<?xml version="1.0" encoding="UTF-8"?>

<raptor xmlns:action="http://martin-weusten.de/raptor/action" xmlns:check="http://martin-weusten.de/raptor/check">
	<name>Advanced</name>
	<desc>This example detects and logs users causing much traffic. They are logged if they produce more 
		than 50 packets per second over longer time. Also it blocks external users from using your
		transports.</desc>
	<version>2</version>
	
	<var type="JID" name="COMPONENT"/>
    <var type="JID" name="USER"/>
	
	<counter name="TRAFFIC-TIME" interval="1000" decrement="1"/>     
	<counter name="TRAFFIC-COUNT" interval="2000" decrement="100"/>
	<counter name="NOTIFY" interval="1000" decrement="1"/>
	
	<emailmapper>
        <map regex="@gmail.com$" replace="@gmail.com"/>
        <map regex="@googlemail.com$" replace="@googlemail.com"/>
		<map regex="@gmx.de$" replace="@gmx.de"/>
		<map regex="@gmx.net$" replace="@gmx.net"/>
    </emailmapper>
	
	<function name="main">
		<!-- drop packets from/to known bad guys -->
		<action:rule>
			<if>
				<check:address fromtype="GROUP" from="badguys" totype="ANY" mutual="true"/>
			</if>
			<then>
				<action:drop/>
			</then>
		</action:rule>

		<!-- flood detection. Detects and blocks users that send more than 50 packets per second. -->
		<action:rule>
			<if>
				<check:count counter="TRAFFIC-TIME" count="FROM" compare="GREATER" ref="0"/>
			</if>
			<then>
				<action:drop/>
			</then>
		</action:rule>
		<action:count counter="TRAFFIC-COUNT" count="FROM"/>
		<action:rule>
			<if>
				<check:set_count counter="TRAFFIC-COUNT" count="FROM" compare="GREATER" ref="1500" newvalue="0"/>
			</if>
			<then>
				<action:set_count counter="TRAFFIC-TIME" count="FROM" newvalue="600"/>
				<action:email mode="MAIL" to="admin@example.tld" subject="[Raptor] flood detected">
					Raptor detected an packet flood from '\F'. Blocking outgoing packets from this user for
					10 minutes. Packet details as follows:\n
					TYPE: '\P'\n
					FROM: '\F'\n
					TO: '\F'\n
					IP: '\I'\n
					-----------\n
					\X
				</action:email>
				<action:log>Raptor: Much traffic from user '\F' with IP=\I. Dropping all packets from this user for 10 minutes.</action:log>
				<action:drop/>
			</then>
		</action:rule>
		
		<!-- block external users from using our transports. -->
		<action:set_jid name="USER" mode="FROM"/>
		<action:set_jid name="COMPONENT" mode="TO"/>
		<action:call function="PROTECT_TRANSPORTS"/>
		<action:set_jid name="USER" mode="TO"/>
		<action:set_jid name="COMPONENT" mode="FROM"/>
		<action:call function="PROTECT_TRANSPORTS"/>
	</function>
	
	<!-- helper function for transports check -->
	<function name="PROTECT_TRANSPORTS">
		<action:rule>
			<if>
				<check:jid name="COMPONENT" mode="NDOMAIN" ref="icq.localhost"/>
				<check:jid name="COMPONENT" mode="NDOMAIN" ref="msn.localhost"/>
				<check:jid name="COMPONENT" mode="NDOMAIN" ref="search.localhost"/>
			</if>
			<else>
				<action:rule>
					<if>
						<check:jid name="USER" mode="NDOMAIN" ref="localhost"/>
						<check:jid name="USER" mode="NGROUP" ref="whitelist"/>
						<check:jid name="USER" mode="NDOMAIN" ref="component.localhost"/>
						<check:jid name="USER" mode="NDOMAIN" ref="raptor.localhost"/>
					</if>
					<then>
						<action:call function="NOTIFY_USER"/>
						<action:drop/>
					</then>
				</action:rule>
			</else>
		</action:rule>            
	</function>
	
	<!-- log only every 15 minutes... -->
	<function name="NOTIFY_USER">
		<action:rule>
			<if>
				<check:set_count counter="NOTIFY" count="VAR" var="USER" compare="EQUAL" ref="0" newvalue="900"/>
			</if>
			<then>
				<action:log>Raptor: User '\VJID(USER)' blocked from using our transports!</action:log>
				<action:rule>
					<if>
						<check:jid name="USER" mode="NDOMAIN" ref="gmail.com"/>
						<check:jid name="USER" mode="NDOMAIN" ref="googlemail.com"/>
						<check:jid name="USER" mode="NDOMAIN" ref="gmx.de"/>
						<check:jid name="USER" mode="NDOMAIN" ref="gmx.net"/>
					</if>
					<then>
						<action:message mode="FROM">Hi, you are trying to use some of our services using your
						Jabber account '\F'. Access to this component(s) is allowed for local users only. If
						you are a student or an employee of rwth-aachen university, you may request access by
						sending us an email.\n(this message was automatically generated, do not answer on this
						message)</action:message>
					</then>
					<else>
						<action:email mode="MAP_FROM" subject="Services of RWTH Aachen university">Hi, you are
						trying to use some of our services using your Jabber account '\F'. Access to this
						component(s) is allowed for local users only. If you are a student or an employee of
						rwth-aachen university, you may request access by (informally) answering this email.
						\n(this mail was automatically generated)</action:email>
					</else>
				</action:rule>
			</then>
		</action:rule>
	</function>	
</raptor>

