|
1
|
1 /***************************************************************************
|
|
|
2 * Copyright (C) 2005 by 510 Software Group *
|
|
|
3 * *
|
|
|
4 * *
|
|
|
5 * This program is free software; you can redistribute it and/or modify *
|
|
|
6 * it under the terms of the GNU General Public License as published by *
|
|
|
7 * the Free Software Foundation; either version 2 of the License, or *
|
|
|
8 * (at your option) any later version. *
|
|
|
9 * *
|
|
|
10 * This program is distributed in the hope that it will be useful, *
|
|
|
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
|
|
|
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
|
|
|
13 * GNU General Public License for more details. *
|
|
|
14 * *
|
|
|
15 * You should have received a copy of the GNU General Public License *
|
|
|
16 * along with this program; if not, write to the *
|
|
|
17 * Free Software Foundation, Inc., *
|
|
|
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
|
|
|
19 ***************************************************************************/
|
|
|
20
|
|
|
21 #ifndef syslogconfig_include
|
|
|
22 #define syslogconfig_include
|
|
|
23
|
|
|
24 #include "tokenizer.h"
|
|
|
25 #include <map>
|
|
3
|
26 #include <regex.h>
|
|
4
|
27 #include <sys/types.h>
|
|
|
28 #include <sys/stat.h>
|
|
1
|
29
|
|
|
30
|
|
|
31 class SYSLOGCONFIG;
|
|
3
|
32 class CONFIG;
|
|
|
33
|
|
|
34 struct IPPAIR {
|
|
|
35 int first;
|
|
|
36 int last;
|
|
|
37 int cidr;
|
|
|
38 };
|
|
|
39
|
|
|
40 class PATTERN {
|
|
|
41 char * pattern; // owned by the string table
|
|
|
42 regex_t re;
|
|
|
43 int index; // zero based substring of the regex match that contains the ip address or hostname
|
|
4
|
44 int amount; // count to add to the ip address leaky bucket
|
|
3
|
45 public:
|
|
|
46 ~PATTERN();
|
|
4
|
47 PATTERN(TOKEN &tok, char *pattern_, int index_, int amount_);
|
|
3
|
48 bool process(char *buf, CONFIG &con);
|
|
|
49 void dump(int level);
|
|
|
50 };
|
|
1
|
51
|
|
|
52 typedef SYSLOGCONFIG * SYSLOGCONFIGP;
|
|
3
|
53 typedef PATTERN * PATTERNP;
|
|
1
|
54 typedef list<SYSLOGCONFIGP> syslogconfig_list;
|
|
3
|
55 typedef list<IPPAIR> ippair_list;
|
|
|
56 typedef list<PATTERNP> pattern_list;
|
|
2
|
57 const int buflen = 1024;
|
|
1
|
58
|
|
|
59 class SYSLOGCONFIG {
|
|
4
|
60 TOKEN * tokp;
|
|
1
|
61 char * file_name; // name of the syslog file
|
|
3
|
62 pattern_list patterns; // owns the patterns
|
|
2
|
63 int fd;
|
|
4
|
64 struct stat openfdstat;
|
|
2
|
65 int len; // bytes in the buffer
|
|
|
66 char buf[buflen];
|
|
1
|
67 public:
|
|
3
|
68 SYSLOGCONFIG(TOKEN &tok, char *file_name_);
|
|
1
|
69 ~SYSLOGCONFIG();
|
|
4
|
70 bool failed() { return (fd == -1); };
|
|
|
71 void open(bool msg);
|
|
|
72 bool read(CONFIG &con);
|
|
|
73 void close();
|
|
3
|
74 void add_pattern(PATTERNP pat);
|
|
|
75 void process(CONFIG &con);
|
|
1
|
76 void dump(int level);
|
|
|
77 };
|
|
|
78
|
|
3
|
79 class CONFIG {
|
|
|
80 public:
|
|
1
|
81 // the only mutable stuff once it has been loaded from the config file
|
|
|
82 int reference_count; // protected by the global config_mutex
|
|
|
83 // all the rest is constant after loading from the config file
|
|
|
84 int generation;
|
|
|
85 time_t load_time;
|
|
|
86 string_set config_files;
|
|
3
|
87 int threshold;
|
|
|
88 ippair_list ignore; // owns all the ippairs
|
|
|
89 syslogconfig_list syslogconfigs; // owns all the syslogconfigs
|
|
1
|
90
|
|
|
91 CONFIG();
|
|
|
92 ~CONFIG();
|
|
3
|
93 void set_threshold(int threshold_) { threshold = threshold_; };
|
|
|
94 int get_threshold() { return threshold; };
|
|
2
|
95 void add_syslogconfig(SYSLOGCONFIGP con);
|
|
3
|
96 void add_pair(IPPAIR pair);
|
|
2
|
97 void dump();
|
|
|
98 void read();
|
|
4
|
99 void sleep(int duration, time_t &previous);
|
|
3
|
100 bool looking(int ip);
|
|
1
|
101 };
|
|
|
102
|
|
|
103 void discard(string_set &s);
|
|
|
104 char* register_string(string_set &s, char *name);
|
|
|
105 char* register_string(char *name);
|
|
3
|
106 int ip_address(char *have);
|
|
1
|
107 bool load_conf(CONFIG &dc, char *fn);
|
|
|
108 void token_init();
|
|
|
109
|
|
3
|
110 extern char *token_bucket;
|
|
1
|
111 extern char *token_file;
|
|
3
|
112 extern char *token_ignore;
|
|
1
|
113 extern char *token_include;
|
|
3
|
114 extern char *token_index;
|
|
1
|
115 extern char *token_lbrace;
|
|
3
|
116 extern char *token_pattern;
|
|
1
|
117 extern char *token_rbrace;
|
|
|
118 extern char *token_semi;
|
|
3
|
119 extern char *token_slash;
|
|
|
120 extern char *token_threshold;
|
|
1
|
121
|
|
|
122 #endif
|
