|
36
|
1 /*
|
|
|
2
|
|
|
3 Copyright (c) 2007 Carl Byington - 510 Software Group, released under
|
|
|
4 the GPL version 3 or any later version at your choice available at
|
|
|
5 http://www.gnu.org/licenses/gpl-3.0.txt
|
|
|
6
|
|
|
7 */
|
|
1
|
8
|
|
|
9 #include "includes.h"
|
|
2
|
10 #include <fcntl.h>
|
|
3
|
11 #include <sys/socket.h>
|
|
|
12 #include <netinet/in.h>
|
|
|
13 #include <arpa/inet.h>
|
|
|
14 #include <netdb.h>
|
|
4
|
15 #include <limits.h>
|
|
1
|
16
|
|
4
|
17 static char* syslogconfig_version = "$Id$";
|
|
1
|
18
|
|
27
|
19 char *token_add;
|
|
3
|
20 char *token_bucket;
|
|
1
|
21 char *token_file;
|
|
3
|
22 char *token_ignore;
|
|
1
|
23 char *token_include;
|
|
3
|
24 char *token_index;
|
|
1
|
25 char *token_lbrace;
|
|
35
|
26 char *token_message;
|
|
3
|
27 char *token_pattern;
|
|
1
|
28 char *token_rbrace;
|
|
27
|
29 char *token_remove;
|
|
1
|
30 char *token_semi;
|
|
3
|
31 char *token_slash;
|
|
|
32 char *token_threshold;
|
|
|
33
|
|
|
34 struct ltint
|
|
|
35 {
|
|
|
36 bool operator()(const int s1, const int s2) const
|
|
|
37 {
|
|
36
|
38 return (unsigned)s1 < (unsigned)s2;
|
|
3
|
39 }
|
|
|
40 };
|
|
1
|
41
|
|
4
|
42 struct bucket {
|
|
36
|
43 int count;
|
|
|
44 bool latch; // true iff ever count>threshold
|
|
4
|
45 };
|
|
|
46
|
|
36
|
47 string_set all_strings; // owns all the strings, only modified by the config loader thread
|
|
|
48 const int maxlen = 1000; // used for snprintf buffers
|
|
4
|
49 typedef map<int, bucket, ltint> ip_buckets;
|
|
3
|
50
|
|
|
51 class IPR {
|
|
36
|
52 ip_buckets violations;
|
|
3
|
53 public:
|
|
36
|
54 void add(int ip, int amount, CONFIG &con, char *file_name, int pattern_index, char *message);
|
|
|
55 void leak(int amount, CONFIG &con);
|
|
|
56 void free_all(CONFIG &con);
|
|
|
57 void update(int ip, bool added, char *file_name, int pattern_index, char *message);
|
|
|
58 void changed(CONFIG &con, int ip, bool added);
|
|
3
|
59 };
|
|
|
60
|
|
|
61 IPR recorder;
|
|
|
62
|
|
|
63
|
|
|
64 ////////////////////////////////////////////////
|
|
|
65 //
|
|
35
|
66 void IPR::add(int ip, int amount, CONFIG &con, char *file_name, int pattern_index, char *message) {
|
|
36
|
67 if (con.looking(ip)) {
|
|
|
68 ip_buckets::iterator i = violations.find(ip);
|
|
|
69 if (i == violations.end()) {
|
|
|
70 bucket b;
|
|
|
71 b.count = amount;
|
|
|
72 b.latch = (con.get_threshold() <= b.count);
|
|
|
73 violations[ip] = b;
|
|
|
74 if (b.latch) {
|
|
|
75 update(ip, true, file_name, pattern_index, message);
|
|
|
76 changed(con, ip, true);
|
|
|
77 }
|
|
|
78 }
|
|
|
79 else {
|
|
|
80 bucket &b = (*i).second;
|
|
|
81 if (b.count < (INT_MAX-amount)) {
|
|
|
82 int t = con.get_threshold();
|
|
|
83 int c = b.count;
|
|
|
84 b.count += amount;
|
|
|
85 if ((!b.latch) && (c < t) && (t <= b.count)) {
|
|
|
86 b.latch = true;
|
|
|
87 update(ip, true, file_name, pattern_index, message);
|
|
|
88 changed(con, ip, true);
|
|
|
89 }
|
|
|
90 }
|
|
|
91 }
|
|
|
92 }
|
|
3
|
93 }
|
|
|
94
|
|
|
95
|
|
|
96 void IPR::leak(int amount, CONFIG &con) {
|
|
36
|
97 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); ) {
|
|
|
98 int ip = (*i).first;
|
|
|
99 bucket &b = (*i).second;
|
|
|
100 if (b.count <= amount) {
|
|
|
101 if (b.latch) {
|
|
|
102 update(ip, false, NULL, 0, NULL);
|
|
|
103 changed(con, ip, false);
|
|
|
104 }
|
|
|
105 violations.erase(i++);
|
|
|
106 }
|
|
|
107 else {
|
|
|
108 b.count -= amount;
|
|
|
109 i++;
|
|
|
110 }
|
|
|
111 }
|
|
|
112 }
|
|
|
113
|
|
|
114
|
|
|
115 void IPR::free_all(CONFIG &con) {
|
|
37
|
116 if (debug_syslog > 2) {
|
|
|
117 my_syslog("syslog2iptables shutting down");
|
|
|
118 }
|
|
36
|
119 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); i++) {
|
|
|
120 int ip = (*i).first;
|
|
|
121 bucket &b = (*i).second;
|
|
|
122 if (b.latch) {
|
|
|
123 update(ip, false, NULL, 0, NULL);
|
|
|
124 changed(con, ip, false);
|
|
|
125 }
|
|
|
126 }
|
|
|
127 violations.clear();
|
|
20
|
128 }
|
|
|
129
|
|
|
130
|
|
35
|
131 void IPR::update(int ip, bool added, char *file_name, int pattern_index, char *message) {
|
|
36
|
132 if (debug_syslog > 2) {
|
|
|
133 char buf[maxlen];
|
|
|
134 in_addr ad;
|
|
|
135 ad.s_addr = htonl(ip);
|
|
|
136 if (added) {
|
|
|
137 if (message) snprintf(buf, maxlen, "dropping traffic from/to %s based on %s in %s", inet_ntoa(ad), message, file_name);
|
|
|
138 else snprintf(buf, maxlen, "dropping traffic from/to %s based on pattern match %d in %s", inet_ntoa(ad), pattern_index, file_name);
|
|
|
139 }
|
|
|
140 else snprintf(buf, maxlen, "allowing traffic from/to %s", inet_ntoa(ad));
|
|
|
141 my_syslog(buf);
|
|
|
142 }
|
|
3
|
143 }
|
|
|
144
|
|
|
145
|
|
20
|
146 void IPR::changed(CONFIG &con, int ip, bool added) {
|
|
36
|
147 int t = con.get_threshold();
|
|
|
148 char buf[maxlen];
|
|
|
149 if (added) {
|
|
|
150 bucket &b = violations[ip];
|
|
|
151 if (con.looking(ip) && (b.count > t)) {
|
|
|
152 in_addr ad;
|
|
|
153 ad.s_addr = htonl(ip);
|
|
|
154 snprintf(buf, maxlen, con.add_command, inet_ntoa(ad));
|
|
|
155 system(buf);
|
|
|
156 }
|
|
|
157 }
|
|
|
158 else {
|
|
|
159 in_addr ad;
|
|
|
160 ad.s_addr = htonl(ip);
|
|
|
161 snprintf(buf, maxlen, con.remove_command, inet_ntoa(ad));
|
|
|
162 system(buf);
|
|
|
163 }
|
|
3
|
164 }
|
|
1
|
165
|
|
|
166
|
|
3
|
167 ////////////////////////////////////////////////
|
|
|
168 //
|
|
|
169 int ip_address(char *have);
|
|
|
170 int ip_address(char *have) {
|
|
36
|
171 int ipaddr = 0;
|
|
|
172 in_addr ip;
|
|
|
173 if (inet_aton(have, &ip)) ipaddr = ip.s_addr;
|
|
|
174 else {
|
|
|
175 struct hostent *host = gethostbyname(have);
|
|
|
176 if (host && host->h_addrtype == AF_INET) memcpy(&ipaddr, host->h_addr, sizeof(ipaddr));
|
|
|
177 }
|
|
|
178 return ntohl(ipaddr);
|
|
3
|
179 }
|
|
|
180
|
|
|
181
|
|
|
182 ////////////////////////////////////////////////
|
|
|
183 //
|
|
35
|
184 PATTERN::PATTERN(TOKEN &tok, char *pattern_, int index_, int amount_, char *msg_) {
|
|
36
|
185 pattern = pattern_;
|
|
|
186 index = index_;
|
|
|
187 amount = amount_;
|
|
|
188 message = msg_;
|
|
|
189 if (pattern) {
|
|
|
190 int rc = regcomp(&re, pattern, REG_ICASE | REG_EXTENDED);
|
|
|
191 if (rc) {
|
|
|
192 char bu[maxlen];
|
|
|
193 regerror(rc, &re, bu, maxlen);
|
|
|
194 char buf[maxlen];
|
|
|
195 snprintf(buf, sizeof(buf), "pattern %s not valid - %s", pattern, bu);
|
|
|
196 tok.token_error(buf);
|
|
|
197 pattern = NULL;
|
|
|
198 }
|
|
|
199 }
|
|
3
|
200 }
|
|
|
201
|
|
|
202
|
|
|
203 PATTERN::~PATTERN() {
|
|
36
|
204 regfree(&re);
|
|
3
|
205 }
|
|
|
206
|
|
|
207
|
|
20
|
208 bool PATTERN::process(char *buf, CONFIG &con, char *file_name, int pattern_index) {
|
|
36
|
209 if (pattern) {
|
|
|
210 const int nmatch = index+1;
|
|
|
211 regmatch_t match[nmatch];
|
|
|
212 if (0 == regexec(&re, buf, nmatch, match, 0)) {
|
|
|
213 int s = match[index].rm_so;
|
|
|
214 int e = match[index].rm_eo;
|
|
|
215 if (s != -1) {
|
|
|
216 if (debug_syslog > 3) {
|
|
|
217 my_syslog(buf); // show lines with matches
|
|
|
218 }
|
|
|
219 buf[e] = '\0';
|
|
|
220 int ip = ip_address(buf+s);
|
|
|
221 if (ip) {
|
|
|
222 recorder.add(ip, amount, con, file_name, pattern_index, message);
|
|
|
223 }
|
|
|
224 return true;
|
|
|
225 }
|
|
|
226 }
|
|
|
227 }
|
|
|
228 return false;
|
|
3
|
229 }
|
|
|
230
|
|
|
231
|
|
|
232 void PATTERN::dump(int level) {
|
|
36
|
233 char indent[maxlen];
|
|
|
234 int i = min(maxlen-1, level*4);
|
|
|
235 memset(indent, ' ', i);
|
|
|
236 indent[i] = '\0';
|
|
|
237 printf("%s pattern \"%s\" {; \n", indent, pattern);
|
|
|
238 printf("%s index %d; \n", indent, index);
|
|
|
239 printf("%s bucket %d; \n", indent, amount);
|
|
|
240 if (message) printf("%s message \"%s\"; \n", indent, message);
|
|
|
241 printf("%s }; \n", indent);
|
|
3
|
242 }
|
|
|
243
|
|
|
244
|
|
|
245 ////////////////////////////////////////////////
|
|
|
246 //
|
|
1
|
247 CONFIG::CONFIG() {
|
|
36
|
248 reference_count = 0;
|
|
|
249 generation = 0;
|
|
|
250 load_time = 0;
|
|
|
251 threshold = 500;
|
|
|
252 add_command = "/sbin/iptables -I INPUT --src %s --jump DROP";
|
|
|
253 remove_command = "/sbin/iptables -D INPUT --src %s --jump DROP";
|
|
1
|
254 }
|
|
|
255
|
|
|
256
|
|
|
257 CONFIG::~CONFIG() {
|
|
36
|
258 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
|
|
|
259 SYSLOGCONFIG *c = *i;
|
|
|
260 delete c;
|
|
|
261 }
|
|
|
262 ignore.clear();
|
|
1
|
263 }
|
|
|
264
|
|
|
265
|
|
|
266 void CONFIG::add_syslogconfig(SYSLOGCONFIGP con) {
|
|
36
|
267 syslogconfigs.push_back(con);
|
|
1
|
268 }
|
|
|
269
|
|
|
270
|
|
3
|
271 void CONFIG::add_pair(IPPAIR pair) {
|
|
36
|
272 ignore.push_back(pair);
|
|
3
|
273 }
|
|
|
274
|
|
|
275
|
|
1
|
276 void CONFIG::dump() {
|
|
36
|
277 printf(" threshold %d; \n\n", threshold);
|
|
3
|
278
|
|
36
|
279 printf(" add_command \"%s\"; \n", add_command);
|
|
|
280 printf(" remove_command \"%s\"; \n\n", remove_command);
|
|
27
|
281
|
|
36
|
282 printf(" ignore { \n");
|
|
|
283 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
|
|
|
284 IPPAIR &p = *i;
|
|
|
285 in_addr ip;
|
|
|
286 ip.s_addr = htonl(p.first);
|
|
|
287 printf(" %s/%d; \n", inet_ntoa(ip), p.cidr);
|
|
|
288 }
|
|
|
289 printf(" }; \n\n");
|
|
3
|
290
|
|
36
|
291 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
|
|
|
292 SYSLOGCONFIGP c = *i;
|
|
|
293 c->dump(0);
|
|
|
294 }
|
|
1
|
295 }
|
|
|
296
|
|
|
297
|
|
2
|
298 void CONFIG::read() {
|
|
36
|
299 while (true) {
|
|
|
300 bool have = false;
|
|
|
301 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
|
|
|
302 SYSLOGCONFIGP c = *i;
|
|
|
303 have |= c->read(*this);
|
|
|
304 }
|
|
|
305 if (!have) break;
|
|
|
306 }
|
|
2
|
307 }
|
|
|
308
|
|
|
309
|
|
4
|
310 void CONFIG::sleep(int duration, time_t &previous) {
|
|
36
|
311 ::sleep(duration);
|
|
|
312 time_t now = time(NULL);
|
|
|
313 recorder.leak(now-previous, *this);
|
|
|
314 previous = now;
|
|
3
|
315 }
|
|
|
316
|
|
|
317
|
|
36
|
318 void CONFIG::free_all() {
|
|
|
319 recorder.free_all(*this);
|
|
|
320 }
|
|
|
321
|
|
3
|
322 bool CONFIG::looking(int ip) {
|
|
36
|
323 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
|
|
|
324 IPPAIR &p = *i;
|
|
|
325 if ((p.first <= ip) && (ip <= p.last)) return false;
|
|
|
326 }
|
|
|
327 return true;
|
|
3
|
328 }
|
|
|
329
|
|
|
330 ////////////////////////////////////////////////
|
|
|
331 //
|
|
|
332 SYSLOGCONFIG::SYSLOGCONFIG(TOKEN &tok, char *file_name_) {
|
|
36
|
333 tokp = &tok;
|
|
|
334 file_name = file_name_;
|
|
|
335 open(true);
|
|
1
|
336 }
|
|
|
337
|
|
|
338
|
|
|
339 SYSLOGCONFIG::~SYSLOGCONFIG() {
|
|
36
|
340 close();
|
|
|
341 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
|
|
|
342 PATTERN *p = *i;
|
|
|
343 delete p;
|
|
|
344 }
|
|
2
|
345 }
|
|
|
346
|
|
|
347
|
|
4
|
348 void SYSLOGCONFIG::open(bool msg) {
|
|
36
|
349 fd = ::open(file_name, O_RDONLY);
|
|
|
350 len = 0;
|
|
|
351 if (fd == -1) {
|
|
|
352 if (msg) {
|
|
|
353 char buf[maxlen];
|
|
|
354 snprintf(buf, sizeof(buf), "syslog file %s not readable", file_name);
|
|
|
355 tokp->token_error(buf);
|
|
|
356 }
|
|
|
357 }
|
|
|
358 else {
|
|
|
359 if (debug_syslog > 1) {
|
|
|
360 snprintf(buf, sizeof(buf), "syslog file %s opened", file_name);
|
|
|
361 my_syslog(buf);
|
|
|
362 }
|
|
|
363 lseek(fd, 0, SEEK_END);
|
|
|
364 if (fstat(fd, &openfdstat)) {
|
|
|
365 close();
|
|
|
366 snprintf(buf, sizeof(buf), "syslog file %s cannot stat after open", file_name);
|
|
|
367 tokp->token_error(buf);
|
|
|
368 }
|
|
|
369 // specify that this fd gets closed on exec, so that selinux
|
|
|
370 // won't complain about iptables trying to read log files.
|
|
|
371 int oldflags = fcntl(fd, F_GETFD, 0);
|
|
|
372 if (oldflags >= 0) {
|
|
|
373 fcntl(fd, F_SETFD, oldflags | FD_CLOEXEC);
|
|
|
374 }
|
|
|
375 }
|
|
3
|
376 }
|
|
|
377
|
|
|
378
|
|
|
379 bool SYSLOGCONFIG::read(CONFIG &con) {
|
|
36
|
380 if (failed()) {
|
|
|
381 open(false);
|
|
|
382 if (failed()) return false;
|
|
|
383 }
|
|
|
384 int n = ::read(fd, buf+len, buflen-len);
|
|
|
385 bool have = (n > 0);
|
|
|
386 if (have) {
|
|
|
387 len += n;
|
|
|
388 while (true) {
|
|
|
389 char *p = (char*)memchr(buf, '\n', len);
|
|
|
390 if (!p) break;
|
|
|
391 n = p-buf;
|
|
|
392 *p = '\0';
|
|
|
393 process(con); // process null terminated string
|
|
|
394 len -= n+1;
|
|
|
395 memmove(buf, p+1, len);
|
|
|
396 }
|
|
|
397 // no <lf> in a full buffer
|
|
|
398 if (len == buflen) len = 0;
|
|
|
399 }
|
|
|
400 else {
|
|
|
401 // check for file close
|
|
|
402 struct stat filenamest;
|
|
|
403 if (0 == stat(file_name, &filenamest)) {
|
|
|
404 if ((filenamest.st_dev != openfdstat.st_dev) ||
|
|
|
405 (filenamest.st_ino != openfdstat.st_ino)) {
|
|
|
406 close();
|
|
|
407 }
|
|
|
408 }
|
|
|
409 else {
|
|
|
410 // filename no longer exists
|
|
|
411 close();
|
|
|
412 }
|
|
|
413 }
|
|
|
414 return have;
|
|
2
|
415 }
|
|
|
416
|
|
|
417
|
|
4
|
418 void SYSLOGCONFIG::close() {
|
|
36
|
419 if (debug_syslog > 1) {
|
|
|
420 snprintf(buf, sizeof(buf), "syslog file %s closed", file_name);
|
|
|
421 my_syslog(buf);
|
|
|
422 }
|
|
|
423 if (fd != -1) ::close(fd);
|
|
|
424 fd = -1;
|
|
4
|
425 }
|
|
|
426
|
|
|
427
|
|
|
428 void SYSLOGCONFIG::add_pattern(PATTERNP pat) {
|
|
36
|
429 patterns.push_back(pat);
|
|
4
|
430 }
|
|
|
431
|
|
|
432
|
|
3
|
433 void SYSLOGCONFIG::process(CONFIG &con) {
|
|
36
|
434 int pi=0;
|
|
|
435 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
|
|
|
436 PATTERN *p = *i;
|
|
|
437 if (p->process(buf, con, file_name, pi)) break;
|
|
|
438 pi++;
|
|
|
439 }
|
|
1
|
440 }
|
|
|
441
|
|
|
442
|
|
|
443 void SYSLOGCONFIG::dump(int level) {
|
|
36
|
444 char indent[maxlen];
|
|
|
445 int i = min(maxlen-1, level*4);
|
|
|
446 memset(indent, ' ', i);
|
|
|
447 indent[i] = '\0';
|
|
|
448 char buf[maxlen];
|
|
|
449 printf("%s file \"%s\" {\n", indent, file_name);
|
|
|
450 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
|
|
|
451 PATTERN *p = *i;
|
|
|
452 p->dump(level+1);
|
|
|
453 }
|
|
|
454 printf("%s }; \n", indent);
|
|
1
|
455 }
|
|
|
456
|
|
|
457
|
|
|
458 ////////////////////////////////////////////////
|
|
|
459 // helper to discard the strings held by a string_set
|
|
|
460 //
|
|
|
461 void discard(string_set &s) {
|
|
36
|
462 for (string_set::iterator i=s.begin(); i!=s.end(); i++) {
|
|
|
463 free(*i);
|
|
|
464 }
|
|
|
465 s.clear();
|
|
1
|
466 }
|
|
|
467
|
|
|
468
|
|
|
469 ////////////////////////////////////////////////
|
|
|
470 // helper to register a string in a string set
|
|
|
471 //
|
|
|
472 char* register_string(string_set &s, char *name) {
|
|
36
|
473 string_set::iterator i = s.find(name);
|
|
|
474 if (i != s.end()) return *i;
|
|
|
475 char *x = strdup(name);
|
|
|
476 s.insert(x);
|
|
|
477 return x;
|
|
1
|
478 }
|
|
|
479
|
|
|
480
|
|
|
481 ////////////////////////////////////////////////
|
|
|
482 // register a global string
|
|
|
483 //
|
|
|
484 char* register_string(char *name) {
|
|
36
|
485 return register_string(all_strings, name);
|
|
1
|
486 }
|
|
|
487
|
|
|
488
|
|
|
489 ////////////////////////////////////////////////
|
|
38
|
490 // clear all global strings, helper for valgrind checking
|
|
|
491 //
|
|
|
492 void clear_strings() {
|
|
|
493 discard(all_strings);
|
|
|
494 }
|
|
|
495
|
|
|
496
|
|
|
497 ////////////////////////////////////////////////
|
|
1
|
498 //
|
|
|
499 bool tsa(TOKEN &tok, char *token);
|
|
|
500 bool tsa(TOKEN &tok, char *token) {
|
|
36
|
501 char *have = tok.next();
|
|
|
502 if (have == token) return true;
|
|
|
503 tok.token_error(token, have);
|
|
|
504 return false;
|
|
1
|
505 }
|
|
|
506
|
|
|
507
|
|
|
508 ////////////////////////////////////////////////
|
|
|
509 //
|
|
3
|
510 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con);
|
|
|
511 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con) {
|
|
36
|
512 char *pat = tok.next();
|
|
|
513 int ind, buc;
|
|
|
514 char *msg = NULL;
|
|
|
515 if (!tsa(tok, token_lbrace)) return false;
|
|
|
516 while (true) {
|
|
|
517 char *have = tok.next();
|
|
|
518 if (!have) break;
|
|
|
519 if (have == token_rbrace) break;
|
|
|
520 if (have == token_index) {
|
|
|
521 have = tok.next();
|
|
|
522 ind = atoi(have);
|
|
|
523 if (!tsa(tok, token_semi)) return false;
|
|
|
524 }
|
|
|
525 else if (have == token_bucket) {
|
|
|
526 have = tok.next();
|
|
|
527 buc = atoi(have);
|
|
|
528 if (!tsa(tok, token_semi)) return false;
|
|
|
529 }
|
|
|
530 else if (have == token_message) {
|
|
|
531 msg = tok.next();
|
|
|
532 if (!tsa(tok, token_semi)) return false;
|
|
|
533 }
|
|
|
534 else {
|
|
|
535 tok.token_error("index/bucket", have);
|
|
|
536 return false;
|
|
|
537 }
|
|
|
538 }
|
|
|
539 if (!tsa(tok, token_semi)) return false;
|
|
|
540 PATTERNP patt = new PATTERN(tok, pat, ind, buc, msg);
|
|
|
541 con.add_pattern(patt);
|
|
|
542 return true;
|
|
3
|
543 }
|
|
|
544
|
|
|
545
|
|
|
546 ////////////////////////////////////////////////
|
|
|
547 //
|
|
|
548 bool parse_ignore(TOKEN &tok, CONFIG &dc);
|
|
|
549 bool parse_ignore(TOKEN &tok, CONFIG &dc) {
|
|
36
|
550 if (!tsa(tok, token_lbrace)) return false;
|
|
|
551 while (true) {
|
|
|
552 char *have = tok.next();
|
|
|
553 if (!have) break;
|
|
|
554 if (have == token_rbrace) break;
|
|
|
555 int ipaddr = ip_address(have);
|
|
|
556 if (ipaddr == 0) {
|
|
|
557 tok.token_error("ip address", have);
|
|
|
558 return false;
|
|
|
559 }
|
|
|
560 if (!tsa(tok, token_slash)) return false;
|
|
|
561 have = tok.next();
|
|
|
562 int mask = atoi(have);
|
|
|
563 if ((mask < 8) || (mask > 32)) {
|
|
|
564 tok.token_error("cidr 8..32 value", have);
|
|
|
565 return false;
|
|
|
566 }
|
|
|
567 if (!tsa(tok, token_semi)) return false;
|
|
|
568 IPPAIR pair;
|
|
|
569 const int masks[33] = {0xffffffff, // 0
|
|
|
570 0x7fffffff, // 1
|
|
|
571 0x3fffffff, // 2
|
|
|
572 0x1fffffff, // 3
|
|
|
573 0x0fffffff, // 4
|
|
|
574 0x07ffffff, // 5
|
|
|
575 0x03ffffff, // 6
|
|
|
576 0x01ffffff, // 7
|
|
|
577 0x00ffffff, // 8
|
|
|
578 0x007fffff, // 9
|
|
|
579 0x003fffff, // 10
|
|
|
580 0x001fffff, // 11
|
|
|
581 0x000fffff, // 12
|
|
|
582 0x0007ffff, // 13
|
|
|
583 0x0003ffff, // 14
|
|
|
584 0x0001ffff, // 15
|
|
|
585 0x0000ffff, // 16
|
|
|
586 0x00007fff, // 17
|
|
|
587 0x00003fff, // 18
|
|
|
588 0x00001fff, // 19
|
|
|
589 0x00000fff, // 20
|
|
|
590 0x000007ff, // 21
|
|
|
591 0x000003ff, // 22
|
|
|
592 0x000001ff, // 23
|
|
|
593 0x000000ff, // 24
|
|
|
594 0x0000007f, // 25
|
|
|
595 0x0000003f, // 26
|
|
|
596 0x0000001f, // 27
|
|
|
597 0x0000000f, // 28
|
|
|
598 0x00000007, // 29
|
|
|
599 0x00000003, // 30
|
|
|
600 0x00000001, // 31
|
|
|
601 0x00000000}; // 32
|
|
|
602 pair.first = ipaddr;
|
|
|
603 pair.last = ipaddr | masks[mask];
|
|
|
604 pair.cidr = mask;
|
|
|
605 dc.add_pair(pair);
|
|
|
606 }
|
|
|
607 if (!tsa(tok, token_semi)) return false;
|
|
|
608 return true;
|
|
3
|
609 }
|
|
|
610
|
|
|
611
|
|
|
612 ////////////////////////////////////////////////
|
|
|
613 //
|
|
|
614 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc);
|
|
|
615 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc) {
|
|
36
|
616 char *name = tok.next();
|
|
|
617 if (!tsa(tok, token_lbrace)) return false;
|
|
|
618 SYSLOGCONFIGP con = new SYSLOGCONFIG(tok, name);
|
|
|
619 if (con->failed()) {
|
|
|
620 delete con;
|
|
|
621 return false;
|
|
|
622 }
|
|
|
623 dc.add_syslogconfig(con);
|
|
|
624 while (true) {
|
|
|
625 char *have = tok.next();
|
|
|
626 if (!have) break;
|
|
|
627 if (have == token_rbrace) break;
|
|
|
628 if (have == token_pattern) {
|
|
|
629 if (!parse_pattern(tok, *con)) return false;
|
|
|
630 }
|
|
|
631 else {
|
|
|
632 tok.token_error("pattern", have);
|
|
|
633 return false;
|
|
|
634 }
|
|
|
635 }
|
|
|
636 if (!tsa(tok, token_semi)) return false;
|
|
|
637 return true;
|
|
1
|
638 }
|
|
|
639
|
|
|
640
|
|
|
641 ////////////////////////////////////////////////
|
|
|
642 // parse a config file
|
|
|
643 //
|
|
|
644 bool load_conf(CONFIG &dc, char *fn) {
|
|
36
|
645 int count = 0;
|
|
|
646 TOKEN tok(fn, &dc.config_files);
|
|
|
647 while (true) {
|
|
|
648 char *have = tok.next();
|
|
|
649 if (!have) break;
|
|
|
650 if (have == token_threshold) {
|
|
|
651 have = tok.next();
|
|
|
652 dc.set_threshold(atoi(have));
|
|
|
653 if (!tsa(tok, token_semi)) return false;
|
|
|
654 }
|
|
|
655 else if (have == token_ignore) {
|
|
|
656 if (!parse_ignore(tok, dc)) return false;
|
|
|
657 }
|
|
|
658 else if (have == token_add) {
|
|
|
659 have = tok.next();
|
|
|
660 dc.set_add(have);
|
|
|
661 if (!tsa(tok, token_semi)) return false;
|
|
|
662 }
|
|
|
663 else if (have == token_remove) {
|
|
|
664 have = tok.next();
|
|
|
665 dc.set_remove(have);
|
|
|
666 if (!tsa(tok, token_semi)) return false;
|
|
|
667 }
|
|
|
668 else if (have == token_file) {
|
|
|
669 if (!parse_syslogconfig(tok, dc)) return false;
|
|
|
670 count++;
|
|
|
671 }
|
|
|
672 else {
|
|
|
673 tok.token_error("threshold/ignore/add_command/remove_command/file", have);
|
|
|
674 return false;
|
|
|
675 }
|
|
|
676 }
|
|
|
677 tok.token_error("load_conf() found %d syslog files in %s", count, fn);
|
|
|
678 return (!dc.syslogconfigs.empty());
|
|
1
|
679 }
|
|
|
680
|
|
|
681
|
|
|
682 ////////////////////////////////////////////////
|
|
|
683 // init the tokens
|
|
|
684 //
|
|
|
685 void token_init() {
|
|
36
|
686 token_add = register_string("add_command");
|
|
|
687 token_bucket = register_string("bucket");
|
|
|
688 token_file = register_string("file");
|
|
|
689 token_ignore = register_string("ignore");
|
|
|
690 token_include = register_string("include");
|
|
|
691 token_index = register_string("index");
|
|
|
692 token_lbrace = register_string("{");
|
|
|
693 token_message = register_string("message");
|
|
|
694 token_pattern = register_string("pattern");
|
|
|
695 token_rbrace = register_string("}");
|
|
|
696 token_remove = register_string("remove_command");
|
|
|
697 token_semi = register_string(";");
|
|
|
698 token_slash = register_string("/");
|
|
|
699 token_threshold = register_string("threshold");
|
|
1
|
700 }
|
