geod.c

//  geod.c
//  geod
//
//  Created by Dr. Rolf Jansen on 2016-07-14.
//  Copyright © 2016-2018 Dr. Rolf Jansen. All rights reserved.
//
//  Redistribution and use in source and binary forms, with or without modification,
//  are permitted provided that the following conditions are met:
//
//  1. Redistributions of source code must retain the above copyright notice,
//     this list of conditions and the following disclaimer.
//
//  2. Redistributions in binary form must reproduce the above copyright notice,
//     this list of conditions and the following disclaimer in the documentation
//     and/or other materials provided with the distribution.
//
//  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS
//  OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
//  AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER
//  OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
//  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
//  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
//  IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
//  THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.


#include <stdlib.h>
#include <stdio.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stddef.h>
#include <math.h>
#include <time.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <string.h>
#include <syslog.h>
#include <unistd.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/time.h>

#include "utils.h"
#include "uint128t.h"
#include "store.h"

#define DAEMON_NAME "geod"

const char *pidfname = "/var/run/"DAEMON_NAME".pid";


void usage(const char *executable)
{
   const char *r = executable + strvlen(executable);
   while (--r >= executable && *r != '/'); r++;
   printf("%s v1.0 (" SCMREV "), Copyright © 2016-2018 Dr. Rolf Jansen\n", r);
   printf("Usage:  %s [-a AA:BB:..] [-d DD:EE:..] [-r bstfile] [-p pidfile] [-f] [-n] [-h]\n", r);
   printf(" -a AA:BB:.. allow IPv4 source addresses from the listed countries,\n");
   printf("             i.e, 2 letter capital country codes, separated by colon.\n");
   printf(" -d DD:EE:.. deny IPv4 source addresses from the listed countries.\n");
   printf("             NOTE: the -a and the -d option are mutually exclusive.\n");
   printf(" -r bstfile  the path to the binary file with the consolidated IP ranges that has been.\n");
   printf("             generated by the 'ipdb' tool [default: /usr/local/etc/ipdb/IPRanges/ipcc.bst].\n");
   printf(" -p pidfile  the path to the pid file [default: /var/run/"DAEMON_NAME".pid].\n");
   printf(" -f          foreground mode, don't fork off as a daemon.\n");
   printf(" -n          no console, don't fork off as a daemon - started/managed by initd, launchd, etc.\n");
   printf(" -h          show these usage instructions.\n\n");
}


static void signals(int sig)
{
   switch (sig)
   {
      case SIGHUP:
         syslog(LOG_ERR, "Received SIGHUP signal.");
         kill(0, SIGHUP);
         unlink(pidfname);
         exit(0);
         break;

      case SIGINT:
         syslog(LOG_ERR, "Received SIGINT signal.");
         kill(0, SIGINT);
         unlink(pidfname);
         exit(0);
         break;

      case SIGQUIT:
         syslog(LOG_ERR, "Received SIGQUIT signal.");
         kill(0, SIGQUIT);
         unlink(pidfname);
         exit(0);
         break;

      case SIGTERM:
         syslog(LOG_ERR, "Received SIGTERM signal.");
         kill(0, SIGTERM);
         unlink(pidfname);
         exit(0);
         break;

      default:
         syslog(LOG_ERR, "Unhandled signal (%d) %s", sig, strsignal(sig));
         break;
   }
}


typedef enum
{
   noDaemon,
   launchdDaemon,
   discreteDaemon
} DaemonKind;


void daemonize(DaemonKind kind)
{
   switch (kind)
   {
      case noDaemon:
         openlog(DAEMON_NAME, LOG_NDELAY | LOG_PID | LOG_CONS, LOG_USER);
         break;

      case launchdDaemon:
         signal(SIGTERM, signals);
         openlog(DAEMON_NAME, LOG_NDELAY | LOG_PID, LOG_USER);
         break;

      case discreteDaemon:
      {
         // fork off the parent process
         pid_t pid = fork();

         if (pid < 0)
            exit(EXIT_FAILURE);

         // if we got a good PID, then we can exit the parent process.
         if (pid > 0)
            exit(EXIT_SUCCESS);

         // The child process continues here.
         // first close all open descriptors
         for (int i = getdtablesize(); i >= 0; --i)
            close(i);

         // re-open stdin, stdout, stderr connected to /dev/null
         int inouterr = open("/dev/null", O_RDWR);    // stdin
         dup(inouterr);                               // stdout
         dup(inouterr);                               // stderr

         // Change the file mode mask, 027 = complement of 750
         umask(027);

         pid_t sid = setsid();
         if (sid < 0)
            exit(EXIT_FAILURE);     // should log the failure before exiting?

         // Check and write our pid lock file
         // and mutually exclude other instances from running
         int pidfile = open(pidfname, O_RDWR|O_CREAT, 0640);
         if (pidfile < 0)
            exit(1);                // can not open our pid file

         if (lockf(pidfile, F_TLOCK, 0) < 0)
            exit(0);                // can not lock our pid file -- was locked already

         // only first instance continues beyound this
         char s[256];
         int  l = snprintf(s, 256, "%d\n", getpid());
         write(pidfile, s, l);      // record pid to our pid file

         signal(SIGHUP,  signals);
         signal(SIGINT,  signals);
         signal(SIGQUIT, signals);
         signal(SIGTERM, signals);
         signal(SIGCHLD, SIG_IGN);  // ignore child
         signal(SIGTSTP, SIG_IGN);  // ignore tty signals
         signal(SIGTTOU, SIG_IGN);
         signal(SIGTTIN, SIG_IGN);

         openlog(DAEMON_NAME, LOG_NDELAY | LOG_PID, LOG_USER);
         break;
      }
   }
}


bool allowMatch = true;

CCNode **CCTable = NULL;
IP4Set  *sortedIP4Sets = NULL;

void releaseStores(void)
{
   deallocate(VPR(sortedIP4Sets), false);
   releaseCCTable(CCTable);
}

int main(int argc, char *argv[])
{
   int   ch, rc     = 0;
   char *cmd        = argv[0];
   char *allowList  = NULL,
        *denyList   = NULL,
        *bstfname   = "/usr/local/etc/ipdb/IPRanges/ipcc.bst";
   DaemonKind dKind = discreteDaemon;

   while ((ch = getopt(argc, argv, "a:d:r:p:fnh")) != -1)
   {
      switch (ch)
      {
         case 'a':
            if (!denyList)
               allowList = optarg;
            else
               goto arg_err;
            break;

         case 'd':
            if (!allowList)
            {
               denyList = optarg;
               allowMatch = false;
            }
            else
               goto arg_err;
            break;

         case 'r':
            bstfname = optarg;
            break;

         case 'p':
            pidfname = optarg;
            break;

         case 'f':
            dKind = noDaemon;
            break;

         case 'n':
            dKind = launchdDaemon;
            break;

         arg_err:
            printf("Incorrect argument:\n -%c %s, ...\n\n", ch, optarg);
         default:
            rc = 1;
         case 'h':
            usage(cmd);
            return rc;
      }
   }

   argc -= optind;
   argv += optind;

   if (argc != 0)
   {
      printf("Wrong number of arguments:\n %s, ...\n\n", argv[0]);
      usage(cmd);
      return 1;
   }

   daemonize(dKind);

   char *cc = (allowList) ?: denyList;
   if (cc)
   {
      CCTable = createCCTable();

      while (*cc)
      {
         int tl = collen(cc);
         if (cc[tl] == ':')
            cc[tl++] = '\0';
         storeCC(CCTable, *(uint16_t *)cc, 0);
         cc += tl;
      }
   }

   struct stat st;
   FILE *in;
   if (stat(bstfname, &st) == no_error && st.st_size && (in = fopen(bstfname, "r")))
   {
      sortedIP4Sets = allocate((ssize_t)st.st_size, false, default_align);
      atexit(releaseStores);
      rc = (int)fread(sortedIP4Sets, (ssize_t)st.st_size, 1, in);
      fclose(in);
      if (!rc)
      {
         syslog(LOG_ERR, "IPv4 database file could not be loaded.");
         exit(EXIT_FAILURE);
      }

      int divertSock;
      if ((divertSock = socket(PF_INET, SOCK_RAW, IPPROTO_DIVERT)) < 0)
      {
         syslog(LOG_ERR, "Error creating the divert socket: %d", errno);
         exit(EXIT_FAILURE);
      }

      struct sockaddr_in divertAddress = {};
      divertAddress.sin_family = AF_INET;
      divertAddress.sin_port = htons(8669);
      if (bind(divertSock, (struct sockaddr *)&divertAddress, sizeof(divertAddress)) < 0)
      {
         syslog(LOG_ERR, "Error calling bind() on the divert socket: %d", errno);
         exit(EXIT_FAILURE);
      }

      uint8_t buffer[IP_MAXPACKET];
      struct ip *ip = (struct ip*)buffer;
      struct sockaddr_in addr;
      socklen_t addrlen = sizeof(addr);
      ssize_t recvlen, sendlen;

      int o, n = (int)(st.st_size/sizeof(IP4Set));

      for (;;)
      {
         if ((recvlen = recvfrom(divertSock, buffer, IP_MAXPACKET, 0, (struct sockaddr *)&addr, &addrlen)) < 0)
         {
            syslog(LOG_ERR, "Error receiving raw data from the divert socket: %d", errno);
            exit(EXIT_FAILURE);
         }

         // don't filter if no CC list was given or if the source IP cannot be found in the IP ranges sets
         if (CCTable && (o = bisectionIP4Search(htonl(ip->ip_src.s_addr), sortedIP4Sets, n)) >= 0)
         {
            bool doesMatch = findCC(CCTable, sortedIP4Sets[o].cc) != NULL;
            if (allowMatch && !doesMatch || !allowMatch && doesMatch)
               continue;
         }

         if ((sendlen = sendto(divertSock, buffer, recvlen, 0, (struct sockaddr *)&addr, sizeof(addr))) < 0)
         {
            syslog(LOG_ERR, "Error sending raw data to the divert socket: %d", errno);
            exit(EXIT_FAILURE);
         }
      }

      return 0;
   }

   return 1;
}