Skip to content

libswoc: update maxmind plugin to IPSpace. #9208

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SolidWallOfCode merged 1 commit into from
Nov 21, 2022
Merged

libswoc: update maxmind plugin to IPSpace. #9208

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions include/tscpp/util/ts_ip.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -394,6 +394,9 @@ class IPAddrSet
/// @return Number of ranges in the set.
size_t count() const;

/// Remove all addresses in the set.
void clear();

protected:
/// Empty struct to use for payload.
/// This declares the struct and defines the singleton instance used.
Expand Down Expand Up @@ -435,6 +438,12 @@ IPAddrSet::count() const
return _addrs.count();
}

inline void
IPAddrSet::clear()
{
_addrs.clear();
}

inline bool
IPAddrSet::Mark::operator==(IPAddrSet::Mark::self_type const &that)
{
Expand Down
3 changes: 3 additions & 0 deletions lib/swoc/include/swoc/IPRange.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -373,6 +373,9 @@ class IPRange {
/// @return The IPv6 range.
IP6Range const & ip6() const { return _range._ip6; }

/// @return The range family.
sa_family_t family() const { return _family; }
Copy link
Member Author

@SolidWallOfCode SolidWallOfCode Nov 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On libswoc master, will be there in the next drop.


/** Compute the mask for @a this as a network.
*
* @return If @a this is a network, the mask for that network. Otherwise an invalid mask.
Expand Down
21 changes: 11 additions & 10 deletions plugins/experimental/maxmind_acl/mmdb.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,10 +242,10 @@ Acl::loaddeny(const YAML::Node &denyNode)
if (ip.IsSequence()) {
// Do IP Deny processing
for (auto &&i : ip) {
IpAddr min, max;
ats_ip_range_parse(std::string_view{i.as<std::string>()}, min, max);
deny_ip_map.fill(min, max, nullptr);
TSDebug(PLUGIN_NAME, "loading ip: valid: %d, fam %d ", min.isValid(), min.family());
if (swoc::IPRange r; r.load(i.Scalar())) {
deny_ip_map.fill(r);
TSDebug(PLUGIN_NAME, "Denying ip fam %d ", r.family());
}
}
} else {
TSDebug(PLUGIN_NAME, "Invalid IP deny list yaml");
Expand Down Expand Up @@ -323,10 +323,10 @@ Acl::loadallow(const YAML::Node &allowNode)
if (ip.IsSequence()) {
// Do IP Allow processing
for (auto &&i : ip) {
IpAddr min, max;
ats_ip_range_parse(std::string_view{i.as<std::string>()}, min, max);
allow_ip_map.fill(min, max, nullptr);
TSDebug(PLUGIN_NAME, "loading ip: valid: %d, fam %d ", min.isValid(), min.family());
if (swoc::IPRange r; r.load(i.Scalar())) {
allow_ip_map.fill(r);
TSDebug(PLUGIN_NAME, "loading ip: valid: fam %d ", r.family());
}
}
} else {
TSDebug(PLUGIN_NAME, "Invalid IP allow list yaml");
Expand Down Expand Up @@ -749,12 +749,13 @@ Acl::eval_ip(const sockaddr *sock) const
}
#endif

if (allow_ip_map.contains(sock, nullptr)) {
swoc::IPAddr addr(sock);
if (allow_ip_map.contains(addr)) {
// Allow map has this ip, we know we want to allow it
return ALLOW_IP;
}

if (deny_ip_map.contains(sock, nullptr)) {
if (deny_ip_map.contains(addr)) {
// Deny map has this ip, explicitly deny
return DENY_IP;
}
Expand Down
6 changes: 3 additions & 3 deletions plugins/experimental/maxmind_acl/mmdb.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
#include <unistd.h>
#include <iterator>
#include <maxminddb.h>
#include "tscore/IpMap.h"
#include "tscpp/util/ts_ip.h"

#ifdef HAVE_PCRE_PCRE_H
#include <pcre/pcre.h>
Expand Down Expand Up @@ -91,8 +91,8 @@ class Acl
std::unordered_map<std::string, std::vector<plugin_regex>> allow_regex;
std::unordered_map<std::string, std::vector<plugin_regex>> deny_regex;

IpMap allow_ip_map;
IpMap deny_ip_map;
ts::IPAddrSet allow_ip_map;
ts::IPAddrSet deny_ip_map;

// Anonymous blocking default to off
bool _anonymous_ip = false;
Expand Down