]>
git.ipfire.org Git - people/stevee/guardian.git/blob - modules/Events.pm
2f4b561a15d5bfd914620ddb8dcdcf63b015f868
1 package Guardian
::Events
;
5 use Exporter
qw(import);
7 our @EXPORT_OK = qw(Init CheckAction Update);
9 # Hash which stores all supported commands from the queue.
12 'block' => \
&CallBlock
,
13 'unblock' => \
&CallUnblock
,
14 'flush' => \
&CallFlush
,
17 # Hash to store addresses and their current count.
20 # Hash to store all currentyl blocked addresses and a timestamp
21 # when the block for this address can be released.
24 # This object will contain the reference to the logger object after calling Init.
28 ## The "Init" (Block) function.
30 ## This function is responsible to initialize Block as a class based object.
31 ## It has to be called once before any blocking event can be processed.
33 ## The following arguments must be passed, during initialization:
34 ## "BlockCount" and "BlockTime" which both have to be natural numbers.
37 my ( $class, %args ) = @_;
40 # Fail, if some critical arguments are missing.
41 unless ((exists($self->{BlockCount
})) && (exists($self->{BlockTime
}))) {
42 die "Could not initialize Block: Too less arguments are given.\n";
45 # Use bless to make "$self" to an object of class "$class".
48 # Assign logger object.
49 $logger = $self->{Logger
};
51 # Log used firewall engine.
52 $logger->Log("debug", "Using firewall engine: $self->{FirewallEngine}");
54 # Try to load the specified firewall engine or die.
55 my $module_name = "Guardian::" . $self->{FirewallEngine
};
56 eval "use $module_name; 1" or die "Could not load a module for firewall engine: $self->{FirewallEngine}!";
58 # Return the class object.
63 ## The main "CheckAction" function.
65 ## This function is used to handle each recived event from the main event queue of guardian.
67 ## It will check if the given command is valid and will pass it to the responsible function.
69 sub CheckAction
($$) {
71 my @event = split(/ /, $_[0], 4);
72 my ($command, $address, $module, $message) = @event;
74 # Check if we got an invalid command.
75 unless(exists($commands{$command})) {
76 $logger->Log("err", "The CheckAction function has been called with an unsupported command ($command)!");
81 # Check if the given address is valid.
83 # Call required handler.
84 my $error = $commands{$command}->($self, $address, $module, $message);
86 # If we got any return code, something went wrong and should be logged.
88 $logger->Log("err", "Got error: $error");
94 ## The main "Counter" function.
96 ## This function is used to handle each count message + address, which has been sent by the main event
99 ## It stores the address and the current count into the counthash and increase the count each time when
100 ## the same address should be counted again. When the current count reaches the configured BlockCount,
101 ## the responsible function will be called to block the address.
105 my ($address, $module, $message) = @_;
108 $logger->Log("debug", "$module reported $message for address: $address");
110 # Increase existing count or start counting for new source addresses.
111 if (exists($counthash{$address})) {
112 # Skip already blocked addresses.
113 if (exists($blockhash{$address})) {
117 # Increase count of the existing entry.
118 $counthash{$address} = $counthash{$address} + 1;
120 # Log altered count of the address.
121 $logger->Log("debug", "Source $address now has count $counthash{$address}/$self->{BlockCount}...");
123 # Log that counting for the address has been started.
124 $logger->Log("debug", "Start counting for $address...");
127 $counthash{$address} = 1;
130 # Check if the address has reached the configured count limit.
131 if ($counthash{$address} >= $self->{BlockCount
}) {
132 # Write out log message.
133 $logger->Log("info", "Blocking $address for $self->{BlockTime} seconds...");
135 # Call block subroutine to block the address.
136 my $error = &CallBlock
($self, $address, $module, $message);
138 # Return the message if an error occurs.
142 # Everything worked well, return nothing.
147 ## The RemoveBlocks function.
149 ## This function periodly will be called and is responsible for releasing the block if the Blocktime
150 ## on an address has expired.
152 ## To do this, the code will loop through all entries of the blockhash and check
153 ## if the estimiated BlockTime of each address has reached and so the block can be released.
155 sub RemoveBlocks
() {
158 # Get the current time.
161 # Loop through the blockhash.
162 foreach my $address (keys %blockhash) {
163 # Check if the blocktime for the address has expired.
164 if ($blockhash{$address} <= $time) {
165 # Call unblock subroutine.
166 my $error = &CallUnblock
($self, $address, "BlockTime", "has expired for $address");
168 # Log error messages if returned.
170 $logger->Log("err", "$error");
175 # Everything okay, return nothing.
180 ## The CallBlock function.
182 ## This function is called, if the BlockCount for an address is reached or a direct
183 ## request for blocking an address has been recieved.
187 my ($address, $module, $message) = @_;
189 # Log the call for blocking an address.
190 $logger->Log("info", "$module - $message");
192 # Check if an entry for this address exists
193 # in the blockhash. If not, the address has
194 # not been blocked yet, call the responisible
195 # function to do this now.
196 unless (exists($blockhash{$address})) {
197 # Obtain the configured FirewallAction.
198 my $action = $self->{FirewallAction
};
200 # Block the given address.
201 my $error = &DoBlock
($address, $action);
203 # If we got back an error message something went wrong.
205 # Exit function and return the used FirewallEngine and the error message.
206 return "$self->{FirewallEngine} - $error";
208 # Address has been successfully blocked, print a log message.
209 $logger->Log("debug", "Address $address successfully has been blocked...");
213 # Generate time when the block will expire.
214 my $expire = time() + $self->{BlockTime
};
216 # Store the blocked address and the expire time
218 $blockhash{$address} = $expire;
220 # Return nothing "undef" if everything is okay.
225 ## CallUnblock function.
227 ## This function is responsible for unblocking and deleting a given
228 ## address from the blockhash.
230 sub CallUnblock
($) {
232 my ($address, $module, $message) = @_;
234 # Log the call for unblocking an address.
235 $logger->Log("info", "$module - $message");
237 # Return an error if no entry for the given address
238 # is present in the blockhash.
239 unless (exists($blockhash{$address})) {
240 return "Address $address was not blocked!";
243 # Unblock the address.
244 my $error = &DoUnblock
($address);
246 # If an error message is returned, something went wrong.
248 # Exit function and return the error message.
251 # Address successfully has been unblocked.
252 $logger->Log("debug", "Address $address successfully has been unblocked...");
255 # Drop address from blockhash.
256 delete ($blockhash{$address});
258 # Everything worked well, return nothing.