PacketBL
Check-in [2dad03cf84]
Login
HomeTimelineFilesBranchesTagsTicketsWiki
Overview
Comment:move include stuff to the include file. add new include file for packetbl_getstat
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA1: 2dad03cf8488ad13a37c62d9d3f77d4cd22e31ed
User & Date: rmiller on 2011-03-06 17:33:29
Other Links: manifest | tags
Context
2011-03-06
17:45
change version, documentation fixes to avoid misleading. check-in: 6d6dfd2faa user: rmiller tags: trunk
17:33
move include stuff to the include file. add new include file for packetbl_getstat check-in: 2dad03cf84 user: rmiller tags: trunk
17:18
This has been verified to work, at least on a quick test. Need to test more thoroughly. Good for a beta release, anyway. check-in: 697a450bd4 user: rmiller tags: trunk
Changes
Hide Diffs Unified Diffs Ignore Whitespace Patch

Modified autom4te.cache/output.0 from [c36152d6d3] to [0675b2e82e].

︙︙
3969
3970
3971
3972
3973
3974
3975

3976
3977
3978
3979
3980
3981
3982

$as_echo "$ac_cv_lib_netfilter_queue_nfq_set_verdict" >&6; }
if test "x$ac_cv_lib_netfilter_queue_nfq_set_verdict" = x""yes; then :
  
	
$as_echo "@%:@define HAVE_NFQUEUE /**/" >>confdefs.h

	LIBS="$LIBS -lnetfilter_queue"

	have_nfqueue='yes'

fi


if test "$have_nfqueue" != 'yes'; then
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5








>








3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983

$as_echo "$ac_cv_lib_netfilter_queue_nfq_set_verdict" >&6; }
if test "x$ac_cv_lib_netfilter_queue_nfq_set_verdict" = x""yes; then :
  
	
$as_echo "@%:@define HAVE_NFQUEUE /**/" >>confdefs.h

	LIBS="$LIBS -lnetfilter_queue"
	INCLUDES="$INCLUDES -I/usr/include/libnetfilter_queue"
	have_nfqueue='yes'

fi


if test "$have_nfqueue" != 'yes'; then
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
︙︙

Modified autom4te.cache/requests from [7956dc4e38] to [837bb9279c].

︙︙
11
12
13
14
15
16
17

18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

51
52
53
54

55
56
57
58
59

60
61
62
63
64
65
66

                      ],
                      [
                        '/usr/share/autoconf/autoconf/autoconf.m4f',
                        'aclocal.m4',
                        'configure.in'
                      ],
                      {

                        'AM_PROG_F77_C_O' => 1,
                        '_LT_AC_TAGCONFIG' => 1,
                        'm4_pattern_forbid' => 1,
                        'AC_INIT' => 1,
                        '_AM_COND_IF' => 1,
                        'AC_CANONICAL_TARGET' => 1,
                        'AC_CONFIG_LIBOBJ_DIR' => 1,
                        'AC_SUBST' => 1,
                        'AC_CANONICAL_HOST' => 1,
                        'AC_FC_SRCEXT' => 1,
                        'AC_PROG_LIBTOOL' => 1,
                        'AM_INIT_AUTOMAKE' => 1,
                        'AC_CONFIG_SUBDIRS' => 1,
                        'AM_AUTOMAKE_VERSION' => 1,
                        'LT_CONFIG_LTDL_DIR' => 1,

                        'AC_REQUIRE_AUX_FILE' => 1,
                        'AC_CONFIG_LINKS' => 1,
                        'LT_SUPPORTED_TAG' => 1,
                        'm4_sinclude' => 1,
                        'AM_MAINTAINER_MODE' => 1,
                        'AM_GNU_GETTEXT_INTL_SUBDIR' => 1,
                        '_m4_warn' => 1,
                        'AM_PROG_CXX_C_O' => 1,
                        '_AM_COND_ENDIF' => 1,
                        'AM_ENABLE_MULTILIB' => 1,
                        'AM_SILENT_RULES' => 1,
                        'AC_CONFIG_FILES' => 1,
                        'include' => 1,
                        'LT_INIT' => 1,
                        'AM_GNU_GETTEXT' => 1,
                        'AC_LIBSOURCE' => 1,
                        'AM_PROG_FC_C_O' => 1,
                        'AC_CANONICAL_BUILD' => 1,

                        'AC_FC_FREEFORM' => 1,
                        'AH_OUTPUT' => 1,
                        '_AM_SUBST_NOTMAKE' => 1,
                        'AC_CONFIG_AUX_DIR' => 1,

                        'AM_PROG_CC_C_O' => 1,
                        'm4_pattern_allow' => 1,
                        'sinclude' => 1,
                        'AM_CONDITIONAL' => 1,
                        'AC_CANONICAL_SYSTEM' => 1,

                        'AC_CONFIG_HEADERS' => 1,
                        'AC_DEFINE_TRACE_LITERAL' => 1,
                        'm4_include' => 1,
                        '_AM_COND_ELSE' => 1,
                        'AC_SUBST_TRACE' => 1
                      }
                    ], 'Autom4te::Request' )








>

|

|

|

|

<





>

|

<












<

>


<

>
|

|
<

>








11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

28
29
30
31
32
33
34
35
36

37
38
39
40
41
42
43
44
45
46
47
48

49
50
51
52

53
54
55
56
57

58
59
60
61
62
63
64
65
66

                      ],
                      [
                        '/usr/share/autoconf/autoconf/autoconf.m4f',
                        'aclocal.m4',
                        'configure.in'
                      ],
                      {
                        '_LT_AC_TAGCONFIG' => 1,
                        'AM_PROG_F77_C_O' => 1,
                        'AC_INIT' => 1,
                        'm4_pattern_forbid' => 1,
                        'AC_CANONICAL_TARGET' => 1,
                        '_AM_COND_IF' => 1,
                        'AC_SUBST' => 1,
                        'AC_CONFIG_LIBOBJ_DIR' => 1,
                        'AC_FC_SRCEXT' => 1,
                        'AC_CANONICAL_HOST' => 1,

                        'AC_PROG_LIBTOOL' => 1,
                        'AM_INIT_AUTOMAKE' => 1,
                        'AC_CONFIG_SUBDIRS' => 1,
                        'AM_AUTOMAKE_VERSION' => 1,
                        'LT_CONFIG_LTDL_DIR' => 1,
                        'AC_CONFIG_LINKS' => 1,
                        'AC_REQUIRE_AUX_FILE' => 1,
                        'm4_sinclude' => 1,
                        'LT_SUPPORTED_TAG' => 1,

                        'AM_MAINTAINER_MODE' => 1,
                        'AM_GNU_GETTEXT_INTL_SUBDIR' => 1,
                        '_m4_warn' => 1,
                        'AM_PROG_CXX_C_O' => 1,
                        '_AM_COND_ENDIF' => 1,
                        'AM_ENABLE_MULTILIB' => 1,
                        'AM_SILENT_RULES' => 1,
                        'AC_CONFIG_FILES' => 1,
                        'include' => 1,
                        'LT_INIT' => 1,
                        'AM_GNU_GETTEXT' => 1,
                        'AC_LIBSOURCE' => 1,

                        'AC_CANONICAL_BUILD' => 1,
                        'AM_PROG_FC_C_O' => 1,
                        'AC_FC_FREEFORM' => 1,
                        'AH_OUTPUT' => 1,

                        'AC_CONFIG_AUX_DIR' => 1,
                        '_AM_SUBST_NOTMAKE' => 1,
                        'sinclude' => 1,
                        'm4_pattern_allow' => 1,
                        'AM_PROG_CC_C_O' => 1,

                        'AC_CANONICAL_SYSTEM' => 1,
                        'AM_CONDITIONAL' => 1,
                        'AC_CONFIG_HEADERS' => 1,
                        'AC_DEFINE_TRACE_LITERAL' => 1,
                        'm4_include' => 1,
                        '_AM_COND_ELSE' => 1,
                        'AC_SUBST_TRACE' => 1
                      }
                    ], 'Autom4te::Request' )
︙︙

Modified autom4te.cache/traces.0 from [bad0bba9bc] to [a60c0f7b2c].

︙︙
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428

m4trace:configure.in:49: -1- m4_pattern_allow([^HAVE_LIBCONFIG$])
m4trace:configure.in:49: -1- AH_OUTPUT([HAVE_LIBCONFIG], [/* Enable if you have the required libconfig library. */
@%:@undef HAVE_LIBCONFIG])
m4trace:configure.in:56: -1- AC_DEFINE_TRACE_LITERAL([HAVE_NFQUEUE])
m4trace:configure.in:56: -1- m4_pattern_allow([^HAVE_NFQUEUE$])
m4trace:configure.in:56: -1- AH_OUTPUT([HAVE_NFQUEUE], [/* Enable if you have nfqueue */
@%:@undef HAVE_NFQUEUE])
m4trace:configure.in:66: -1- AC_DEFINE_TRACE_LITERAL([HAVE_NFNETLINK])
m4trace:configure.in:66: -1- m4_pattern_allow([^HAVE_NFNETLINK$])
m4trace:configure.in:66: -1- AH_OUTPUT([HAVE_NFNETLINK], [/* Enable if netlink exists */
@%:@undef HAVE_NFNETLINK])
m4trace:configure.in:79: -1- AC_DEFINE_TRACE_LITERAL([HAVE_FIREDNS])
m4trace:configure.in:79: -1- m4_pattern_allow([^HAVE_FIREDNS$])
m4trace:configure.in:79: -1- AH_OUTPUT([HAVE_FIREDNS], [/* Enable if you have the optional firedns library */
@%:@undef HAVE_FIREDNS])
m4trace:configure.in:92: -1- AC_DEFINE_TRACE_LITERAL([USE_CACHE])
m4trace:configure.in:92: -1- m4_pattern_allow([^USE_CACHE$])
m4trace:configure.in:92: -1- AH_OUTPUT([USE_CACHE], [/* Enable if you want to use a caching mechanism. */
@%:@undef USE_CACHE])
m4trace:configure.in:97: -1- AC_CONFIG_FILES([Makefile])
m4trace:configure.in:98: -1- AC_CONFIG_HEADERS([config.h])
m4trace:configure.in:99: -1- AC_SUBST([LIB@&t@OBJS], [$ac_libobjs])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([LIB@&t@OBJS])
m4trace:configure.in:99: -1- m4_pattern_allow([^LIB@&t@OBJS$])
m4trace:configure.in:99: -1- AC_SUBST([LTLIBOBJS], [$ac_ltlibobjs])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([LTLIBOBJS])
m4trace:configure.in:99: -1- m4_pattern_allow([^LTLIBOBJS$])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([top_builddir])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([top_build_prefix])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([srcdir])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([abs_srcdir])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([top_srcdir])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([abs_top_srcdir])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([builddir])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([abs_builddir])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([abs_top_builddir])
m4trace:configure.in:99: -1- AC_SUBST_TRACE([INSTALL])








|
|
|

|
|
|

|
|
|

|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|

392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428

m4trace:configure.in:49: -1- m4_pattern_allow([^HAVE_LIBCONFIG$])
m4trace:configure.in:49: -1- AH_OUTPUT([HAVE_LIBCONFIG], [/* Enable if you have the required libconfig library. */
@%:@undef HAVE_LIBCONFIG])
m4trace:configure.in:56: -1- AC_DEFINE_TRACE_LITERAL([HAVE_NFQUEUE])
m4trace:configure.in:56: -1- m4_pattern_allow([^HAVE_NFQUEUE$])
m4trace:configure.in:56: -1- AH_OUTPUT([HAVE_NFQUEUE], [/* Enable if you have nfqueue */
@%:@undef HAVE_NFQUEUE])
m4trace:configure.in:67: -1- AC_DEFINE_TRACE_LITERAL([HAVE_NFNETLINK])
m4trace:configure.in:67: -1- m4_pattern_allow([^HAVE_NFNETLINK$])
m4trace:configure.in:67: -1- AH_OUTPUT([HAVE_NFNETLINK], [/* Enable if netlink exists */
@%:@undef HAVE_NFNETLINK])
m4trace:configure.in:80: -1- AC_DEFINE_TRACE_LITERAL([HAVE_FIREDNS])
m4trace:configure.in:80: -1- m4_pattern_allow([^HAVE_FIREDNS$])
m4trace:configure.in:80: -1- AH_OUTPUT([HAVE_FIREDNS], [/* Enable if you have the optional firedns library */
@%:@undef HAVE_FIREDNS])
m4trace:configure.in:93: -1- AC_DEFINE_TRACE_LITERAL([USE_CACHE])
m4trace:configure.in:93: -1- m4_pattern_allow([^USE_CACHE$])
m4trace:configure.in:93: -1- AH_OUTPUT([USE_CACHE], [/* Enable if you want to use a caching mechanism. */
@%:@undef USE_CACHE])
m4trace:configure.in:98: -1- AC_CONFIG_FILES([Makefile])
m4trace:configure.in:99: -1- AC_CONFIG_HEADERS([config.h])
m4trace:configure.in:100: -1- AC_SUBST([LIB@&t@OBJS], [$ac_libobjs])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([LIB@&t@OBJS])
m4trace:configure.in:100: -1- m4_pattern_allow([^LIB@&t@OBJS$])
m4trace:configure.in:100: -1- AC_SUBST([LTLIBOBJS], [$ac_ltlibobjs])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([LTLIBOBJS])
m4trace:configure.in:100: -1- m4_pattern_allow([^LTLIBOBJS$])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([top_builddir])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([top_build_prefix])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([srcdir])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([abs_srcdir])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([top_srcdir])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([abs_top_srcdir])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([builddir])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([abs_builddir])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([abs_top_builddir])
m4trace:configure.in:100: -1- AC_SUBST_TRACE([INSTALL])

Modified configure from [568f3e906e] to [e5605732f1].

︙︙
3969
3970
3971
3972
3973
3974
3975

3976
3977
3978
3979
3980
3981
3982

$as_echo "$ac_cv_lib_netfilter_queue_nfq_set_verdict" >&6; }
if test "x$ac_cv_lib_netfilter_queue_nfq_set_verdict" = x""yes; then :


$as_echo "#define HAVE_NFQUEUE /**/" >>confdefs.h

	LIBS="$LIBS -lnetfilter_queue"

	have_nfqueue='yes'

fi


if test "$have_nfqueue" != 'yes'; then
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5








>








3969
3970
3971
3972
3973
3974
3975
3976
3977
3978
3979
3980
3981
3982
3983

$as_echo "$ac_cv_lib_netfilter_queue_nfq_set_verdict" >&6; }
if test "x$ac_cv_lib_netfilter_queue_nfq_set_verdict" = x""yes; then :


$as_echo "#define HAVE_NFQUEUE /**/" >>confdefs.h

	LIBS="$LIBS -lnetfilter_queue"
	INCLUDES="$INCLUDES -I/usr/include/libnetfilter_queue"
	have_nfqueue='yes'

fi


if test "$have_nfqueue" != 'yes'; then
	{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
︙︙

Modified configure.in from [39f7f4ab4f] to [9fdd4c91b3].

︙︙
52
53
54
55
56
57
58

59
60
61
62
63
64
65

], [
	AC_MSG_FAILURE([You must have libconfig])
])

AC_CHECK_LIB(netfilter_queue, nfq_set_verdict, [
	AC_DEFINE(HAVE_NFQUEUE, [], [Enable if you have nfqueue])
	LIBS="$LIBS -lnetfilter_queue"

	have_nfqueue='yes'
])

if test "$have_nfqueue" != 'yes'; then
	AC_MSG_FAILURE([nfqueue was not found.])
fi









>








52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

], [
	AC_MSG_FAILURE([You must have libconfig])
])

AC_CHECK_LIB(netfilter_queue, nfq_set_verdict, [
	AC_DEFINE(HAVE_NFQUEUE, [], [Enable if you have nfqueue])
	LIBS="$LIBS -lnetfilter_queue"
	INCLUDES="$INCLUDES -I/usr/include/libnetfilter_queue"
	have_nfqueue='yes'
])

if test "$have_nfqueue" != 'yes'; then
	AC_MSG_FAILURE([nfqueue was not found.])
fi
︙︙

Modified packetbl.c from [939b1038a8] to [e9253f6863].

︙︙
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202


    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/

#include "packetbl.h"
#include <stdlib.h>
#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <resolv.h>
#include <netdb.h>
#include <ctype.h>
#include <syslog.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <string.h>
#include <unistd.h>
#include <getopt.h>
#include <time.h>
#include <errno.h>
#include <linux/netfilter.h>
#include <libconfig.h>

#ifdef USE_SOCKSTAT
#include <sys/socket.h>
#include <sys/un.h>
#include <pthread.h>
#endif

#ifdef HAVE_FIREDNS
#include <firedns.h>
#endif

#ifndef BUFFERSIZE
#define BUFFERSIZE 65536
#endif
#ifdef USE_CACHE
#  ifndef USE_CACHE_DEF_LEN
#    define USE_CACHE_DEF_LEN 8192
#  endif
#  ifndef USE_CACHE_DEF_TTL
#    define USE_CACHE_DEF_TTL 3600
#  endif
#endif

#  define TH_FIN        0x01
#  define TH_SYN        0x02
#  define TH_RST        0x04
#  define TH_PUSH       0x08
#  define TH_ACK        0x10
#  define TH_URG        0x20

# include <libnetfilter_queue.h>
# define SET_VERDICT nfq_set_verdict
# define PBL_HANDLE nfq_q_handle
# define PBL_SET_MODE nfq_set_mode
# define PBL_COPY_PACKET NFQNL_COPY_PACKET
# define PBL_ID_T u_int32_t
# define PBL_ERRSTR ""

#define DEBUG(x, y) if (conf.debug >= x) { printf(y "\n"); }
#define INVALID_OCTET(x) x < 0 || x > 255

struct packet_info {

	uint8_t b1;
	uint8_t b2;
	uint8_t b3;
	uint8_t b4;

	unsigned int s_port;
	unsigned int d_port;

	int flags;
};

struct cidr {

	uint32_t ip;
	uint32_t network;
	uint32_t processed;		/* network, but as a bitmask */

};

struct config_entry {

	char *string;
	struct config_entry *next;
	struct packet_info ip;
	struct cidr	cidr;

};

char msgbuf[BUFFERSIZE];

struct config {
	int	allow_non25;
	int	allow_nonsyn;
	int	default_accept;
	int	dryrun;
	int 	log_facility;
	int	queueno;
	int	quiet;
	int	debug;
	struct config_entry *blacklistbl;
	struct config_entry *whitelistbl;
	struct config_entry *blacklist;
	struct config_entry *whitelist;
};

static struct config conf = { 0, 0, 1, 0, LOG_DAEMON, 1, 0, 0, NULL, NULL, NULL, NULL };

struct pbl_stat_info {
	uint32_t	cacheaccept;
	uint32_t	cachereject;
	uint32_t	whitelistblhits;
	uint32_t	blacklistblhits;
	uint32_t	whitelisthits;
	uint32_t	blacklisthits;
	uint32_t	fallthroughhits;
	uint32_t	totalpackets;
};
static struct pbl_stat_info statistics = { 0, 0, 0, 0, 0, 0, 0 };

#ifdef USE_CACHE
struct packet_cache_t {
	uint32_t ipaddr;
	time_t	expires;
	int	action;
};
struct packet_cache_t *packet_cache = NULL;
uint32_t packet_cache_len = USE_CACHE_DEF_LEN;
uint16_t packet_cache_ttl = USE_CACHE_DEF_TTL;
#endif

struct config_entry *hostlistcache = NULL;

int get_packet_info(char *payload, struct packet_info *ip);

int check_packet_list(const struct packet_info *ip, struct config_entry *list);
int check_packet_dnsbl(const struct packet_info *ip, struct config_entry *list);
int parse_cidr(struct config_entry *ce);
/* int validate_blacklist(char *); */
void parse_config(void);
void parse_arguments(int argc, char **argv);
void pbl_init_sockstat(void);
static void get_ip_string(const struct packet_info *ip);
static void pbl_set_verdict(struct PBL_HANDLE *h, PBL_ID_T id,
        unsigned int verdict);

static int pbl_callback(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
	struct nfq_data *nfa, void *data);
	
typedef struct facility {
	char *string;
	int num;
} facility;

static struct facility facenum[] = {
	{"auth", LOG_AUTH},
	{"authpriv", LOG_AUTHPRIV},
	{"cron", LOG_CRON},
	{"daemon", LOG_DAEMON},
	{"kern", LOG_KERN},
	{"lpr", LOG_LPR},
	{"mail", LOG_MAIL},
	{"news", LOG_NEWS},
	{"syslog", LOG_SYSLOG},
	{"user", LOG_USER},
	{"uucp", LOG_UUCP},
	{"local0", LOG_LOCAL0},
	{"local1", LOG_LOCAL1},
	{"local2", LOG_LOCAL2},
	{"local3", LOG_LOCAL3},
	{"local4", LOG_LOCAL4},
	{"local5", LOG_LOCAL5},
	{"local6", LOG_LOCAL6},
	{"local7", LOG_LOCAL7},
	NULL
};

/*
 * SYNOPSIS:
 *   void daemonize(void);
 *
 * NOTES:
 *   This function accomplishes everything needed to become a daemon.








<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<
<








12
13
14
15
16
17
18

















































































































































































19
20
21
22
23
24
25


    You should have received a copy of the GNU General Public License
    along with this program; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
*/

#include "packetbl.h"


















































































































































































/*
 * SYNOPSIS:
 *   void daemonize(void);
 *
 * NOTES:
 *   This function accomplishes everything needed to become a daemon.
︙︙

Modified packetbl.h from [e61fbc9557] to [04dd1a732b]. 

1
2
3





















4
5
6
7
8
9
10
11
12
13






























































































































































14

#ifndef LOCAL_PACKETBL_H
#  define LOCAL_PACKETBL_H






















#  ifdef HAVE_CONFIG_H
#    include "config.h"
#  endif

#  ifdef USE_SOCKSTAT
#    ifndef SOCKSTAT_PATH
#      define SOCKSTAT_PATH "/tmp/.packetbl.sock"
#    endif
#  endif































































































































































#endif




>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>










>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193

#ifndef LOCAL_PACKETBL_H
#  define LOCAL_PACKETBL_H

#include <stdlib.h>
#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <resolv.h>
#include <netdb.h>
#include <ctype.h>
#include <syslog.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <string.h>
#include <unistd.h>
#include <getopt.h>
#include <time.h>
#include <errno.h>
#include <linux/netfilter.h>
#include <libconfig.h>
#include <libnetfilter_queue.h>

#  ifdef HAVE_CONFIG_H
#    include "config.h"
#  endif

#  ifdef USE_SOCKSTAT
#    ifndef SOCKSTAT_PATH
#      define SOCKSTAT_PATH "/tmp/.packetbl.sock"
#    endif
#  endif


#ifdef USE_SOCKSTAT
#include <sys/socket.h>
#include <sys/un.h>
#include <pthread.h>
#endif

#ifdef HAVE_FIREDNS
#include <firedns.h>
#endif

#ifndef BUFFERSIZE
#define BUFFERSIZE 65536
#endif
#ifdef USE_CACHE
#  ifndef USE_CACHE_DEF_LEN
#    define USE_CACHE_DEF_LEN 8192
#  endif
#  ifndef USE_CACHE_DEF_TTL
#    define USE_CACHE_DEF_TTL 3600
#  endif
#endif

#  define TH_FIN        0x01
#  define TH_SYN        0x02
#  define TH_RST        0x04
#  define TH_PUSH       0x08
#  define TH_ACK        0x10
#  define TH_URG        0x20

# define SET_VERDICT nfq_set_verdict
# define PBL_HANDLE nfq_q_handle
# define PBL_SET_MODE nfq_set_mode
# define PBL_COPY_PACKET NFQNL_COPY_PACKET
# define PBL_ID_T u_int32_t
# define PBL_ERRSTR ""

#define DEBUG(x, y) if (conf.debug >= x) { printf(y "\n"); }
#define INVALID_OCTET(x) x < 0 || x > 255

struct packet_info {

	uint8_t b1;
	uint8_t b2;
	uint8_t b3;
	uint8_t b4;

	unsigned int s_port;
	unsigned int d_port;

	int flags;
};

struct cidr {

	uint32_t ip;
	uint32_t network;
	uint32_t processed;		/* network, but as a bitmask */

};

struct config_entry {

	char *string;
	struct config_entry *next;
	struct packet_info ip;
	struct cidr	cidr;

};

char msgbuf[BUFFERSIZE];

struct config {
	int	allow_non25;
	int	allow_nonsyn;
	int	default_accept;
	int	dryrun;
	int 	log_facility;
	int	queueno;
	int	quiet;
	int	debug;
	struct config_entry *blacklistbl;
	struct config_entry *whitelistbl;
	struct config_entry *blacklist;
	struct config_entry *whitelist;
};

static struct config conf = { 0, 0, 1, 0, LOG_DAEMON, 1, 0, 0, NULL, NULL, NULL, NULL };

struct pbl_stat_info {
	uint32_t	cacheaccept;
	uint32_t	cachereject;
	uint32_t	whitelistblhits;
	uint32_t	blacklistblhits;
	uint32_t	whitelisthits;
	uint32_t	blacklisthits;
	uint32_t	fallthroughhits;
	uint32_t	totalpackets;
};
static struct pbl_stat_info statistics = { 0, 0, 0, 0, 0, 0, 0 };

#ifdef USE_CACHE
struct packet_cache_t {
	uint32_t ipaddr;
	time_t	expires;
	int	action;
};
struct packet_cache_t *packet_cache = NULL;
uint32_t packet_cache_len = USE_CACHE_DEF_LEN;
uint16_t packet_cache_ttl = USE_CACHE_DEF_TTL;
#endif

struct config_entry *hostlistcache = NULL;

int get_packet_info(char *payload, struct packet_info *ip);

int check_packet_list(const struct packet_info *ip, struct config_entry *list);
int check_packet_dnsbl(const struct packet_info *ip, struct config_entry *list);
int parse_cidr(struct config_entry *ce);
/* int validate_blacklist(char *); */
void parse_config(void);
void parse_arguments(int argc, char **argv);
void pbl_init_sockstat(void);
static void get_ip_string(const struct packet_info *ip);
static void pbl_set_verdict(struct PBL_HANDLE *h, PBL_ID_T id,
        unsigned int verdict);

static int pbl_callback(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
	struct nfq_data *nfa, void *data);
	
typedef struct facility {
	char *string;
	int num;
} facility;

static struct facility facenum[] = {
	{"auth", LOG_AUTH},
	{"authpriv", LOG_AUTHPRIV},
	{"cron", LOG_CRON},
	{"daemon", LOG_DAEMON},
	{"kern", LOG_KERN},
	{"lpr", LOG_LPR},
	{"mail", LOG_MAIL},
	{"news", LOG_NEWS},
	{"syslog", LOG_SYSLOG},
	{"user", LOG_USER},
	{"uucp", LOG_UUCP},
	{"local0", LOG_LOCAL0},
	{"local1", LOG_LOCAL1},
	{"local2", LOG_LOCAL2},
	{"local3", LOG_LOCAL3},
	{"local4", LOG_LOCAL4},
	{"local5", LOG_LOCAL5},
	{"local6", LOG_LOCAL6},
	{"local7", LOG_LOCAL7},
	NULL
};

#endif

Modified packetbl_getstat.c from [336a514000] to [59a5b1db0b]. 

1
2
3
4
5
6
7
8

#include "packetbl.h"
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

|








1
2
3
4
5
6
7
8

#include "packetbl_getstat.h"
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
︙︙

Added packetbl_getstat.h version [45e910ff68]. 



























>
>
>
>
>
>
>
>
>
>
>
>

1
2
3
4
5
6
7
8
9
10
11
12

#ifndef PACKETBL_GETSTAT_H
#define PACKETBL_GETSTAT_H
#  ifdef HAVE_CONFIG_H
#    include "config.h"
#  endif

#  ifdef USE_SOCKSTAT
#    ifndef SOCKSTAT_PATH
#      define SOCKSTAT_PATH "/tmp/.packetbl.sock"
#    endif
#  endif
#endif

Powered by Fossil · RSS