]>
git.ipfire.org Git - people/stevee/guardian.git/blob - modules/Events.pm
1 package Guardian
::Events
;
5 use Exporter
qw(import);
7 our @EXPORT_OK = qw(Init CheckAction GenerateIgnoreList Update);
9 # Hash which stores all supported commands from the queue.
12 'block' => \
&CallBlock
,
13 'unblock' => \
&CallUnblock
,
14 'flush' => \
&CallFlush
,
17 # Hash to store addresses and their current count.
20 # Hash to store all currentyl blocked addresses and a timestamp
21 # when the block for this address can be released.
24 # Hash to store user-defined IP addresses and/or subnets which should be
25 # ignored in case any events should be repored for them.
28 # This object will contain the reference to the logger object after calling Init.
32 ## The "Init" (Block) function.
34 ## This function is responsible to initialize Block as a class based object.
35 ## It has to be called once before any blocking event can be processed.
37 ## The following arguments must be passed, during initialization:
38 ## "BlockCount" and "BlockTime" which both have to be natural numbers.
41 my ( $class, %args ) = @_;
44 # Fail, if some critical arguments are missing.
45 unless ((exists($self->{BlockCount
})) && (exists($self->{BlockTime
}))) {
46 die "Could not initialize Block: Too less arguments are given.\n";
49 # Use bless to make "$self" to an object of class "$class".
52 # Assign logger object.
53 $logger = $self->{Logger
};
55 # Log used firewall engine.
56 $logger->Log("debug", "Using firewall engine: $self->{FirewallEngine}");
58 # Try to load the specified firewall engine or die.
59 my $module_name = "Guardian::" . $self->{FirewallEngine
};
60 eval "use $module_name; 1" or die "Could not load a module for firewall engine: $self->{FirewallEngine}!";
62 # Check if an IgnoreFile has been configured.
63 if (exists($self->{IgnoreFile
})) {
64 # Call function to handle the ignore mechanism.
65 &GenerateIgnoreList
($self->{IgnoreFile
});
68 # Return the class object.
73 ## The main "CheckAction" function.
75 ## This function is used to handle each recived event from the main event queue of guardian.
77 ## It will check if the given command is valid and will pass it to the responsible function.
79 sub CheckAction
($$) {
81 my @event = split(/ /, $_[0], 4);
82 my ($command, $address, $module, $message) = @event;
84 # Check if we got an invalid command.
85 unless(exists($commands{$command})) {
86 $logger->Log("err", "The CheckAction function has been called with an unsupported command ($command)!");
90 # Convert and validate the given address.
91 my $bin_address = &Guardian
::Base
::IPOrNet2Int
($address);
93 # Abort if the given address could not be converted because it is not valid.
94 unless ($bin_address) {
95 $logger->Log("err", "Invalid IP address: $address");
99 # Check if address should be ignored.
100 if(&_IsOnIgnoreList
($bin_address)) {
102 $logger->Log("info", "Ignoring event for $address, because it is part of the ignore list.");
106 # Call required handler.
107 my $error = $commands{$command}->($self, $address, $module, $message);
109 # If we got any return code, something went wrong and should be logged.
111 $logger->Log("err", "Got error: $error");
117 ## The main "Counter" function.
119 ## This function is used to handle each count message + address, which has been sent by the main event
122 ## It stores the address and the current count into the counthash and increase the count each time when
123 ## the same address should be counted again. When the current count reaches the configured BlockCount,
124 ## the responsible function will be called to block the address.
128 my ($address, $module, $message) = @_;
131 $logger->Log("debug", "$module reported $message for address: $address");
133 # Increase existing count or start counting for new source addresses.
134 if (exists($counthash{$address})) {
135 # Skip already blocked addresses.
136 if (exists($blockhash{$address})) {
140 # Increase count of the existing entry.
141 $counthash{$address} = $counthash{$address} + 1;
143 # Log altered count of the address.
144 $logger->Log("debug", "Source $address now has count $counthash{$address}/$self->{BlockCount}...");
146 # Log that counting for the address has been started.
147 $logger->Log("debug", "Start counting for $address...");
150 $counthash{$address} = 1;
153 # Check if the address has reached the configured count limit.
154 if ($counthash{$address} >= $self->{BlockCount
}) {
155 # Write out log message.
156 $logger->Log("info", "Blocking $address for $self->{BlockTime} seconds...");
158 # Call block subroutine to block the address.
159 my $error = &CallBlock
($self, $address, $module, $message);
161 # Return the message if an error occurs.
165 # Everything worked well, return nothing.
170 ## The RemoveBlocks function.
172 ## This function periodly will be called and is responsible for releasing the block if the Blocktime
173 ## on an address has expired.
175 ## To do this, the code will loop through all entries of the blockhash and check
176 ## if the estimiated BlockTime of each address has reached and so the block can be released.
178 sub RemoveBlocks
() {
181 # Get the current time.
184 # Loop through the blockhash.
185 foreach my $address (keys %blockhash) {
186 # Check if the blocktime for the address has expired.
187 if ($blockhash{$address} <= $time) {
188 # Call unblock subroutine.
189 my $error = &CallUnblock
($self, $address, "BlockTime", "has expired for $address");
191 # Log error messages if returned.
193 $logger->Log("err", "$error");
198 # Everything okay, return nothing.
203 ## The CallBlock function.
205 ## This function is called, if the BlockCount for an address is reached or a direct
206 ## request for blocking an address has been recieved.
210 my ($address, $module, $message) = @_;
212 # Log the call for blocking an address.
213 $logger->Log("info", "$module - $message");
215 # Check if an entry for this address exists
216 # in the blockhash. If not, the address has
217 # not been blocked yet, call the responisible
218 # function to do this now.
219 unless (exists($blockhash{$address})) {
220 # Obtain the configured FirewallAction.
221 my $action = $self->{FirewallAction
};
223 # Block the given address.
224 my $error = &DoBlock
($address, $action);
226 # If we got back an error message something went wrong.
228 # Exit function and return the used FirewallEngine and the error message.
229 return "$self->{FirewallEngine} - $error";
231 # Address has been successfully blocked, print a log message.
232 $logger->Log("debug", "Address $address successfully has been blocked...");
236 # Generate time when the block will expire.
237 my $expire = time() + $self->{BlockTime
};
239 # Store the blocked address and the expire time
241 $blockhash{$address} = $expire;
243 # Return nothing "undef" if everything is okay.
248 ## CallUnblock function.
250 ## This function is responsible for unblocking and deleting a given
251 ## address from the blockhash.
253 sub CallUnblock
($) {
255 my ($address, $module, $message) = @_;
257 # Log the call for unblocking an address.
258 $logger->Log("info", "$module - $message");
260 # Return an error if no entry for the given address
261 # is present in the blockhash.
262 unless (exists($blockhash{$address})) {
263 return "Address $address was not blocked!";
266 # Unblock the address.
267 my $error = &DoUnblock
($address);
269 # If an error message is returned, something went wrong.
271 # Exit function and return the error message.
274 # Address successfully has been unblocked.
275 $logger->Log("debug", "Address $address successfully has been unblocked...");
278 # Drop address from blockhash.
279 delete ($blockhash{$address});
281 # Everything worked well, return nothing.
286 ## GenerateIgnoreList function.
288 ## This function is responsible for generating/updating the
289 ## IgnoreHash which contains all ignored IP addresses and
292 sub GenerateIgnoreList
($) {
295 # Check if the given IgnoreFile could be opened.
297 $logger->Log("err", "The configured IgnoreFile \($file\) could not be opened. Skipped!");
301 # Open the given IgnoreFile.
302 open (IGNORE
, $file);
304 # Read-in the file line by line.
312 # Remove any newlines.
315 # Check if the line contains a valid single address or network and
316 # convert it into binary format. Store the result/start and
317 # end values in a temporary array.
318 my @values = &Guardian
::Base
::IPOrNet2Int
($_);
320 # If the function returned any values, the line contained a valid
321 # single address or network which successfully has been converted into
324 # Assign the array as value to the ignorehash.
325 $ignorehash{$_} = [@values];
328 $logger->Log("err", "IgnoreFile contains an invalid address/network: $_");
335 # Close filehandle for the IgnoreFile.
340 ## Private function to check if an address is part of the Ignore Hash.
342 ## This function checks if a passed IP address in binary format (!),
343 ## directly or as part of an ignored network is stored in the ignore hash.
345 sub _IsOnIgnoreList
($) {
346 my $bin_address = shift;
348 # Loop through the ignore hash and grab the stored values.
349 foreach my $key ( keys %ignorehash ) {
350 # Dereference values array.
351 my @values = @
{$ignorehash{$key}};
353 # Obtain amount of items for the current value array.
354 my $items = scalar @values;
356 # Whether the amount equals one, the given binary address just
357 # needs to be compared against a single address.
359 my ($ignored_address) = @values;
361 # Simple check if the stored and the given binary address
363 if ($bin_address eq $ignored_address) {
364 # The given address is part of the ignore list.
365 $logger->Log("debug", "Address $key found on the ignore list.");
372 # If the amount equals two, for passed binary address needs to
373 # be checked if it is part of the ignored network range.
374 elsif ($items eq "2") {
375 my ($first_address, $last_address) = @values;
377 # Check if the passed binary address is bigger than
378 # the first address and smaler than the last address
379 # (between) the stored network range.
380 if (($bin_address >= $first_address) && ($bin_address <= $last_address)) {
381 # The address is part of an ignored network.
382 $logger->Log("debug", "Address is found inside the ignored network $key.");
388 # If the amount is not eighter one or two, the current entry of the ignorehash seems
389 # to be corrupted. Skip and log it.
391 # Write log message about this corruped item in the ignore hash.
392 $logger->Log("err", "Invalid item in the Ignore Hash: $key - @values");
394 # Skip this element of the ignore hash.
399 # If we got here, the given address is not part of the ignore hash.
400 # Return nothing (False).