ip.c

Go to the documentation of this file.

/*----------------------------------------------------------------------------
 secwatch - Copyright (C) 2006 Nic Stevens -- See COPYING for license details
------------------------------------------------------------------------------
 ip.c - Ip list management functions
  
  The IP list is a list of IPs that have been detected through log analysis as 
  potential hazards. Once a potential has been detected it is tracked with a 
  hit count and a timestamp. Each time the hit count is updated the timestamp 
  is updated too. If the hit count reaches maxatt then the IP is "banned" 
  using the configured firewall rules. 
  If the the current_time - timestamp > maxage minutes then the IP is removed
  from the list. When an offending IP is re-enabled it remains on the list with 
  a fresh timestamp. It will either be removed after a timeout or re-blocked
  after fresh attempts.
-----------------------------------------------------------------------------*/
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <errno.h>
#include "log.h"
#include "strutil.h"
#include "tail.h"
#include "configfile.h"

typedef struct _ipinfo {
     char ip[32];
     int hitcount;
     int isdropped;
     time_t timein;
} ipinfo_t;


ipinfo_t *iplist = NULL;
int ipcnt = 0;
int ipDeleteFlag = 0;

int loadIpList(void) {
     struct stat _st, *s = &_st;
     int cnt;
     char * filename = NULL;
     FILE *f;
     if(filename == NULL) 
          filename = confVarPath("iplist",&cnt);
     if(stat(filename,s) != 0) {
          writeLog("Cannot stat %s: %m",filename);
          return -1;
     }
     cnt = s->st_size / sizeof(ipinfo_t);
     if((iplist = malloc(s->st_size)) == NULL) {
          fprintf(stderr,"Cannot allocate space for iplist: %m\n");
          exit(-1);
     }
     if((f = fopen(filename,"r")) == NULL) {
          fprintf(stderr,"Cannot open iplist: %m\n");
          exit(-1);
     }
     fread(iplist,sizeof(ipinfo_t),cnt,f);
     fclose(f);
     ipcnt = cnt;
     return 0;
}
int writeIpList(void) {
     FILE *f;
     char *filename = NULL;
     int i;
     if(filename == NULL) 
          filename = confVarPath("iplist",&i);
     if((f = fopen(filename,"w")) == NULL) {
          fprintf(stderr,"Cannot open iplist: %m\n");
          exit(-1);
     }
     fwrite(iplist,sizeof(ipinfo_t),ipcnt,f);
     fclose(f);
     return 0;
}
int deleteIp(char *ip) {
     int i;
     if((i = ipEntry(ip)) != -1) {
          bzero(iplist[i].ip,sizeof(iplist[i].ip));
          iplist[i].timein = (time_t)-1;
          ipDeleteFlag = 1;
          return 0;
     }
     return -1;
}
int compactIpList() {
     ipinfo_t *nlist;
     int i, ncnt = 0;
     if((nlist = calloc(sizeof(ipinfo_t),ipcnt)) == NULL) {
          writeLog("Cannot allocate space for compaction %m");
          return -1;
     }
     for(i = 0; i < ipcnt; i++) 
          if(iplist[i].timein != -1) 
               nlist[ncnt++] = iplist[i];
     if((nlist = realloc(nlist,(sizeof(ipinfo_t)*ncnt))) == NULL) {
          writeLog("Cannot allocate space for compaction %m");
          return -1;
     }
     free(iplist);
     iplist = nlist;
     ipDeleteFlag = 0;
}
int ipadd(char *ip) {
     ipinfo_t ipi;
     int ipn;
     strcpy(ipi.ip,ip);
     time(&ipi.timein);
     ipi.hitcount = 1;
     ipi.isdropped = 0;
     ipn = ipcnt++;
     if((iplist = realloc(iplist,(sizeof(ipinfo_t)*ipcnt))) == NULL) {
          writeLog("Cannot allocate ip member");
          return -1;
     }
     iplist[ipn] = ipi;
     writeIpList();
     return 0;
}
int ipEntry(char *ip) {
     int i;
     for(i = 0; i < ipcnt; i++) 
          if(strcmp(iplist[i].ip,ip) == 0)
               return i;
     errno = ENOENT;
     return -1;
}
void incrementHitCount(char *ip) {
     int i;
     if((i = ipEntry(ip)) != -1)
          iplist[i].hitcount ++;
     else
          ipadd(ip);
     time(&iplist[i].timein);
     writeIpList();
}
void ipManage(void) {
     int i;
     time_t now;
     static int maxatt = -1;
     static int maxsecs = -1;
     
     if(maxatt == -1) 
          maxatt=confVarInt("maxatt",&i);
     if(maxsecs == -1) 
          maxsecs = confVarInt("maxage",&i) * 60;
     time(&now);
     for(i = 0; i < ipcnt; i++) {
          if(iplist[i].isdropped == 0 && iplist[i].hitcount >= maxatt) 
               dropIp(i);
          else if((now - iplist[i].timein) >= maxsecs)
               undropIp(i);
     }
     if(ipDeleteFlag) 
          compactIpList();
     writeIpList();
}
char * replaceIp(char *buf, char *ip) {
     char *tmp, *p;
     int i;
     tmp = alloca(strlen(buf)+strlen(ip)+2);
     if((i = strpos(buf,"$i")) == -1) 
          return NULL;
     p = &buf[i];
     p+= 2;
     strncpy(tmp,buf,i);
     strcat(tmp,ip);
     strcat(tmp,p);
     return strdup(tmp);
}
int dropIp(int ind) {
     ipinfo_t *ip = &iplist[ind];
     char * s;
     char ** dropRules = NULL;
     int i, x;
     
     if(dropRules == NULL) 
          dropRules = confVarFlist("fwreject",&i);
     
     for(i = 0; i < count(dropRules); i++) {
          s = replaceIp(confVarText(dropRules[i],&x),ip->ip);
          system(s);
          free(s);
     }
     ip->isdropped = 1;
     time(&ip->timein);
     writeIpList();
     inform("secwatch dropped IP %s",ip->ip);
     return 0;
}
int undropIp(int ind) {
     ipinfo_t *ip = &iplist[ind];
     char * s;
     char ** allowRules = NULL;
     int i, x;
     if(allowRules == NULL) 
          allowRules = confVarFlist("fwallow",&i);
     if(ip->isdropped) {
          for(i = 0; i < count(allowRules); i++) {
               s = replaceIp(confVarText(allowRules[i],&x),ip->ip);
               system(s);
               free(s);
          }
          ip->isdropped = 0;
          inform("secwatch undropped IP %s",ip->ip);
          time(&ip->timein);
     } else 
          deleteIp(ip->ip);
     writeIpList();
     return 0;
}

---