src/acl/Asn.cc

   1
   2 /*
   3  * $Id$
   4  *
   5  * DEBUG: section 53    AS Number handling
   6  * AUTHOR: Duane Wessels, Kostas Anagnostakis
   7  *
   8  * SQUID Web Proxy Cache          http://www.squid-cache.org/
   9  * ----------------------------------------------------------
  10  *
  11  *  Squid is the result of efforts by numerous individuals from
  12  *  the Internet community; see the CONTRIBUTORS file for full
  13  *  details.   Many organizations have provided support for Squid's
  14  *  development; see the SPONSORS file for full details.  Squid is
  15  *  Copyrighted (C) 2001 by the Regents of the University of
  16  *  California; see the COPYRIGHT file for full details.  Squid
  17  *  incorporates software developed and/or copyrighted by other
  18  *  sources; see the CREDITS file for full details.
  19  *
  20  *  This program is free software; you can redistribute it and/or modify
  21  *  it under the terms of the GNU General Public License as published by
  22  *  the Free Software Foundation; either version 2 of the License, or
  23  *  (at your option) any later version.
  24  *
  25  *  This program is distributed in the hope that it will be useful,
  26  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  27  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  28  *  GNU General Public License for more details.
  29  *
  30  *  You should have received a copy of the GNU General Public License
  31  *  along with this program; if not, write to the Free Software
  32  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  33  *
  34  */
  35
  36 #include "squid.h"
  37 #include "mgr/Registration.h"
  38 #include "radix.h"
  39 #include "HttpRequest.h"
  40 #include "StoreClient.h"
  41 #include "Store.h"
  42 #include "acl/Acl.h"
  43 #include "acl/Asn.h"
  44 #include "acl/Checklist.h"
  45 #include "acl/SourceAsn.h"
  46 #include "acl/DestinationAsn.h"
  47 #include "acl/DestinationIp.h"
  48 #include "HttpReply.h"
  49 #include "forward.h"
  50 #include "wordlist.h"
  51
  52 #define WHOIS_PORT 43
  53 #define AS_REQBUF_SZ    4096
  54
  55 /* BEGIN of definitions for radix tree entries */
  56
  57
  58 /* 32/128 bits address in memory with length */
  59 class m_ADDR
  60 {
  61 public:
  62     uint8_t len;
  63     Ip::Address addr;
  64
  65     m_ADDR() : len(sizeof(Ip::Address)) {};
  66 };
  67
  68 /* END of definitions for radix tree entries */
  69
  70 /* Head for ip to asn radix tree */
  71
  72 struct squid_radix_node_head *AS_tree_head;
  73
  74 /* explicit instantiation required for some systems */
  75
  76 /// \cond AUTODOCS-IGNORE
  77 template cbdata_type CbDataList<int>::CBDATA_CbDataList;
  78 /// \endcond
  79
  80 /**
  81  * Structure for as number information. it could be simply
  82  * a list but it's coded as a structure for future
  83  * enhancements (e.g. expires)
  84  */
  85 struct as_info {
  86     CbDataList<int> *as_number;
  87     time_t expires;             /* NOTUSED */
  88 };
  89
  90 struct ASState {
  91     StoreEntry *entry;
  92     store_client *sc;
  93     HttpRequest *request;
  94     int as_number;
  95     int64_t offset;
  96     int reqofs;
  97     char reqbuf[AS_REQBUF_SZ];
  98     bool dataRead;
  99 };
 100
 101 /** entry into the radix tree */
 102 struct rtentry_t {
 103     struct squid_radix_node e_nodes[2];
 104     as_info *e_info;
 105     m_ADDR e_addr;
 106     m_ADDR e_mask;
 107 };
 108
 109 static int asnAddNet(char *, int);
 110
 111 static void asnCacheStart(int as);
 112
 113 static STCB asHandleReply;
 114
 115
 116 #if defined(__cplusplus)
 117 extern "C" {
 118 #endif
 119
 120     static int destroyRadixNode(struct squid_radix_node *rn, void *w);
 121     static int printRadixNode(struct squid_radix_node *rn, void *sentry);
 122
 123 #if defined(__cplusplus)
 124 }
 125 #endif
 126
 127 void asnAclInitialize(ACL * acls);
 128
 129 static void asStateFree(void *data);
 130
 131 static void destroyRadixNodeInfo(as_info *);
 132
 133 static OBJH asnStats;
 134
 135 /* PUBLIC */
 136
 137 int
 138 asnMatchIp(CbDataList<int> *data, Ip::Address &addr)
 139 {
 140     struct squid_radix_node *rn;
 141     as_info *e;
 142     m_ADDR m_addr;
 143     CbDataList<int> *a = NULL;
 144     CbDataList<int> *b = NULL;
 145
 146     debugs(53, 3, "asnMatchIp: Called for " << addr );
 147
 148     if (AS_tree_head == NULL)
 149         return 0;
 150
 151     if (addr.IsNoAddr())
 152         return 0;
 153
 154     if (addr.IsAnyAddr())
 155         return 0;
 156
 157     m_addr.addr = addr;
 158
 159     rn = squid_rn_match(&m_addr, AS_tree_head);
 160
 161     if (rn == NULL) {
 162         debugs(53, 3, "asnMatchIp: Address not in as db.");
 163         return 0;
 164     }
 165
 166     debugs(53, 3, "asnMatchIp: Found in db!");
 167     e = ((rtentry_t *) rn)->e_info;
 168     assert(e);
 169
 170     for (a = data; a; a = a->next)
 171         for (b = e->as_number; b; b = b->next)
 172             if (a->element == b->element) {
 173                 debugs(53, 5, "asnMatchIp: Found a match!");
 174                 return 1;
 175             }
 176
 177     debugs(53, 5, "asnMatchIp: AS not in as db.");
 178     return 0;
 179 }
 180
 181 void
 182 ACLASN::prepareForUse()
 183 {
 184     for (CbDataList<int> *i = data; i; i = i->
 185                                            next)
 186         asnCacheStart(i->element);
 187 }
 188
 189 static void
 190 asnRegisterWithCacheManager(void)
 191 {
 192     Mgr::RegisterAction("asndb", "AS Number Database", asnStats, 0, 1);
 193 }
 194
 195 /* initialize the radix tree structure */
 196
 197 SQUIDCEXTERN int squid_max_keylen;      /* yuck.. this is in lib/radix.c */
 198
 199 CBDATA_TYPE(ASState);
 200 void
 201 asnInit(void)
 202 {
 203     static int inited = 0;
 204     squid_max_keylen = 40;
 205     CBDATA_INIT_TYPE(ASState);
 206
 207     if (0 == inited++)
 208         squid_rn_init();
 209
 210     squid_rn_inithead(&AS_tree_head, 8);
 211
 212     asnRegisterWithCacheManager();
 213 }
 214
 215 void
 216 asnFreeMemory(void)
 217 {
 218     squid_rn_walktree(AS_tree_head, destroyRadixNode, AS_tree_head);
 219
 220     destroyRadixNode((struct squid_radix_node *) 0, (void *) AS_tree_head);
 221 }
 222
 223 static void
 224 asnStats(StoreEntry * sentry)
 225 {
 226     storeAppendPrintf(sentry, "Address    \tAS Numbers\n");
 227     squid_rn_walktree(AS_tree_head, printRadixNode, sentry);
 228 }
 229
 230 /* PRIVATE */
 231
 232
 233 static void
 234 asnCacheStart(int as)
 235 {
 236     LOCAL_ARRAY(char, asres, 4096);
 237     StoreEntry *e;
 238     HttpRequest *req;
 239     ASState *asState;
 240     asState = cbdataAlloc(ASState);
 241     asState->dataRead = 0;
 242     debugs(53, 3, "asnCacheStart: AS " << as);
 243     snprintf(asres, 4096, "whois://%s/!gAS%d", Config.as_whois_server, as);
 244     asState->as_number = as;
 245     req = HttpRequest::CreateFromUrl(asres);
 246     assert(NULL != req);
 247     asState->request = HTTPMSGLOCK(req);
 248
 249     if ((e = storeGetPublic(asres, METHOD_GET)) == NULL) {
 250         e = storeCreateEntry(asres, asres, request_flags(), METHOD_GET);
 251         asState->sc = storeClientListAdd(e, asState);
 252         Comm::ConnectionPointer nul;
 253         FwdState::fwdStart(nul, e, asState->request);
 254     } else {
 255
 256         e->lock();
 257         asState->sc = storeClientListAdd(e, asState);
 258     }
 259
 260     asState->entry = e;
 261     asState->offset = 0;
 262     asState->reqofs = 0;
 263     StoreIOBuffer readBuffer (AS_REQBUF_SZ, asState->offset, asState->reqbuf);
 264     storeClientCopy(asState->sc,
 265                     e,
 266                     readBuffer,
 267                     asHandleReply,
 268                     asState);
 269 }
 270
 271 static void
 272 asHandleReply(void *data, StoreIOBuffer result)
 273 {
 274     ASState *asState = (ASState *)data;
 275     StoreEntry *e = asState->entry;
 276     char *s;
 277     char *t;
 278     char *buf = asState->reqbuf;
 279     int leftoversz = -1;
 280
 281     debugs(53, 3, "asHandleReply: Called with size=" << (unsigned int)result.length);
 282     debugs(53, 3, "asHandleReply: buffer='" << buf << "'");
 283
 284     /* First figure out whether we should abort the request */
 285
 286     if (EBIT_TEST(e->flags, ENTRY_ABORTED)) {
 287         asStateFree(asState);
 288         return;
 289     }
 290
 291     if (result.length == 0 && asState->dataRead) {
 292         debugs(53, 3, "asHandleReply: Done: " << e->url()  );
 293         asStateFree(asState);
 294         return;
 295     } else if (result.flags.error) {
 296         debugs(53, 1, "asHandleReply: Called with Error set and size=" << (unsigned int) result.length);
 297         asStateFree(asState);
 298         return;
 299     } else if (HTTP_OK != e->getReply()->sline.status) {
 300         debugs(53, 1, "WARNING: AS " << asState->as_number << " whois request failed");
 301         asStateFree(asState);
 302         return;
 303     }
 304
 305     /*
 306      * Next, attempt to parse our request
 307      * Remembering that the actual buffer size is retsize + reqofs!
 308      */
 309     s = buf;
 310
 311     while ((size_t)(s - buf) < result.length + asState->reqofs && *s != '\0') {
 312         while (*s && xisspace(*s))
 313             s++;
 314
 315         for (t = s; *t; t++) {
 316             if (xisspace(*t))
 317                 break;
 318         }
 319
 320         if (*t == '\0') {
 321             /* oof, word should continue on next block */
 322             break;
 323         }
 324
 325         *t = '\0';
 326         debugs(53, 3, "asHandleReply: AS# " << s << " (" << asState->as_number << ")");
 327         asnAddNet(s, asState->as_number);
 328         s = t + 1;
 329         asState->dataRead = 1;
 330     }
 331
 332     /*
 333      * Next, grab the end of the 'valid data' in the buffer, and figure
 334      * out how much data is left in our buffer, which we need to keep
 335      * around for the next request
 336      */
 337     leftoversz = (asState->reqofs + result.length) - (s - buf);
 338
 339     assert(leftoversz >= 0);
 340
 341     /*
 342      * Next, copy the left over data, from s to s + leftoversz to the
 343      * beginning of the buffer
 344      */
 345     memmove(buf, s, leftoversz);
 346
 347     /*
 348      * Next, update our offset and reqofs, and kick off a copy if required
 349      */
 350     asState->offset += result.length;
 351
 352     asState->reqofs = leftoversz;
 353
 354     debugs(53, 3, "asState->offset = " << asState->offset);
 355
 356     if (e->store_status == STORE_PENDING) {
 357         debugs(53, 3, "asHandleReply: store_status == STORE_PENDING: " << e->url()  );
 358         StoreIOBuffer tempBuffer (AS_REQBUF_SZ - asState->reqofs,
 359                                   asState->offset,
 360                                   asState->reqbuf + asState->reqofs);
 361         storeClientCopy(asState->sc,
 362                         e,
 363                         tempBuffer,
 364                         asHandleReply,
 365                         asState);
 366     } else {
 367         StoreIOBuffer tempBuffer;
 368         debugs(53, 3, "asHandleReply: store complete, but data received " << e->url()  );
 369         tempBuffer.offset = asState->offset;
 370         tempBuffer.length = AS_REQBUF_SZ - asState->reqofs;
 371         tempBuffer.data = asState->reqbuf + asState->reqofs;
 372         storeClientCopy(asState->sc,
 373                         e,
 374                         tempBuffer,
 375                         asHandleReply,
 376                         asState);
 377     }
 378 }
 379
 380 static void
 381 asStateFree(void *data)
 382 {
 383     ASState *asState = (ASState *)data;
 384     debugs(53, 3, "asnStateFree: " << asState->entry->url()  );
 385     storeUnregister(asState->sc, asState->entry, asState);
 386     asState->entry->unlock();
 387     HTTPMSGUNLOCK(asState->request);
 388     cbdataFree(asState);
 389 }
 390
 391
 392 /**
 393  * add a network (addr, mask) to the radix tree, with matching AS number
 394  */
 395 static int
 396 asnAddNet(char *as_string, int as_number)
 397 {
 398     rtentry_t *e;
 399
 400     struct squid_radix_node *rn;
 401     CbDataList<int> **Tail = NULL;
 402     CbDataList<int> *q = NULL;
 403     as_info *asinfo = NULL;
 404
 405     Ip::Address mask;
 406     Ip::Address addr;
 407     char *t;
 408     int bitl;
 409
 410     t = strchr(as_string, '/');
 411
 412     if (t == NULL) {
 413         debugs(53, 3, "asnAddNet: failed, invalid response from whois server.");
 414         return 0;
 415     }
 416
 417     *t = '\0';
 418     addr = as_string;
 419     bitl = atoi(t + 1);
 420
 421     if (bitl < 0)
 422         bitl = 0;
 423
 424     // INET6 TODO : find a better way of identifying the base IPA family for mask than this.
 425     t = strchr(as_string, '.');
 426
 427     // generate Netbits Format Mask
 428     mask.SetNoAddr();
 429     mask.ApplyMask(bitl, (t!=NULL?AF_INET:AF_INET6) );
 430
 431     debugs(53, 3, "asnAddNet: called for " << addr << "/" << mask );
 432
 433     e = (rtentry_t *)xmalloc(sizeof(rtentry_t));
 434
 435     memset(e, '\0', sizeof(rtentry_t));
 436
 437     e->e_addr.addr = addr;
 438
 439     e->e_mask.addr = mask;
 440
 441     rn = squid_rn_lookup(&e->e_addr, &e->e_mask, AS_tree_head);
 442
 443     if (rn != NULL) {
 444         asinfo = ((rtentry_t *) rn)->e_info;
 445
 446         if (asinfo->as_number->find(as_number)) {
 447             debugs(53, 3, "asnAddNet: Ignoring repeated network '" << addr << "/" << bitl << "' for AS " << as_number);
 448         } else {
 449             debugs(53, 3, "asnAddNet: Warning: Found a network with multiple AS numbers!");
 450
 451             for (Tail = &asinfo->as_number; *Tail; Tail = &(*Tail)->next);
 452             q = new CbDataList<int> (as_number);
 453
 454             *(Tail) = q;
 455
 456             e->e_info = asinfo;
 457         }
 458     } else {
 459         q = new CbDataList<int> (as_number);
 460         asinfo = (as_info *)xmalloc(sizeof(as_info));
 461         asinfo->as_number = q;
 462         rn = squid_rn_addroute(&e->e_addr, &e->e_mask, AS_tree_head, e->e_nodes);
 463         rn = squid_rn_match(&e->e_addr, AS_tree_head);
 464         assert(rn != NULL);
 465         e->e_info = asinfo;
 466     }
 467
 468     if (rn == 0) {              /* assert might expand to nothing */
 469         xfree(asinfo);
 470         delete q;
 471         xfree(e);
 472         debugs(53, 3, "asnAddNet: Could not add entry.");
 473         return 0;
 474     }
 475
 476     e->e_info = asinfo;
 477     return 1;
 478 }
 479
 480 static int
 481 destroyRadixNode(struct squid_radix_node *rn, void *w)
 482 {
 483
 484     struct squid_radix_node_head *rnh = (struct squid_radix_node_head *) w;
 485
 486     if (rn && !(rn->rn_flags & RNF_ROOT)) {
 487         rtentry_t *e = (rtentry_t *) rn;
 488         rn = squid_rn_delete(rn->rn_key, rn->rn_mask, rnh);
 489
 490         if (rn == 0)
 491             debugs(53, 3, "destroyRadixNode: internal screwup");
 492
 493         destroyRadixNodeInfo(e->e_info);
 494
 495         xfree(rn);
 496     }
 497
 498     return 1;
 499 }
 500
 501 static void
 502 destroyRadixNodeInfo(as_info * e_info)
 503 {
 504     CbDataList<int> *prev = NULL;
 505     CbDataList<int> *data = e_info->as_number;
 506
 507     while (data) {
 508         prev = data;
 509         data = data->next;
 510         delete prev;
 511     }
 512
 513     delete data;
 514 }
 515
 516 static int
 517 printRadixNode(struct squid_radix_node *rn, void *_sentry)
 518 {
 519     StoreEntry *sentry = (StoreEntry *)_sentry;
 520     rtentry_t *e = (rtentry_t *) rn;
 521     CbDataList<int> *q;
 522     as_info *asinfo;
 523     char buf[MAX_IPSTRLEN];
 524     Ip::Address addr;
 525     Ip::Address mask;
 526
 527     assert(e);
 528     assert(e->e_info);
 529     addr = e->e_addr.addr;
 530     mask = e->e_mask.addr;
 531     storeAppendPrintf(sentry, "%s/%d\t",
 532                       addr.NtoA(buf, MAX_IPSTRLEN),
 533                       mask.GetCIDR() );
 534     asinfo = e->e_info;
 535     assert(asinfo->as_number);
 536
 537     for (q = asinfo->as_number; q; q = q->next)
 538         storeAppendPrintf(sentry, " %d", q->element);
 539
 540     storeAppendPrintf(sentry, "\n");
 541
 542     return 0;
 543 }
 544
 545 ACLASN::~ACLASN()
 546 {
 547     if (data)
 548         delete data;
 549 }
 550
 551 bool
 552
 553 ACLASN::match(Ip::Address toMatch)
 554 {
 555     return asnMatchIp(data, toMatch);
 556 }
 557
 558 wordlist *
 559 ACLASN::dump()
 560 {
 561     wordlist *W = NULL;
 562     char buf[32];
 563     CbDataList<int> *ldata = data;
 564
 565     while (ldata != NULL) {
 566         snprintf(buf, sizeof(buf), "%d", ldata->element);
 567         wordlistAdd(&W, buf);
 568         ldata = ldata->next;
 569     }
 570
 571     return W;
 572 }
 573
 574 bool
 575 ACLASN::empty () const
 576 {
 577     return data == NULL;
 578 }
 579
 580 void
 581 ACLASN::parse()
 582 {
 583     CbDataList<int> **curlist = &data;
 584     CbDataList<int> **Tail;
 585     CbDataList<int> *q = NULL;
 586     char *t = NULL;
 587
 588     for (Tail = curlist; *Tail; Tail = &((*Tail)->next));
 589     while ((t = strtokFile())) {
 590         q = new CbDataList<int> (atoi(t));
 591         *(Tail) = q;
 592         Tail = &q->next;
 593     }
 594 }
 595
 596 ACLData<Ip::Address> *
 597 ACLASN::clone() const
 598 {
 599     if (data)
 600         fatal ("cloning of ACLASN not implemented");
 601
 602     return new ACLASN(*this);
 603 }
 604
 605 /* explicit template instantiation required for some systems */
 606
 607 template class ACLStrategised<Ip::Address>;
 608
 609 ACL::Prototype ACLASN::SourceRegistryProtoype(&ACLASN::SourceRegistryEntry_, "src_as");
 610
 611 ACLStrategised<Ip::Address> ACLASN::SourceRegistryEntry_(new ACLASN, ACLSourceASNStrategy::Instance(), "src_as");
 612
 613 ACL::Prototype ACLASN::DestinationRegistryProtoype(&ACLASN::DestinationRegistryEntry_, "dst_as");
 614
 615 ACLStrategised<Ip::Address> ACLASN::DestinationRegistryEntry_(new ACLASN, ACLDestinationASNStrategy::Instance(), "dst_as");
 616
 617 int
 618 ACLSourceASNStrategy::match (ACLData<Ip::Address> * &data, ACLFilledChecklist *checklist)
 619 {
 620     return data->match(checklist->src_addr);
 621 }
 622
 623 ACLSourceASNStrategy *
 624 ACLSourceASNStrategy::Instance()
 625 {
 626     return &Instance_;
 627 }
 628
 629 ACLSourceASNStrategy ACLSourceASNStrategy::Instance_;
 630
 631
 632 int
 633 ACLDestinationASNStrategy::match (ACLData<MatchType> * &data, ACLFilledChecklist *checklist)
 634 {
 635     const ipcache_addrs *ia = ipcache_gethostbyname(checklist->request->GetHost(), IP_LOOKUP_IF_MISS);
 636
 637     if (ia) {
 638         for (int k = 0; k < (int) ia->count; k++) {
 639             if (data->match(ia->in_addrs[k]))
 640                 return 1;
 641         }
 642
 643         return 0;
 644
 645     } else if (!checklist->request->flags.destinationIPLookedUp()) {
 646         /* No entry in cache, lookup not attempted */
 647         /* XXX FIXME: allow accessing the acl name here */
 648         debugs(28, 3, "asnMatchAcl: Can't yet compare '" << "unknown" /*name*/ << "' ACL for '" << checklist->request->GetHost() << "'");
 649         checklist->changeState (DestinationIPLookup::Instance());
 650     } else {
 651         Ip::Address noaddr;
 652         noaddr.SetNoAddr();
 653         return data->match(noaddr);
 654     }
 655
 656     return 0;
 657 }
 658
 659 ACLDestinationASNStrategy *
 660 ACLDestinationASNStrategy::Instance()
 661 {
 662     return &Instance_;
 663 }
 664
 665 ACLDestinationASNStrategy ACLDestinationASNStrategy::Instance_;