annotate src/syslogconfig.cpp @ 41:738d1f059183

update tags
author convert-repo
date Fri, 21 Mar 2008 08:51:24 +0000
parents 26c29da3fbdf
children d9ae11033b4b
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
1 /*
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
2
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
3 Copyright (c) 2007 Carl Byington - 510 Software Group, released under
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
4 the GPL version 3 or any later version at your choice available at
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
5 http://www.gnu.org/licenses/gpl-3.0.txt
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
6
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
7 */
1
551433a01cab initial coding
carl
parents:
diff changeset
8
551433a01cab initial coding
carl
parents:
diff changeset
9 #include "includes.h"
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
10 #include <fcntl.h>
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
11 #include <sys/socket.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
12 #include <netinet/in.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
13 #include <arpa/inet.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
14 #include <netdb.h>
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
15 #include <limits.h>
1
551433a01cab initial coding
carl
parents:
diff changeset
16
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
17 static char* syslogconfig_version = "$Id$";
1
551433a01cab initial coding
carl
parents:
diff changeset
18
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
19 char *token_add;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
20 char *token_bucket;
1
551433a01cab initial coding
carl
parents:
diff changeset
21 char *token_file;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
22 char *token_ignore;
1
551433a01cab initial coding
carl
parents:
diff changeset
23 char *token_include;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
24 char *token_index;
1
551433a01cab initial coding
carl
parents:
diff changeset
25 char *token_lbrace;
35
d2ceebcf6595 add message description in patterns
carl
parents: 31
diff changeset
26 char *token_message;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
27 char *token_pattern;
1
551433a01cab initial coding
carl
parents:
diff changeset
28 char *token_rbrace;
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
29 char *token_remove;
1
551433a01cab initial coding
carl
parents:
diff changeset
30 char *token_semi;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
31 char *token_slash;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
32 char *token_threshold;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
33
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
34 struct ltint
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
35 {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
36 bool operator()(const int s1, const int s2) const
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
37 {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
38 return (unsigned)s1 < (unsigned)s2;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
39 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
40 };
1
551433a01cab initial coding
carl
parents:
diff changeset
41
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
42 struct bucket {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
43 int count;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
44 bool latch; // true iff ever count>threshold
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
45 };
2737ab01659a initial coding
carl
parents: 3
diff changeset
46
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
47 string_set all_strings; // owns all the strings, only modified by the config loader thread
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
48 const int maxlen = 1000; // used for snprintf buffers
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
49 typedef map<int, bucket, ltint> ip_buckets;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
50
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
51 class IPR {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
52 ip_buckets violations;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
53 public:
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
54 void add(int ip, int amount, CONFIG &con, char *file_name, int pattern_index, char *message);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
55 void leak(int amount, CONFIG &con);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
56 void free_all(CONFIG &con);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
57 void update(int ip, bool added, char *file_name, int pattern_index, char *message);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
58 void changed(CONFIG &con, int ip, bool added);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
59 };
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
60
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
61 IPR recorder;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
62
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
63
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
64 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
65 //
35
d2ceebcf6595 add message description in patterns
carl
parents: 31
diff changeset
66 void IPR::add(int ip, int amount, CONFIG &con, char *file_name, int pattern_index, char *message) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
67 if (con.looking(ip)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
68 ip_buckets::iterator i = violations.find(ip);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
69 if (i == violations.end()) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
70 bucket b;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
71 b.count = amount;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
72 b.latch = (con.get_threshold() <= b.count);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
73 violations[ip] = b;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
74 if (b.latch) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
75 update(ip, true, file_name, pattern_index, message);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
76 changed(con, ip, true);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
77 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
78 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
79 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
80 bucket &b = (*i).second;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
81 if (b.count < (INT_MAX-amount)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
82 int t = con.get_threshold();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
83 int c = b.count;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
84 b.count += amount;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
85 if ((!b.latch) && (c < t) && (t <= b.count)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
86 b.latch = true;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
87 update(ip, true, file_name, pattern_index, message);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
88 changed(con, ip, true);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
89 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
90 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
91 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
92 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
93 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
94
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
95
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
96 void IPR::leak(int amount, CONFIG &con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
97 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); ) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
98 int ip = (*i).first;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
99 bucket &b = (*i).second;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
100 if (b.count <= amount) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
101 if (b.latch) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
102 update(ip, false, NULL, 0, NULL);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
103 changed(con, ip, false);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
104 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
105 violations.erase(i++);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
106 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
107 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
108 b.count -= amount;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
109 i++;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
110 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
111 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
112 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
113
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
114
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
115 void IPR::free_all(CONFIG &con) {
37
e4eb969dfc4a shutdown removes iptables entries that we added
carl
parents: 36
diff changeset
116 if (debug_syslog > 2) {
e4eb969dfc4a shutdown removes iptables entries that we added
carl
parents: 36
diff changeset
117 my_syslog("syslog2iptables shutting down");
e4eb969dfc4a shutdown removes iptables entries that we added
carl
parents: 36
diff changeset
118 }
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
119 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
120 int ip = (*i).first;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
121 bucket &b = (*i).second;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
122 if (b.latch) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
123 update(ip, false, NULL, 0, NULL);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
124 changed(con, ip, false);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
125 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
126 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
127 violations.clear();
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
128 }
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
129
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
130
35
d2ceebcf6595 add message description in patterns
carl
parents: 31
diff changeset
131 void IPR::update(int ip, bool added, char *file_name, int pattern_index, char *message) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
132 if (debug_syslog > 2) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
133 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
134 in_addr ad;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
135 ad.s_addr = htonl(ip);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
136 if (added) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
137 if (message) snprintf(buf, maxlen, "dropping traffic from/to %s based on %s in %s", inet_ntoa(ad), message, file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
138 else snprintf(buf, maxlen, "dropping traffic from/to %s based on pattern match %d in %s", inet_ntoa(ad), pattern_index, file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
139 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
140 else snprintf(buf, maxlen, "allowing traffic from/to %s", inet_ntoa(ad));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
141 my_syslog(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
142 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
143 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
144
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
145
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
146 void IPR::changed(CONFIG &con, int ip, bool added) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
147 int t = con.get_threshold();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
148 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
149 if (added) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
150 bucket &b = violations[ip];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
151 if (con.looking(ip) && (b.count > t)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
152 in_addr ad;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
153 ad.s_addr = htonl(ip);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
154 snprintf(buf, maxlen, con.add_command, inet_ntoa(ad));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
155 system(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
156 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
157 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
158 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
159 in_addr ad;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
160 ad.s_addr = htonl(ip);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
161 snprintf(buf, maxlen, con.remove_command, inet_ntoa(ad));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
162 system(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
163 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
164 }
1
551433a01cab initial coding
carl
parents:
diff changeset
165
551433a01cab initial coding
carl
parents:
diff changeset
166
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
167 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
168 //
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
169 int ip_address(char *have);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
170 int ip_address(char *have) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
171 int ipaddr = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
172 in_addr ip;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
173 if (inet_aton(have, &ip)) ipaddr = ip.s_addr;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
174 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
175 struct hostent *host = gethostbyname(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
176 if (host && host->h_addrtype == AF_INET) memcpy(&ipaddr, host->h_addr, sizeof(ipaddr));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
177 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
178 return ntohl(ipaddr);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
179 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
180
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
181
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
182 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
183 //
35
d2ceebcf6595 add message description in patterns
carl
parents: 31
diff changeset
184 PATTERN::PATTERN(TOKEN &tok, char *pattern_, int index_, int amount_, char *msg_) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
185 pattern = pattern_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
186 index = index_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
187 amount = amount_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
188 message = msg_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
189 if (pattern) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
190 int rc = regcomp(&re, pattern, REG_ICASE | REG_EXTENDED);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
191 if (rc) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
192 char bu[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
193 regerror(rc, &re, bu, maxlen);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
194 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
195 snprintf(buf, sizeof(buf), "pattern %s not valid - %s", pattern, bu);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
196 tok.token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
197 pattern = NULL;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
198 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
199 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
200 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
201
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
202
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
203 PATTERN::~PATTERN() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
204 regfree(&re);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
205 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
206
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
207
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
208 bool PATTERN::process(char *buf, CONFIG &con, char *file_name, int pattern_index) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
209 if (pattern) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
210 const int nmatch = index+1;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
211 regmatch_t match[nmatch];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
212 if (0 == regexec(&re, buf, nmatch, match, 0)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
213 int s = match[index].rm_so;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
214 int e = match[index].rm_eo;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
215 if (s != -1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
216 if (debug_syslog > 3) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
217 my_syslog(buf); // show lines with matches
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
218 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
219 buf[e] = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
220 int ip = ip_address(buf+s);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
221 if (ip) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
222 recorder.add(ip, amount, con, file_name, pattern_index, message);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
223 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
224 return true;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
225 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
226 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
227 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
228 return false;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
229 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
230
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
231
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
232 void PATTERN::dump(int level) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
233 char indent[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
234 int i = min(maxlen-1, level*4);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
235 memset(indent, ' ', i);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
236 indent[i] = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
237 printf("%s pattern \"%s\" {; \n", indent, pattern);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
238 printf("%s index %d; \n", indent, index);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
239 printf("%s bucket %d; \n", indent, amount);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
240 if (message) printf("%s message \"%s\"; \n", indent, message);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
241 printf("%s }; \n", indent);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
242 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
243
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
244
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
245 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
246 //
1
551433a01cab initial coding
carl
parents:
diff changeset
247 CONFIG::CONFIG() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
248 reference_count = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
249 generation = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
250 load_time = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
251 threshold = 500;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
252 add_command = "/sbin/iptables -I INPUT --src %s --jump DROP";
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
253 remove_command = "/sbin/iptables -D INPUT --src %s --jump DROP";
1
551433a01cab initial coding
carl
parents:
diff changeset
254 }
551433a01cab initial coding
carl
parents:
diff changeset
255
551433a01cab initial coding
carl
parents:
diff changeset
256
551433a01cab initial coding
carl
parents:
diff changeset
257 CONFIG::~CONFIG() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
258 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
259 SYSLOGCONFIG *c = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
260 delete c;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
261 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
262 ignore.clear();
1
551433a01cab initial coding
carl
parents:
diff changeset
263 }
551433a01cab initial coding
carl
parents:
diff changeset
264
551433a01cab initial coding
carl
parents:
diff changeset
265
551433a01cab initial coding
carl
parents:
diff changeset
266 void CONFIG::add_syslogconfig(SYSLOGCONFIGP con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
267 syslogconfigs.push_back(con);
1
551433a01cab initial coding
carl
parents:
diff changeset
268 }
551433a01cab initial coding
carl
parents:
diff changeset
269
551433a01cab initial coding
carl
parents:
diff changeset
270
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
271 void CONFIG::add_pair(IPPAIR pair) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
272 ignore.push_back(pair);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
273 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
274
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
275
1
551433a01cab initial coding
carl
parents:
diff changeset
276 void CONFIG::dump() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
277 printf(" threshold %d; \n\n", threshold);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
278
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
279 printf(" add_command \"%s\"; \n", add_command);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
280 printf(" remove_command \"%s\"; \n\n", remove_command);
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
281
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
282 printf(" ignore { \n");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
283 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
284 IPPAIR &p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
285 in_addr ip;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
286 ip.s_addr = htonl(p.first);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
287 printf(" %s/%d; \n", inet_ntoa(ip), p.cidr);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
288 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
289 printf(" }; \n\n");
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
290
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
291 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
292 SYSLOGCONFIGP c = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
293 c->dump(0);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
294 }
1
551433a01cab initial coding
carl
parents:
diff changeset
295 }
551433a01cab initial coding
carl
parents:
diff changeset
296
551433a01cab initial coding
carl
parents:
diff changeset
297
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
298 void CONFIG::read() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
299 while (true) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
300 bool have = false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
301 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
302 SYSLOGCONFIGP c = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
303 have |= c->read(*this);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
304 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
305 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
306 }
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
307 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
308
6e88da080f08 initial coding
carl
parents: 1
diff changeset
309
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
310 void CONFIG::sleep(int duration, time_t &previous) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
311 ::sleep(duration);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
312 time_t now = time(NULL);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
313 recorder.leak(now-previous, *this);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
314 previous = now;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
315 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
316
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
317
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
318 void CONFIG::free_all() {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
319 recorder.free_all(*this);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
320 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
321
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
322 bool CONFIG::looking(int ip) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
323 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
324 IPPAIR &p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
325 if ((p.first <= ip) && (ip <= p.last)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
326 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
327 return true;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
328 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
329
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
330 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
331 //
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
332 SYSLOGCONFIG::SYSLOGCONFIG(TOKEN &tok, char *file_name_) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
333 tokp = &tok;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
334 file_name = file_name_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
335 open(true);
1
551433a01cab initial coding
carl
parents:
diff changeset
336 }
551433a01cab initial coding
carl
parents:
diff changeset
337
551433a01cab initial coding
carl
parents:
diff changeset
338
551433a01cab initial coding
carl
parents:
diff changeset
339 SYSLOGCONFIG::~SYSLOGCONFIG() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
340 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
341 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
342 PATTERN *p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
343 delete p;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
344 }
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
345 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
346
6e88da080f08 initial coding
carl
parents: 1
diff changeset
347
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
348 void SYSLOGCONFIG::open(bool msg) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
349 fd = ::open(file_name, O_RDONLY);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
350 len = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
351 if (fd == -1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
352 if (msg) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
353 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
354 snprintf(buf, sizeof(buf), "syslog file %s not readable", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
355 tokp->token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
356 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
357 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
358 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
359 if (debug_syslog > 1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
360 snprintf(buf, sizeof(buf), "syslog file %s opened", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
361 my_syslog(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
362 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
363 lseek(fd, 0, SEEK_END);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
364 if (fstat(fd, &openfdstat)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
365 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
366 snprintf(buf, sizeof(buf), "syslog file %s cannot stat after open", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
367 tokp->token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
368 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
369 // specify that this fd gets closed on exec, so that selinux
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
370 // won't complain about iptables trying to read log files.
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
371 int oldflags = fcntl(fd, F_GETFD, 0);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
372 if (oldflags >= 0) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
373 fcntl(fd, F_SETFD, oldflags | FD_CLOEXEC);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
374 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
375 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
376 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
377
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
378
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
379 bool SYSLOGCONFIG::read(CONFIG &con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
380 if (failed()) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
381 open(false);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
382 if (failed()) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
383 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
384 int n = ::read(fd, buf+len, buflen-len);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
385 bool have = (n > 0);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
386 if (have) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
387 len += n;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
388 while (true) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
389 char *p = (char*)memchr(buf, '\n', len);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
390 if (!p) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
391 n = p-buf;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
392 *p = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
393 process(con); // process null terminated string
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
394 len -= n+1;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
395 memmove(buf, p+1, len);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
396 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
397 // no <lf> in a full buffer
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
398 if (len == buflen) len = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
399 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
400 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
401 // check for file close
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
402 struct stat filenamest;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
403 if (0 == stat(file_name, &filenamest)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
404 if ((filenamest.st_dev != openfdstat.st_dev) ||
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
405 (filenamest.st_ino != openfdstat.st_ino)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
406 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
407 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
408 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
409 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
410 // filename no longer exists
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
411 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
412 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
413 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
414 return have;
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
415 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
416
6e88da080f08 initial coding
carl
parents: 1
diff changeset
417
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
418 void SYSLOGCONFIG::close() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
419 if (debug_syslog > 1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
420 snprintf(buf, sizeof(buf), "syslog file %s closed", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
421 my_syslog(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
422 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
423 if (fd != -1) ::close(fd);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
424 fd = -1;
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
425 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
426
2737ab01659a initial coding
carl
parents: 3
diff changeset
427
2737ab01659a initial coding
carl
parents: 3
diff changeset
428 void SYSLOGCONFIG::add_pattern(PATTERNP pat) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
429 patterns.push_back(pat);
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
430 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
431
2737ab01659a initial coding
carl
parents: 3
diff changeset
432
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
433 void SYSLOGCONFIG::process(CONFIG &con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
434 int pi=0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
435 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
436 PATTERN *p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
437 if (p->process(buf, con, file_name, pi)) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
438 pi++;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
439 }
1
551433a01cab initial coding
carl
parents:
diff changeset
440 }
551433a01cab initial coding
carl
parents:
diff changeset
441
551433a01cab initial coding
carl
parents:
diff changeset
442
551433a01cab initial coding
carl
parents:
diff changeset
443 void SYSLOGCONFIG::dump(int level) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
444 char indent[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
445 int i = min(maxlen-1, level*4);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
446 memset(indent, ' ', i);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
447 indent[i] = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
448 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
449 printf("%s file \"%s\" {\n", indent, file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
450 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
451 PATTERN *p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
452 p->dump(level+1);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
453 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
454 printf("%s }; \n", indent);
1
551433a01cab initial coding
carl
parents:
diff changeset
455 }
551433a01cab initial coding
carl
parents:
diff changeset
456
551433a01cab initial coding
carl
parents:
diff changeset
457
551433a01cab initial coding
carl
parents:
diff changeset
458 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
459 // helper to discard the strings held by a string_set
551433a01cab initial coding
carl
parents:
diff changeset
460 //
551433a01cab initial coding
carl
parents:
diff changeset
461 void discard(string_set &s) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
462 for (string_set::iterator i=s.begin(); i!=s.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
463 free(*i);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
464 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
465 s.clear();
1
551433a01cab initial coding
carl
parents:
diff changeset
466 }
551433a01cab initial coding
carl
parents:
diff changeset
467
551433a01cab initial coding
carl
parents:
diff changeset
468
551433a01cab initial coding
carl
parents:
diff changeset
469 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
470 // helper to register a string in a string set
551433a01cab initial coding
carl
parents:
diff changeset
471 //
551433a01cab initial coding
carl
parents:
diff changeset
472 char* register_string(string_set &s, char *name) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
473 string_set::iterator i = s.find(name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
474 if (i != s.end()) return *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
475 char *x = strdup(name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
476 s.insert(x);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
477 return x;
1
551433a01cab initial coding
carl
parents:
diff changeset
478 }
551433a01cab initial coding
carl
parents:
diff changeset
479
551433a01cab initial coding
carl
parents:
diff changeset
480
551433a01cab initial coding
carl
parents:
diff changeset
481 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
482 // register a global string
551433a01cab initial coding
carl
parents:
diff changeset
483 //
551433a01cab initial coding
carl
parents:
diff changeset
484 char* register_string(char *name) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
485 return register_string(all_strings, name);
1
551433a01cab initial coding
carl
parents:
diff changeset
486 }
551433a01cab initial coding
carl
parents:
diff changeset
487
551433a01cab initial coding
carl
parents:
diff changeset
488
551433a01cab initial coding
carl
parents:
diff changeset
489 ////////////////////////////////////////////////
38
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
490 // clear all global strings, helper for valgrind checking
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
491 //
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
492 void clear_strings() {
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
493 discard(all_strings);
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
494 }
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
495
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
496
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
497 ////////////////////////////////////////////////
1
551433a01cab initial coding
carl
parents:
diff changeset
498 //
551433a01cab initial coding
carl
parents:
diff changeset
499 bool tsa(TOKEN &tok, char *token);
551433a01cab initial coding
carl
parents:
diff changeset
500 bool tsa(TOKEN &tok, char *token) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
501 char *have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
502 if (have == token) return true;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
503 tok.token_error(token, have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
504 return false;
1
551433a01cab initial coding
carl
parents:
diff changeset
505 }
551433a01cab initial coding
carl
parents:
diff changeset
506
551433a01cab initial coding
carl
parents:
diff changeset
507
551433a01cab initial coding
carl
parents:
diff changeset
508 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
509 //
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
510 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
511 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
512 char *pat = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
513 int ind, buc;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
514 char *msg = NULL;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
515 if (!tsa(tok, token_lbrace)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
516 while (true) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
517 char *have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
518 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
519 if (have == token_rbrace) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
520 if (have == token_index) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
521 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
522 ind = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
523 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
524 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
525 else if (have == token_bucket) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
526 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
527 buc = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
528 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
529 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
530 else if (have == token_message) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
531 msg = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
532 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
533 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
534 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
535 tok.token_error("index/bucket", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
536 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
537 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
538 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
539 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
540 PATTERNP patt = new PATTERN(tok, pat, ind, buc, msg);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
541 con.add_pattern(patt);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
542 return true;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
543 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
544
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
545
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
546 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
547 //
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
548 bool parse_ignore(TOKEN &tok, CONFIG &dc);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
549 bool parse_ignore(TOKEN &tok, CONFIG &dc) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
550 if (!tsa(tok, token_lbrace)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
551 while (true) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
552 char *have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
553 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
554 if (have == token_rbrace) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
555 int ipaddr = ip_address(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
556 if (ipaddr == 0) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
557 tok.token_error("ip address", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
558 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
559 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
560 if (!tsa(tok, token_slash)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
561 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
562 int mask = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
563 if ((mask < 8) || (mask > 32)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
564 tok.token_error("cidr 8..32 value", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
565 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
566 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
567 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
568 IPPAIR pair;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
569 const int masks[33] = {0xffffffff, // 0
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
570 0x7fffffff, // 1
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
571 0x3fffffff, // 2
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
572 0x1fffffff, // 3
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
573 0x0fffffff, // 4
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
574 0x07ffffff, // 5
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
575 0x03ffffff, // 6
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
576 0x01ffffff, // 7
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
577 0x00ffffff, // 8
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
578 0x007fffff, // 9
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
579 0x003fffff, // 10
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
580 0x001fffff, // 11
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
581 0x000fffff, // 12
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
582 0x0007ffff, // 13
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
583 0x0003ffff, // 14
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
584 0x0001ffff, // 15
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
585 0x0000ffff, // 16
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
586 0x00007fff, // 17
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
587 0x00003fff, // 18
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
588 0x00001fff, // 19
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
589 0x00000fff, // 20
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
590 0x000007ff, // 21
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
591 0x000003ff, // 22
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
592 0x000001ff, // 23
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
593 0x000000ff, // 24
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
594 0x0000007f, // 25
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
595 0x0000003f, // 26
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
596 0x0000001f, // 27
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
597 0x0000000f, // 28
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
598 0x00000007, // 29
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
599 0x00000003, // 30
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
600 0x00000001, // 31
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
601 0x00000000}; // 32
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
602 pair.first = ipaddr;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
603 pair.last = ipaddr | masks[mask];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
604 pair.cidr = mask;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
605 dc.add_pair(pair);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
606 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
607 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
608 return true;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
609 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
610
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
611
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
612 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
613 //
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
614 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
615 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
616 char *name = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
617 if (!tsa(tok, token_lbrace)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
618 SYSLOGCONFIGP con = new SYSLOGCONFIG(tok, name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
619 if (con->failed()) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
620 delete con;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
621 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
622 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
623 dc.add_syslogconfig(con);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
624 while (true) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
625 char *have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
626 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
627 if (have == token_rbrace) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
628 if (have == token_pattern) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
629 if (!parse_pattern(tok, *con)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
630 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
631 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
632 tok.token_error("pattern", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
633 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
634 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
635 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
636 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
637 return true;
1
551433a01cab initial coding
carl
parents:
diff changeset
638 }
551433a01cab initial coding
carl
parents:
diff changeset
639
551433a01cab initial coding
carl
parents:
diff changeset
640
551433a01cab initial coding
carl
parents:
diff changeset
641 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
642 // parse a config file
551433a01cab initial coding
carl
parents:
diff changeset
643 //
551433a01cab initial coding
carl
parents:
diff changeset
644 bool load_conf(CONFIG &dc, char *fn) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
645 int count = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
646 TOKEN tok(fn, &dc.config_files);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
647 while (true) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
648 char *have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
649 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
650 if (have == token_threshold) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
651 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
652 dc.set_threshold(atoi(have));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
653 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
654 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
655 else if (have == token_ignore) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
656 if (!parse_ignore(tok, dc)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
657 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
658 else if (have == token_add) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
659 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
660 dc.set_add(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
661 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
662 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
663 else if (have == token_remove) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
664 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
665 dc.set_remove(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
666 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
667 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
668 else if (have == token_file) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
669 if (!parse_syslogconfig(tok, dc)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
670 count++;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
671 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
672 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
673 tok.token_error("threshold/ignore/add_command/remove_command/file", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
674 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
675 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
676 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
677 tok.token_error("load_conf() found %d syslog files in %s", count, fn);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
678 return (!dc.syslogconfigs.empty());
1
551433a01cab initial coding
carl
parents:
diff changeset
679 }
551433a01cab initial coding
carl
parents:
diff changeset
680
551433a01cab initial coding
carl
parents:
diff changeset
681
551433a01cab initial coding
carl
parents:
diff changeset
682 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
683 // init the tokens
551433a01cab initial coding
carl
parents:
diff changeset
684 //
551433a01cab initial coding
carl
parents:
diff changeset
685 void token_init() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
686 token_add = register_string("add_command");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
687 token_bucket = register_string("bucket");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
688 token_file = register_string("file");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
689 token_ignore = register_string("ignore");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
690 token_include = register_string("include");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
691 token_index = register_string("index");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
692 token_lbrace = register_string("{");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
693 token_message = register_string("message");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
694 token_pattern = register_string("pattern");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
695 token_rbrace = register_string("}");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
696 token_remove = register_string("remove_command");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
697 token_semi = register_string(";");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
698 token_slash = register_string("/");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
699 token_threshold = register_string("threshold");
1
551433a01cab initial coding
carl
parents:
diff changeset
700 }