summaryrefslogtreecommitdiff
path: root/tools/libltgrey.c
diff options
context:
space:
mode:
authorJohn Denker <jsd@av8n.com>2012-07-29 23:50:11 (GMT)
committerJohn Denker <jsd@av8n.com>2012-07-29 23:50:11 (GMT)
commitd2564d25e802d1ee3230cf045c4940e836b5c6a2 (patch)
treeddc7c3feac95d01ccb859596c21f218b122060c5 /tools/libltgrey.c
parent92280557b6bdde0b3e1d8fa93ba2fae494d5c355 (diff)
split ltgrey (and libltgrey) off from greylist;
put some utility functions into their own file.
Diffstat (limited to 'tools/libltgrey.c')
-rw-r--r--tools/libltgrey.c343
1 files changed, 343 insertions, 0 deletions
diff --git a/tools/libltgrey.c b/tools/libltgrey.c
new file mode 100644
index 0000000..d4ec0da
--- /dev/null
+++ b/tools/libltgrey.c
@@ -0,0 +1,343 @@
+#include <stdlib.h> /* for exit(), getenv() */
+#include <iostream>
+#include <iomanip>
+#include <string>
+
+#include <sys/types.h> /* for stat(), getaddrinfo() */
+#include <sys/stat.h> /* for stat() */
+#include <unistd.h> /* for stat() */
+#include <stdio.h> /* for perror */
+#include <errno.h> /* for ENOENT */
+#include <fstream> /* for ofstream() */
+#include <fcntl.h> /* for creat() */
+#include <sys/time.h> /* for gettimeofday() */
+#include <sstream> /* for stringstream */
+#include <signal.h> /* for kill(), SIGUSR1 */
+
+// requires apt-get install libboost-filesystem-dev:
+#include <boost/filesystem.hpp>
+
+#include <sys/socket.h> /* for getaddrinfo() */
+#include <netdb.h> /* for getaddrinfo() */
+#include <string.h> /* for memset() */
+#include <arpa/inet.h> /* for inet_ntop() */
+
+using namespace std;
+
+const int minute(60);
+const int hour(60*minute);
+const int day(24*hour);
+
+const int minimum_age(15*minute);
+const int maximum_age(32*day);
+const int probation(4*hour);
+
+#if 0
+void exeunt(const int sts){
+ if (sts == ex_good) exit(sts);
+
+#ifndef PENALIZE_SPAMMERS
+ if (sts == ex_penaltybox) exit(sts);
+#endif
+
+#ifndef KILL_GROUP
+ exit(sts);
+#endif
+
+ const char* foo = getenv("HI_Q_GROUP");
+ if (!foo) exit(sts);
+
+// No point in signalling ourself:
+ sighandler_t rslt = signal(SIGUSR1, SIG_IGN);
+ if (rslt == SIG_ERR) {
+ cerr << "error setting signal" << endl;
+ }
+ int k = kill(-atoi(foo), SIGUSR1);
+ if (k) {
+ cerr << "kill failed on group " << atoi(foo) << " ... ";
+ perror(0);
+ }
+ exit(sts);
+}
+#endif
+
+#include <sys/time.h> /* for gettimeofday */
+#include <iomanip> /* for setw */
+#include <unistd.h> /* for stat */
+#include <sys/types.h> /* for stat, creat */
+#include <sys/stat.h> /* for stat, creat */
+#include <fcntl.h> /* for creat */
+#include <fstream> /* for ofstream() */
+
+#include "libltgrey.h"
+#include "utils.h"
+#include "qq_exit_codes.h"
+
+void whatsit::dump(const string var){
+ char* str = getenv(var.c_str());
+ cerr << progname
+ << "[" << mypid << "] "
+ << var;
+ if (str) cerr << " is set to '" << str << "'" << endl;
+ else cerr << " is not set." << endl;
+}
+
+int whatsit::setup(){
+ stringstream foo;
+ foo << basename(progname) << suffix
+ << "[" << mypid << "]";
+ progid = foo.str();
+
+ ipvar = getenv("TCPREMOTEIP");
+ if (ipvar) ipbase = ipvar;
+ hostvar = getenv("TCPREMOTEHOST");
+ if (hostvar) hostname = hostvar;
+ return 0;
+}
+
+void whatsit::update(const string msg, const timeval new_mod,
+ const timeval new_ac, const int penalty, const int stain){
+ if (verbosity){
+ if (penalty || stain || verbosity>1) cerr << progid << ": ";
+ if (penalty) cerr << " penalty " << penalty;
+ if (stain) cerr << " stain " << stain;
+ if (verbosity > 1) {
+ if (penalty || stain) cerr << "+"; // separation, punctuation
+ cerr << msg << ": " << ipbase;
+ if (hostname.length()) cerr << " " << hostname;
+ cerr << " mod_age: " << time_out(mod_age)
+ << " ac_age: " << time_out(ac_age);
+ }
+ cerr << endl;
+ }
+ timeval pen_mod(new_mod);
+ timeval stain_ac(new_ac);
+ if (penalty) {
+ pen_mod = now;
+ pen_mod.tv_sec += penalty;
+ }
+ if (stain) {
+ stain_ac = now;
+ stain_ac.tv_sec -= stain;
+ }
+ timeval upd[2] = {
+// beware: access illogically comes *before* modification here:
+ stain_ac,
+ pen_mod
+ };
+ if (utimes(ipname.c_str(), upd))
+ cerr << "oops" << endl;
+}
+
+int whatsit::doit(const int penalty, const int stain){
+
+ if (!ipvar) {
+ cerr << progid
+ << " TCPREMOTEIP not set???" << endl;
+ // should never happen
+ // although you can make it happen using a weird test-harness
+ return(ex_syserr);
+ }
+
+// see if our directory exists:
+ struct stat dirstat;
+ int rslt = stat(dirname.c_str(), &dirstat);
+ if (rslt != 0){
+ if (errno != ENOENT) {
+ cerr << progid << ": stat failed for '"
+ << dirname << "' : ";
+ perror(0);
+ }
+ rslt = mkdir(dirname.c_str(), 0755);
+ if (rslt != 0) {
+ cerr << progid
+ << "uid " << getuid()
+ << ": mkdir failed for '"
+ << dirname << "' : ";
+ perror(0);
+ return(ex_syserr);
+ }
+ }
+
+ ipname = dirname + "/" + ipbase;
+ struct stat ipstat;
+ rslt = stat(ipname.c_str(), &ipstat);
+ if (rslt != 0){
+ if (errno != ENOENT) {
+ cerr << progid << ": stat failed for '"
+ << ipname << "' : ";
+ perror(0);
+ }
+ ofstream foo;
+ int fd = creat(ipname.c_str(), 0644);
+ if (fd < 0){
+ cerr << progid << ": create failed for '"
+ << ipname << "' : ";
+ perror(0);
+ }
+ close(fd);
+ update("new customer", now, now, penalty, stain);
+ return(ex_greylisting);
+ }
+
+// now for really checking the greylist status:
+ mod_age = now.tv_sec - ipstat.st_mtime;
+ ac_age = now.tv_sec - ipstat.st_atime;
+ timeval mod_orig = {ipstat.st_mtime, 0};
+ if (mod_age < 0) {
+ update("penalty box", mod_orig, now, penalty, stain);
+ return(ex_penaltybox);
+ }
+ if (mod_age < ac_age){
+// when he comes out on parole, he starts over with no reputation:
+ update("paroled spammer", now, now, penalty, stain);
+ return(ex_greylisting);
+ }
+ if (mod_age < minimum_age) {
+ update("early bird", mod_orig, now, penalty, stain);
+ return(ex_greylisting);
+ }
+ if (mod_age - ac_age < minimum_age // early bird, or completely unused
+ && mod_age > probation) { // did not diligently resubmit
+ update("disprobation", now, now, penalty, stain);
+ return(ex_greylisting);
+ }
+ if (ac_age > maximum_age) {
+ update("too old, starting over", now, now, penalty, stain);
+ return(ex_greylisting);
+ }
+// if all checks are passed, must be OK:
+ update("returning customer", mod_orig, now, penalty, stain);
+ return 0;
+}
+
+typedef vector<unsigned char> VU;
+
+class VUx{
+public:
+ VU addr;
+ sa_family_t fam;
+ string str();
+};
+
+string VUx::str(){
+ char msgbuf[INET6_ADDRSTRLEN];
+ const char* rslt = inet_ntop(fam, &addr[0],
+ msgbuf, sizeof(msgbuf));
+ if (!rslt) rslt = "";
+ return rslt;
+}
+
+VUx parse_sockaddr(const sockaddr* ai_addr) {
+ void* numericAddress;
+ VUx rslt;
+ int addrsize;
+ rslt.addr = VU(0);
+ rslt.fam = ((sockaddr *)ai_addr)->sa_family;
+ switch (rslt.fam) {
+ case AF_INET:
+ numericAddress = &(((sockaddr_in *)ai_addr)->sin_addr.s_addr);
+ addrsize = sizeof(in_addr);
+ break;
+ case AF_INET6:
+ numericAddress = &(((sockaddr_in6 *)ai_addr)->sin6_addr.s6_addr);
+ addrsize = sizeof(in6_addr);
+ break;
+ default:
+ cerr << "?Unknown address family " << rslt.fam << endl;
+ return rslt;
+ }
+ unsigned char* foo = (unsigned char*) numericAddress;
+ rslt.addr = VU(foo, foo+addrsize);
+ return rslt;
+}
+
+int diff(const VU aaa, const VU bbb){
+ if(aaa.size() != bbb.size()) return 1;
+ for (unsigned int ii=0; ii < aaa.size(); ii++){
+ if (aaa[ii] != bbb[ii]) return 1;
+ }
+ return 0;
+}
+
+int whatsit::check_dns(){
+ string addr("()"), host("()");
+ vector<string> checked;
+ int sts = check_dns_sub(addr, host, checked);
+ if (sts == 0) return sts;
+ if (sts != ex_badDNS) return sts; // possible ex_syserr
+#if 1
+ sts = 0; // demote badDNS to just a warning
+#endif
+ cerr << progid;
+ if (!sts) cerr << " (warning)";
+ cerr << " DNS inconsistency: "
+ << addr << " --> "
+ << host << " ==>";
+ if (!checked.size()) cerr << " ()";
+ else for (vector<string>::const_iterator chk = checked.begin();
+ chk != checked.end(); chk++) cerr << " " << *chk;
+ cerr << endl;
+
+ return sts;
+}
+
+int whatsit::check_dns_sub(string &addr, string &host, vector<string> &checked){
+
+ struct addrinfo *result;
+ struct addrinfo *ipresult;
+ struct addrinfo *res;
+ addrinfo hints;
+ int error;
+
+ memset(&hints, 0, sizeof(struct addrinfo));
+#if 1
+ // restrict to TCP only; otherwise we get N records per address
+ hints.ai_protocol = IPPROTO_TCP;
+#endif
+
+ error = getaddrinfo(ipvar, NULL, &hints, &ipresult);
+ if (error == EAI_NONAME) return ex_badDNS;
+ if (error) { // some unexpected error
+ cerr << progid
+ << " odd error " << error
+ << " in getaddrinfo for " << ipvar
+ << " : " << gai_strerror(error) << endl;
+ return ex_syserr;
+ }
+ if (!ipresult) {
+ cerr << "should never happen (addr with no addrs?)" << endl;
+ return ex_syserr;
+ }
+ VUx ipAddr = parse_sockaddr(ipresult->ai_addr);
+ addr = ipAddr.str();
+
+ char* hostvar = getenv("TCPREMOTEHOST");
+ if (hostvar) host = hostvar;
+ else return(ex_badDNS);
+
+ error = getaddrinfo(hostvar, NULL, &hints, &result);
+ if (error == EAI_NONAME) return ex_badDNS;
+ if (error) {
+ cerr << progid
+ << " error " << error
+ << " compare " << EAI_NONAME
+ << " in getaddrinfo for " << ipvar
+ << " :: " << gai_strerror(error) << endl;
+ return ex_syserr;
+ }
+
+// loop over all returned results and check for a match.
+ for (res = result; res != NULL; res = res->ai_next){
+ VUx hostAddr = parse_sockaddr(res->ai_addr);
+ checked.push_back(hostAddr.str());
+ if (!diff(hostAddr.addr, ipAddr.addr)) {
+ ///// cerr << "match! " << ipAddr.addr.size() << endl;
+ goto done;
+ }
+ }
+ return ex_badDNS;
+
+done:
+ return 0;
+}