Add maxmind acl plugin (apache#6980)

Add maxmind acl plugin

This plugin is similar to the current geoip acl plugin however it is based on the libmaxminddb library.  The GeoIP library is considered legacy at this point and it only supports the old dat formatted databases.
This will work with the newer more common mmdb format.

It takes a yaml formatted configuration file as shown in the docs, which specifies the database to use for that remap, and then any sets of allow and deny rules.  Currently the only rules supported are `country`,`ip`, and `regex`.
Deny rules will always take precedence if both allow and deny rules are set, and in the case of having both sets of rules or only allow rules the default action is to deny a connection. However if no accept rules are
specified then the default action will flip to always allow, since it doesnt make much sense to leave it as blocking everything if you only want to deny.  In that case all connections are allowed except those that fall into
one of the deny rules.

configure.ac

@@ -1685,6 +1685,21 @@ AC_CHECK_HEADERS([GeoIP.h], [
   ])
 ])
 
+#
+# Check for libmaxmind.  This is the maxmind v2 API where GeoIP is the legacy
+# v1 dat file based API
+#
+AC_CHECK_HEADERS([maxminddb.h], [
+  AC_CHECK_LIB([maxminddb], [MMDB_open], [
+    AC_SUBST([MAXMINDDB_LIBS], ["-lmaxminddb"])
+    AC_SUBST(has_maxmind, 1)
+  ], [
+    AC_SUBST([MAXMINDDB_LIBS], [""])
+    AC_SUBST(has_maxmind, 0)
+  ])
+])
+
+AM_CONDITIONAL([BUILD_MAXMIND_ACL_PLUGIN], [test "x${has_maxmind}" = "x1" ])
 
 # Right now, the healthcheck plugins requires inotify_init (and friends)
 AM_CONDITIONAL([BUILD_HEALTHCHECK_PLUGIN], [ test "$ac_cv_func_inotify_init" = "yes" ])

doc/admin-guide/plugins/index.en.rst

@@ -156,6 +156,7 @@ directory of the |TS| source tree. Experimental plugins can be compiled by passi
    Hook Trace <hook-trace.en>
    ICAP <icap.en>
    JA3 Fingerprint <ja3_fingerprint.en>
+   Maxmind ACL <maxmind_acl.en>
    Memcache <memcache.en>
    Metalink <metalink.en>
    Money Trace <money_trace.en>
@@ -199,6 +200,9 @@ directory of the |TS| source tree. Experimental plugins can be compiled by passi
 :doc:`JA3 Fingerprint <ja3_fingerprint.en>`
    Calculates JA3 Fingerprints for incoming SSL traffic.
 
+:doc:`MaxMind ACL <maxmind_acl.en>`
+   ACL based on the maxmind geo databases (GeoIP2 mmdb and libmaxminddb)
+
 :doc:`Memcache <memcache.en>`
    Implements the memcache protocol for cache contents.
 

doc/admin-guide/plugins/maxmind_acl.en.rst

@@ -0,0 +1,80 @@
+.. _admin-plugins-maxmind-acl:
+
+MaxMind ACL Plugin
+******************
+
+.. Licensed to the Apache Software Foundation (ASF) under one
+   or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+
+This remap plugin provides allow and deny functionality based on the libmaxminddb
+library and GeoIP2 databases (mmdb format). It requires libmaxminddb to run
+and the associated development headers in order to build. You can find a sample
+mmdb-lite database on the maxmind website or provide your own. You must provide a database
+for any usages and specify it in the configuration file as shown below.
+
+Configuration
+=============
+
+The plugin takes a single pparam which is the location of the configuration yaml
+file. This can either be relative to the ATS configuration directory or an absolute path ::
+
+   map http://example.com/music http://music.example.com @plugin=maxmind_acl.so @pparam=maxmind.yaml
+
+An example configuration ::
+
+   maxmind:
+    database: GeoIP2-City.mmdb
+    html: deny.html
+    allow:
+     country:
+      - US
+     ip:
+      - 127.0.0.1
+      - 192.168.10.0/20
+    deny:
+     country:
+      - DE
+     ip:
+      - 127.0.0.1
+     regex:
+      - [US, ".*\\.txt"]  # Because these get parsed you must escape the escape of the ``.`` in order to have it be escaped in the regex, resulting in ".*\.txt"
+      - [US, ".*\\.mp3"]
+
+In order to load an updated configuration while ATS is running you will have to touch or modify the remap.config file in order to initiate a plugin reload to pull in any changes.
+
+Rules
+=====
+
+You can mix and match the allow rules and deny rules, however deny rules will always take precedence so in the above case ``127.0.0.1`` would be denied.
+The IP rules can take either single IPs or cidr formatted rules. It will also accept IPv6 IP and ranges.
+
+The regex portion can be added to both the allow and deny sections for creating allowable or denyable regexes. Each regex takes a country code first and a regex second.
+In the above example all requests from the US would be allowed except for those on ``txt`` and ``mp3`` files. More rules should be added as pairs, not as additions to existing lists.
+
+Currently the only rules available are ``country``, ``ip``, and ``regex``, though more can easily be added if needed. Each config file does require a top level
+``maxmind`` entry as well as a ``database`` entry for the IP lookups.  You can supply a separate database for each remap used in case you use custom
+ones and have specific needs per remap.
+
+One other thing to note.  You can reverse the logic of the plugin, so that it will default to always allowing if you do not supply any ``allow`` rules.
+In the case you supply no allow rules all connections will be allowed through except those that fall in to any of the deny rule lists. In the above example
+the rule of denying ``DE`` would be a noop because there are allow rules set, so by default everything is blocked unless it is explicitly in an allow rule.
+However in this case the regexes would still apply since they are based on an allowable country.
+
+Optional
+========
+
+There is an optional ``html`` field which takes a html file that will be used as the body of the response for any denied requests if you wish to use a custom one.

plugins/Makefile.am

@@ -69,6 +69,11 @@ include experimental/header_freq/Makefile.inc
 include experimental/hook-trace/Makefile.inc
 include experimental/icap/Makefile.inc
 include experimental/inliner/Makefile.inc
+
+if BUILD_MAXMIND_ACL_PLUGIN
+include experimental/maxmind_acl/Makefile.inc
+endif
+
 include experimental/memcache/Makefile.inc
 include experimental/metalink/Makefile.inc
 include experimental/money_trace/Makefile.inc

plugins/experimental/maxmind_acl/Makefile.inc

@@ -0,0 +1,28 @@
+#  Licensed to the Apache Software Foundation (ASF) under one
+#  or more contributor license agreements.  See the NOTICE file
+#  distributed with this work for additional information
+#  regarding copyright ownership.  The ASF licenses this file
+#  to you under the Apache License, Version 2.0 (the
+#  "License"); you may not use this file except in compliance
+#  with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+pkglib_LTLIBRARIES += experimental/maxmind_acl/maxmind_acl.la
+
+experimental_maxmind_acl_maxmind_acl_la_SOURCES = \
+  experimental/maxmind_acl/maxmind_acl.cc \
+  experimental/maxmind_acl/mmdb.cc
+
+experimental_maxmind_acl_maxmind_acl_la_LIBADD = $(MAXMINDDB_LIBS)
+
+experimental_maxmind_acl_maxmind_acl_la_LDFLAGS = \
+	$(AM_LDFLAGS)
+
+AM_CPPFLAGS += @YAMLCPP_INCLUDES@

plugins/experimental/maxmind_acl/maxmind_acl.cc

@@ -0,0 +1,87 @@
+/*
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+#include "mmdb.h"
+
+///////////////////////////////////////////////////////////////////////////////
+// Initialize the plugin as a remap plugin.
+//
+TSReturnCode
+TSRemapInit(TSRemapInterface *api_info, char *errbuf, int errbuf_size)
+{
+  if (api_info->size < sizeof(TSRemapInterface)) {
+    strncpy(errbuf, "[tsremap_init] - Incorrect size of TSRemapInterface structure", errbuf_size - 1);
+    return TS_ERROR;
+  }
+
+  if (api_info->tsremap_version < TSREMAP_VERSION) {
+    snprintf(errbuf, errbuf_size, "[tsremap_init] - Incorrect API version %ld.%ld", api_info->tsremap_version >> 16,
+             (api_info->tsremap_version & 0xffff));
+    return TS_ERROR;
+  }
+
+  TSDebug(PLUGIN_NAME, "remap plugin is successfully initialized");
+  return TS_SUCCESS;
+}
+
+TSReturnCode
+TSRemapNewInstance(int argc, char *argv[], void **ih, char * /* errbuf */, int /* errbuf_size */)
+{
+  if (argc < 3) {
+    TSError("[%s] Unable to create remap instance, missing configuration file", PLUGIN_NAME);
+    return TS_ERROR;
+  }
+
+  Acl *a = new Acl();
+  *ih    = static_cast<void *>(a);
+  if (!a->init(argv[2])) {
+    TSError("[%s] Failed to initialize maxmind with %s", PLUGIN_NAME, argv[2]);
+    return TS_ERROR;
+  }
+
+  TSDebug(PLUGIN_NAME, "created remap instance with configuration %s", argv[2]);
+  return TS_SUCCESS;
+}
+
+void
+TSRemapDeleteInstance(void *ih)
+{
+  if (nullptr != ih) {
+    Acl *const a = static_cast<Acl *>(ih);
+    delete a;
+  }
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// Main entry point when used as a remap plugin.
+//
+TSRemapStatus
+TSRemapDoRemap(void *ih, TSHttpTxn rh, TSRemapRequestInfo *rri)
+{
+  if (nullptr == ih) {
+    TSDebug(PLUGIN_NAME, "No ACLs configured");
+  } else {
+    Acl *a = static_cast<Acl *>(ih);
+    if (!a->eval(rri, rh)) {
+      TSDebug(PLUGIN_NAME, "denying request");
+      TSHttpTxnStatusSet(rh, TS_HTTP_STATUS_FORBIDDEN);
+      a->send_html(rh);
+    }
+  }
+  return TSREMAP_NO_REMAP;
+}