$Revision: 1.20 $
Access control module (ac) - access control for the query part
Status: NOT REVIEWED, TESTED
Design and implementation by: Marek Bukowy
Included Files
- #include <include/rxroutines.h>
- #include <include/access_control.h>
- #include <include/constants.h>
- #include <include/server.h>
Preprocessor definitions
#define AC_OK RX_OK
#define AC_INVARG IP_INVARG
#define AC_IMPL
#define AC_DECAY_TIME 600
#define ACL_FORMAT "%10d %10d %10d %10d %10d"
#define ACL_HEADER "%-20s %10s %10s %10s %10s %10s\n"
#define ACC_FORMAT "%4d %4d %4d %4d %6d %6d %6d"
#define ACC_HEADER "%-20s %4s %4s %4s %4s %6s %6s %6s\n"
rx_tree_t* act_runtime
rx_tree_t* act_hour
rx_tree_t* act_minute
rx_tree_t* act_acl
AC_acc_addup:
Add/subtract the values from one accounting structure to another
void AC_acc_addup ( acc_st* a, acc_st* b, int minus )
- acc_st* a
- - this one gets changed
acc_st *b - this one provides the values to change a
int minus - triggers subtraction if non-zero
- acc_st* b
- &nbs;
- int minus
- &nbs;
AC_acc_load:
loads the acl access tree from the acl table of the RIPADMIN database.
(takes port/host/user/password from the config module).
bails out if encounters problems with the database (logs to stderr).
returns error code from RX_bin_node or wr_malloc.
er_ret_t AC_acc_load ( void )
Prototyped in:
| include/access_control.h
|
Calls:
| CO_get_database_port(), CO_get_host(), CO_get_password(), CO_get_user(), SQ_close_connection(), SQ_errno(), SQ_error(), SQ_execute_query(), SQ_free_result(), SQ_get_column_string(), SQ_get_connection(), SQ_row_next(), TH_acquire_write_lock(), TH_release_write_lock(), fprintf(), memset(), rx_bin_node(), sscanf(), wr_real_free(), wr_real_malloc()
|
References Variables:
| act_acl | modules/ac/access_control.c
|
AC_acl_sql:
updates/creates a record for the given prefix in the acl table of
the RIPADMIN database. Adds a comment.
placeholder: it may return an error code from SQ - as soon as sq
implements common error scheme
er_ret_t AC_acl_sql ( ip_prefix_t* prefix, acl_st* newacl, char* newcomment )
- ip_prefix_t* prefix
- - prefix
acl_st *newacl - new values to store in the database
char *newcomment - comment to be added (must not be NULL)
- acl_st* newacl
- &nbs;
- char* newcomment
- &nbs;
Calls:
| CO_get_database_port(), CO_get_host(), CO_get_password(), CO_get_user(), SQ_close_connection(), SQ_execute_query(), SQ_free_result(), SQ_get_column_string(), SQ_get_connection(), SQ_num_rows(), SQ_row_next(), fprintf(), sprintf(), strlen(), wr_real_free(), wr_real_malloc()
|
Called by:
| AC_ban_set() | modules/ac/access_control.c
|
AC_acl_to_string:
Show an access control list structure
returns an allocated string
char* AC_acl_to_string ( GList* leafptr )
AC_acl_to_string_header:
produce a header for the acl printout
returns an allocated string
char* AC_acl_to_string_header ( void )
AC_asc_ban_set:
sets ban on text address/range. Parses the text address/range/prefix
and then calls AC_ban_set on that prefix.
Precondition: if the key is a range, it must decompose into one prefix
returns error code from IP_smart_conv, AC_ban_set or
AC_INVARG if range composed
er_ret_t AC_asc_ban_set ( char* addrstr, char* text, int denyflag )
AC_ban_set:
re/sets the permanent ban flag both in the acl tree in memory
and the sql table. The "text" is appended to the comment
in the sql record (the expected cases are
- "automatic" in case the limit is exceeded and ban is set by s/w
- "manual" in case it is (un)set from the config iface
returns error code from AC_acl_sql or OK
er_ret_t AC_ban_set ( ip_prefix_t* prefix, char* text, int denyflag )
- ip_prefix_t* prefix
- - prefix
char *text - usually "automatic" or "manual"
int denyflag - new value of the denyflag (ban)
- char* text
- &nbs;
- int denyflag
- &nbs;
AC_build:
creates empty trees for accounting/acl.
returns error code from RX_tree_cre or OK.
(XXX): just now only bails out when encounters problems.
er_ret_t AC_build ( void )
AC_check_acl:
search for this ip or less specific record in the access control tree
if( bonus in combined runtime+connection accountings > max_bonus in acl)
set denial in the acl for this ip (create if needed)
if( combined denialcounter > max_denials in acl)
set the permanent ban in acl; save in SQL too
calculate credit if pointer provided
save the access record (ip if created or found/prefix otherwise)
at *acl_store if provided
any of the args except address can be NULL
returns error code from RX or OK
MT-Note: locks/unlocks the accounting tree
er_ret_t AC_check_acl ( ip_addr_t* addr, acc_st* credit_acc, acl_st* acl_store )
- ip_addr_t* addr
- - address
acc_st *acc_store - pointer to store the *credit* account struct
acl_st *acl_store - pointer to store the acl struct
- acc_st* credit_acc
- &nbs;
- acl_st* acl_store
- &nbs;
AC_commit:
commits the credit into all accounting trees, (XXX: only one at the moment)
checks the limits and sets automatic ban if limit exceeded.
returns error code from AC_commit_credit or AC_ban_set or OK.
outline:
lock runtime + minute accounting trees
----------------------- XXX runtime only for the moment
find or create entries,
increase accounting values by the values from passed acc
check values against acl, see if permanent ban applies
reset the connection acc
unlock accounting trees
if permanent ban - set it! :
lock acl
find/create IP in memory
set ban
find/create IP in SQL
copy old values (if any), set ban, append comment
unlock acl
er_ret_t AC_commit ( ip_addr_t* addr, acc_st* acc_conn, acl_st* acl_copy )
- ip_addr_t* addr
- - user's address
acc_st *acc_conn - credit used
acl_st *acl_copy - pointer to store a copy of the acl
- acc_st* acc_conn
- &nbs;
- acl_st* acl_copy
- &nbs;
AC_commit_credit:
performs the commit on an accounting tree (locks them first)
stores a copy of the accounting record at rec_store
returns error code from AC_findcreate_account_l or OK
MT-Note: locks/unlocks the accounting tree
er_ret_t AC_commit_credit ( rx_tree_t* tree, ip_prefix_t* prefix, acc_st* acc_conn, acc_st* rec_store )
- rx_tree_t* tree
- - the tree
ip_prefix_t *prefix - prefix (usually a /32)
acc_st *acc_conn - credit used
acc_st *rec_store - pointer to store the account struct
- ip_prefix_t* prefix
- &nbs;
- acc_st* acc_conn
- &nbs;
- acc_st* rec_store
- &nbs;
AC_credit_to_string:
Show credit used (for logging of queries)
returns an allocated string
char* AC_credit_to_string ( acc_st* a )
- acc_st* a
- - the credit structure
AC_decay:
Every AC_DECAY_TIME goes through the accounting tree(s) and decays the
bonus values.
returns always OK
MT-Note This should be run as a detached thread.
er_ret_t AC_decay ( void )
AC_decay_hook:
action performed on a single account node during decay (diminishing the
bonus). Conforms to rx_walk_tree interface, therefore some of the
arguments do not apply and are not used.
returns always OK
er_ret_t AC_decay_hook ( rx_node_t* node, int level, int nodecounter, void* con )
- rx_node_t* node
- - pointer to the node of the radix tree
int level - n/a
int nodecounter - n/a
void *con - n/a
- int level
- &nbs;
- int nodecounter
- &nbs;
- void* con
- &nbs;
AC_fetch_acc:
Finds the runtime accounting record for this IP,
stores a copy of it in acc_store.
If not found, then it is created and initialised to zeros in findcreate()
MT-Note: locks/unlocks the accounting tree
er_ret_t AC_fetch_acc ( ip_addr_t* addr, acc_st* acc_store )
- ip_addr_t* addr
- - address
acc_st *acc_store - pointer to store the account struct
- acc_st* acc_store
- &nbs;
AC_findcreate_account_l:
finds exact prefix in the accounting tree
or creates area initialised to zeros + sets ptr to it.
returns error code from RX or OK
MT-Note: assumes locked accounting tree
er_ret_t AC_findcreate_account_l ( rx_tree_t* tree, ip_prefix_t* prefix, acc_st** acc_store )
- rx_tree_t* tree
- - the tree
ip_prefix_t *prefix - prefix to look for
acc_st **store_acl - pointer to store the ptr to the account struct
- ip_prefix_t* prefix
- &nbs;
- acc_st** acc_store
- &nbs;
AC_findcreate_acl_l:
find or create an entry for the given prefix in the acl tree.
returns error code from RX or OK
MT-Note: assumes locked acl tree
er_ret_t AC_findcreate_acl_l ( ip_prefix_t* prefix, acl_st** store_acl )
- ip_prefix_t* prefix
- - prefix to look for
acl_st **store_acl - pointer to store the ptr to the acl struct
(initialised to the values of the parent entry
if just created)
- acl_st** store_acl
- &nbs;
AC_findexless_acl_l:
find the exact or less specific match for the given prefix in the acl tree.
returns error code from RX or OK
MT-Note: assumes locked acl tree
er_ret_t AC_findexless_acl_l ( ip_prefix_t* prefix, acl_st* store_acl )
- ip_prefix_t* prefix
- - prefix to look for
acl_st *store_acl - pointer to store the output
- acl_st* store_acl
- &nbs;
AC_rxwalkhook_print:
action performed on a single account node
when listing the contents of the access tree: format and print the
data from this node.
Conforms to rx_walk_tree interface, therefore some of the
arguments do not apply and are not used.
returns always OK
er_ret_t AC_rxwalkhook_print ( rx_node_t* node, int level, int nodecounter, void* con )
- rx_node_t* node
- - pointer to the node of the radix tree
int level - n/a
int nodecounter - n/a
void *con - pointer to the connection structure (prints to it)
- int level
- &nbs;
- int nodecounter
- &nbs;
- void* con
- &nbs;
AC_rxwalkhook_print_acl:
action performed on a single account node
when listing the contents of the acl tree: format and print the
data from this node.
Conforms to rx_walk_tree interface, therefore some of the
arguments do not apply and are not used.
returns always OK
er_ret_t AC_rxwalkhook_print_acl ( rx_node_t* node, int level, int nodecounter, void* con )
- rx_node_t* node
- - pointer to the node of the radix tree
int level - n/a
int nodecounter - n/a
void *con - pointer to the connection structure (prints to it)
- int level
- &nbs;
- int nodecounter
- &nbs;
- void* con
- &nbs;
AC_to_string:
Show an access structure
returns an allocated string
char* AC_to_string ( GList* leafptr )
AC_to_string_header:
produce a header for the access stats printout
returns an allocated string
char* AC_to_string_header ( void )