From df32d6fd09251717040019177ea0d0e8a712509f Mon Sep 17 00:00:00 2001
From: Auke Kok <auke@foo-projects.org>
Date: Fri, 26 Oct 2012 11:57:47 -0700
Subject: [PATCH] Armed!

- blocking and unblocking
- 1hr default timeout to unblock
- unblock pruning happens every time the queue of messages is
  processed.
---
 tallow.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 46 insertions(+), 4 deletions(-)

diff --git a/tallow.c b/tallow.c
index 98d81b2..42420f1 100644
--- a/tallow.c
+++ b/tallow.c
@@ -17,9 +17,10 @@ struct tallow_struct {
 static struct tallow_struct *head;
 
 #define FILTER_STRING "SYSLOG_IDENTIFIER=sshd"
-#define TALLOW_CHAIN "TALLOW"
 #define PATH_IPTABLES "/usr/sbin"
+#define TALLOW_CHAIN "TALLOW"
 #define TALLOW_THRESHOLD 3
+#define TALLOW_TIMEOUT 3600
 
 const char *whitelist[32] = {
 	"192.168.1.1",
@@ -43,7 +44,12 @@ static void block(struct tallow_struct *s)
 {
 	if (s->count != TALLOW_THRESHOLD)
 		return;
-	(void) ext("/usr/bin/echo %s/iptables -t filter -A %s -s %s -j DROP", PATH_IPTABLES, TALLOW_CHAIN, s->ip);
+	(void) ext("%s/iptables -t filter -A %s -s %s -j DROP", PATH_IPTABLES, TALLOW_CHAIN, s->ip);
+}
+
+static void unblock(char *ip)
+{
+	(void) ext("%s/iptables -t filter -D %s -s %s -j DROP", PATH_IPTABLES, TALLOW_CHAIN, ip);
 }
 
 static void find(char *ip)
@@ -85,14 +91,48 @@ static void find(char *ip)
 	else
 		s->next = n;
 
-	n->ip = ip;
+	n->ip = strdup(ip);
 	n->count = 1;
+	n->next = NULL;
 	(void) gettimeofday(&n->time, NULL);
 
 	block(n);
 	return;
 }
 
+static void prune(void)
+{
+	struct tallow_struct *s = head;
+	struct tallow_struct *p;
+	struct timeval tv;
+
+	(void) gettimeofday(&tv, NULL);
+	p = NULL;
+
+	while (s) {
+		if ((tv.tv_sec - s->time.tv_sec) > TALLOW_TIMEOUT) {
+			if (p) {
+				unblock(s->ip);
+				p->next = s->next;
+				free(s->ip);
+				free(s);
+				s = p->next;
+				continue;
+			} else {
+				unblock(s->ip);
+				head = s->next;
+				free(s->ip);
+				free(s);
+				s = head;
+				p = NULL;
+				continue;
+			}
+		}
+		p = s;
+		s = s->next;
+	}
+}
+
 int main(int argc, char *argv[])
 {
 	int r;
@@ -113,7 +153,7 @@ int main(int argc, char *argv[])
 
 	/* ffwd journal */
 	sd_journal_add_match(j, FILTER_STRING, 0);
-//	sd_journal_seek_tail(j);
+	sd_journal_seek_tail(j);
 
 	while (sd_journal_wait(j, (uint64_t) -1)) {
 		const void *d;
@@ -146,6 +186,8 @@ int main(int argc, char *argv[])
 				find(t);
 			}
 		}
+
+		prune();
 	}
 
 	exit(0);