Merge pull request #287 from edk0/filter
Add extensions/filter (port from ircd-seven)
This commit is contained in:
Aaron Jones
GitHub
commit
58a7048006
5 changed files with 498 additions and 5 deletions
|
|
@ -18,25 +18,25 @@ matrix:
|
|||
compiler: gcc-7
|
||||
addons:
|
||||
apt:
|
||||
packages: ['gcc-7', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo']
|
||||
packages: ['gcc-7', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo', 'libhyperscan-dev']
|
||||
|
||||
- os: linux
|
||||
compiler: gcc-8
|
||||
addons:
|
||||
apt:
|
||||
packages: ['gcc-8', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo']
|
||||
packages: ['gcc-8', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo', 'libhyperscan-dev']
|
||||
|
||||
- os: linux
|
||||
compiler: clang-7
|
||||
addons:
|
||||
apt:
|
||||
packages: ['clang-7', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo']
|
||||
packages: ['clang-7', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo', 'libhyperscan-dev']
|
||||
|
||||
- os: linux
|
||||
compiler: clang-8
|
||||
addons:
|
||||
apt:
|
||||
packages: ['clang-8', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo']
|
||||
packages: ['clang-8', 'automake', 'autoconf', 'libtool', 'shtool', 'libsqlite3-dev', 'python-sphinx', 'texinfo', 'libhyperscan-dev']
|
||||
|
||||
- os: osx
|
||||
osx_image: xcode7.3
|
||||
|
|
|
|||
22
configure.ac
22
configure.ac
|
|
@ -320,6 +320,28 @@ dnl End OpenSSL detection
|
|||
dnl Specialized functions and libraries
|
||||
dnl ===================================
|
||||
|
||||
AC_ARG_ENABLE(hyperscan,
|
||||
AC_HELP_STRING([--disable-hyperscan],[Disable hyperscan support]),
|
||||
[hyperscan=$enableval],[hyperscan=yes])
|
||||
|
||||
AS_IF([test "$hyperscan" = yes], [
|
||||
save_CPPFLAGS="$CPPFLAGS"
|
||||
save_LIBS="$LIBS"
|
||||
PKG_CHECK_MODULES([HS], [libhs >= 4], [], [hyperscan=no])
|
||||
CPPFLAGS="$CPPFLAGS $HS_CFLAGS"
|
||||
LIBS="$LIBS $HS_LIBS"
|
||||
AC_CHECK_HEADER([hs_common.h], [], [hyperscan=no])
|
||||
AC_CHECK_FUNC([hs_scan], [], [hyperscan=no])
|
||||
])
|
||||
|
||||
AS_IF([test "$hyperscan" = no], [
|
||||
CPPFLAGS="$save_CPPFLAGS"
|
||||
LIBS="$save_LIBS"
|
||||
])
|
||||
|
||||
AM_CONDITIONAL([HAVE_HYPERSCAN], [test "$hyperscan" = "yes"])
|
||||
|
||||
|
||||
AC_ARG_WITH(zlib-path,
|
||||
AC_HELP_STRING([--with-zlib-path=DIR],[Path to libz.so for ziplinks support.]),
|
||||
[LIBS="$LIBS -L$withval"],)
|
||||
|
|
|
|||
|
|
@ -77,3 +77,7 @@ extension_LTLIBRARIES = \
|
|||
spy_trace_notice.la \
|
||||
drain.la \
|
||||
example_module.la
|
||||
|
||||
if HAVE_HYPERSCAN
|
||||
extension_LTLIBRARIES += filter.la
|
||||
endif
|
||||
|
|
|
|||
467
extensions/filter.c
Normal file
467
extensions/filter.c
Normal file
|
|
@ -0,0 +1,467 @@
|
|||
/*
|
||||
* ircd-ratbox: A slightly useful ircd.
|
||||
* filter.c: Drop messages we don't like
|
||||
*
|
||||
* Copyright (C) 1990 Jarkko Oikarinen and University of Oulu, Co Center
|
||||
* Copyright (C) 1996-2002 Hybrid Development Team
|
||||
* Copyright (C) 2002-2005 ircd-ratbox development team
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
|
||||
* USA
|
||||
*
|
||||
* $Id$
|
||||
*/
|
||||
|
||||
#include "stdinc.h"
|
||||
#include "channel.h"
|
||||
#include "client.h"
|
||||
#include "chmode.h"
|
||||
#include "match.h"
|
||||
#include "ircd.h"
|
||||
#include "numeric.h"
|
||||
#include "send.h"
|
||||
#include "s_newconf.h"
|
||||
#include "s_serv.h"
|
||||
#include "s_user.h"
|
||||
#include "msg.h"
|
||||
#include "parse.h"
|
||||
#include "modules.h"
|
||||
#include "operhash.h"
|
||||
#include "inline/stringops.h"
|
||||
#include "msgbuf.h"
|
||||
|
||||
#include <hs_common.h>
|
||||
#include <hs_runtime.h>
|
||||
|
||||
#define FILTER_NICK 0
|
||||
#define FILTER_USER 0
|
||||
#define FILTER_HOST 0
|
||||
|
||||
#define FILTER_EXIT_MSG "Connection closed"
|
||||
|
||||
static const char filter_desc[] = "Filter messages using a precompiled Hyperscan database";
|
||||
|
||||
static void filter_msg_user(void *data);
|
||||
static void filter_msg_channel(void *data);
|
||||
static void on_client_exit(void *data);
|
||||
|
||||
static void mo_setfilter(struct MsgBuf *, struct Client *, struct Client *, int, const char **);
|
||||
static void me_setfilter(struct MsgBuf *, struct Client *, struct Client *, int, const char **);
|
||||
|
||||
static char *filter_data = NULL;
|
||||
static size_t filter_data_len = 0;
|
||||
static hs_database_t *filter_db;
|
||||
static hs_scratch_t *filter_scratch;
|
||||
|
||||
static int filter_enable = 1;
|
||||
|
||||
static const char *cmdname[MESSAGE_TYPE_COUNT] = {
|
||||
[MESSAGE_TYPE_PRIVMSG] = "PRIVMSG",
|
||||
[MESSAGE_TYPE_NOTICE] = "NOTICE",
|
||||
};
|
||||
|
||||
enum filter_state {
|
||||
FILTER_EMPTY,
|
||||
FILTER_FILLING,
|
||||
FILTER_LOADED
|
||||
};
|
||||
|
||||
#define ACT_DROP (1 << 0)
|
||||
#define ACT_KILL (1 << 1)
|
||||
#define ACT_ALARM (1 << 2)
|
||||
|
||||
static enum filter_state state = FILTER_EMPTY;
|
||||
static char check_str[21] = "";
|
||||
|
||||
static unsigned filter_chmode, filter_umode;
|
||||
|
||||
mapi_hfn_list_av1 filter_hfnlist[] = {
|
||||
{ "privmsg_user", (hookfn) filter_msg_user },
|
||||
{ "privmsg_channel", (hookfn) filter_msg_channel },
|
||||
{ "client_exit", (hookfn) on_client_exit },
|
||||
{ NULL, NULL }
|
||||
};
|
||||
|
||||
|
||||
struct Message setfilter_msgtab = {
|
||||
"SETFILTER", 0, 0, 0, 0,
|
||||
{mg_unreg, mg_not_oper, mg_ignore, mg_ignore, {me_setfilter, 2}, {mo_setfilter, 2}}
|
||||
};
|
||||
|
||||
static int
|
||||
modinit(void)
|
||||
{
|
||||
filter_umode = user_modes['u'] = find_umode_slot();
|
||||
construct_umodebuf();
|
||||
filter_chmode = cflag_add('u', chm_simple);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void
|
||||
moddeinit(void)
|
||||
{
|
||||
if (filter_umode) {
|
||||
user_modes['u'] = 0;
|
||||
construct_umodebuf();
|
||||
}
|
||||
if (filter_chmode)
|
||||
cflag_orphan('u');
|
||||
if (filter_scratch)
|
||||
hs_free_scratch(filter_scratch);
|
||||
if (filter_db)
|
||||
hs_free_database(filter_db);
|
||||
if (filter_data)
|
||||
rb_free(filter_data);
|
||||
}
|
||||
|
||||
|
||||
mapi_clist_av1 filter_clist[] = { &setfilter_msgtab, NULL };
|
||||
|
||||
DECLARE_MODULE_AV2(filter, modinit, moddeinit, filter_clist, NULL, filter_hfnlist, NULL, "0.4", filter_desc);
|
||||
|
||||
static int
|
||||
setfilter(const char *check, const char *data, const char **error)
|
||||
{
|
||||
if (error) *error = "unknown";
|
||||
|
||||
if (!strcasecmp(data, "disable")) {
|
||||
filter_enable = 0;
|
||||
sendto_realops_snomask(SNO_GENERAL, L_ALL | L_NETWIDE,
|
||||
"Filtering disabled.");
|
||||
return 0;
|
||||
}
|
||||
if (!strcasecmp(data, "enable")) {
|
||||
filter_enable = 1;
|
||||
sendto_realops_snomask(SNO_GENERAL, L_ALL | L_NETWIDE,
|
||||
"Filtering enabled.");
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (strlen(check) > sizeof check_str - 1) {
|
||||
if (error) *error = "check string too long";
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (!strcasecmp(data, "new")) {
|
||||
if (state == FILTER_FILLING) {
|
||||
rb_free(filter_data);
|
||||
filter_data = 0;
|
||||
filter_data_len = 0;
|
||||
}
|
||||
state = FILTER_FILLING;
|
||||
strcpy(check_str, check);
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (!strcasecmp(data, "drop")) {
|
||||
if (!filter_db) {
|
||||
if (error) *error = "no database to drop";
|
||||
return -1;
|
||||
}
|
||||
hs_free_database(filter_db);
|
||||
filter_db = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (!strcasecmp(data, "abort")) {
|
||||
if (state != FILTER_FILLING) {
|
||||
if (error) *error = "not filling";
|
||||
return -1;
|
||||
}
|
||||
state = filter_db ? FILTER_LOADED : FILTER_EMPTY;
|
||||
rb_free(filter_data);
|
||||
filter_data = 0;
|
||||
filter_data_len = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (strcmp(check, check_str) != 0) {
|
||||
if (error) *error = "check strings don't match";
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (!strcasecmp(data, "apply")) {
|
||||
if (state != FILTER_FILLING) {
|
||||
if (error) *error = "not loading anything";
|
||||
return -1;
|
||||
}
|
||||
hs_database_t *db;
|
||||
hs_error_t r = hs_deserialize_database(filter_data, filter_data_len, &db);
|
||||
if (r != HS_SUCCESS) {
|
||||
if (error) *error = "couldn't deserialize db";
|
||||
return -1;
|
||||
}
|
||||
r = hs_alloc_scratch(db, &filter_scratch);
|
||||
if (r != HS_SUCCESS) {
|
||||
if (error) *error = "couldn't allocate scratch";
|
||||
hs_free_database(db);
|
||||
return -1;
|
||||
}
|
||||
if (filter_db) {
|
||||
hs_free_database(filter_db);
|
||||
}
|
||||
state = FILTER_LOADED;
|
||||
filter_db = db;
|
||||
sendto_realops_snomask(SNO_GENERAL, L_ALL | L_NETWIDE,
|
||||
"New filters loaded.");
|
||||
rb_free(filter_data);
|
||||
filter_data = 0;
|
||||
filter_data_len = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (*data != '+') {
|
||||
if (error) *error = "unknown command or data doesn't start with +";
|
||||
return -1;
|
||||
}
|
||||
|
||||
data += 1;
|
||||
|
||||
if (state == FILTER_FILLING) {
|
||||
int dl;
|
||||
unsigned char *d = rb_base64_decode((unsigned char *)data, strlen(data), &dl);
|
||||
if (!d) {
|
||||
if (error) *error = "invalid data";
|
||||
return -1;
|
||||
}
|
||||
if (filter_data_len + dl > 10000000ul) {
|
||||
if (error) *error = "data over size limit";
|
||||
rb_free(d);
|
||||
return -1;
|
||||
}
|
||||
filter_data = rb_realloc(filter_data, filter_data_len + dl);
|
||||
memcpy(filter_data + filter_data_len, d, dl);
|
||||
rb_free(d);
|
||||
filter_data_len += dl;
|
||||
} else {
|
||||
if (error) *error = "send \"new\" first";
|
||||
return -1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* /SETFILTER [server-mask] <check> { NEW | APPLY | <data> }
|
||||
* <check> must be the same for the entirety of a new...data...apply run,
|
||||
* and exists just to ensure runs don't mix
|
||||
* NEW prepares a buffer to receive a hyperscan database
|
||||
* <data> is base64 encoded chunks of hyperscan database, which are decoded
|
||||
* and appended to the buffer
|
||||
* APPLY deserialises the buffer and sets the resulting hyperscan database
|
||||
* as the one to use for filtering */
|
||||
static void
|
||||
mo_setfilter(struct MsgBuf *msgbuf, struct Client *client_p, struct Client *source_p, int parc, const char **parv)
|
||||
{
|
||||
int for_me = 0;
|
||||
const char *check;
|
||||
const char *data;
|
||||
if (!IsOperAdmin(source_p)) {
|
||||
sendto_one(source_p, form_str(ERR_NOPRIVS), me.name, source_p->name, "admin");
|
||||
return;
|
||||
}
|
||||
if (parc == 4) {
|
||||
check = parv[2];
|
||||
data = parv[3];
|
||||
if(match(parv[1], me.name)) {
|
||||
for_me = 1;
|
||||
}
|
||||
sendto_match_servs(source_p, parv[1],
|
||||
CAP_ENCAP, NOCAPS,
|
||||
"ENCAP %s SETFILTER %s :%s", parv[1], check, data);
|
||||
} else if (parc == 3) {
|
||||
check = parv[1];
|
||||
data = parv[2];
|
||||
for_me = 1;
|
||||
} else {
|
||||
sendto_one_notice(source_p, ":SETFILTER needs 2 or 3 params, have %d", parc - 1);
|
||||
return;
|
||||
}
|
||||
if (for_me) {
|
||||
const char *error;
|
||||
int r = setfilter(check, data, &error);
|
||||
if (r) {
|
||||
sendto_one_notice(source_p, ":SETFILTER failed: %s", error);
|
||||
} else {
|
||||
sendto_one_notice(source_p, ":SETFILTER ok");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
me_setfilter(struct MsgBuf *msgbuf, struct Client *client_p, struct Client *source_p, int parc, const char **parv)
|
||||
{
|
||||
if(!IsPerson(source_p))
|
||||
return;
|
||||
|
||||
const char *error;
|
||||
int r = setfilter(parv[1], parv[2], &error);
|
||||
if (r) {
|
||||
sendto_one_notice(source_p, ":SETFILTER failed: %s", error);
|
||||
}
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
/* will be called for every match
|
||||
* hyperscan provides us one piece of information about the expression
|
||||
* matched, an integer ID. we're co-opting the lowest 3 bits of this
|
||||
* as a flag set. conveniently, this means all we really need to do
|
||||
* here is or the IDs together. */
|
||||
int match_callback(unsigned id,
|
||||
unsigned long long from,
|
||||
unsigned long long to,
|
||||
unsigned flags,
|
||||
void *context_)
|
||||
{
|
||||
unsigned *context = context_;
|
||||
*context |= id;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static char check_buffer[2000];
|
||||
static char clean_buffer[BUFSIZE];
|
||||
|
||||
unsigned match_message(const char *prefix,
|
||||
struct Client *source,
|
||||
const char *command,
|
||||
const char *target,
|
||||
const char *msg)
|
||||
{
|
||||
unsigned state = 0;
|
||||
if (!filter_enable)
|
||||
return 0;
|
||||
if (!filter_db)
|
||||
return 0;
|
||||
snprintf(check_buffer, sizeof check_buffer, "%s:%s!%s@%s#%c %s %s :%s",
|
||||
prefix,
|
||||
#if FILTER_NICK
|
||||
source->name,
|
||||
#else
|
||||
"*",
|
||||
#endif
|
||||
#if FILTER_USER
|
||||
source->username,
|
||||
#else
|
||||
"*",
|
||||
#endif
|
||||
#if FILTER_HOST
|
||||
source->host,
|
||||
#else
|
||||
"*",
|
||||
#endif
|
||||
source->user && source->user->suser[0] != '\0' ? '1' : '0',
|
||||
command, target,
|
||||
msg);
|
||||
hs_error_t r = hs_scan(filter_db, check_buffer, strlen(check_buffer), 0, filter_scratch, match_callback, &state);
|
||||
if (r != HS_SUCCESS && r != HS_SCAN_TERMINATED)
|
||||
return 0;
|
||||
return state;
|
||||
}
|
||||
|
||||
void
|
||||
filter_msg_user(void *data_)
|
||||
{
|
||||
hook_data_privmsg_user *data = data_;
|
||||
struct Client *s = data->source_p;
|
||||
/* we only need to filter once */
|
||||
if (!MyClient(s)) {
|
||||
return;
|
||||
}
|
||||
/* opers are immune to checking, for obvious reasons
|
||||
* anything sent to an oper is also immune, because that should make it
|
||||
* less impossible to deal with reports. */
|
||||
if (IsOper(s) || IsOper(data->target_p)) {
|
||||
return;
|
||||
}
|
||||
if (data->target_p->umodes & filter_umode) {
|
||||
return;
|
||||
}
|
||||
char *text = strcpy(clean_buffer, data->text);
|
||||
strip_colour(text);
|
||||
strip_unprintable(text);
|
||||
unsigned r = match_message("0", s, cmdname[data->msgtype], "0", data->text) |
|
||||
match_message("1", s, cmdname[data->msgtype], "0", text);
|
||||
if (r & ACT_DROP) {
|
||||
if (data->msgtype == MESSAGE_TYPE_PRIVMSG) {
|
||||
sendto_one_numeric(s, ERR_CANNOTSENDTOCHAN,
|
||||
form_str(ERR_CANNOTSENDTOCHAN),
|
||||
data->target_p->name);
|
||||
}
|
||||
data->approved = 1;
|
||||
}
|
||||
if (r & ACT_ALARM) {
|
||||
sendto_realops_snomask(SNO_GENERAL, L_ALL | L_NETWIDE,
|
||||
"FILTER: %s!%s@%s [%s]",
|
||||
s->name, s->username, s->host, s->sockhost);
|
||||
}
|
||||
if (r & ACT_KILL) {
|
||||
data->approved = 1;
|
||||
exit_client(NULL, s, s, FILTER_EXIT_MSG);
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
filter_msg_channel(void *data_)
|
||||
{
|
||||
hook_data_privmsg_channel *data = data_;
|
||||
struct Client *s = data->source_p;
|
||||
/* we only need to filter once */
|
||||
if (!MyClient(s)) {
|
||||
return;
|
||||
}
|
||||
/* just normal oper immunity for channels. i'd like to have a mode that
|
||||
* disables the filter per-channel, but that's for the future */
|
||||
if (IsOper(s)) {
|
||||
return;
|
||||
}
|
||||
if (data->chptr->mode.mode & filter_chmode) {
|
||||
return;
|
||||
}
|
||||
char *text = strcpy(clean_buffer, data->text);
|
||||
strip_colour(text);
|
||||
strip_unprintable(text);
|
||||
unsigned r = match_message("0", s, cmdname[data->msgtype], data->chptr->chname, data->text) |
|
||||
match_message("1", s, cmdname[data->msgtype], data->chptr->chname, text);
|
||||
if (r & ACT_DROP) {
|
||||
if (data->msgtype == MESSAGE_TYPE_PRIVMSG) {
|
||||
sendto_one_numeric(s, ERR_CANNOTSENDTOCHAN,
|
||||
form_str(ERR_CANNOTSENDTOCHAN),
|
||||
data->chptr->chname);
|
||||
}
|
||||
data->approved = 1;
|
||||
}
|
||||
if (r & ACT_ALARM) {
|
||||
sendto_realops_snomask(SNO_GENERAL, L_ALL | L_NETWIDE,
|
||||
"FILTER: %s!%s@%s [%s]",
|
||||
s->name, s->username, s->host, s->sockhost);
|
||||
}
|
||||
if (r & ACT_KILL) {
|
||||
data->approved = 1;
|
||||
exit_client(NULL, s, s, FILTER_EXIT_MSG);
|
||||
}
|
||||
}
|
||||
|
||||
void
|
||||
on_client_exit(void *data_)
|
||||
{
|
||||
/* If we see a netsplit, abort the current FILTER_FILLING attempt */
|
||||
hook_data_client_exit *data = data_;
|
||||
|
||||
if (!IsServer(data->target)) return;
|
||||
|
||||
if (state == FILTER_FILLING) {
|
||||
state = filter_db ? FILTER_LOADED : FILTER_EMPTY;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -143,7 +143,7 @@
|
|||
#define NUMERIC_STR_401 "%s :No such nick/channel"
|
||||
#define NUMERIC_STR_402 "%s :No such server"
|
||||
#define NUMERIC_STR_403 "%s :No such channel"
|
||||
#define NUMERIC_STR_404 "%s :Cannot send to channel"
|
||||
#define NUMERIC_STR_404 "%s :Cannot send to nick/channel"
|
||||
#define NUMERIC_STR_405 ":%s 405 %s %s :You have joined too many channels"
|
||||
#define NUMERIC_STR_406 ":%s :There was no such nickname"
|
||||
#define NUMERIC_STR_407 ":%s 407 %s %s :Too many recipients."
|
||||
|
|
|
|||
Loading…
Reference in a new issue