gods

main.c (5367B)

---

 #include <sys/stat.h>
 #include <sys/types.h>
 
 #include <err.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <limits.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
 #include "arg.h"
 
 #include "attack.h"
 #include "config.h"
 #include "fw.h"
 #include "ip.h"
 #include "parser.h"
 #include "queue.h"
 
 #define BUFSZ 512
 
 int fd_black;
 int fd_white;
 int ignore;
 int shutdown;
 char *argv0;
 
 static char buf[BUFSZ];
 SLIST_HEAD(lhead, attacker) head = SLIST_HEAD_INITIALIZER(head);
 
 void
 ban(struct attacker *a)
 {
 	if (a->list != GREY)
 		return;
 
 	a->nban++;
 	if (a->nban >= 0
 	&& fw_block(a->ip)
 	&& a->nban > max_try)
 		blacklist(a);
 }
 
 void
 unban(struct attacker *a, struct lhead *headp)
 {
 	struct attacker *ap;
 
 	if (a) {
 		if (fw_unblock(a->ip))
 			a->last = LLONG_MAX;
 		return;
 	}
 
 	SLIST_FOREACH(ap, headp, attackers)
 		if (ap->list == GREY && isexpire(ap))
 			if (fw_unblock(ap->ip))
 				ap->last = LLONG_MAX;
 }
 
 void
 init(struct attacker *a)
 {
 	strcpy(a->ip, ip);
 	a->nban = -immune_try;
 	a->last = attack;
 	a->list = GREY;
 }
 
 /*
  * XXX readline relies upon the assumption
  * that a line can be atmost BUFSZ long
  */
 char *
 readline(int fd)
 {
 	static char *next;
 	static int rem;
 	int n;
 
 	if (rem)
 		memmove(buf, next, rem);
 
 	if ((n = read(fd, buf+rem, BUFSZ-rem)) == -1)
 		err(1, "read failed");
 
 	rem += n;
 	for (int i = 0; i < rem; ++i)
 		if (buf[i] == '\n') {
 			buf[i] = '\0';
 			rem -= i+1;
 			next = (rem == 0) ? NULL : &buf[i+1];
 			return buf;
 		}
 
 	return NULL;
 }
 
 int
 foverlap(int fd1, int fd2)
 {
 	FILE *fp1, *fp2;
 	int r1, r2;
 	char buf1[16], buf2[16];
 
 	fp1 = fdopen(fd1, "r");
 	if (!fp1)
 		err(1, "fdopen failed");
 
 	fp2 = fdopen(fd2, "r");
 	if (!fp2)
 		err(1, "fdopen failed");
 
 	do {
 		r1 = fscanf(fp1, "%s\n", buf1);
 		if (r1 != EOF) {
 			do {
 				r2 = fscanf(fp2, "%s\n", buf2);
 				if (r2 != EOF
 				&&  !strcmp(buf1, buf2))
 						return 1;
 			} while (r2 != EOF);
 		}
 	} while(r1 != EOF);
 	return 0;
 }
 
 void
 cleanup()
 {
 	struct attacker *prev, *a;
 
 	prev= NULL;
 	SLIST_FOREACH(a, &head, attackers) {
 		if (prev)
 			free(prev);
 		prev = a;
 	}
 	free(prev);
 }
 
 void
 usage(void)
 {
 	fprintf(stderr, "usage: sdog [-d]\n");
 	exit(1);
 }
 
 void
 daemon_init(void)
 {
 	pid_t p;
 
 	if ((p = fork()) == -1)
 		err(1, "fork failed");
 	else if (p != 0)
 		exit(0);
 	if (setsid() == -1)
 		err(1, "setsid failed");
 	if (chdir("/etc/gods") == -1)
 		err(1, "chdir failed: %s", "/etc/gods");
 	umask(0);
 }
 
 void
 terminate(int a)
 {
 	shutdown = 1;
 }
 
 int
 main(int argc, char **argv)
 {
 	FILE *fp;
 	char *line;
 	char bf[16];
 	int debug, fd, found, ret;
 	struct attacker *a;
 	time_t now;
 
 	shutdown = debug = 0;
 
 	ARGBEGIN {
 		case 'd':
 			debug = 1;
 			break;
 		default:
 			usage();
 	} ARGEND
 
 	if (!debug)
 		daemon_init();
 
 	signal(SIGHUP, terminate);
 
 	fd = open(sshlog, O_RDONLY);
 	if (fd == -1)
 		err(1, "open failed: %s", sshlog);
 
 	fd_black = open(black_list, O_RDWR | O_CREAT | O_APPEND,
 			S_IRUSR | S_IWUSR);
 	if (fd_black == -1)
 		err(1, "open failed: %s", black_list);
 
 	fd_white = open(white_list, O_RDWR | O_CREAT | O_APPEND,
 			S_IRUSR | S_IWUSR);
 	if (fd_white == -1)
 		err(1, "open failed: %s", white_list);
 
 	if (foverlap(fd_black, fd_white))
 		errx(1, "blacklist and whitelist are not mutually exclusive.");
 
 	fp = fopen(black_list, "r");
 	if (!fp)
 		err(1, "fopen failed: %s", black_list);
 	do {
 		ret = fscanf(fp, "%s\n", bf);
 		if (ret == EOF)
 			break;
 		if (!isip(bf))
 			errx(1, "malformed ip in blacklist");
 		SLIST_FOREACH(a, &head, attackers)
 			if (!strcmp(a->ip, bf))
 				errx(1, "duplicate entry found in %s",
 				     black_list);
 		a = malloc(sizeof(struct attacker));
 		if (!a)
 			err(1, "malloc failed");
 		/*
 		 * Attackers generated from blacklist
 		 * will have nban and last set to 0
 		 */
 		strcpy(a->ip, bf);
 		a->list = BLACK;
 		fw_block(a->ip);
 		SLIST_INSERT_HEAD(&head, a, attackers);
 	} while (ret != EOF);
 	fclose(fp);
 
 	fp = fopen(white_list, "r");
 	if (!fp)
 		err(1, "fopen failed: %s", white_list);
 	do {
 		ret = fscanf(fp, "%s\n", bf);
 		if (ret == EOF)
 			break;
 		if (!isip(bf))
 			errx(1, "malformed ip in whitelist");
 		SLIST_FOREACH(a, &head, attackers)
 			if (!strcmp(a->ip, bf))
 				errx(1, "duplicate entry found in %s",
 				     white_list);
 		a = malloc(sizeof(struct attacker));
 		if (!a)
 			err(1, "malloc failed");
 		/*
 		 * Attackers generated from whitelist
 		 * will have nban and last set to 0
 		 */
 		strcpy(a->ip, bf);
 		a->list = WHITE;
 		SLIST_INSERT_HEAD(&head, a, attackers);
 	} while (ret != EOF);
 	fclose(fp);
 
 	now = time(NULL);
 	for ( ; ; ) {
 		if (shutdown)
 			break;
 
 		unban(NULL, &head);
 		if ((line = readline(fd)) == NULL) {
 			usleep(5);
 			continue;
 		}
 
 		if (parse(line, now) == -1) {
 			fprintf(stderr, "parse failed\n");
 			continue;
 		}
 		if (ignore)
 			continue;
 
 		a = NULL;
 		found = 0;
 		if (isattack(statmsg, preauth)) {
 			SLIST_FOREACH(a, &head, attackers)
 				if (!strcmp(a->ip, ip)) {
 					++found;
 					break;
 				}
 
 			if (!found) {
 				a = malloc(sizeof(struct attacker));
 				if (!a)
 					err(1, "malloc failed");
 				init(a);
 				SLIST_INSERT_HEAD(&head, a, attackers);
 			}
 			ban(a);
 		}
 
 		if (islogin(statmsg))
 			SLIST_FOREACH(a, &head, attackers)
 				if (!strcmp(a->ip, ip)) {
 					printf("attacker deleted\n");
 					SLIST_REMOVE(&head, a, attacker, attackers);
 					free(a);
 				}
 	}
 	cleanup();
 	return 0;
 }