easytls-conntrac.lib

#!/bin/sh

# Experimental - Use at your own risk

# Copyright - negotiable
#
# VERBATUM_COPYRIGHT_HEADER_INCLUDE_NEGOTIABLE
# easytls-conntrac.lib -- Do simple magic
#
# Copyright (C) 2020 Richard Bonhomme (Friday 13th of March 2020)
# https://github.com/TinCanTech/easy-tls
# tincantech@protonmail.com
# All Rights reserved.
#
# This code is released under version 2 of the GNU GPL
# See LICENSE of this project for full licensing details.
#
# Connection tracking.
#
# VERBATUM_COPYRIGHT_HEADER_INCLUDE_NEGOTIABLE
#

# Connection tacking - Connect
conn_trac_connect ()
{
	[ -n "${1}" ] || return 1
	[ -n "${2}" ] || return 1
	easytls_ct_lock_file="${2}.lock"
	easytls_temp_file="${2}.tmp"
	easytls_ct_log="${2}.log"
	unset -v err_exit record_found ct_ig_ipp_ex \
		ct_tlskey_found ct_tlskey_duplicate

	acquire_lock "${easytls_ct_lock_file}" 7 || return 9

	if [ -n "${ENABLE_CONN_TRAC_STATS}" ]; then
		conn_trac_stats || {
			update_status "conntrac: stats fail"
			release_lock "${easytls_ct_lock_file}" 7 || return 9
			}
	fi

	# Patterns to match - Anything after ++ cannot be used
	ct_pattern="${1%++*}"
	[ -z "${VERBOSE_CONN_TRAC}" ] || \
		update_status "conntrac: pattern ${ct_pattern}"

	ct_tlskey="${1%%=*}"
	if [ "${ct_tlskey}" = "TLSAC" ]; then unset -v ct_tlskey; fi

	if [ -f "${2}" ]; then
		{
			# shellcheck disable=2162 # read without -r
			while read full_conn; do

				conn="${full_conn%++*}"
				tksn="${full_conn%%=*}"

				[ ! "${tksn}" = "${ct_tlskey}" ] || ct_tlskey_found=1

				if [ "${conn}" = "${ct_pattern}" ]; then
					# Log - only the first time - and count duplicate
					[ -n "${record_found}" ] || {
						update_status "conntrac: already registered"
						}
					ct_tlskey_duplicate=$(( ct_tlskey_duplicate + 1 ))
					# IP exhausted is one way to get a duplicate
					# otherwise, openvpn hands out unique VPN IPs
					# other ways; client time-out during connecting
					[ -z "${ip_pool_exhausted}" ] || \
						ct_ig_ipp_ex="${ct_ig_ipp_ex}."
					# Duplicate, because ct will add the same again
					record_found=1
					# shellcheck disable=2154
					"${EASYTLS_PRINTF}" '%s\n' "${full_conn}"
				else
					# Print the existing record
					"${EASYTLS_PRINTF}" '%s\n' "${full_conn}"
				fi
			done < "${2}"

			# Always register the record
			"${EASYTLS_PRINTF}" "%s\n" "${1}"

			# Add Ignore stats
			[ -z "${ct_ig_ipp_ex}" ] || {
				ct_ig_ipp_ex="${ct_ig_ipp_ex%.}"
				update_status "IGN-IPP-EX: ${ct_tlskey_duplicate}"
				tlskey_status \
					"  | ^^ ct: dup-TLSK: ${ct_ig_ipp_ex}${ct_tlskey_duplicate} -"
				}

		} > "${easytls_temp_file}" || err_exit=1

		# shellcheck disable=2154
		"${EASYTLS_MV}" -f "${easytls_temp_file}" "${2}" || err_exit=1

		# This was used for #160/1434 - Re-think it soon
		if [ -n "${record_found}" ]; then
			# IP exhausted
			:
		else
			update_status "conntrac: registered"
			tlskey_status "  | >  ct: register -"
		fi
	else
		# conntrac file does not exist, create it now
		"${EASYTLS_PRINTF}" "%s\n" "${1}" > "${2}" || err_exit=1
		update_status "conntrac: OPENED registered"
		tlskey_status " <O> * ct: *OPENED* -"
		tlskey_status "  | >  ct: register -"
	fi
	release_lock "${easytls_ct_lock_file}" 7 || return 9

	err_exit="${err_exit:-0}"
	[ "${err_exit}" -eq 0 ] && [ -n "${ct_tlskey_found}" ] && err_exit=6
	unset -v easytls_ct_lock_file easytls_temp_file conn record_found \
		ct_ig_ipp_ex ct_tlskey_found ct_tlskey_duplicate
	return "${err_exit}"
} # => conn_trac_connect ()

# Update connection tacking - disconnect
conn_trac_disconnect ()
{
	[ -n "${1}" ] || return 1
	[ -n "${2}" ] || return 1
	easytls_ct_lock_file="${2}.lock"
	easytls_temp_file="${2}.tmp"
	easytls_ct_log="${2}.log"
	unset -v err_exit record_found ct_ig_ipp_ex

	acquire_lock "${easytls_ct_lock_file}" 7 || return 9

	if [ -n "${ENABLE_CONN_TRAC_STATS}" ]; then
		conn_trac_stats || {
			update_status "conntrac: stats fail"
			release_lock "${easytls_ct_lock_file}" 7 || return 9
			}
	fi

	# Pattern to match - Anything after ++ cannot be used
	ct_pattern="${1%%++*}"
	[ -z "${VERBOSE_CONN_TRAC}" ] || \
		update_status "conntrac pattern: ${ct_pattern}"

	if [ -f "${2}" ]; then
		{
			# shellcheck disable=2162 # read without -r
			while read full_conn; do

				conn="${full_conn%%++*}"
				if [ "${conn}" = "${ct_pattern}" ]; then
					# If record_found then a record has been deleted
					# Print the remaining duplicates
					[ -z "${record_found}" ] || \
						"${EASYTLS_PRINTF}" '%s\n' "${full_conn}"
					if [ -n "${record_found}" ] && [ -n "${ip_pool_exhausted}" ]
					then
						ct_ig_ipp_ex="${ct_ig_ipp_ex}."
					fi
					# Matched - Do not Print
					[ -n "${record_found}" ] || {
						update_status "conntrac: unregistered"
						tlskey_status "  |<   ct: unregist -"
						}
					record_found=1
				else
					# No match - Print current record
					"${EASYTLS_PRINTF}" '%s\n' "${full_conn}"
				fi
			done < "${2}"

			# Add Ignore stats
			[ -z "${ct_ig_ipp_ex}" ] || {
				update_status "IGN-IPP-EX: ${ct_ig_ipp_ex}"
				tlskey_status "  | ^^ ct: TLSK-DUP: ${ct_ig_ipp_ex} -"
				}

		} > "${easytls_temp_file}" || err_exit=1

		"${EASYTLS_MV}" -f "${easytls_temp_file}" "${2}" || err_exit=1

		[ -n "${record_found}" ] || {
			update_status "conntrac: record not found"
			err_exit=${err_exit:-2}
			}
		[ -s "${2}" ] || {
			# shellcheck disable=2154
			"${EASYTLS_RM}" -f "${2}"
			update_status "conntrac: CLOSED"
			tlskey_status " >X< * ct: *CLOSED* -"
			}
	else
		update_status "conntrac: file not found"
		err_exit=3
	fi
	release_lock "${easytls_ct_lock_file}" 7 || return 9

	err_exit="${err_exit:-0}"
	unset -v easytls_ct_lock_file easytls_temp_file conn \
			record_found ct_ig_ipp_ex
	return "${err_exit}"
} # => conn_trac_disconnect ()

# Keep statistics
conn_trac_stats ()
{
	ctc=0
	# shellcheck disable=2154
	[ ! -f "${easytls_ct_log}" ] || ctc="$("${EASYTLS_CAT}" "${easytls_ct_log}")"
	[ $(( ctc )) -lt 4294967296 ] || ctc=0
	ctc=$(( ctc + 1 ))
	"${EASYTLS_PRINTF}" '%s\n' "${ctc}" > "${easytls_temp_file}" || return 1
	"${EASYTLS_MV}" -f "${easytls_temp_file}" "${easytls_ct_log}" || return 1
	#update_status "conntrac: tallied"
	tlskey_status "  |;   ct: tallied  -"
} # => conn_trac_stats ()