Sample Source Code

blacklist-1.c

The sample blacklisting plugin included in the Traffic Server SDK is blacklist-1.c. This plugin checks every incoming HTTP client request against a list of blacklisted web sites. If the client requests a blacklisted site, then the plugin returns an Access forbidden message to the client.

This plugin illustrates:

  • An HTTP transaction extension
  • How to examine HTTP request headers
  • How to use the logging interface
  • How to use the plugin configuration management interface
  1. /** @file
  3.   An example plugin that denies client access to blacklisted sites (blacklist.txt).
  5.   @section license License
  7.   Licensed to the Apache Software Foundation (ASF) under one
  8.   or more contributor license agreements.  See the NOTICE file
  9.   distributed with this work for additional information
  10.   regarding copyright ownership.  The ASF licenses this file
  11.   to you under the Apache License, Version 2.0 (the
  12.   "License"); you may not use this file except in compliance
  13.   with the License.  You may obtain a copy of the License at
  15.       http://www.apache.org/licenses/LICENSE-2.0
  17.   Unless required by applicable law or agreed to in writing, software
  18.   distributed under the License is distributed on an "AS IS" BASIS,
  19.   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  20.   See the License for the specific language governing permissions and
  21.   limitations under the License.
  22.  */
  24. #include <stdio.h>
  25. #include <string.h>
  27. #include "ts/ts.h"
  28. #include "ts/ink_defs.h"
  30. #define MAX_NSITES 500
  31. #define RETRY_TIME 10
  33. static char *sites[MAX_NSITES];
  34. static int nsites;
  35. static TSMutex sites_mutex;
  36. static TSTextLogObject log;
  37. static TSCont global_contp;
  39. static void handle_txn_start(TSCont contp, TSHttpTxn txnp);
  41. typedef struct contp_data {
  42.   enum calling_func {
  43.     HANDLE_DNS,
  44.     HANDLE_RESPONSE,
  45.     READ_BLACKLIST,
  46.   } cf;
  48.   TSHttpTxn txnp;
  50. } cdata;
  52. static void
  53. destroy_continuation(TSHttpTxn txnp, TSCont contp)
  54. {
  55.   cdata *cd = NULL;
  57.   cd = (cdata *)TSContDataGet(contp);
  58.   if (cd != NULL) {
  59.     TSfree(cd);
  60.   }
  61.   TSContDestroy(contp);
  62.   TSHttpTxnReenable(txnp, TS_EVENT_HTTP_CONTINUE);
  63.   return;
  64. }
  66. static void
  67. handle_dns(TSHttpTxn txnp, TSCont contp)
  68. {
  69.   TSMBuffer bufp;
  70.   TSMLoc hdr_loc;
  71.   TSMLoc url_loc;
  72.   const char *host;
  73.   int i;
  74.   int host_length;
  76.   if (TSHttpTxnClientReqGet(txnp, &bufp, &hdr_loc) != TS_SUCCESS) {
  77.     TSError("[blacklist-1] Couldn't retrieve client request header");
  78.     goto done;
  79.   }
  81.   if (TSHttpHdrUrlGet(bufp, hdr_loc, &url_loc) != TS_SUCCESS) {
  82.     TSError("[blacklist-1] Couldn't retrieve request url");
  83.     TSHandleMLocRelease(bufp, TS_NULL_MLOC, hdr_loc);
  84.     goto done;
  85.   }
  87.   host = TSUrlHostGet(bufp, url_loc, &host_length);
  88.   if (!host) {
  89.     TSError("[blacklist-1] Couldn't retrieve request hostname");
  90.     TSHandleMLocRelease(bufp, hdr_loc, url_loc);
  91.     TSHandleMLocRelease(bufp, TS_NULL_MLOC, hdr_loc);
  92.     goto done;
  93.   }
  95.   /* We need to lock the sites_mutex as that is the mutex that is
  96.      protecting the global list of all blacklisted sites. */
  97.   if (TSMutexLockTry(sites_mutex) != TS_SUCCESS) {
  98.     TSDebug("blacklist-1", "Unable to get lock. Will retry after some time");
  99.     TSHandleMLocRelease(bufp, hdr_loc, url_loc);
  100.     TSHandleMLocRelease(bufp, TS_NULL_MLOC, hdr_loc);
  101.     TSContSchedule(contp, RETRY_TIME, TS_THREAD_POOL_DEFAULT);
  102.     return;
  103.   }
  105.   for (i = 0; i < nsites; i++) {
  106.     if (strncmp(host, sites[i], host_length) == 0) {
  107.       if (log) {
  108.         TSTextLogObjectWrite(log, "blacklisting site: %s", sites[i]);
  109.       } else {
  110.         TSDebug("blacklist-1", "blacklisting site: %s", sites[i]);
  111.       }
  112.       TSHttpTxnHookAdd(txnp, TS_HTTP_SEND_RESPONSE_HDR_HOOK, contp);
  113.       TSHandleMLocRelease(bufp, hdr_loc, url_loc);
  114.       TSHandleMLocRelease(bufp, TS_NULL_MLOC, hdr_loc);
  115.       TSHttpTxnReenable(txnp, TS_EVENT_HTTP_ERROR);
  116.       TSMutexUnlock(sites_mutex);
  117.       return;
  118.     }
  119.   }
  121.   TSMutexUnlock(sites_mutex);
  122.   TSHandleMLocRelease(bufp, hdr_loc, url_loc);
  123.   TSHandleMLocRelease(bufp, TS_NULL_MLOC, hdr_loc);
  125. done:
  126.   TSHttpTxnReenable(txnp, TS_EVENT_HTTP_CONTINUE);
  127. }
  129. static void
  130. handle_response(TSHttpTxn txnp, TSCont contp ATS_UNUSED)
  131. {
  132.   TSMBuffer bufp;
  133.   TSMLoc hdr_loc;
  134.   TSMLoc url_loc;
  135.   char *url_str;
  136.   char *buf;
  137.   int url_length;
  139.   if (TSHttpTxnClientRespGet(txnp, &bufp, &hdr_loc) != TS_SUCCESS) {
  140.     TSError("[blacklist-1] Couldn't retrieve client response header");
  141.     goto done;
  142.   }
  144.   TSHttpHdrStatusSet(bufp, hdr_loc, TS_HTTP_STATUS_FORBIDDEN);
  145.   TSHttpHdrReasonSet(bufp, hdr_loc, TSHttpHdrReasonLookup(TS_HTTP_STATUS_FORBIDDEN),
  146.                      strlen(TSHttpHdrReasonLookup(TS_HTTP_STATUS_FORBIDDEN)));
  148.   if (TSHttpTxnClientReqGet(txnp, &bufp, &hdr_loc) != TS_SUCCESS) {
  149.     TSError("[blacklist-1] Couldn't retrieve client request header");
  150.     TSHandleMLocRelease(bufp, TS_NULL_MLOC, hdr_loc);
  151.     goto done;
  152.   }
  154.   if (TSHttpHdrUrlGet(bufp, hdr_loc, &url_loc) != TS_SUCCESS) {
  155.     TSError("[blacklist-1] Couldn't retrieve request url");
  156.     TSHandleMLocRelease(bufp, TS_NULL_MLOC, hdr_loc);
  157.     goto done;
  158.   }
  160.   buf = (char *)TSmalloc(4096);
  162.   url_str = TSUrlStringGet(bufp, url_loc, &url_length);
  163.   sprintf(buf, "You are forbidden from accessing \"%s\"\n", url_str);
  164.   TSfree(url_str);
  165.   TSHandleMLocRelease(bufp, hdr_loc, url_loc);
  166.   TSHandleMLocRelease(bufp, TS_NULL_MLOC, hdr_loc);
  168.   TSHttpTxnErrorBodySet(txnp, buf, strlen(buf), NULL);
  170. done:
  171.   TSHttpTxnReenable(txnp, TS_EVENT_HTTP_CONTINUE);
  172. }
  174. static void
  175. read_blacklist(TSCont contp)
  176. {
  177.   char blacklist_file[1024];
  178.   TSFile file;
  180.   sprintf(blacklist_file, "%s/blacklist.txt", TSPluginDirGet());
  181.   file   = TSfopen(blacklist_file, "r");
  182.   nsites = 0;
  184.   /* If the Mutext lock is not successful try again in RETRY_TIME */
  185.   if (TSMutexLockTry(sites_mutex) != TS_SUCCESS) {
  186.     if (file != NULL) {
  187.       TSfclose(file);
  188.     }
  189.     TSContSchedule(contp, RETRY_TIME, TS_THREAD_POOL_DEFAULT);
  190.     return;
  191.   }
  193.   if (file != NULL) {
  194.     char buffer[1024];
  196.     while (TSfgets(file, buffer, sizeof(buffer) - 1) != NULL && nsites < MAX_NSITES) {
  197.       char *eol;
  198.       if ((eol = strstr(buffer, "\r\n")) != NULL) {
  199.         /* To handle newlines on Windows */
  200.         *eol = '\0';
  201.       } else if ((eol = strchr(buffer, '\n')) != NULL) {
  202.         *eol = '\0';
  203.       } else {
  204.         /* Not a valid line, skip it */
  205.         continue;
  206.       }
  207.       if (sites[nsites] != NULL) {
  208.         TSfree(sites[nsites]);
  209.       }
  210.       sites[nsites] = TSstrdup(buffer);
  211.       nsites++;
  212.     }
  214.     TSfclose(file);
  215.   } else {
  216.     TSError("[blacklist-1] Unable to open %s", blacklist_file);
  217.     TSError("[blacklist-1] All sites will be allowed");
  218.   }
  220.   TSMutexUnlock(sites_mutex);
  221. }
  223. static int
  224. blacklist_plugin(TSCont contp, TSEvent event, void *edata)
  225. {
  226.   TSHttpTxn txnp;
  227.   cdata *cd;
  229.   switch (event) {
  230.   case TS_EVENT_HTTP_TXN_START:
  231.     txnp = (TSHttpTxn)edata;
  232.     handle_txn_start(contp, txnp);
  233.     return 0;
  234.   case TS_EVENT_HTTP_OS_DNS:
  235.     if (contp != global_contp) {
  236.       cd     = (cdata *)TSContDataGet(contp);
  237.       cd->cf = HANDLE_DNS;
  238.       handle_dns(cd->txnp, contp);
  239.       return 0;
  240.     } else {
  241.       break;
  242.     }
  243.   case TS_EVENT_HTTP_TXN_CLOSE:
  244.     txnp = (TSHttpTxn)edata;
  245.     if (contp != global_contp) {
  246.       destroy_continuation(txnp, contp);
  247.     }
  248.     break;
  249.   case TS_EVENT_HTTP_SEND_RESPONSE_HDR:
  250.     if (contp != global_contp) {
  251.       cd     = (cdata *)TSContDataGet(contp);
  252.       cd->cf = HANDLE_RESPONSE;
  253.       handle_response(cd->txnp, contp);
  254.       return 0;
  255.     } else {
  256.       break;
  257.     }
  258.   case TS_EVENT_TIMEOUT:
  259.     /* when mutex lock is not acquired and continuation is rescheduled,
  260.        the plugin is called back with TS_EVENT_TIMEOUT with a NULL
  261.        edata. We need to decide, in which function did the MutexLock
  262.        failed and call that function again */
  263.     if (contp != global_contp) {
  264.       cd = (cdata *)TSContDataGet(contp);
  265.       switch (cd->cf) {
  266.       case HANDLE_DNS:
  267.         handle_dns(cd->txnp, contp);
  268.         return 0;
  269.       case HANDLE_RESPONSE:
  270.         handle_response(cd->txnp, contp);
  271.         return 0;
  272.       default:
  273.         TSDebug("blacklist_plugin", "This event was unexpected: %d", event);
  274.         break;
  275.       }
  276.     } else {
  277.       read_blacklist(contp);
  278.       return 0;
  279.     }
  280.   default:
  281.     break;
  282.   }
  283.   return 0;
  284. }
  286. static void
  287. handle_txn_start(TSCont contp ATS_UNUSED, TSHttpTxn txnp)
  288. {
  289.   TSCont txn_contp;
  290.   cdata *cd;
  292.   txn_contp = TSContCreate((TSEventFunc)blacklist_plugin, TSMutexCreate());
  293.   /* create the data that'll be associated with the continuation */
  294.   cd = (cdata *)TSmalloc(sizeof(cdata));
  295.   TSContDataSet(txn_contp, cd);
  297.   cd->txnp = txnp;
  299.   TSHttpTxnHookAdd(txnp, TS_HTTP_OS_DNS_HOOK, txn_contp);
  300.   TSHttpTxnHookAdd(txnp, TS_HTTP_TXN_CLOSE_HOOK, txn_contp);
  302.   TSHttpTxnReenable(txnp, TS_EVENT_HTTP_CONTINUE);
  303. }
  305. void
  306. TSPluginInit(int argc ATS_UNUSED, const char *argv[] ATS_UNUSED)
  307. {
  308.   int i;
  309.   TSPluginRegistrationInfo info;
  310.   TSReturnCode error;
  312.   info.plugin_name   = "blacklist-1";
  313.   info.vendor_name   = "MyCompany";
  314.   info.support_email = "ts-api-support@MyCompany.com";
  316.   if (TSPluginRegister(&info) != TS_SUCCESS) {
  317.     TSError("[blacklist-1] Plugin registration failed.");
  318.   }
  320.   /* create an TSTextLogObject to log blacklisted requests to */
  321.   error = TSTextLogObjectCreate("blacklist", TS_LOG_MODE_ADD_TIMESTAMP, &log);
  322.   if (!log || error == TS_ERROR) {
  323.     TSDebug("blacklist-1", "error while creating log");
  324.   }
  326.   sites_mutex = TSMutexCreate();
  328.   nsites = 0;
  329.   for (i = 0; i < MAX_NSITES; i++) {
  330.     sites[i] = NULL;
  331.   }
  333.   global_contp = TSContCreate(blacklist_plugin, sites_mutex);
  334.   read_blacklist(global_contp);
  336.   /*TSHttpHookAdd (TS_HTTP_OS_DNS_HOOK, contp); */
  337.   TSHttpHookAdd(TS_HTTP_TXN_START_HOOK, global_contp);
  338. }