annotate src/syslogconfig.cpp @ 50:75361069c6ef

changes for fedora 10
author Carl Byington <carl@five-ten-sg.com>
date Wed, 24 Dec 2008 18:40:54 -0800
parents ba0259c9e411
children 206448c00b55
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
1 /*
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
2
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
3 Copyright (c) 2007 Carl Byington - 510 Software Group, released under
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
4 the GPL version 3 or any later version at your choice available at
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
5 http://www.gnu.org/licenses/gpl-3.0.txt
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
6
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
7 */
1
551433a01cab initial coding
carl
parents:
diff changeset
8
551433a01cab initial coding
carl
parents:
diff changeset
9 #include "includes.h"
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
10 #include <fcntl.h>
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
11 #include <sys/socket.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
12 #include <netinet/in.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
13 #include <arpa/inet.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
14 #include <netdb.h>
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
15 #include <limits.h>
1
551433a01cab initial coding
carl
parents:
diff changeset
16
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
17 const char *token_add;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
18 const char *token_bucket;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
19 const char *token_file;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
20 const char *token_ignore;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
21 const char *token_include;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
22 const char *token_index;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
23 const char *token_lbrace;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
24 const char *token_message;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
25 const char *token_pattern;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
26 const char *token_rbrace;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
27 const char *token_remove;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
28 const char *token_semi;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
29 const char *token_slash;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
30 const char *token_threshold;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
31
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
32 struct ltint
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
33 {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
34 bool operator()(const int s1, const int s2) const
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
35 {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
36 return (unsigned)s1 < (unsigned)s2;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
37 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
38 };
1
551433a01cab initial coding
carl
parents:
diff changeset
39
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
40 struct bucket {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
41 int count;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
42 bool latch; // true iff ever count>threshold
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
43 };
2737ab01659a initial coding
carl
parents: 3
diff changeset
44
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
45 string_set all_strings; // owns all the strings, only modified by the config loader thread
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
46 const int maxlen = 1000; // used for snprintf buffers
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
47 typedef map<int, bucket, ltint> ip_buckets;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
48
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
49 class IPR {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
50 ip_buckets violations;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
51 public:
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
52 void add(int ip, int amount, CONFIG &con, const char *file_name, int pattern_index, const char *message);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
53 void leak(int amount, CONFIG &con);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
54 void free_all(CONFIG &con);
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
55 void update(int ip, bool added, const char *file_name, int pattern_index, const char *message);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
56 void changed(CONFIG &con, int ip, bool added);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
57 };
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
58
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
59 IPR recorder;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
60
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
61
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
62 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
63 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
64 void IPR::add(int ip, int amount, CONFIG &con, const char *file_name, int pattern_index, const char *message) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
65 if (con.looking(ip)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
66 ip_buckets::iterator i = violations.find(ip);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
67 if (i == violations.end()) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
68 bucket b;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
69 b.count = amount;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
70 b.latch = (con.get_threshold() <= b.count);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
71 violations[ip] = b;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
72 if (b.latch) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
73 update(ip, true, file_name, pattern_index, message);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
74 changed(con, ip, true);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
75 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
76 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
77 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
78 bucket &b = (*i).second;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
79 if (b.count < (INT_MAX-amount)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
80 int t = con.get_threshold();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
81 int c = b.count;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
82 b.count += amount;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
83 if ((!b.latch) && (c < t) && (t <= b.count)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
84 b.latch = true;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
85 update(ip, true, file_name, pattern_index, message);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
86 changed(con, ip, true);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
87 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
88 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
89 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
90 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
91 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
92
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
93
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
94 void IPR::leak(int amount, CONFIG &con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
95 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); ) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
96 int ip = (*i).first;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
97 bucket &b = (*i).second;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
98 if (b.count <= amount) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
99 if (b.latch) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
100 update(ip, false, NULL, 0, NULL);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
101 changed(con, ip, false);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
102 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
103 violations.erase(i++);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
104 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
105 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
106 b.count -= amount;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
107 i++;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
108 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
109 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
110 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
111
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
112
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
113 void IPR::free_all(CONFIG &con) {
37
e4eb969dfc4a shutdown removes iptables entries that we added
carl
parents: 36
diff changeset
114 if (debug_syslog > 2) {
e4eb969dfc4a shutdown removes iptables entries that we added
carl
parents: 36
diff changeset
115 my_syslog("syslog2iptables shutting down");
e4eb969dfc4a shutdown removes iptables entries that we added
carl
parents: 36
diff changeset
116 }
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
117 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
118 int ip = (*i).first;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
119 bucket &b = (*i).second;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
120 if (b.latch) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
121 update(ip, false, NULL, 0, NULL);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
122 changed(con, ip, false);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
123 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
124 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
125 violations.clear();
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
126 }
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
127
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
128
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
129 void IPR::update(int ip, bool added, const char *file_name, int pattern_index, const char *message) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
130 if (debug_syslog > 2) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
131 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
132 in_addr ad;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
133 ad.s_addr = htonl(ip);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
134 if (added) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
135 if (message) snprintf(buf, maxlen, "dropping traffic from/to %s based on %s in %s", inet_ntoa(ad), message, file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
136 else snprintf(buf, maxlen, "dropping traffic from/to %s based on pattern match %d in %s", inet_ntoa(ad), pattern_index, file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
137 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
138 else snprintf(buf, maxlen, "allowing traffic from/to %s", inet_ntoa(ad));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
139 my_syslog(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
140 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
141 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
142
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
143
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
144 void IPR::changed(CONFIG &con, int ip, bool added) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
145 int t = con.get_threshold();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
146 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
147 if (added) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
148 bucket &b = violations[ip];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
149 if (con.looking(ip) && (b.count > t)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
150 in_addr ad;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
151 ad.s_addr = htonl(ip);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
152 snprintf(buf, maxlen, con.add_command, inet_ntoa(ad));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
153 system(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
154 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
155 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
156 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
157 in_addr ad;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
158 ad.s_addr = htonl(ip);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
159 snprintf(buf, maxlen, con.remove_command, inet_ntoa(ad));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
160 system(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
161 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
162 }
1
551433a01cab initial coding
carl
parents:
diff changeset
163
551433a01cab initial coding
carl
parents:
diff changeset
164
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
165 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
166 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
167 int ip_address(const char *have);
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
168 int ip_address(const char *have) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
169 int ipaddr = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
170 in_addr ip;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
171 if (inet_aton(have, &ip)) ipaddr = ip.s_addr;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
172 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
173 struct hostent *host = gethostbyname(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
174 if (host && host->h_addrtype == AF_INET) memcpy(&ipaddr, host->h_addr, sizeof(ipaddr));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
175 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
176 return ntohl(ipaddr);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
177 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
178
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
179
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
180 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
181 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
182 PATTERN::PATTERN(TOKEN &tok, const char *pattern_, int index_, int amount_, const char *msg_) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
183 pattern = pattern_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
184 index = index_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
185 amount = amount_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
186 message = msg_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
187 if (pattern) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
188 int rc = regcomp(&re, pattern, REG_ICASE | REG_EXTENDED);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
189 if (rc) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
190 char bu[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
191 regerror(rc, &re, bu, maxlen);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
192 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
193 snprintf(buf, sizeof(buf), "pattern %s not valid - %s", pattern, bu);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
194 tok.token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
195 pattern = NULL;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
196 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
197 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
198 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
199
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
200
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
201 PATTERN::~PATTERN() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
202 regfree(&re);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
203 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
204
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
205
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
206 bool PATTERN::process(char *buf, CONFIG &con, const char *file_name, int pattern_index) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
207 if (pattern) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
208 const int nmatch = index+1;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
209 regmatch_t match[nmatch];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
210 if (0 == regexec(&re, buf, nmatch, match, 0)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
211 int s = match[index].rm_so;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
212 int e = match[index].rm_eo;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
213 if (s != -1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
214 if (debug_syslog > 3) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
215 my_syslog(buf); // show lines with matches
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
216 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
217 buf[e] = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
218 int ip = ip_address(buf+s);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
219 if (ip) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
220 recorder.add(ip, amount, con, file_name, pattern_index, message);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
221 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
222 return true;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
223 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
224 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
225 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
226 return false;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
227 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
228
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
229
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
230 void PATTERN::dump(int level) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
231 char indent[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
232 int i = min(maxlen-1, level*4);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
233 memset(indent, ' ', i);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
234 indent[i] = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
235 printf("%s pattern \"%s\" {; \n", indent, pattern);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
236 printf("%s index %d; \n", indent, index);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
237 printf("%s bucket %d; \n", indent, amount);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
238 if (message) printf("%s message \"%s\"; \n", indent, message);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
239 printf("%s }; \n", indent);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
240 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
241
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
242
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
243 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
244 //
1
551433a01cab initial coding
carl
parents:
diff changeset
245 CONFIG::CONFIG() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
246 reference_count = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
247 generation = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
248 load_time = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
249 threshold = 500;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
250 add_command = "/sbin/iptables -I INPUT --src %s --jump DROP";
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
251 remove_command = "/sbin/iptables -D INPUT --src %s --jump DROP";
1
551433a01cab initial coding
carl
parents:
diff changeset
252 }
551433a01cab initial coding
carl
parents:
diff changeset
253
551433a01cab initial coding
carl
parents:
diff changeset
254
551433a01cab initial coding
carl
parents:
diff changeset
255 CONFIG::~CONFIG() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
256 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
257 SYSLOGCONFIG *c = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
258 delete c;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
259 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
260 ignore.clear();
1
551433a01cab initial coding
carl
parents:
diff changeset
261 }
551433a01cab initial coding
carl
parents:
diff changeset
262
551433a01cab initial coding
carl
parents:
diff changeset
263
551433a01cab initial coding
carl
parents:
diff changeset
264 void CONFIG::add_syslogconfig(SYSLOGCONFIGP con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
265 syslogconfigs.push_back(con);
1
551433a01cab initial coding
carl
parents:
diff changeset
266 }
551433a01cab initial coding
carl
parents:
diff changeset
267
551433a01cab initial coding
carl
parents:
diff changeset
268
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
269 void CONFIG::add_pair(IPPAIR pair) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
270 ignore.push_back(pair);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
271 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
272
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
273
1
551433a01cab initial coding
carl
parents:
diff changeset
274 void CONFIG::dump() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
275 printf(" threshold %d; \n\n", threshold);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
276
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
277 printf(" add_command \"%s\"; \n", add_command);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
278 printf(" remove_command \"%s\"; \n\n", remove_command);
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
279
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
280 printf(" ignore { \n");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
281 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
282 IPPAIR &p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
283 in_addr ip;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
284 ip.s_addr = htonl(p.first);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
285 printf(" %s/%d; \n", inet_ntoa(ip), p.cidr);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
286 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
287 printf(" }; \n\n");
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
288
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
289 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
290 SYSLOGCONFIGP c = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
291 c->dump(0);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
292 }
1
551433a01cab initial coding
carl
parents:
diff changeset
293 }
551433a01cab initial coding
carl
parents:
diff changeset
294
551433a01cab initial coding
carl
parents:
diff changeset
295
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
296 void CONFIG::read() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
297 while (true) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
298 bool have = false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
299 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
300 SYSLOGCONFIGP c = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
301 have |= c->read(*this);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
302 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
303 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
304 }
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
305 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
306
6e88da080f08 initial coding
carl
parents: 1
diff changeset
307
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
308 void CONFIG::sleep(int duration, time_t &previous) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
309 ::sleep(duration);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
310 time_t now = time(NULL);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
311 recorder.leak(now-previous, *this);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
312 previous = now;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
313 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
314
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
315
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
316 void CONFIG::free_all() {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
317 recorder.free_all(*this);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
318 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
319
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
320 bool CONFIG::looking(int ip) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
321 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
322 IPPAIR &p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
323 if ((p.first <= ip) && (ip <= p.last)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
324 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
325 return true;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
326 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
327
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
328 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
329 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
330 SYSLOGCONFIG::SYSLOGCONFIG(TOKEN &tok, const char *file_name_) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
331 tokp = &tok;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
332 file_name = file_name_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
333 open(true);
1
551433a01cab initial coding
carl
parents:
diff changeset
334 }
551433a01cab initial coding
carl
parents:
diff changeset
335
551433a01cab initial coding
carl
parents:
diff changeset
336
551433a01cab initial coding
carl
parents:
diff changeset
337 SYSLOGCONFIG::~SYSLOGCONFIG() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
338 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
339 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
340 PATTERN *p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
341 delete p;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
342 }
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
343 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
344
6e88da080f08 initial coding
carl
parents: 1
diff changeset
345
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
346 void SYSLOGCONFIG::open(bool msg) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
347 fd = ::open(file_name, O_RDONLY);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
348 len = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
349 if (fd == -1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
350 if (msg) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
351 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
352 snprintf(buf, sizeof(buf), "syslog file %s not readable", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
353 tokp->token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
354 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
355 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
356 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
357 if (debug_syslog > 1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
358 snprintf(buf, sizeof(buf), "syslog file %s opened", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
359 my_syslog(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
360 }
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
361 if (msg) lseek(fd, 0, SEEK_END);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
362 if (fstat(fd, &openfdstat)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
363 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
364 snprintf(buf, sizeof(buf), "syslog file %s cannot stat after open", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
365 tokp->token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
366 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
367 // specify that this fd gets closed on exec, so that selinux
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
368 // won't complain about iptables trying to read log files.
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
369 int oldflags = fcntl(fd, F_GETFD, 0);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
370 if (oldflags >= 0) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
371 fcntl(fd, F_SETFD, oldflags | FD_CLOEXEC);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
372 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
373 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
374 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
375
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
376
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
377 bool SYSLOGCONFIG::read(CONFIG &con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
378 if (failed()) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
379 open(false);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
380 if (failed()) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
381 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
382 int n = ::read(fd, buf+len, buflen-len);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
383 bool have = (n > 0);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
384 if (have) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
385 len += n;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
386 while (true) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
387 char *p = (char*)memchr(buf, '\n', len);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
388 if (!p) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
389 n = p-buf;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
390 *p = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
391 process(con); // process null terminated string
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
392 len -= n+1;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
393 memmove(buf, p+1, len);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
394 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
395 // no <lf> in a full buffer
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
396 if (len == buflen) len = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
397 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
398 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
399 // check for file close
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
400 struct stat filenamest;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
401 if (0 == stat(file_name, &filenamest)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
402 if ((filenamest.st_dev != openfdstat.st_dev) ||
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
403 (filenamest.st_ino != openfdstat.st_ino)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
404 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
405 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
406 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
407 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
408 // filename no longer exists
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
409 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
410 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
411 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
412 return have;
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
413 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
414
6e88da080f08 initial coding
carl
parents: 1
diff changeset
415
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
416 void SYSLOGCONFIG::close() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
417 if (debug_syslog > 1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
418 snprintf(buf, sizeof(buf), "syslog file %s closed", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
419 my_syslog(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
420 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
421 if (fd != -1) ::close(fd);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
422 fd = -1;
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
423 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
424
2737ab01659a initial coding
carl
parents: 3
diff changeset
425
2737ab01659a initial coding
carl
parents: 3
diff changeset
426 void SYSLOGCONFIG::add_pattern(PATTERNP pat) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
427 patterns.push_back(pat);
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
428 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
429
2737ab01659a initial coding
carl
parents: 3
diff changeset
430
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
431 void SYSLOGCONFIG::process(CONFIG &con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
432 int pi=0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
433 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
434 PATTERN *p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
435 if (p->process(buf, con, file_name, pi)) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
436 pi++;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
437 }
1
551433a01cab initial coding
carl
parents:
diff changeset
438 }
551433a01cab initial coding
carl
parents:
diff changeset
439
551433a01cab initial coding
carl
parents:
diff changeset
440
551433a01cab initial coding
carl
parents:
diff changeset
441 void SYSLOGCONFIG::dump(int level) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
442 char indent[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
443 int i = min(maxlen-1, level*4);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
444 memset(indent, ' ', i);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
445 indent[i] = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
446 printf("%s file \"%s\" {\n", indent, file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
447 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
448 PATTERN *p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
449 p->dump(level+1);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
450 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
451 printf("%s }; \n", indent);
1
551433a01cab initial coding
carl
parents:
diff changeset
452 }
551433a01cab initial coding
carl
parents:
diff changeset
453
551433a01cab initial coding
carl
parents:
diff changeset
454
551433a01cab initial coding
carl
parents:
diff changeset
455 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
456 // helper to discard the strings held by a string_set
551433a01cab initial coding
carl
parents:
diff changeset
457 //
551433a01cab initial coding
carl
parents:
diff changeset
458 void discard(string_set &s) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
459 for (string_set::iterator i=s.begin(); i!=s.end(); i++) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
460 free((void*)*i);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
461 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
462 s.clear();
1
551433a01cab initial coding
carl
parents:
diff changeset
463 }
551433a01cab initial coding
carl
parents:
diff changeset
464
551433a01cab initial coding
carl
parents:
diff changeset
465
551433a01cab initial coding
carl
parents:
diff changeset
466 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
467 // helper to register a string in a string set
551433a01cab initial coding
carl
parents:
diff changeset
468 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
469 const char* register_string(string_set &s, const char *name) {
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
470 string_set::const_iterator i = s.find(name);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
471 if (i != s.end()) return *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
472 char *x = strdup(name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
473 s.insert(x);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
474 return x;
1
551433a01cab initial coding
carl
parents:
diff changeset
475 }
551433a01cab initial coding
carl
parents:
diff changeset
476
551433a01cab initial coding
carl
parents:
diff changeset
477
551433a01cab initial coding
carl
parents:
diff changeset
478 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
479 // register a global string
551433a01cab initial coding
carl
parents:
diff changeset
480 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
481 const char* register_string(const char *name) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
482 return register_string(all_strings, name);
1
551433a01cab initial coding
carl
parents:
diff changeset
483 }
551433a01cab initial coding
carl
parents:
diff changeset
484
551433a01cab initial coding
carl
parents:
diff changeset
485
551433a01cab initial coding
carl
parents:
diff changeset
486 ////////////////////////////////////////////////
38
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
487 // clear all global strings, helper for valgrind checking
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
488 //
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
489 void clear_strings() {
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
490 discard(all_strings);
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
491 }
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
492
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
493
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
494 ////////////////////////////////////////////////
1
551433a01cab initial coding
carl
parents:
diff changeset
495 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
496 bool tsa(TOKEN &tok, const char *token);
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
497 bool tsa(TOKEN &tok, const char *token) {
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
498 const char *have = tok.next();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
499 if (have == token) return true;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
500 tok.token_error(token, have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
501 return false;
1
551433a01cab initial coding
carl
parents:
diff changeset
502 }
551433a01cab initial coding
carl
parents:
diff changeset
503
551433a01cab initial coding
carl
parents:
diff changeset
504
551433a01cab initial coding
carl
parents:
diff changeset
505 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
506 //
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
507 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
508 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
509 const char *pat = tok.next();
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
510 int ind = 0;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
511 int buc = 0;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
512 const char *msg = NULL;
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
513 if (!tsa(tok, token_lbrace)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
514 while (true) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
515 const char *have = tok.next();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
516 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
517 if (have == token_rbrace) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
518 if (have == token_index) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
519 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
520 ind = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
521 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
522 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
523 else if (have == token_bucket) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
524 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
525 buc = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
526 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
527 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
528 else if (have == token_message) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
529 msg = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
530 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
531 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
532 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
533 tok.token_error("index/bucket", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
534 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
535 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
536 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
537 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
538 PATTERNP patt = new PATTERN(tok, pat, ind, buc, msg);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
539 con.add_pattern(patt);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
540 return true;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
541 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
542
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
543
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
544 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
545 //
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
546 bool parse_ignore(TOKEN &tok, CONFIG &dc);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
547 bool parse_ignore(TOKEN &tok, CONFIG &dc) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
548 if (!tsa(tok, token_lbrace)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
549 while (true) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
550 const char *have = tok.next();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
551 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
552 if (have == token_rbrace) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
553 int ipaddr = ip_address(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
554 if (ipaddr == 0) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
555 tok.token_error("ip address", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
556 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
557 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
558 if (!tsa(tok, token_slash)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
559 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
560 int mask = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
561 if ((mask < 8) || (mask > 32)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
562 tok.token_error("cidr 8..32 value", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
563 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
564 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
565 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
566 IPPAIR pair;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
567 const int masks[33] = {0xffffffff, // 0
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
568 0x7fffffff, // 1
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
569 0x3fffffff, // 2
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
570 0x1fffffff, // 3
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
571 0x0fffffff, // 4
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
572 0x07ffffff, // 5
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
573 0x03ffffff, // 6
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
574 0x01ffffff, // 7
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
575 0x00ffffff, // 8
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
576 0x007fffff, // 9
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
577 0x003fffff, // 10
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
578 0x001fffff, // 11
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
579 0x000fffff, // 12
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
580 0x0007ffff, // 13
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
581 0x0003ffff, // 14
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
582 0x0001ffff, // 15
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
583 0x0000ffff, // 16
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
584 0x00007fff, // 17
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
585 0x00003fff, // 18
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
586 0x00001fff, // 19
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
587 0x00000fff, // 20
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
588 0x000007ff, // 21
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
589 0x000003ff, // 22
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
590 0x000001ff, // 23
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
591 0x000000ff, // 24
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
592 0x0000007f, // 25
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
593 0x0000003f, // 26
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
594 0x0000001f, // 27
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
595 0x0000000f, // 28
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
596 0x00000007, // 29
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
597 0x00000003, // 30
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
598 0x00000001, // 31
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
599 0x00000000}; // 32
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
600 pair.first = ipaddr;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
601 pair.last = ipaddr | masks[mask];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
602 pair.cidr = mask;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
603 dc.add_pair(pair);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
604 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
605 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
606 return true;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
607 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
608
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
609
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
610 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
611 //
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
612 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
613 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
614 const char *name = tok.next();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
615 if (!tsa(tok, token_lbrace)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
616 SYSLOGCONFIGP con = new SYSLOGCONFIG(tok, name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
617 if (con->failed()) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
618 delete con;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
619 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
620 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
621 dc.add_syslogconfig(con);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
622 while (true) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
623 const char *have = tok.next();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
624 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
625 if (have == token_rbrace) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
626 if (have == token_pattern) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
627 if (!parse_pattern(tok, *con)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
628 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
629 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
630 tok.token_error("pattern", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
631 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
632 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
633 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
634 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
635 return true;
1
551433a01cab initial coding
carl
parents:
diff changeset
636 }
551433a01cab initial coding
carl
parents:
diff changeset
637
551433a01cab initial coding
carl
parents:
diff changeset
638
551433a01cab initial coding
carl
parents:
diff changeset
639 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
640 // parse a config file
551433a01cab initial coding
carl
parents:
diff changeset
641 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
642 bool load_conf(CONFIG &dc, const char *fn) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
643 int count = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
644 TOKEN tok(fn, &dc.config_files);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
645 while (true) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
646 const char *have = tok.next();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
647 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
648 if (have == token_threshold) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
649 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
650 dc.set_threshold(atoi(have));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
651 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
652 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
653 else if (have == token_ignore) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
654 if (!parse_ignore(tok, dc)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
655 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
656 else if (have == token_add) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
657 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
658 dc.set_add(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
659 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
660 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
661 else if (have == token_remove) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
662 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
663 dc.set_remove(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
664 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
665 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
666 else if (have == token_file) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
667 if (!parse_syslogconfig(tok, dc)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
668 count++;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
669 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
670 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
671 tok.token_error("threshold/ignore/add_command/remove_command/file", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
672 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
673 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
674 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
675 tok.token_error("load_conf() found %d syslog files in %s", count, fn);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
676 return (!dc.syslogconfigs.empty());
1
551433a01cab initial coding
carl
parents:
diff changeset
677 }
551433a01cab initial coding
carl
parents:
diff changeset
678
551433a01cab initial coding
carl
parents:
diff changeset
679
551433a01cab initial coding
carl
parents:
diff changeset
680 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
681 // init the tokens
551433a01cab initial coding
carl
parents:
diff changeset
682 //
551433a01cab initial coding
carl
parents:
diff changeset
683 void token_init() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
684 token_add = register_string("add_command");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
685 token_bucket = register_string("bucket");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
686 token_file = register_string("file");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
687 token_ignore = register_string("ignore");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
688 token_include = register_string("include");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
689 token_index = register_string("index");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
690 token_lbrace = register_string("{");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
691 token_message = register_string("message");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
692 token_pattern = register_string("pattern");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
693 token_rbrace = register_string("}");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
694 token_remove = register_string("remove_command");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
695 token_semi = register_string(";");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
696 token_slash = register_string("/");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
697 token_threshold = register_string("threshold");
1
551433a01cab initial coding
carl
parents:
diff changeset
698 }