gluon-arp-limiter.c 5.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299
  1. /*
  2. * Copyright (c) 2017 Linus Lüssing <linus.luessing@c0d3.blue>
  3. *
  4. * SPDX-License-Identifier: GPL-2.0+
  5. * License-Filename: LICENSE
  6. */
  7. #include <arpa/inet.h>
  8. #include <errno.h>
  9. #include <netinet/in.h>
  10. #include <stdio.h>
  11. #include <stdlib.h>
  12. #include <string.h>
  13. #include <unistd.h>
  14. #include "addr_store.h"
  15. #include "gluon-arp-limiter.h"
  16. #include "mac.h"
  17. #define BATCTL_DC "/usr/sbin/batctl dc -H -n"
  18. #define BATCTL_TL "/usr/sbin/batctl tl -H -n"
  19. #define EBTABLES "/usr/sbin/ebtables --concurrent"
  20. #define BUILD_BUG_ON(check) ((void)sizeof(int[1-2*!!(check)]))
  21. static struct addr_store ip_store;
  22. static struct addr_store mac_store;
  23. char *addr_mac_ntoa(void *addr)
  24. {
  25. return mac_ntoa((struct mac_addr *)addr);
  26. }
  27. char *addr_inet_ntoa(void *addr)
  28. {
  29. return inet_ntoa(*((struct in_addr *)addr));
  30. }
  31. static void ebt_ip_call(char *mod, struct in_addr ip)
  32. {
  33. char str[196];
  34. int ret;
  35. snprintf(str, sizeof(str),
  36. EBTABLES " %s ARP_LIMIT_DATCHECK -p ARP --arp-ip-dst %s -j mark --mark-or 0x2 --mark-target RETURN",
  37. mod, inet_ntoa(ip));
  38. ret = system(str);
  39. if (ret)
  40. fprintf(stderr,
  41. "%i: Calling ebtables for DAT failed with status %i\n",
  42. clock, ret);
  43. }
  44. static void ip_node_destructor(struct addr_list *node)
  45. {
  46. struct in_addr *ip = (struct in_addr *)node->addr;
  47. ebt_ip_call("-D", *ip);
  48. }
  49. static void ebt_mac_limit_call(char *mod, struct mac_addr *mac)
  50. {
  51. char str[128];
  52. int ret;
  53. snprintf(str, sizeof(str),
  54. EBTABLES " %s ARP_LIMIT_TLCHECK --source %s --limit 6/min --limit-burst 50 -j RETURN",
  55. mod, mac_ntoa(mac));
  56. ret = system(str);
  57. if (ret)
  58. fprintf(stderr,
  59. "%i: Calling ebtables for TL failed with status %i\n",
  60. clock, ret);
  61. }
  62. static void ebt_mac_ret_call(char *mod, struct mac_addr *mac, int add)
  63. {
  64. char str[128];
  65. int ret;
  66. snprintf(str, sizeof(str),
  67. EBTABLES " %s ARP_LIMIT_TLCHECK %s --source %s -j DROP",
  68. mod, add ? "2" : "", mac_ntoa(mac));
  69. ret = system(str);
  70. if (ret)
  71. fprintf(stderr,
  72. "%i: Calling ebtables for TL failed with status %i\n",
  73. clock, ret);
  74. }
  75. static void ebt_mac_call(char *mod, struct mac_addr *mac)
  76. {
  77. if (!strncmp(mod, "-D", strlen(mod))) {
  78. ebt_mac_ret_call(mod, mac, 0);
  79. ebt_mac_limit_call(mod, mac);
  80. } else {
  81. ebt_mac_limit_call(mod, mac);
  82. ebt_mac_ret_call(mod, mac, 1);
  83. }
  84. }
  85. static void mac_node_destructor(struct addr_list *node)
  86. {
  87. struct mac_addr *mac = (struct mac_addr *)node->addr;
  88. ebt_mac_call("-D", mac);
  89. }
  90. static int dat_parse_line(const char *line, struct in_addr *ip)
  91. {
  92. int ret;
  93. char *p;
  94. char *tok;
  95. p = strpbrk(line, "0123456789");
  96. if (!p) {
  97. fprintf(stderr, "Error: Can't find integer in: %s\n", line);
  98. return -EINVAL;
  99. }
  100. tok = strtok(p, " ");
  101. if (!tok) {
  102. fprintf(stderr, "Error: Can't find end of string': %s\n", line);
  103. return -EINVAL;
  104. }
  105. ret = inet_aton(p, ip);
  106. if (!ret) {
  107. fprintf(stderr, "Error: inet_aton failed on: %s\n", p);
  108. return -EINVAL;
  109. }
  110. return 0;
  111. }
  112. static void ebt_add_ip(struct in_addr ip)
  113. {
  114. int ret = addr_store_add(&ip, &ip_store);
  115. /* already stored or out-of-memory */
  116. if (ret)
  117. return;
  118. ebt_ip_call("-I", ip);
  119. }
  120. static void ebt_add_mac(struct mac_addr *mac)
  121. {
  122. int ret = addr_store_add(mac, &mac_store);
  123. /* already stored or out-of-memory */
  124. if (ret)
  125. return;
  126. ebt_mac_call("-I", mac);
  127. }
  128. static void ebt_dat_update(void)
  129. {
  130. FILE *fp;
  131. char line[256];
  132. char *pline;
  133. int ret;
  134. struct in_addr ip;
  135. fp = popen(BATCTL_DC, "r");
  136. if (!fp) {
  137. fprintf(stderr, "%i: Error: Could not call batctl dc\n", clock);
  138. return;
  139. }
  140. while (1) {
  141. pline = fgets(line, sizeof(line), fp);
  142. if (!pline) {
  143. if (!feof(fp))
  144. fprintf(stderr, "%i: Error: fgets() failed\n", clock);
  145. break;
  146. }
  147. ret = dat_parse_line(line, &ip);
  148. if (ret < 0) {
  149. fprintf(stderr, "%i: Error: Parsing line failed\n",
  150. clock);
  151. break;
  152. }
  153. ebt_add_ip(ip);
  154. }
  155. pclose(fp);
  156. }
  157. static int tl_parse_line(char *line, struct mac_addr *mac)
  158. {
  159. int ret;
  160. char *p;
  161. char *tok;
  162. p = strpbrk(line, "0123456789abcdef");
  163. if (!p) {
  164. fprintf(stderr, "Error: Can't find hex in: %s\n", line);
  165. return -EINVAL;
  166. }
  167. tok = strtok(p, " ");
  168. if (!tok) {
  169. fprintf(stderr, "Error: Can't find end of string': %s\n", line);
  170. return -EINVAL;
  171. }
  172. ret = mac_aton(p, mac);
  173. if (!ret) {
  174. fprintf(stderr, "Error: mac_aton failed on: %s\n", p);
  175. return -EINVAL;
  176. }
  177. return 0;
  178. }
  179. static void ebt_tl_update(void)
  180. {
  181. FILE *fp;
  182. char line[256];
  183. char *pline;
  184. int ret;
  185. struct mac_addr mac;
  186. fp = popen(BATCTL_TL, "r");
  187. if (!fp) {
  188. fprintf(stderr, "%i: Error: Could not call batctl tl\n", clock);
  189. return;
  190. }
  191. while (1) {
  192. pline = fgets(line, sizeof(line), fp);
  193. if (!pline) {
  194. if (!feof(fp))
  195. fprintf(stderr, "%i: Error: fgets() failed\n", clock);
  196. break;
  197. }
  198. ret = tl_parse_line(line, &mac);
  199. if (ret < 0) {
  200. fprintf(stderr, "%i: Error: Parsing line failed\n",
  201. clock);
  202. break;
  203. }
  204. ebt_add_mac(&mac);
  205. }
  206. pclose(fp);
  207. }
  208. static void ebt_dat_flush(void)
  209. {
  210. int ret = system(EBTABLES " -F ARP_LIMIT_DATCHECK");
  211. if (ret)
  212. fprintf(stderr, "Error flushing ARP_LIMIT_DATCHECK\n");
  213. }
  214. static void ebt_tl_flush(void)
  215. {
  216. int ret = system(EBTABLES " -F ARP_LIMIT_TLCHECK");
  217. if (ret)
  218. fprintf(stderr, "Error flushing ARP_LIMIT_TLCHECK\n");
  219. }
  220. int main(int argc, char *argv[])
  221. {
  222. ebt_dat_flush();
  223. ebt_tl_flush();
  224. /* necessary alignment for hashword() */
  225. BUILD_BUG_ON(sizeof(struct in_addr) % sizeof(uint32_t) != 0);
  226. BUILD_BUG_ON(sizeof(struct mac_addr) % sizeof(uint32_t) != 0);
  227. addr_store_init(sizeof(struct in_addr), &ip_node_destructor,
  228. addr_inet_ntoa, &ip_store);
  229. addr_store_init(sizeof(struct mac_addr), &mac_node_destructor,
  230. addr_mac_ntoa, &mac_store);
  231. while (1) {
  232. ebt_dat_update();
  233. addr_store_cleanup(&ip_store);
  234. ebt_tl_update();
  235. addr_store_cleanup(&mac_store);
  236. sleep(30);
  237. clock++;
  238. }
  239. return 0;
  240. }