */ |
|
#define DEFAULT_EXPIRETIME 14400 /* in seconds, 4 hours */ |
|
#define DEFAULT_BANSCORE 50 |
|
|
|
f2b_jail_t *jails = NULL; |
|
|
|
static f2b_jail_t defaults = { |
|
.bantime = DEFAULT_BANTIME, |
|
.findtime = DEFAULT_FINDTIME, |
|
.expiretime = DEFAULT_EXPIRETIME, |
|
.banscore = DEFAULT_BANSCORE, |
|
}; |
|
|
|
static struct opt_remap { |
|
const char *old; |
|
const char *new; |
|
} deprecated[] = { |
|
{ .old = "incr_bantime", .new = "bantime_extend" }, |
|
{ .old = "incr_findtime", .new = "findtime_extend" }, |
|
{ .old = "maxretry", .new = "banscore" }, |
|
{ .old = NULL } /* end of list */ |
|
}; |
|
|
|
void |
|
f2b_jail_parse_compound_value(const char *value, char *name, char *init) { |
|
size_t len = 0; |
|
char *p = NULL; |
|
|
|
if ((p = strchr(value, ':')) == NULL) { |
|
/* param = name */ |
|
strlcpy(name, value, CONFIG_KEY_MAX); |
|
return; |
|
} |
|
|
|
/* param = name:init_string */ |
|
len = p - value; |
|
if (len >= CONFIG_KEY_MAX) { |
|
f2b_log_msg(log_warn, "'name' part of value exceeds max length %d bytes: %s", CONFIG_KEY_MAX, value); |
|
return; |
|
} |
|
|
|
strlcpy(name, value, len + 1); /* ':' acts as '\0' */ |
|
strlcpy(init, (p + 1), CONFIG_VAL_MAX); |
|
return; |
|
} |
|
|
|
bool |
|
f2b_jail_set_param(f2b_jail_t *jail, const char *param, const char *value) { |
|
assert(jail != NULL); |
|
assert(param != NULL); |
|
assert(value != NULL); |
|
|
|
if (strcmp(param, "enabled") == 0) { |
|
if (strcmp(value, "yes") == 0) { |
|
jail->flags |= JAIL_ENABLED; |
|
} else { |
|
jail->flags &= ~JAIL_ENABLED; |
|
} |
|
return true; |
|
} |
|
if (strcmp(param, "state") == 0) { |
|
if (strcmp(value, "yes") == 0) { |
|
jail->flags |= JAIL_HAS_STATE; |
|
} else { |
|
jail->flags &= ~JAIL_HAS_STATE; |
|
} |
|
return true; |
|
} |
|
if (strcmp(param, "bantime") == 0) { |
|
jail->bantime = atoi(value); |
|
if (jail->bantime <= 0) |
|
jail->bantime = DEFAULT_BANTIME; |
|
return true; |
|
} |
|
if (strcmp(param, "findtime") == 0) { |
|
jail->findtime = atoi(value); |
|
if (jail->findtime <= 0) |
|
jail->findtime = DEFAULT_FINDTIME; |
|
return true; |
|
} |
|
if (strcmp(param, "expiretime") == 0) { |
|
jail->expiretime = atoi(value); |
|
if (jail->expiretime <= 0) |
|
jail->expiretime = DEFAULT_EXPIRETIME; |
|
return true; |
|
} |
|
if (strcmp(param, "banscore") == 0) { |
|
jail->banscore = atoi(value); |
|
if (jail->banscore == 0) |
|
jail->banscore = DEFAULT_BANSCORE; |
|
return true; |
|
} |
|
if (strcmp(param, "bantime_extend") == 0) { |
|
jail->bantime_extend = atof(value); |
|
return true; |
|
} |
|
if (strcmp(param, "findtime_extend") == 0) { |
|
jail->findtime_extend = atof(value); |
|
return true; |
|
} |
|
if (strcmp(param, "expiretime_extend") == 0) { |
|
jail->expiretime_extend = atof(value); |
|
return true; |
|
} |
|
for (struct opt_remap *opt = deprecated; opt->old != NULL; opt++) { |
|
if (strcmp(opt->old, param) != 0) |
|
continue; |
|
f2b_log_msg(log_warn, "jail '%s': param '%s' deprecated, use '%s' instead", jail->name, opt->old, opt->new); |
|
return true; |
|
} |
|
return false; |
|
} |
|
|
|
void |
|
f2b_jail_apply_config(f2b_jail_t *jail, f2b_config_section_t *section) { |
|
char name[CONFIG_KEY_MAX]; |
|
char init[CONFIG_KEY_MAX]; |
|
f2b_config_param_t *param = NULL; |
|
|
|
assert(jail != NULL); |
|
assert(section != NULL); |
|
assert(section->type == t_jail || section->type == t_defaults); |
|
|
|
for (param = section->param; param != NULL; param = param->next) { |
|
if (strcmp(param->name, "source") == 0) { |
|
f2b_jail_parse_compound_value(param->value, name, init); |
|
jail->source = f2b_source_create(name, init); |
|
jail->flags |= JAIL_HAS_SOURCE; |
|
continue; |
|
} |
|
if (strcmp(param->name, "filter") == 0) { |
|
f2b_jail_parse_compound_value(param->value, name, init); |
|
jail->filter = f2b_filter_create(name, init); |
|
jail->flags |= JAIL_HAS_FILTER; |
|
continue; |
|
} |
|
if (strcmp(param->name, "backend") == 0) { |
|
f2b_jail_parse_compound_value(param->value, name, init); |
|
jail->backend = f2b_backend_create(name, init); |
|
continue; |
|
} |
|
if (f2b_jail_set_param(jail, param->name, param->value)) |
|
continue; |
|
f2b_log_msg(log_warn, "jail '%s': unrecognized parameter: %s", jail->name, param->name); |
|
} |
|
|
|
return; |
|
} |
|
|
|
void |
|
f2b_jail_set_defaults(f2b_config_section_t *section) { |
|
assert(section != NULL); |
|
assert(section->type == t_defaults); |
|
|
|
strlcpy(defaults.name, "default", sizeof(defaults.name)); /* can't init before */ |
|
f2b_jail_apply_config(&defaults, section); |
|
|
|
return; |
|
} |
|
|
|
static void |
|
f2b_jail_evt_match(const char *jail, f2b_ipaddr_t *addr, f2b_match_t *match) { |
|
char buf[EVENT_MAX] = ""; |
|
snprintf(buf, sizeof(buf), "event=match jail=%s addr=%s stag=%08X ftag=%08X score=%d", |
|
jail, addr->text, match->stag, match->ftag, match->score); |
|
f2b_event_send(buf); |
|
} |
|
|
|
static void |
|
f2b_jail_evt_ban(const char *jail, f2b_ipaddr_t *addr, int bantime) { |
|
char buf[EVENT_MAX] = ""; |
|
snprintf(buf, sizeof(buf), "event=ban jail=%s addr=%s bantime=%u count=%lu", jail, addr->text, bantime, addr->bancount); |
|
f2b_event_send(buf); |
|
} |
|
|
|
static void |
|
f2b_jail_evt_release(const char *jail, f2b_ipaddr_t *addr) { |
|
char buf[EVENT_MAX] = ""; |
|
snprintf(buf, sizeof(buf), "event=release jail=%s addr=%s", jail, addr->text); |
|
f2b_event_send(buf); |
|
} |
|
|
|
bool |
|
f2b_jail_ban(f2b_jail_t *jail, f2b_ipaddr_t *addr) { |
|
time_t bantime = 0; |
|
assert(jail != NULL); |
|
assert(addr != NULL); |
|
|
|
f2b_matches_flush(&addr->matches); |
|
addr->banned = true; |
|
addr->banned_at = addr->lastseen; |
|
|
|
if (jail->bantime_extend > 0) { |
|
bantime = jail->bantime + (int) (addr->bancount * (jail->bantime * jail->bantime_extend)); |
|
} else { |
|
bantime = jail->bantime; |
|
} |
|
addr->bancount++; |
|
addr->release_at = addr->banned_at + bantime; |
|
jail->stats.bans++; |
|
|
|
if (f2b_backend_check(jail->backend, addr->text)) { |
|
f2b_log_msg(log_warn, "jail '%s': ip %s was already banned", jail->name, addr->text); |
|
return true; |
|
} |
|
|
|
if (f2b_backend_ban(jail->backend, addr->text)) { |
|
f2b_jail_evt_ban(jail->name, addr, bantime); |
|
f2b_log_msg(log_note, "jail '%s': banned ip %s for %.1fhrs", |
|
jail->name, addr->text, (float) bantime / 3600); |
|
return true; |
|
} |
|
|
|
f2b_log_msg(log_error, "jail '%s': can't ban ip %s", jail->name, addr->text); |
|
return false; |
|
} |
|
|
|
bool |
|
f2b_jail_unban(f2b_jail_t *jail, f2b_ipaddr_t *addr) { |
|
assert(jail != NULL); |
|
assert(addr != NULL); |
|
|
|
addr->banned = false; |
|
addr->banned_at = 0; |
|
addr->release_at = 0; |
|
|
|
if (f2b_backend_unban(jail->backend, addr->text)) { |
|
f2b_jail_evt_release(jail->name, addr); |
|
f2b_log_msg(log_note, "jail '%s': released ip %s", jail->name, addr->text); |
|
return true; |
|
} |
|
|
|
f2b_log_msg(log_error, "jail '%s': can't release ip %s", jail->name, addr->text); |
|
return false; |
|
} |
|
|
|
f2b_jail_t * |
|
f2b_jail_create(f2b_config_section_t *section) { |
|
f2b_jail_t *jail = NULL; |
|
|
|
assert(section != NULL); |
|
assert(section->type == t_jail); |
|
|
|
if ((jail = calloc(1, sizeof(f2b_jail_t))) == NULL) { |
|
f2b_log_msg(log_error, "calloc() for new jail failed"); |
|
return NULL; |
|
} |
|
|
|
memcpy(jail, &defaults, sizeof(f2b_jail_t)); |
|
strlcpy(jail->name, section->name, sizeof(jail->name)); |
|
f2b_jail_apply_config(jail, section); |
|
|
|
return jail; |
|
} |
|
|
|
f2b_jail_t * |
|
f2b_jail_find(f2b_jail_t *list, const char *name) { |
|
assert(name != NULL); |
|
|
|
for (; list != NULL; list = list->next) |
|
if (strcmp(list->name, name) == 0) |
|
return list; |
|
|
|
return NULL; |
|
} |
|
|
|
void |
|
f2b_jail_process(f2b_jail_t *jail) { |
|
f2b_match_t *match = NULL; |
|
f2b_ipaddr_t *prev = NULL; |
|
f2b_ipaddr_t *addr = NULL; |
|
unsigned int hostc = 0; |
|
char line[LOGLINE_MAX] = ""; |
|
char matchbuf[IPADDR_MAX] = ""; |
|
time_t findtime = 0; |
|
time_t expiretime = 0; |
|
time_t now = time(NULL); |
|
bool remove = false; |
|
bool reset = true; /* source reset */ |
|
unsigned int stag, ftag; |
|
short int score; |
|
|
|
assert(jail != NULL); |
|
|
|
f2b_log_msg(log_debug, "jail '%s': processing", jail->name); |
|
|
|
f2b_backend_ping(jail->backend); |
|
|
|
while (jail->flags & JAIL_HAS_SOURCE) { |
|
if ((stag = f2b_source_next(jail->source, line, sizeof(line), reset)) <= 0) |
|
break; /* no more data */ |
|
reset = false; |
|
if (jail->flags & JAIL_HAS_FILTER) { |
|
if ((ftag = f2b_filter_match(jail->filter, line, matchbuf, sizeof(matchbuf), &score)) == 0) |
|
continue; /* no match in filter */ |
|
} else { |
|
/* without filter: 1) value always matches, 2) passed as-is */ |
|
memcpy(matchbuf, line, sizeof(matchbuf)); |
|
ftag = 0; |
|
score = MATCH_DEFSCORE; |
|
} |
|
/* find-or-create matched address in jail known hosts list */ |
|
addr = f2b_addrlist_lookup(jail->ipaddrs, matchbuf); |
|
if (!addr) { |
|
addr = f2b_ipaddr_create(matchbuf); |
|
jail->ipaddrs = f2b_addrlist_append(jail->ipaddrs, addr); |
|
f2b_log_msg(log_debug, "jail '%s': found new ip %s", jail->name, matchbuf); |
|
} |
|
addr->lastseen = now; |
|
/* create, fill and append new match to found host history */ |
|
jail->stats.matches++; |
|
if ((match = f2b_match_create(now)) == NULL) { |
|
f2b_log_msg(log_error, "can't allocate memory for new match"); |
|
continue; |
|
} |
|
match->time = now; |
|
match->stag = stag; |
|
match->ftag = ftag; |
|
match->score = score; |
|
f2b_matches_prepend(&addr->matches, match); |
|
f2b_jail_evt_match(jail->name, addr, match); |
|
/* host is banned? */ |
|
if (addr->banned) { |
|
if (addr->banned_at > (now - 5)) |
|
f2b_log_msg(log_warn, "jail '%s': ip %s was already banned", jail->name, matchbuf); |
|
continue; |
|
} |
|
/* how deep should we look inside host's history? */ |
|
findtime = jail->findtime + jail->findtime * (jail->findtime_extend * addr->bancount); |
|
f2b_matches_expire(&addr->matches, now - findtime - 600); |
|
/* ...so, check host score */ |
|
score = f2b_matches_score(&addr->matches, findtime); |
|
f2b_log_msg(log_info, "jail '%s': new match for ip %s (%u/%u)", |
|
jail->name, matchbuf, score, jail->banscore); |
|
if (score < jail->banscore) |
|
continue; /* lucky bastard */ |
|
/* else: score limit reached, ban ip */ |
|
f2b_jail_ban(jail, addr); |
|
if (jail->flags & JAIL_HAS_STATE) |
|
jail->sfile->need_save = true; |
|
} /* while(1) */ |
|
|
|
for (addr = jail->ipaddrs, prev = NULL; addr != NULL; ) { |
|
remove = false; |
|
/* check release time */ |
|
if (addr->banned && now > addr->release_at) |
|
f2b_jail_unban(jail, addr); |
|
/* check expiration */ |
|
expiretime = (addr->lastseen >= addr->release_at) |
|
? addr->lastseen |
|
: addr->release_at; |
|
expiretime += jail->expiretime; |
|
if (now > expiretime) { |
|
f2b_log_msg(log_info, "jail '%s': expired ip %s", |
|
jail->name, addr->text); |
|
remove = true; |
|
} |
|
/* list cleanup */ |
|
if (!remove) { |
|
prev = addr, addr = addr->next; |
|
hostc++; |
|
continue; |
|
} |
|
/* remove from list */ |
|
if (prev == NULL) { |
|
/* first item in list */ |
|
jail->ipaddrs = addr->next; |
|
f2b_ipaddr_destroy(addr); |
|
addr = jail->ipaddrs; |
|
} else { |
|
/* somewhere in list */ |
|
prev->next = addr->next; |
|
f2b_ipaddr_destroy(addr); |
|
addr = prev->next; |
|
} |
|
} |
|
jail->stats.hosts = hostc; |
|
|
|
if (jail->flags & JAIL_HAS_STATE && jail->sfile->need_save) { |
|
f2b_statefile_save(jail->sfile, jail->ipaddrs); |
|
jail->sfile->need_save = false; |
|
} |
|
|
|
return; |
|
} |
|
|
|
bool |
|
f2b_jail_init(f2b_jail_t *jail, f2b_config_t *config) { |
|
f2b_config_section_t *section = NULL; |
|
|
|
assert(jail != NULL); |
|
assert(config != NULL); |
|
|
|
if (jail->flags & JAIL_HAS_SOURCE) { |
|
if ((section = f2b_config_section_find(config->sources, jail->source->name)) == NULL) { |
|
f2b_log_msg(log_error, "jail '%s': no source with name '%s'", jail->name, jail->source->name); |
|
goto cleanup1; |
|
} |
|
if (!f2b_source_init(jail->source, section)) { |
|
f2b_log_msg(log_error, "jail '%s': can't init source '%s' with %s", jail->name, jail->source->name, jail->source->init); |
|
goto cleanup1; |
|
} |
|
} |
|
|
|
if (jail->flags & JAIL_HAS_FILTER) { |
|
if ((section = f2b_config_section_find(config->filters, jail->filter->name)) == NULL) { |
|
f2b_log_msg(log_error, "jail '%s': no filter with name '%s'", jail->name, jail->filter->name); |
|
goto cleanup2; |
|
} |
|
if (!f2b_filter_init(jail->filter, section)) { |
|
f2b_log_msg(log_error, "jail '%s': no regexps loaded from '%s'", jail->name, jail->filter->init); |
|
goto cleanup2; |
|
} |
|
} else if (jail->source && jail->source->flags & MOD_NEED_FILTER) { |
|
f2b_log_msg(log_error, "jail '%s': source '%s' needs filter, but jail has no one", jail->name, jail->source->name); |
|
goto cleanup1; |
|
} |
|
|
|
if (!jail->backend) { |
|
f2b_log_msg(log_error, "jail '%s': missing 'backend' option", jail->name); |
|
goto cleanup3; |
|
} |
|
if ((section = f2b_config_section_find(config->backends, jail->backend->name)) == NULL) { |
|
f2b_log_msg(log_error, "jail '%s': no backend with name '%s'", jail->name, jail->backend->name); |
|
goto cleanup3; |
|
} |
|
if (!f2b_backend_init(jail->backend, section)) { |
|
f2b_log_msg(log_error, "jail '%s': can't init backend '%s' with %s", |
|
jail->name, jail->backend->name, jail->backend->init); |
|
goto cleanup3; |
|
} |
|
|
|
/* start all */ |
|
if (jail->source && !f2b_source_start(jail->source)) { |
|
f2b_log_msg(log_warn, "jail '%s': source action 'start' failed", jail->name); |
|
goto cleanup3; |
|
} |
|
if (!f2b_backend_start(jail->backend)) { |
|
f2b_log_msg(log_warn, "jail '%s': backend action 'start' failed", jail->name); |
|
goto cleanup3; |
|
} |
|
|
|
f2b_log_msg(log_debug, "jail '%s' init complete", jail->name); |
|
|
|
return true; |
|
|
|
cleanup3: |
|
if (jail->backend) { |
|
f2b_backend_destroy(jail->backend); |
|
jail->backend = NULL; |
|
} |
|
cleanup2: |
|
if (jail->filter) { |
|
f2b_filter_destroy(jail->filter); |
|
jail->filter = NULL; |
|
} |
|
cleanup1: |
|
if (jail->source) { |
|
f2b_source_destroy(jail->source); |
|
jail->source = NULL; |
|
} |
|
return false; |
|
} |
|
|
|
bool |
|
f2b_jail_start(f2b_jail_t *jail) { |
|
unsigned int hostc = 0; |
|
time_t now = time(NULL); |
|
time_t remains; |
|
|
|
assert(jail != NULL); |
|
|
|
if (jail->flags & JAIL_HAS_STATE) { |
|
jail->sfile = f2b_statefile_create(appconfig.statedir_path, jail->name); |
|
if (jail->sfile == NULL) { |
|
/* error occured, must be already logged, just drop flag */ |
|
jail->flags &= ~JAIL_HAS_STATE; |
|
} else { |
|
jail->ipaddrs = f2b_statefile_load(jail->sfile); |
|
} |
|
} |
|
|
|
for (f2b_ipaddr_t *addr = jail->ipaddrs; addr != NULL; addr = addr->next) { |
|
hostc++; |
|
if (!addr->banned) |
|
continue; /* if list NOW contains such addresses, it may be bug */ |
|
if (f2b_backend_check(jail->backend, addr->text)) |
|
continue; /* already banned or backend don't support check() */ |
|
if (now >= addr->release_at) { |
|
addr->banned = false; |
|
continue; /* ban time already expired */ |
|
} |
|
if (f2b_backend_ban(jail->backend, addr->text)) { |
|
remains = addr->release_at - now; |
|
f2b_log_msg(log_note, "jail '%s': restored ban of ip %s (%.1fhrs remain)", |
|
jail->name, addr->text, (float) remains / 3600); |
|
} else { |
|
f2b_log_msg(log_error, "jail '%s': can't ban ip %s", jail->name, addr->text); |
|
} |
|
} |
|
jail->stats.hosts = hostc; |
|
|
|
f2b_log_msg(log_info, "jail '%s' started", jail->name); |
|
|
|
return true; |
|
} |
|
|
|
bool |
|
f2b_jail_stop(f2b_jail_t *jail) { |
|
bool errors = false; |
|
|
|
assert(jail != NULL); |
|
|
|
f2b_log_msg(log_info, "jail '%s': gracefull shutdown", jail->name); |
|
|
|
if (!f2b_source_stop(jail->source)) { |
|
f2b_log_msg(log_error, "jail '%s': action 'stop' for source failed", jail->name); |
|
errors = true; |
|
} |
|
|
|
f2b_source_destroy(jail->source); |
|
f2b_filter_destroy(jail->filter); |
|
|
|
for (f2b_ipaddr_t *addr = jail->ipaddrs; addr != NULL; addr = addr->next) { |
|
if (!addr->banned) |
|
continue; |
|
if (f2b_jail_unban(jail, addr)) |
|
continue; |
|
errors = true; |
|
} |
|
f2b_addrlist_destroy(jail->ipaddrs); |
|
|
|
if (!f2b_backend_stop(jail->backend)) { |
|
f2b_log_msg(log_error, "jail '%s': action 'stop' for backend failed", jail->name); |
|
errors = true; |
|
} |
|
|
|
return errors; |
|
} |
|
|
|
void |
|
f2b_jail_cmd_status(char *res, size_t ressize, f2b_jail_t *jail) { |
|
char buf[1024] = ""; |
|
const char *fmt1 = |
|
"name: %s\n" |
|
"banscore: %d\n" |
|
"flags:\n" |
|
" enabled: %s\n" |
|
" state: %s\n" |
|
" source: %s\n" |
|
" filter: %s\n"; |
|
const char *fmt2 = |
|
"times:\n" |
|
" bantime: %.1f hrs (+%d%%)\n" |
|
" findtime: %.1f min (+%d%%)\n" |
|
" expiretime: %.1f hrs (+%d%%)\n"; |
|
const char *fmt3 = |
|
"stats:\n" |
|
" hosts: %d\n" |
|
" matches: %d\n" |
|
" bans: %d\n"; |
|
|
|
assert(res != NULL); |
|
assert(jail != NULL); |
|
|
|
snprintf(res, ressize, fmt1, |
|
jail->name, jail->banscore, |
|
jail->flags & JAIL_ENABLED ? "yes" : "no", |
|
jail->flags & JAIL_HAS_STATE ? "yes" : "no", |
|
jail->flags & JAIL_HAS_SOURCE ? "yes" : "no", |
|
jail->flags & JAIL_HAS_FILTER ? "yes" : "no" |
|
); |
|
snprintf(buf, sizeof(buf), fmt2, |
|
(float) jail->bantime / 3600, (int) (jail->bantime_extend * 100), |
|
(float) jail->findtime / 60, (int) (jail->findtime_extend * 100), |
|
(float) jail->expiretime / 3600, (int) (jail->expiretime_extend * 100) |
|
); |
|
strlcat(res, buf, ressize); |
|
snprintf(buf, sizeof(buf), fmt3, |
|
jail->stats.hosts, |
|
jail->stats.matches, |
|
jail->stats.bans |
|
); |
|
strlcat(res, buf, ressize); |
|
} |
|
|
|
void |
|
f2b_jail_cmd_set(char *res, size_t ressize, f2b_jail_t *jail, const char *param, const char *value) { |
|
assert(res != NULL); |
|
assert(jail != NULL); |
|
assert(param != NULL); |
|
assert(value != NULL); |
|
|
|
if (f2b_jail_set_param(jail, param, value)) |
|
return; |
|
snprintf(res, ressize, "-parameter not found: %s", param); |
|
} |
|
|
|
/** |
|
* @brief misc operations on ip in given jail |
|
* @param res response buffer (don't change if no error) |
|
* @param ressize response buffer size |
|
* @param jail selected jail |
|
* @param op Type of operation: >0 - ban, 0 - status, <0 - unban |
|
* @param ip IP address |
|
*/ |
|
void |
|
f2b_jail_cmd_ip_xxx(char *res, size_t ressize, f2b_jail_t *jail, int op, const char *ip) { |
|
f2b_match_t *match = NULL; |
|
f2b_ipaddr_t *addr = NULL; |
|
|
|
assert(res != NULL); |
|
assert(jail != NULL); |
|
assert(ip != NULL); |
|
|
|
if ((addr = f2b_addrlist_lookup(jail->ipaddrs, ip)) == NULL) { |
|
/* address not found in list */ |
|
if (op > 0) { |
|
/* ban */ |
|
time_t now = time(NULL); |
|
if ((addr = f2b_ipaddr_create(ip)) == NULL) { |
|
snprintf(res, ressize, "-can't parse ip address: %s", ip); |
|
return; |
|
} |
|
addr->lastseen = now; |
|
match = f2b_match_create(now); |
|
f2b_matches_prepend(&addr->matches, match); |
|
f2b_matches_flush(&addr->matches); |
|
jail->ipaddrs = f2b_addrlist_append(jail->ipaddrs, addr); |
|
jail->stats.hosts++; |
|
if (jail->flags & JAIL_HAS_STATE) |
|
jail->sfile->need_save = true; |
|
} else { |
|
/* unban & status */ |
|
snprintf(res, ressize, "-can't find ip '%s' in jail '%s'\n", ip, jail->name); |
|
return; |
|
} |
|
} |
|
|
|
if (op > 0) { |
|
f2b_jail_ban(jail, addr); |
|
} else if (op < 0) { |
|
f2b_jail_unban(jail, addr); |
|
} else { |
|
f2b_ipaddr_status(addr, res, ressize); |
|
} |
|
}
|
|
|