Adding upstream version 2.15.2.
Signed-off-by: Daniel Baumann <daniel@debian.org>
This commit is contained in:
parent
ddb1028ee9
commit
69e263a68b
GPG key ID:
FBB4F0E80A80222F
255 changed files with 79628 additions and 0 deletions
403
src/asn_index.c
Normal file
403
src/asn_index.c
Normal file
|
|
@ -0,0 +1,403 @@
|
|||
/*
|
||||
* Copyright (c) 2008-2024 OARC, Inc.
|
||||
* Copyright (c) 2007-2008, Internet Systems Consortium, Inc.
|
||||
* Copyright (c) 2003-2007, The Measurement Factory, Inc.
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in
|
||||
* the documentation and/or other materials provided with the
|
||||
* distribution.
|
||||
*
|
||||
* 3. Neither the name of the copyright holder nor the names of its
|
||||
* contributors may be used to endorse or promote products derived
|
||||
* from this software without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
||||
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
||||
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||||
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
||||
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
||||
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
||||
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
|
||||
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||||
* POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "config.h"
|
||||
|
||||
#include "asn_index.h"
|
||||
#include "xmalloc.h"
|
||||
#include "hashtbl.h"
|
||||
#include "syslog_debug.h"
|
||||
|
||||
#include "geoip.h"
|
||||
#if defined(HAVE_LIBGEOIP) && defined(HAVE_GEOIP_H)
|
||||
#define HAVE_GEOIP 1
|
||||
#include <GeoIP.h>
|
||||
#endif
|
||||
#if defined(HAVE_LIBMAXMINDDB) && defined(HAVE_MAXMINDDB_H)
|
||||
#define HAVE_MAXMINDDB 1
|
||||
#include <maxminddb.h>
|
||||
#endif
|
||||
|
||||
#ifdef HAVE_MAXMINDDB
|
||||
#include "compat.h"
|
||||
#endif
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#ifdef HAVE_MAXMINDDB
|
||||
#include <inttypes.h>
|
||||
#include <errno.h>
|
||||
#endif
|
||||
|
||||
extern int debug_flag;
|
||||
extern char* geoip_asn_v4_dat;
|
||||
extern int geoip_asn_v4_options;
|
||||
extern char* geoip_asn_v6_dat;
|
||||
extern int geoip_asn_v6_options;
|
||||
extern enum geoip_backend asn_indexer_backend;
|
||||
extern char* maxminddb_asn;
|
||||
static hashfunc asn_hashfunc;
|
||||
static hashkeycmp asn_cmpfunc;
|
||||
|
||||
#define MAX_ARRAY_SZ 65536
|
||||
static hashtbl* theHash = NULL;
|
||||
static int next_idx = 0;
|
||||
#ifdef HAVE_GEOIP
|
||||
static GeoIP* geoip = NULL;
|
||||
static GeoIP* geoip6 = NULL;
|
||||
#endif
|
||||
#ifdef HAVE_MAXMINDDB
|
||||
static MMDB_s mmdb;
|
||||
static char _mmasn[32];
|
||||
static int have_mmdb = 0;
|
||||
#endif
|
||||
static char ipstr[81];
|
||||
#ifdef HAVE_GEOIP
|
||||
static char* nodb = "NODB";
|
||||
#endif
|
||||
static char* unknown = "??";
|
||||
static char* unknown_v4 = "?4";
|
||||
static char* unknown_v6 = "?6";
|
||||
static char* _asn = NULL;
|
||||
|
||||
typedef struct {
|
||||
char* asn;
|
||||
int index;
|
||||
} asnobj;
|
||||
|
||||
const char*
|
||||
asn_get_from_message(dns_message* m)
|
||||
{
|
||||
transport_message* tm = m->tm;
|
||||
const char* asn = unknown;
|
||||
|
||||
if (asn_indexer_backend == geoip_backend_libgeoip) {
|
||||
if (!inXaddr_ntop(&tm->src_ip_addr, ipstr, sizeof(ipstr) - 1)) {
|
||||
dfprint(0, "asn_index: Error converting IP address");
|
||||
return unknown;
|
||||
}
|
||||
}
|
||||
|
||||
if (_asn) {
|
||||
free(_asn);
|
||||
_asn = NULL;
|
||||
}
|
||||
|
||||
switch (tm->ip_version) {
|
||||
case 4:
|
||||
switch (asn_indexer_backend) {
|
||||
case geoip_backend_libgeoip:
|
||||
#ifdef HAVE_GEOIP
|
||||
if (geoip) {
|
||||
if ((_asn = GeoIP_name_by_addr(geoip, ipstr))) {
|
||||
/* libgeoip reports for networks with the same ASN different network names.
|
||||
* Probably it uses the network description, not the AS description. Therefore,
|
||||
* we truncate after the first space and only use the AS number. Mappings
|
||||
* to AS names must be done in the presenter.
|
||||
*/
|
||||
char* truncate = strchr(_asn, ' ');
|
||||
if (truncate) {
|
||||
*truncate = 0;
|
||||
}
|
||||
asn = _asn;
|
||||
} else {
|
||||
asn = unknown_v4;
|
||||
}
|
||||
} else {
|
||||
asn = nodb;
|
||||
}
|
||||
#endif
|
||||
break;
|
||||
case geoip_backend_libmaxminddb:
|
||||
#ifdef HAVE_MAXMINDDB
|
||||
if (have_mmdb) {
|
||||
struct sockaddr_in s;
|
||||
int ret;
|
||||
MMDB_lookup_result_s r;
|
||||
|
||||
s.sin_family = AF_INET;
|
||||
s.sin_addr = tm->src_ip_addr.in4;
|
||||
|
||||
r = MMDB_lookup_sockaddr(&mmdb, (struct sockaddr*)&s, &ret);
|
||||
if (ret == MMDB_SUCCESS && r.found_entry) {
|
||||
MMDB_entry_data_s entry_data;
|
||||
|
||||
if (MMDB_get_value(&r.entry, &entry_data, "autonomous_system_number", 0) == MMDB_SUCCESS) {
|
||||
switch (entry_data.type) {
|
||||
case MMDB_DATA_TYPE_UINT16:
|
||||
snprintf(_mmasn, sizeof(_mmasn), "%" PRIu16, entry_data.uint16);
|
||||
asn = _mmasn;
|
||||
break;
|
||||
case MMDB_DATA_TYPE_UINT32:
|
||||
snprintf(_mmasn, sizeof(_mmasn), "%" PRIu32, entry_data.uint32);
|
||||
asn = _mmasn;
|
||||
break;
|
||||
case MMDB_DATA_TYPE_INT32:
|
||||
snprintf(_mmasn, sizeof(_mmasn), "%" PRId32, entry_data.int32);
|
||||
asn = _mmasn;
|
||||
break;
|
||||
case MMDB_DATA_TYPE_UINT64:
|
||||
snprintf(_mmasn, sizeof(_mmasn), "%" PRIu64, entry_data.uint64);
|
||||
asn = _mmasn;
|
||||
break;
|
||||
default:
|
||||
dfprintf(1, "asn_index: found entry in MMDB but unknown type %u", entry_data.type);
|
||||
asn = unknown_v4;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
asn = unknown_v4;
|
||||
#endif
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
break;
|
||||
|
||||
case 6:
|
||||
switch (asn_indexer_backend) {
|
||||
case geoip_backend_libgeoip:
|
||||
#ifdef HAVE_GEOIP
|
||||
if (geoip6) {
|
||||
if ((_asn = GeoIP_name_by_addr_v6(geoip6, ipstr))) {
|
||||
/* libgeoip reports for networks with the same ASN different network names.
|
||||
* Probably it uses the network description, not the AS description. Therefore,
|
||||
* we truncate after the first space and only use the AS number. Mappings
|
||||
* to AS names must be done in the presenter.
|
||||
*/
|
||||
char* truncate = strchr(_asn, ' ');
|
||||
if (truncate) {
|
||||
*truncate = 0;
|
||||
}
|
||||
asn = _asn;
|
||||
} else {
|
||||
asn = unknown_v6;
|
||||
}
|
||||
} else {
|
||||
asn = nodb;
|
||||
}
|
||||
#endif
|
||||
break;
|
||||
case geoip_backend_libmaxminddb:
|
||||
#ifdef HAVE_MAXMINDDB
|
||||
if (have_mmdb) {
|
||||
struct sockaddr_in6 s;
|
||||
int ret;
|
||||
MMDB_lookup_result_s r;
|
||||
|
||||
s.sin6_family = AF_INET;
|
||||
s.sin6_addr = tm->src_ip_addr.in6;
|
||||
|
||||
r = MMDB_lookup_sockaddr(&mmdb, (struct sockaddr*)&s, &ret);
|
||||
if (ret == MMDB_SUCCESS && r.found_entry) {
|
||||
MMDB_entry_data_s entry_data;
|
||||
|
||||
if (MMDB_get_value(&r.entry, &entry_data, "autonomous_system_number", 0) == MMDB_SUCCESS) {
|
||||
switch (entry_data.type) {
|
||||
case MMDB_DATA_TYPE_UINT16:
|
||||
snprintf(_mmasn, sizeof(_mmasn), "%" PRIu16, entry_data.uint16);
|
||||
asn = _mmasn;
|
||||
break;
|
||||
case MMDB_DATA_TYPE_UINT32:
|
||||
snprintf(_mmasn, sizeof(_mmasn), "%" PRIu32, entry_data.uint32);
|
||||
asn = _mmasn;
|
||||
break;
|
||||
case MMDB_DATA_TYPE_INT32:
|
||||
snprintf(_mmasn, sizeof(_mmasn), "%" PRId32, entry_data.int32);
|
||||
asn = _mmasn;
|
||||
break;
|
||||
case MMDB_DATA_TYPE_UINT64:
|
||||
snprintf(_mmasn, sizeof(_mmasn), "%" PRIu64, entry_data.uint64);
|
||||
asn = _mmasn;
|
||||
break;
|
||||
default:
|
||||
dfprintf(1, "asn_index: found entry in MMDB but unknown type %u", entry_data.type);
|
||||
asn = unknown_v6;
|
||||
}
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
asn = unknown_v6;
|
||||
#endif
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
break;
|
||||
|
||||
default:
|
||||
break;
|
||||
}
|
||||
|
||||
dfprintf(1, "asn_index: network name: %s", asn);
|
||||
return asn;
|
||||
}
|
||||
|
||||
int asn_indexer(const dns_message* m)
|
||||
{
|
||||
const char* asn;
|
||||
asnobj* obj;
|
||||
|
||||
if (m->malformed)
|
||||
return -1;
|
||||
|
||||
asn = asn_get_from_message((dns_message*)m);
|
||||
if (asn == NULL)
|
||||
return -1;
|
||||
|
||||
if (NULL == theHash) {
|
||||
theHash = hash_create(MAX_ARRAY_SZ, asn_hashfunc, asn_cmpfunc, 1, afree, afree);
|
||||
if (NULL == theHash)
|
||||
return -1;
|
||||
}
|
||||
|
||||
if ((obj = hash_find(asn, theHash))) {
|
||||
return obj->index;
|
||||
}
|
||||
|
||||
obj = acalloc(1, sizeof(*obj));
|
||||
if (NULL == obj)
|
||||
return -1;
|
||||
|
||||
obj->asn = astrdup(asn);
|
||||
if (NULL == obj->asn) {
|
||||
afree(obj);
|
||||
return -1;
|
||||
}
|
||||
|
||||
obj->index = next_idx;
|
||||
if (0 != hash_add(obj->asn, obj, theHash)) {
|
||||
afree(obj->asn);
|
||||
afree(obj);
|
||||
return -1;
|
||||
}
|
||||
|
||||
next_idx++;
|
||||
|
||||
return obj->index;
|
||||
}
|
||||
|
||||
int asn_iterator(const char** label)
|
||||
{
|
||||
asnobj* obj;
|
||||
static char label_buf[128];
|
||||
if (0 == next_idx)
|
||||
return -1;
|
||||
if (NULL == label) {
|
||||
/* initialize and tell caller how big the array is */
|
||||
hash_iter_init(theHash);
|
||||
return next_idx;
|
||||
}
|
||||
if ((obj = hash_iterate(theHash)) == NULL)
|
||||
return -1;
|
||||
snprintf(label_buf, sizeof(label_buf), "%s", obj->asn);
|
||||
*label = label_buf;
|
||||
return obj->index;
|
||||
}
|
||||
|
||||
void asn_reset()
|
||||
{
|
||||
theHash = NULL;
|
||||
next_idx = 0;
|
||||
}
|
||||
|
||||
static unsigned int
|
||||
asn_hashfunc(const void* key)
|
||||
{
|
||||
return hashendian(key, strlen(key), 0);
|
||||
}
|
||||
|
||||
static int
|
||||
asn_cmpfunc(const void* a, const void* b)
|
||||
{
|
||||
return strcasecmp(a, b);
|
||||
}
|
||||
|
||||
void asn_init(void)
|
||||
{
|
||||
switch (asn_indexer_backend) {
|
||||
case geoip_backend_libgeoip:
|
||||
#ifdef HAVE_GEOIP
|
||||
if (geoip_asn_v4_dat) {
|
||||
geoip = GeoIP_open(geoip_asn_v4_dat, geoip_asn_v4_options);
|
||||
if (geoip == NULL) {
|
||||
dsyslog(LOG_ERR, "asn_index: Error opening IPv4 ASNum DB. Make sure libgeoip's GeoIPASNum.dat file is available");
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
if (geoip_asn_v6_dat) {
|
||||
geoip6 = GeoIP_open(geoip_asn_v6_dat, geoip_asn_v6_options);
|
||||
if (geoip6 == NULL) {
|
||||
dsyslog(LOG_ERR, "asn_index: Error opening IPv6 ASNum DB. Make sure libgeoip's GeoIPASNumv6.dat file is available");
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
memset(ipstr, 0, sizeof(ipstr));
|
||||
if (geoip || geoip6) {
|
||||
dsyslog(LOG_INFO, "asn_index: Sucessfully initialized GeoIP ASN");
|
||||
} else {
|
||||
dsyslog(LOG_INFO, "asn_index: No database loaded for GeoIP ASN");
|
||||
}
|
||||
#endif
|
||||
break;
|
||||
case geoip_backend_libmaxminddb:
|
||||
#ifdef HAVE_MAXMINDDB
|
||||
if (maxminddb_asn) {
|
||||
int ret;
|
||||
char errbuf[512];
|
||||
|
||||
ret = MMDB_open(maxminddb_asn, 0, &mmdb);
|
||||
if (ret == MMDB_IO_ERROR) {
|
||||
dsyslogf(LOG_ERR, "asn_index: Error opening MaxMind ASN, IO error: %s", dsc_strerror(errno, errbuf, sizeof(errbuf)));
|
||||
exit(1);
|
||||
} else if (ret != MMDB_SUCCESS) {
|
||||
dsyslogf(LOG_ERR, "asn_index: Error opening MaxMind ASN: %s", MMDB_strerror(ret));
|
||||
exit(1);
|
||||
}
|
||||
dsyslog(LOG_INFO, "asn_index: Sucessfully initialized MaxMind ASN");
|
||||
have_mmdb = 1;
|
||||
} else {
|
||||
dsyslog(LOG_INFO, "asn_index: No database loaded for MaxMind ASN");
|
||||
}
|
||||
#endif
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue