varnish-cache/vmod/vmod_debug_acl.c
0
/*-
1
 * Copyright (c) 2012-2019 Varnish Software AS
2
 * All rights reserved.
3
 *
4
 * Author: Poul-Henning Kamp <phk@FreeBSD.org>
5
 *
6
 * SPDX-License-Identifier: BSD-2-Clause
7
 *
8
 * Redistribution and use in source and binary forms, with or without
9
 * modification, are permitted provided that the following conditions
10
 * are met:
11
 * 1. Redistributions of source code must retain the above copyright
12
 *    notice, this list of conditions and the following disclaimer.
13
 * 2. Redistributions in binary form must reproduce the above copyright
14
 *    notice, this list of conditions and the following disclaimer in the
15
 *    documentation and/or other materials provided with the distribution.
16
 *
17
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20
 * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
21
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27
 * SUCH DAMAGE.
28
 */
29
30
#include "config.h"
31
32
#include <stdlib.h>
33
#include <stdio.h>
34
#include <string.h>
35
#include <sys/socket.h>
36
#include <unistd.h>
37
38
// #include "vdef.h"
39
//#include "vas.h"
40
#include "cache/cache.h"
41
#include "vend.h"
42
#include "vsa.h"
43
#include "vsb.h"
44
#include "vsha256.h"
45
#include "vtcp.h"
46
#include "vtim.h"
47
#include "vcc_debug_if.h"
48
49
VCL_ACL v_matchproto_(td_debug_null_acl)
50 50
xyzzy_null_acl(VRT_CTX)
51
{
52
53 50
        CHECK_OBJ_ORNULL(ctx, VRT_CTX_MAGIC);
54 50
        return (NULL);
55
}
56
57
VCL_ACL v_matchproto_(td_debug_acl)
58 25
xyzzy_acl(VRT_CTX, VCL_ACL acl)
59
{
60
61 25
        CHECK_OBJ_ORNULL(ctx, VRT_CTX_MAGIC);
62 25
        return (acl);
63
}
64
65
VCL_BOOL v_matchproto_(td_debug_match_acl)
66 50
xyzzy_match_acl(VRT_CTX, VCL_ACL acl, VCL_IP ip)
67
{
68
69 50
        CHECK_OBJ_ORNULL(ctx, VRT_CTX_MAGIC);
70 50
        assert(VSA_Sane(ip));
71
72 50
        return (VRT_acl_match(ctx, acl, ip));
73
}
74
75
/*
76
 * The code below is more intimate with VSA than anything is supposed to.
77
 */
78
79
struct acl_sweep {
80
        int                     family;
81
        const uint8_t           *ip0_p;
82
        const uint8_t           *ip1_p;
83
        struct suckaddr         *probe;
84
        uint8_t                 *probe_p;
85
        VCL_INT                 step;
86
        uint64_t                reset;
87
        uint64_t                that;
88
        uint64_t                count;
89
};
90
91
static void
92 25000
reset_sweep(struct acl_sweep *asw)
93
{
94 25000
        asw->that = asw->reset;
95 25000
}
96
97
static int
98 200
setup_sweep(VRT_CTX, struct acl_sweep *asw, VCL_IP ip0, VCL_IP ip1,
99
    VCL_INT step)
100
{
101
        int fam0, fam1;
102
        const uint8_t *ptr;
103
104 200
        AN(asw);
105 200
        memset(asw, 0, sizeof *asw);
106
107 200
        AN(ip0);
108 200
        AN(ip1);
109 200
        fam0 = VSA_GetPtr(ip0, &asw->ip0_p);
110 200
        fam1 = VSA_GetPtr(ip1, &asw->ip1_p);
111 200
        if (fam0 != fam1) {
112 0
                VRT_fail(ctx, "IPs have different families (0x%x vs 0x%x)",
113 0
                    fam0, fam1);
114 0
                return (-1);
115
        }
116
117 200
        asw->family = fam0;
118 200
        if (asw->family == PF_INET) {
119 75
                if (memcmp(asw->ip0_p, asw->ip1_p, 4) > 0) {
120 0
                        VRT_fail(ctx, "Sweep: ipv4.end < ipv4.start");
121 0
                        return (-1);
122
                }
123 75
                asw->reset = vbe32dec(asw->ip0_p);
124 75
        } else {
125 125
                if (memcmp(asw->ip0_p, asw->ip1_p, 16) > 0) {
126 0
                        VRT_fail(ctx, "Sweep: ipv6.end < ipv6.start");
127 0
                        return (-1);
128
                }
129 125
                asw->reset = vbe64dec(asw->ip0_p + 8);
130
        }
131 200
        asw->that = asw->reset;
132
133
        /* Dont try this at home */
134 200
        asw->probe = malloc(vsa_suckaddr_len);
135 200
        AN(asw->probe);
136 200
        memcpy(asw->probe, ip0, vsa_suckaddr_len);
137 200
        (void)VSA_GetPtr(asw->probe, &ptr);
138 200
        asw->probe_p = ((uint8_t*)(asw->probe)) + (ptr - (uint8_t*)asw->probe);
139
140 200
        asw->step = step;
141
142 200
        return (0);
143 200
}
144
145
static void
146 200
cleanup_sweep(struct acl_sweep *asw)
147
{
148 200
        free(asw->probe);
149 200
        memset(asw, 0, sizeof *asw);
150 200
}
151
152
static int
153 2409750
step_sweep(struct acl_sweep *asw)
154
{
155
156 2409750
        AN(asw);
157 2409750
        asw->count++;
158 2409750
        asw->that += asw->step;
159 2409750
        if (asw->family == PF_INET) {
160 2475
                vbe32enc(asw->probe_p, asw->that);
161 2475
                return (memcmp(asw->probe_p, asw->ip1_p, 4));
162
        } else {
163 2407275
                vbe64enc(asw->probe_p + 8, asw->that);
164 2407275
                return (memcmp(asw->probe_p, asw->ip1_p, 16));
165
        }
166 2409750
}
167
168
169
VCL_BLOB
170 175
xyzzy_sweep_acl(VRT_CTX, VCL_ACL acl, VCL_IP ip0, VCL_IP ip1, VCL_INT step)
171
{
172
        struct acl_sweep asw[1];
173
        int i, j;
174
        struct vsb *vsb;
175
        char abuf[VTCP_ADDRBUFSIZE];
176
        char pbuf[VTCP_PORTBUFSIZE];
177
        unsigned char digest[VSHA256_DIGEST_LENGTH];
178
        struct VSHA256Context vsha[1];
179
        struct vrt_blob *b;
180
        ssize_t sz;
181
182 175
        CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC);
183 175
        AN(acl);
184 175
        AN(ip0);
185 175
        AN(ip1);
186 175
        assert(step > 0);
187 175
        if (setup_sweep(ctx, asw, ip0, ip1, step))
188 0
                return (NULL);
189
190 175
        vsb = VSB_new_auto();
191 175
        AN(vsb);
192
193 175
        VSHA256_Init(vsha);
194 7350
        for (j = 0; ; j++) {
195 7350
                if ((j & 0x3f) == 0x00) {
196 400
                        VTCP_name(asw->probe, abuf, sizeof abuf,
197 200
                            pbuf, sizeof pbuf);
198 200
                        VSB_printf(vsb, "Sweep: %-15s", abuf);
199 200
                }
200 7350
                i = VRT_acl_match(ctx, acl, asw->probe);
201 7350
                assert(0 <= i && i <= 1);
202 7350
                VSB_putc(vsb, "-X"[i]);
203 7350
                if ((j & 0x3f) == 0x3f) {
204 25
                        AZ(VSB_finish(vsb));
205 25
                        VSLbs(ctx->vsl, SLT_Debug, TOSTRAND(VSB_data(vsb)));
206 25
                        sz =VSB_len(vsb);
207 25
                        assert (sz > 0);
208 25
                        VSHA256_Update(vsha, VSB_data(vsb), sz);
209 25
                        VSB_clear(vsb);
210 25
                }
211 7350
                if (step_sweep(asw) > 0)
212 175
                        break;
213 7175
        }
214 175
        if (VSB_len(vsb)) {
215 175
                AZ(VSB_finish(vsb));
216 175
                VSLbs(ctx->vsl, SLT_Debug, TOSTRAND(VSB_data(vsb)));
217 175
                sz =VSB_len(vsb);
218 175
                assert (sz > 0);
219 175
                VSHA256_Update(vsha, VSB_data(vsb), sz);
220 175
                VSB_clear(vsb);
221 175
        }
222 175
        VSB_destroy(&vsb);
223
224 175
        VSHA256_Final(digest, vsha);
225 175
        b = WS_Alloc(ctx->ws, sizeof *b + sizeof digest);
226 175
        if (b != NULL) {
227 175
                memcpy(b + 1, digest, sizeof digest);
228 175
                b->blob = b + 1;
229 175
                b->len = sizeof digest;
230 175
        }
231 175
        cleanup_sweep(asw);
232 175
        return (b);
233 175
}
234
235
VCL_DURATION
236 25
xyzzy_time_acl(VRT_CTX, VCL_ACL acl, VCL_IP ip0, VCL_IP ip1,
237
    VCL_INT step, VCL_INT turnus)
238
{
239
        struct acl_sweep asw[1];
240
        vtim_mono t0, t1;
241
        vtim_dur d;
242
        VCL_INT cnt;
243
244 25
        CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC);
245 25
        AN(acl);
246 25
        AN(ip0);
247 25
        AN(ip1);
248 25
        assert(step > 0);
249 25
        assert(turnus > 0);
250
251 25
        if (setup_sweep(ctx, asw, ip0, ip1, step))
252 0
                return (-1);
253 25
        do {
254 2400
                (void)VRT_acl_match(ctx, acl, asw->probe);
255 2400
        } while (step_sweep(asw) <= 0);
256 25
        asw->count = 0;
257 25
        t0 = VTIM_mono();
258 25025
        for (cnt = 0; cnt < turnus; cnt++) {
259 25000
                reset_sweep(asw);
260 25000
                do {
261 2400000
                        (void)VRT_acl_match(ctx, acl, asw->probe);
262 2400000
                } while (step_sweep(asw) <= 0);
263 25000
        }
264 25
        t1 = VTIM_mono();
265 25
        cnt = asw->count;
266 25
        assert(cnt > 0);
267 25
        d = (t1 - t0) / cnt;
268 50
        VSLb(ctx->vsl, SLT_Debug,
269
            "Timed ACL: %.9f -> %.9f = %.9f %.9f/round, %.9f/IP %ju IPs",
270 25
            t0, t1, t1 - t0, (t1-t0) / turnus, d, (intmax_t)cnt);
271 25
        cleanup_sweep(asw);
272 25
        return (d);
273 25
}
274
275
struct xyzzy_debug_aclobj {
276
        unsigned                        magic;
277
#define VMOD_DEBUG_ACLOBJ_MAGIC 0xac10ac10
278
        char *                          vcl_name;
279
        VCL_ACL                 acl;
280
};
281
282
VCL_VOID v_matchproto_(td_xyzzy_debug_aclobj__init)
283 50
xyzzy_aclobj__init(VRT_CTX, struct VPFX(debug_aclobj) **op,
284
    const char *vcl_name, VCL_ACL acl)
285
{
286
        struct VPFX(debug_aclobj) *o;
287
288 50
        CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC);
289 50
        AN(op);
290 50
        AZ(*op);
291 50
        ALLOC_OBJ(o, VMOD_DEBUG_ACLOBJ_MAGIC);
292 50
        AN(o);
293 50
        REPLACE(o->vcl_name, vcl_name);
294 50
        o->acl = acl;
295 50
        *op = o;
296 50
}
297
298
VCL_VOID v_matchproto_(td_xyzzy_debug_aclobj__fini)
299 0
xyzzy_aclobj__fini(struct VPFX(debug_aclobj) **op)
300
{
301
        struct VPFX(debug_aclobj) *o;
302
303 0
        TAKE_OBJ_NOTNULL(o, op, VMOD_DEBUG_ACLOBJ_MAGIC);
304 0
        REPLACE(o->vcl_name, NULL);
305 0
        FREE_OBJ(o);
306 0
}
307
308
VCL_ACL v_matchproto_(td_xyzzy_debug_aclobj_get)
309 50
xyzzy_aclobj_get(VRT_CTX, struct VPFX(debug_aclobj) *o)
310
{
311 50
        CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC);
312 50
        CHECK_OBJ_NOTNULL(o, VMOD_DEBUG_ACLOBJ_MAGIC);
313 50
        return (o->acl);
314
}