-const char filters_h_rcs[] = FILTERS_H_VERSION;
-
-/* Fix a problem with Solaris. There should be no effect on other
- * platforms.
- * Solaris's isspace() is a macro which uses it's argument directly
- * as an array index. Therefore we need to make sure that high-bit
- * characters generate +ve values, and ideally we also want to make
- * the argument match the declared parameter type of "int".
- */
-#define ijb_isdigit(__X) isdigit((int)(unsigned char)(__X))
-
-
-static const char CBLOCK[] =
-#ifdef AMIGA
- "HTTP/1.0 403 Request for blocked URL\n"
-#else /* ifndef AMIGA */
- "HTTP/1.0 202 Request for blocked URL\n"
-#endif /* ndef AMIGA */
- "Pragma: no-cache\n"
- "Last-Modified: Thu Jul 31, 1997 07:42:22 pm GMT\n"
- "Expires: Thu Jul 31, 1997 07:42:22 pm GMT\n"
- "Content-Type: text/html\n\n"
- "<html>\n"
- "<head>\n"
- "<title>Internet Junkbuster: Request for blocked URL</title>\n"
- "</head>\n"
- WHITEBG
- "<center><h1>"
- BANNER
- "</h1></center>\n"
- "<p align=center>Your request for <b>%s%s</b><br>\n"
- "was blocked because it matches the following pattern "
- "in the blockfile: <b>%s</b>\n</p>"
-#ifdef FORCE_LOAD
- "<p align=center><a href=\"http://%s" FORCE_PREFIX
- "%s\">Go there anyway.</a></p>"
-#endif /* def FORCE_LOAD */
- "</body>\n"
- "</html>\n";
-
-#ifdef TRUST_FILES
-static const char CTRUST[] =
-#ifdef AMIGA
- "HTTP/1.0 403 Request for untrusted URL\n"
-#else /* ifndef AMIGA */
- "HTTP/1.0 202 Request for untrusted URL\n"
-#endif /* ndef AMIGA */
- "Pragma: no-cache\n"
- "Last-Modified: Thu Jul 31, 1997 07:42:22 pm GMT\n"
- "Expires: Thu Jul 31, 1997 07:42:22 pm GMT\n"
- "Content-Type: text/html\n\n"
- "<html>\n"
- "<head>\n"
- "<title>Internet Junkbuster: Request for untrusted URL</title>\n"
- "</head>\n"
- WHITEBG
- "<center>"
- "<a href=http://internet.junkbuster.com/ij-untrusted-url?%s+%s+%s>"
- BANNER
- "</a>"
- "</center>"
- "</body>\n"
- "</html>\n";
-#endif /* def TRUST_FILES */
-
-
-#ifdef ACL_FILES
+typedef char *(*filter_function_ptr)();
+static filter_function_ptr get_filter_function(const struct client_state *csp);
+static jb_err prepare_for_filtering(struct client_state *csp);
+static void apply_url_actions(struct current_action_spec *action,
+ struct http_request *http,
+#ifdef FEATURE_CLIENT_TAGS
+ const struct list *client_tags,
+#endif
+ struct url_actions *b);
+
+#ifdef FEATURE_ACL
+#ifdef HAVE_RFC2553
+/*********************************************************************
+ *
+ * Function : sockaddr_storage_to_ip
+ *
+ * Description : Access internal structure of sockaddr_storage
+ *
+ * Parameters :
+ * 1 : addr = socket address
+ * 2 : ip = IP address as array of octets in network order
+ * (it points into addr)
+ * 3 : len = length of IP address in octets
+ * 4 : port = port number in network order;
+ *
+ * Returns : void
+ *
+ *********************************************************************/
+static void sockaddr_storage_to_ip(const struct sockaddr_storage *addr,
+ uint8_t **ip, unsigned int *len,
+ in_port_t **port)
+{
+ assert(NULL != addr);
+ assert(addr->ss_family == AF_INET || addr->ss_family == AF_INET6);
+
+ switch (addr->ss_family)
+ {
+ case AF_INET:
+ if (NULL != len)
+ {
+ *len = 4;
+ }
+ if (NULL != ip)
+ {
+ *ip = (uint8_t *)
+ &(((struct sockaddr_in *)addr)->sin_addr.s_addr);
+ }
+ if (NULL != port)
+ {
+ *port = &((struct sockaddr_in *)addr)->sin_port;
+ }
+ break;
+
+ case AF_INET6:
+ if (NULL != len)
+ {
+ *len = 16;
+ }
+ if (NULL != ip)
+ {
+ *ip = ((struct sockaddr_in6 *)addr)->sin6_addr.s6_addr;
+ }
+ if (NULL != port)
+ {
+ *port = &((struct sockaddr_in6 *)addr)->sin6_port;
+ }
+ break;
+
+ }
+}
+
+
+/*********************************************************************
+ *
+ * Function : match_sockaddr
+ *
+ * Description : Check whether address matches network (IP address and port)
+ *
+ * Parameters :
+ * 1 : network = socket address of subnework
+ * 2 : netmask = network mask as socket address
+ * 3 : address = checked socket address against given network
+ *
+ * Returns : 0 = doesn't match; 1 = does match
+ *
+ *********************************************************************/
+static int match_sockaddr(const struct sockaddr_storage *network,
+ const struct sockaddr_storage *netmask,
+ const struct sockaddr_storage *address)
+{
+ uint8_t *network_addr, *netmask_addr, *address_addr;
+ unsigned int addr_len;
+ in_port_t *network_port, *netmask_port, *address_port;
+ int i;
+
+ if (network->ss_family != netmask->ss_family)
+ {
+ /* This should never happen */
+ assert(network->ss_family == netmask->ss_family);
+ log_error(LOG_LEVEL_FATAL, "Network and netmask differ in family.");
+ }
+
+ sockaddr_storage_to_ip(network, &network_addr, &addr_len, &network_port);
+ sockaddr_storage_to_ip(netmask, &netmask_addr, NULL, &netmask_port);
+ sockaddr_storage_to_ip(address, &address_addr, NULL, &address_port);
+
+ /* Check for family */
+ if ((network->ss_family == AF_INET) && (address->ss_family == AF_INET6)
+ && IN6_IS_ADDR_V4MAPPED((struct in6_addr *)address_addr))
+ {
+ /* Map AF_INET6 V4MAPPED address into AF_INET */
+ address_addr += 12;
+ addr_len = 4;
+ }
+ else if ((network->ss_family == AF_INET6) && (address->ss_family == AF_INET)
+ && IN6_IS_ADDR_V4MAPPED((struct in6_addr *)network_addr))
+ {
+ /* Map AF_INET6 V4MAPPED network into AF_INET */
+ network_addr += 12;
+ netmask_addr += 12;
+ addr_len = 4;
+ }
+
+ /* XXX: Port check is signaled in netmask */
+ if (*netmask_port && *network_port != *address_port)
+ {
+ return 0;
+ }
+
+ /* TODO: Optimize by checking by words instead of octets */
+ for (i = 0; (i < addr_len) && netmask_addr[i]; i++)
+ {
+ if ((network_addr[i] & netmask_addr[i]) !=
+ (address_addr[i] & netmask_addr[i]))
+ {
+ return 0;
+ }
+ }
+
+ return 1;
+}
+#endif /* def HAVE_RFC2553 */
+
+