annotate src/syslogconfig.cpp @ 80:858aec84fe13

Added tag stable-1-0-18 for changeset 831d0b46bbd2
author Carl Byington <carl@five-ten-sg.com>
date Wed, 15 Jul 2020 14:29:47 -0700
parents 831d0b46bbd2
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
1 /*
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
2
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
3 Copyright (c) 2007 Carl Byington - 510 Software Group, released under
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
4 the GPL version 3 or any later version at your choice available at
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
5 http://www.gnu.org/licenses/gpl-3.0.txt
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
6
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
7 */
1
551433a01cab initial coding
carl
parents:
diff changeset
8
551433a01cab initial coding
carl
parents:
diff changeset
9 #include "includes.h"
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
10 #include <fcntl.h>
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
11 #include <sys/socket.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
12 #include <netinet/in.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
13 #include <arpa/inet.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
14 #include <netdb.h>
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
15 #include <limits.h>
1
551433a01cab initial coding
carl
parents:
diff changeset
16
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
17 const char *token_add;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
18 const char *token_bucket;
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
19 const char *token_context;
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
20 const char *token_file;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
21 const char *token_ignore;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
22 const char *token_include;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
23 const char *token_index;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
24 const char *token_lbrace;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
25 const char *token_message;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
26 const char *token_pattern;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
27 const char *token_rbrace;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
28 const char *token_remove;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
29 const char *token_semi;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
30 const char *token_slash;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
31 const char *token_threshold;
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
32 string_set all_strings;// owns all the strings, only modified by the config loader thread
76
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
33 recorder_map recorders; // all the recorders are named by their context
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
34 const int maxlen = 1000; // used for snprintf buffers
58
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
35 const int scale_max = 500000;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
36
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
37
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
38 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
39 //
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
40
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
41 IPR::IPR() {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
42 reference_count = 0;
58
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
43 daily_timer = 86400;
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
44 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
45
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
46 IPR* IPR::find(const char* name) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
47 recorder_map::iterator m = recorders.find(name);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
48 if (m == recorders.end()) recorders[name] = new IPR;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
49 recorders[name]->reference(1);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
50 return recorders[name];
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
51 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
52
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
53
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
54 void IPR::release(const char* name) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
55 recorder_map::iterator m = recorders.find(name);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
56 IPR* i = (*m).second;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
57 int r = i->reference(-1);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
58 if (r == 0) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
59 delete i;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
60 recorders.erase(m);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
61 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
62 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
63
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
64
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
65 void IPR::add(int ip, int amount, CONTEXT &con, const char *file_name, int pattern_index, const char *message) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
66 if (con.looking(ip)) {
63
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
67 if (amount > 0) {
76
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
68 int original_amount = amount;
63
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
69 ip_buckets::iterator j = repeat_offenders.find(ip);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
70 int scale = (j == repeat_offenders.end()) ? 1 : (*j).second.count;
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
71 amount *= scale;
58
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
72
63
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
73 ip_buckets::iterator i = violations.find(ip);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
74 if (i == violations.end()) {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
75 bucket b;
76
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
76 b.count = amount;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
77 b.blocked = (con.get_threshold() <= b.count);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
78 b.max_scale = 1;
63
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
79 violations[ip] = b;
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
80 if (b.blocked) {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
81 update(ip, true, scale, file_name, pattern_index, message);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
82 changed(con, ip, true);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
83 }
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
84 }
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
85 else {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
86 bucket &b = (*i).second;
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
87 if ((b.count >= 0) && (b.count < 2600000)) {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
88 // good authentication (count<0) prevents blocking
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
89 // not much point in blocking for more than a month
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
90 b.count += amount;
76
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
91 int threshold = con.get_threshold();
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
92 if (b.blocked) {
79
831d0b46bbd2 add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 76
diff changeset
93 int effective_scale = 2;
76
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
94 while (original_amount * effective_scale < b.count) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
95 effective_scale = effective_scale * 3 / 2;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
96 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
97 if (effective_scale > b.max_scale) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
98 b.max_scale = effective_scale;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
99 if (debug_syslog > 2) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
100 char buf[maxlen];
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
101 in_addr ad;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
102 ad.s_addr = htonl(ip);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
103 if (message) snprintf(buf, maxlen, "upgrade dropping traffic from/to %s based on %s in %s, scale %d", inet_ntoa(ad), message, file_name, effective_scale);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
104 else snprintf(buf, maxlen, "upgrade dropping traffic from/to %s based on pattern match %d in %s, scale %d", inet_ntoa(ad), pattern_index, file_name, effective_scale);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
105 my_syslog(buf);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
106 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
107 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
108 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
109 if ((!b.blocked) && (threshold <= b.count)) {
63
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
110 b.blocked = true;
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
111 update(ip, true, scale, file_name, pattern_index, message);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
112 changed(con, ip, true);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
113 }
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
114 }
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
115 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
116 }
63
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
117
69
0e736950a117 fix post uninstall script; allow config bucket count zero to disable a pattern
Carl Byington <carl@five-ten-sg.com>
parents: 63
diff changeset
118 else if (amount < 0) {
63
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
119 char buf[maxlen];
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
120 in_addr ad;
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
121 ad.s_addr = htonl(ip);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
122 snprintf(buf, maxlen, "%s for %s", message, inet_ntoa(ad));
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
123 my_syslog(buf);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
124
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
125 ip_buckets::iterator j = repeat_offenders.find(ip);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
126 if (j != repeat_offenders.end()) {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
127 repeat_offenders.erase(j++);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
128 snprintf(buf, maxlen, "removing %s from repeat offenders", inet_ntoa(ad));
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
129 my_syslog(buf);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
130 }
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
131 ip_buckets::iterator i = violations.find(ip);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
132 if (i == violations.end()) {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
133 bucket b;
76
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
134 b.count = amount;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
135 b.blocked = false;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
136 b.max_scale = 1;
63
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
137 violations[ip] = b;
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
138 }
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
139 else {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
140 bucket &b = (*i).second;
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
141 b.count = amount;
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
142 if (b.blocked) {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
143 update(ip, false, 0, NULL, 0, NULL);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
144 changed(con, ip, false);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
145 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
146 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
147 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
148 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
149 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
150
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
151
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
152 void IPR::leak(int amount, CONTEXT &con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
153 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); ) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
154 int ip = (*i).first;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
155 bucket &b = (*i).second;
63
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
156 if (b.count < 0) {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
157 if (b.count >= -amount) violations.erase(i++);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
158 else {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
159 b.count += amount;
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
160 i++;
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
161 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
162 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
163 else {
63
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
164 if (b.count <= amount) {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
165 if (b.blocked) {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
166 update(ip, false, 0, NULL, 0, NULL);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
167 changed(con, ip, false);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
168 }
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
169 violations.erase(i++);
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
170 }
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
171 else {
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
172 b.count -= amount;
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
173 i++;
60f59936fabb good authentication prevents ip blocking for awhile
Carl Byington <carl@five-ten-sg.com>
parents: 59
diff changeset
174 }
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
175 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
176 }
58
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
177 daily_timer -= amount;
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
178 if (daily_timer < 0) {
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
179 daily_timer = 86400;
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
180 for (ip_buckets::iterator j=repeat_offenders.begin(); j!=repeat_offenders.end(); ) {
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
181 int ip = (*j).first;
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
182 bucket &b = (*j).second;
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
183 b.count = b.count * 2 / 3;
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
184 if (b.count <= 2) {
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
185 repeat_offenders.erase(j++);
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
186 char buf[maxlen];
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
187 in_addr ad;
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
188 ad.s_addr = htonl(ip);
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
189 snprintf(buf, maxlen, "removing %s from repeat offenders", inet_ntoa(ad));
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
190 my_syslog(buf);
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
191 }
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
192 else {
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
193 j++;
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
194 }
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
195 }
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
196 }
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
197 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
198
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
199
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
200 void IPR::free_all(CONTEXT &con) {
37
e4eb969dfc4a shutdown removes iptables entries that we added
carl
parents: 36
diff changeset
201 if (debug_syslog > 2) {
e4eb969dfc4a shutdown removes iptables entries that we added
carl
parents: 36
diff changeset
202 my_syslog("syslog2iptables shutting down");
e4eb969dfc4a shutdown removes iptables entries that we added
carl
parents: 36
diff changeset
203 }
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
204 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
205 int ip = (*i).first;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
206 bucket &b = (*i).second;
58
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
207 if (b.blocked) {
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
208 update(ip, false, 0, NULL, 0, NULL);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
209 changed(con, ip, false);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
210 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
211 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
212 violations.clear();
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
213 }
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
214
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
215
58
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
216 void IPR::update(int ip, bool added, int scale, const char *file_name, int pattern_index, const char *message) {
76
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
217 char buf[maxlen];
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
218 in_addr ad;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
219 ad.s_addr = htonl(ip);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
220 if (added) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
221 if (debug_syslog > 2) {
58
b45dddebe8fc Add exponential increase in penalty for repeat offenders
Carl Byington <carl@five-ten-sg.com>
parents: 51
diff changeset
222 if (message) snprintf(buf, maxlen, "dropping traffic from/to %s based on %s in %s, scale %d", inet_ntoa(ad), message, file_name, scale);
76
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
223 else snprintf(buf, maxlen, "dropping traffic from/to %s based on pattern match %d in %s, scale %d", inet_ntoa(ad), pattern_index, file_name, scale);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
224 my_syslog(buf);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
225 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
226 ip_buckets::iterator j = repeat_offenders.find(ip);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
227 if (j == repeat_offenders.end()) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
228 bucket b;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
229 b.count = 2;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
230 b.blocked = true; // unused
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
231 b.max_scale = 1; // unused
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
232 repeat_offenders[ip] = b;
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
233 }
76
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
234 else {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
235 bucket &b = (*j).second;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
236 if (b.count < scale_max) b.count = b.count * 3 / 2;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
237 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
238 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
239 else {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
240 if (debug_syslog > 2) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
241 snprintf(buf, maxlen, "allowing traffic from/to %s", inet_ntoa(ad));
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
242 my_syslog(buf);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values
Carl Byington <carl@five-ten-sg.com>
parents: 69
diff changeset
243 }
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
244 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
245 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
246
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
247
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
248 void IPR::changed(CONTEXT &con, int ip, bool added) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
249 int t = con.get_threshold();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
250 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
251 if (added) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
252 bucket &b = violations[ip];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
253 if (con.looking(ip) && (b.count > t)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
254 in_addr ad;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
255 ad.s_addr = htonl(ip);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
256 snprintf(buf, maxlen, con.add_command, inet_ntoa(ad));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
257 system(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
258 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
259 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
260 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
261 in_addr ad;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
262 ad.s_addr = htonl(ip);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
263 snprintf(buf, maxlen, con.remove_command, inet_ntoa(ad));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
264 system(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
265 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
266 }
1
551433a01cab initial coding
carl
parents:
diff changeset
267
551433a01cab initial coding
carl
parents:
diff changeset
268
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
269 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
270 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
271 int ip_address(const char *have);
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
272 int ip_address(const char *have) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
273 int ipaddr = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
274 in_addr ip;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
275 if (inet_aton(have, &ip)) ipaddr = ip.s_addr;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
276 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
277 struct hostent *host = gethostbyname(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
278 if (host && host->h_addrtype == AF_INET) memcpy(&ipaddr, host->h_addr, sizeof(ipaddr));
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
279 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
280 return ntohl(ipaddr);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
281 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
282
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
283
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
284 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
285 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
286 PATTERN::PATTERN(TOKEN &tok, const char *pattern_, int index_, int amount_, const char *msg_) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
287 pattern = pattern_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
288 index = index_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
289 amount = amount_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
290 message = msg_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
291 if (pattern) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
292 int rc = regcomp(&re, pattern, REG_ICASE | REG_EXTENDED);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
293 if (rc) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
294 char bu[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
295 regerror(rc, &re, bu, maxlen);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
296 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
297 snprintf(buf, sizeof(buf), "pattern %s not valid - %s", pattern, bu);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
298 tok.token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
299 pattern = NULL;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
300 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
301 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
302 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
303
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
304
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
305 PATTERN::~PATTERN() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
306 regfree(&re);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
307 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
308
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
309
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
310 bool PATTERN::process(char *buf, CONTEXT &con, const char *file_name, int pattern_index) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
311 if (pattern) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
312 const int nmatch = index+1;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
313 regmatch_t match[nmatch];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
314 if (0 == regexec(&re, buf, nmatch, match, 0)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
315 int s = match[index].rm_so;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
316 int e = match[index].rm_eo;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
317 if (s != -1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
318 if (debug_syslog > 3) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
319 my_syslog(buf); // show lines with matches
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
320 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
321 buf[e] = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
322 int ip = ip_address(buf+s);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
323 if (ip) {
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
324 con.recorder->add(ip, amount, con, file_name, pattern_index, message);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
325 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
326 return true;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
327 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
328 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
329 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
330 return false;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
331 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
332
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
333
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
334 void PATTERN::dump(int level) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
335 char indent[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
336 int i = min(maxlen-1, level*4);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
337 memset(indent, ' ', i);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
338 indent[i] = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
339 printf("%s pattern \"%s\" {; \n", indent, pattern);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
340 printf("%s index %d; \n", indent, index);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
341 printf("%s bucket %d; \n", indent, amount);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
342 if (message) printf("%s message \"%s\"; \n", indent, message);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
343 printf("%s }; \n", indent);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
344 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
345
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
346
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
347 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
348 //
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
349 CONTEXT::CONTEXT(const char *nam) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
350 name = nam;
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
351 threshold = 500;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
352 add_command = "/sbin/iptables -I INPUT --src %s --jump DROP";
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
353 remove_command = "/sbin/iptables -D INPUT --src %s --jump DROP";
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
354 recorder = IPR::find(name);
1
551433a01cab initial coding
carl
parents:
diff changeset
355 }
551433a01cab initial coding
carl
parents:
diff changeset
356
551433a01cab initial coding
carl
parents:
diff changeset
357
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
358 ////////////////////////////////////////////////
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
359 //
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
360 CONTEXT::~CONTEXT() {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
361 ignore.clear();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
362 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
363 SYSLOGCONFIG *c = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
364 delete c;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
365 }
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
366 IPR::release(name);
1
551433a01cab initial coding
carl
parents:
diff changeset
367 }
551433a01cab initial coding
carl
parents:
diff changeset
368
551433a01cab initial coding
carl
parents:
diff changeset
369
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
370 void CONTEXT::add_syslogconfig(SYSLOGCONFIGP con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
371 syslogconfigs.push_back(con);
1
551433a01cab initial coding
carl
parents:
diff changeset
372 }
551433a01cab initial coding
carl
parents:
diff changeset
373
551433a01cab initial coding
carl
parents:
diff changeset
374
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
375 void CONTEXT::add_pair(IPPAIR pair) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
376 ignore.push_back(pair);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
377 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
378
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
379
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
380 void CONTEXT::dump() {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
381 string indents(" ");
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
382 const char *indent = indents.c_str();
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
383
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
384 printf("context %s {\n", name);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
385 printf("%s threshold %d; \n\n", indent, threshold);
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
386
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
387 printf("%s add_command \"%s\"; \n", indent, add_command);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
388 printf("%s remove_command \"%s\"; \n\n", indent, remove_command);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
389
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
390 printf("%s ignore { \n", indent);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
391 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
392 IPPAIR &p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
393 in_addr ip;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
394 ip.s_addr = htonl(p.first);
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
395 printf("%s %s/%d; \n", indent, inet_ntoa(ip), p.cidr);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
396 }
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
397 printf("%s }; \n\n", indent);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
398
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
399 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
400 SYSLOGCONFIGP c = *i;
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
401 c->dump(1);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
402 }
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
403 printf("}; \n\n");
1
551433a01cab initial coding
carl
parents:
diff changeset
404 }
551433a01cab initial coding
carl
parents:
diff changeset
405
551433a01cab initial coding
carl
parents:
diff changeset
406
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
407 void CONTEXT::read(CONFIG &con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
408 while (true) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
409 bool have = false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
410 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
411 SYSLOGCONFIGP c = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
412 have |= c->read(*this);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
413 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
414 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
415 }
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
416 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
417
6e88da080f08 initial coding
carl
parents: 1
diff changeset
418
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
419 void CONTEXT::free_all() {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
420 recorder->free_all(*this);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
421 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
422
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
423
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
424 void CONTEXT::leak(int delta) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
425 recorder->leak(delta, *this);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
426
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
427 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
428
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
429
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
430 bool CONTEXT::looking(int ip) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
431 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
432 IPPAIR &p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
433 if ((p.first <= ip) && (ip <= p.last)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
434 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
435 return true;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
436 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
437
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
438 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
439 //
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
440 CONFIG::CONFIG() {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
441 reference_count = 0;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
442 generation = 0;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
443 load_time = 0;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
444 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
445
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
446
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
447 CONFIG::~CONFIG() {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
448 for (context_list::iterator i=contexts.begin(); i!=contexts.end(); i++) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
449 CONTEXT *c = *i;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
450 delete c;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
451 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
452 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
453
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
454
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
455 void CONFIG::dump() {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
456 for (context_list::iterator i=contexts.begin(); i!=contexts.end(); i++) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
457 CONTEXTP c = *i;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
458 c->dump();
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
459 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
460 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
461
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
462
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
463 void CONFIG::read() {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
464 for (context_list::iterator i=contexts.begin(); i!=contexts.end(); i++) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
465 CONTEXT *c = *i;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
466 c->read(*this);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
467 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
468 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
469
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
470
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
471 void CONFIG::sleep(int duration, time_t &previous) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
472 ::sleep(duration);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
473 time_t now = time(NULL);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
474 for (context_list::iterator i=contexts.begin(); i!=contexts.end(); i++) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
475 CONTEXT *c = *i;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
476 c->leak(now-previous);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
477 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
478 previous = now;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
479 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
480
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
481
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
482 void CONFIG::free_all() {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
483 for (context_list::iterator i=contexts.begin(); i!=contexts.end(); i++) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
484 CONTEXT *c = *i;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
485 c->free_all();
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
486 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
487 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
488
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
489
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
490 ////////////////////////////////////////////////
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
491 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
492 SYSLOGCONFIG::SYSLOGCONFIG(TOKEN &tok, const char *file_name_) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
493 tokp = &tok;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
494 file_name = file_name_;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
495 open(true);
1
551433a01cab initial coding
carl
parents:
diff changeset
496 }
551433a01cab initial coding
carl
parents:
diff changeset
497
551433a01cab initial coding
carl
parents:
diff changeset
498
551433a01cab initial coding
carl
parents:
diff changeset
499 SYSLOGCONFIG::~SYSLOGCONFIG() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
500 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
501 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
502 PATTERN *p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
503 delete p;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
504 }
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
505 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
506
6e88da080f08 initial coding
carl
parents: 1
diff changeset
507
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
508 void SYSLOGCONFIG::open(bool msg) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
509 fd = ::open(file_name, O_RDONLY);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
510 len = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
511 if (fd == -1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
512 if (msg) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
513 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
514 snprintf(buf, sizeof(buf), "syslog file %s not readable", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
515 tokp->token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
516 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
517 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
518 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
519 if (debug_syslog > 1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
520 snprintf(buf, sizeof(buf), "syslog file %s opened", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
521 my_syslog(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
522 }
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
523 if (msg) lseek(fd, 0, SEEK_END);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
524 if (fstat(fd, &openfdstat)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
525 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
526 snprintf(buf, sizeof(buf), "syslog file %s cannot stat after open", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
527 tokp->token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
528 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
529 // specify that this fd gets closed on exec, so that selinux
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
530 // won't complain about iptables trying to read log files.
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
531 int oldflags = fcntl(fd, F_GETFD, 0);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
532 if (oldflags >= 0) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
533 fcntl(fd, F_SETFD, oldflags | FD_CLOEXEC);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
534 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
535 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
536 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
537
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
538
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
539 bool SYSLOGCONFIG::read(CONTEXT &con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
540 if (failed()) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
541 open(false);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
542 if (failed()) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
543 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
544 int n = ::read(fd, buf+len, buflen-len);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
545 bool have = (n > 0);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
546 if (have) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
547 len += n;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
548 while (true) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
549 char *p = (char*)memchr(buf, '\n', len);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
550 if (!p) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
551 n = p-buf;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
552 *p = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
553 process(con); // process null terminated string
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
554 len -= n+1;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
555 memmove(buf, p+1, len);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
556 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
557 // no <lf> in a full buffer
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
558 if (len == buflen) len = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
559 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
560 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
561 // check for file close
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
562 struct stat filenamest;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
563 if (0 == stat(file_name, &filenamest)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
564 if ((filenamest.st_dev != openfdstat.st_dev) ||
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
565 (filenamest.st_ino != openfdstat.st_ino)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
566 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
567 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
568 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
569 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
570 // filename no longer exists
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
571 close();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
572 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
573 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
574 return have;
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
575 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
576
6e88da080f08 initial coding
carl
parents: 1
diff changeset
577
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
578 void SYSLOGCONFIG::close() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
579 if (debug_syslog > 1) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
580 snprintf(buf, sizeof(buf), "syslog file %s closed", file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
581 my_syslog(buf);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
582 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
583 if (fd != -1) ::close(fd);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
584 fd = -1;
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
585 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
586
2737ab01659a initial coding
carl
parents: 3
diff changeset
587
2737ab01659a initial coding
carl
parents: 3
diff changeset
588 void SYSLOGCONFIG::add_pattern(PATTERNP pat) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
589 patterns.push_back(pat);
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
590 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
591
2737ab01659a initial coding
carl
parents: 3
diff changeset
592
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
593 void SYSLOGCONFIG::process(CONTEXT &con) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
594 int pi=0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
595 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
596 PATTERN *p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
597 if (p->process(buf, con, file_name, pi)) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
598 pi++;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
599 }
1
551433a01cab initial coding
carl
parents:
diff changeset
600 }
551433a01cab initial coding
carl
parents:
diff changeset
601
551433a01cab initial coding
carl
parents:
diff changeset
602
551433a01cab initial coding
carl
parents:
diff changeset
603 void SYSLOGCONFIG::dump(int level) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
604 char indent[maxlen];
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
605 int i = min(maxlen-1, level*4);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
606 memset(indent, ' ', i);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
607 indent[i] = '\0';
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
608 printf("%s file \"%s\" {\n", indent, file_name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
609 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
610 PATTERN *p = *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
611 p->dump(level+1);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
612 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
613 printf("%s }; \n", indent);
1
551433a01cab initial coding
carl
parents:
diff changeset
614 }
551433a01cab initial coding
carl
parents:
diff changeset
615
551433a01cab initial coding
carl
parents:
diff changeset
616
551433a01cab initial coding
carl
parents:
diff changeset
617 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
618 // helper to discard the strings held by a string_set
551433a01cab initial coding
carl
parents:
diff changeset
619 //
551433a01cab initial coding
carl
parents:
diff changeset
620 void discard(string_set &s) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
621 for (string_set::iterator i=s.begin(); i!=s.end(); i++) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
622 free((void*)*i);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
623 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
624 s.clear();
1
551433a01cab initial coding
carl
parents:
diff changeset
625 }
551433a01cab initial coding
carl
parents:
diff changeset
626
551433a01cab initial coding
carl
parents:
diff changeset
627
551433a01cab initial coding
carl
parents:
diff changeset
628 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
629 // helper to register a string in a string set
551433a01cab initial coding
carl
parents:
diff changeset
630 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
631 const char* register_string(string_set &s, const char *name) {
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
632 string_set::const_iterator i = s.find(name);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
633 if (i != s.end()) return *i;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
634 char *x = strdup(name);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
635 s.insert(x);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
636 return x;
1
551433a01cab initial coding
carl
parents:
diff changeset
637 }
551433a01cab initial coding
carl
parents:
diff changeset
638
551433a01cab initial coding
carl
parents:
diff changeset
639
551433a01cab initial coding
carl
parents:
diff changeset
640 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
641 // register a global string
551433a01cab initial coding
carl
parents:
diff changeset
642 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
643 const char* register_string(const char *name) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
644 return register_string(all_strings, name);
1
551433a01cab initial coding
carl
parents:
diff changeset
645 }
551433a01cab initial coding
carl
parents:
diff changeset
646
551433a01cab initial coding
carl
parents:
diff changeset
647
551433a01cab initial coding
carl
parents:
diff changeset
648 ////////////////////////////////////////////////
38
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
649 // clear all global strings, helper for valgrind checking
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
650 //
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
651 void clear_strings() {
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
652 discard(all_strings);
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
653 }
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
654
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
655
26c29da3fbdf shutdown removes iptables entries that we added
carl
parents: 37
diff changeset
656 ////////////////////////////////////////////////
1
551433a01cab initial coding
carl
parents:
diff changeset
657 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
658 bool tsa(TOKEN &tok, const char *token);
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
659 bool tsa(TOKEN &tok, const char *token) {
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
660 const char *have = tok.next();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
661 if (have == token) return true;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
662 tok.token_error(token, have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
663 return false;
1
551433a01cab initial coding
carl
parents:
diff changeset
664 }
551433a01cab initial coding
carl
parents:
diff changeset
665
551433a01cab initial coding
carl
parents:
diff changeset
666
551433a01cab initial coding
carl
parents:
diff changeset
667 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
668 //
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
669 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con, CONTEXT &me);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
670 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con, CONTEXT &me) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
671 const char *pat = tok.next();
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
672 int ind = 0;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
673 int buc = 0;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
674 const char *msg = NULL;
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
675 if (!tsa(tok, token_lbrace)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
676 while (true) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
677 const char *have = tok.next();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
678 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
679 if (have == token_rbrace) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
680 if (have == token_index) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
681 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
682 ind = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
683 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
684 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
685 else if (have == token_bucket) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
686 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
687 buc = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
688 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
689 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
690 else if (have == token_message) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
691 msg = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
692 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
693 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
694 else {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
695 tok.token_error("index/bucket", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
696 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
697 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
698 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
699 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
700 PATTERNP patt = new PATTERN(tok, pat, ind, buc, msg);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
701 con.add_pattern(patt);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
702 return true;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
703 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
704
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
705
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
706 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
707 //
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
708 bool parse_ignore(TOKEN &tok, CONFIG &dc, CONTEXT &me);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
709 bool parse_ignore(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
710 if (!tsa(tok, token_lbrace)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
711 while (true) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
712 const char *have = tok.next();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
713 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
714 if (have == token_rbrace) break;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
715 int ipaddr = ip_address(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
716 if (ipaddr == 0) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
717 tok.token_error("ip address", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
718 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
719 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
720 if (!tsa(tok, token_slash)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
721 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
722 int mask = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
723 if ((mask < 8) || (mask > 32)) {
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
724 tok.token_error("cidr 8..32 value", have);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
725 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
726 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
727 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
728 IPPAIR pair;
59
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
729 const unsigned int masks[33] = {0xffffffff, // 0
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
730 0x7fffffff, // 1
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
731 0x3fffffff, // 2
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
732 0x1fffffff, // 3
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
733 0x0fffffff, // 4
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
734 0x07ffffff, // 5
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
735 0x03ffffff, // 6
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
736 0x01ffffff, // 7
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
737 0x00ffffff, // 8
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
738 0x007fffff, // 9
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
739 0x003fffff, // 10
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
740 0x001fffff, // 11
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
741 0x000fffff, // 12
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
742 0x0007ffff, // 13
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
743 0x0003ffff, // 14
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
744 0x0001ffff, // 15
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
745 0x0000ffff, // 16
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
746 0x00007fff, // 17
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
747 0x00003fff, // 18
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
748 0x00001fff, // 19
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
749 0x00000fff, // 20
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
750 0x000007ff, // 21
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
751 0x000003ff, // 22
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
752 0x000001ff, // 23
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
753 0x000000ff, // 24
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
754 0x0000007f, // 25
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
755 0x0000003f, // 26
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
756 0x0000001f, // 27
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
757 0x0000000f, // 28
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
758 0x00000007, // 29
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
759 0x00000003, // 30
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
760 0x00000001, // 31
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
761 0x00000000}; // 32
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
762 pair.first = ipaddr;
59
f133196b8591 fix c++11 compiler warnings
Carl Byington <carl@five-ten-sg.com>
parents: 58
diff changeset
763 pair.last = ipaddr | (int)masks[mask];
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
764 pair.cidr = mask;
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
765 me.add_pair(pair);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
766 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
767 if (!tsa(tok, token_semi)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
768 return true;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
769 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
770
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
771
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
772 ////////////////////////////////////////////////
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
773 //
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
774 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc, CONTEXT &me);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
775 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
776 const char *name = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
777 if (!tsa(tok, token_lbrace)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
778 SYSLOGCONFIGP con = new SYSLOGCONFIG(tok, name);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
779 if (con->failed()) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
780 delete con;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
781 return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
782 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
783 me.add_syslogconfig(con);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
784 while (true) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
785 const char *have = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
786 if (!have) break;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
787 if (have == token_rbrace) break;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
788 if (have == token_pattern) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
789 if (!parse_pattern(tok, *con, me)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
790 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
791 else {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
792 tok.token_error("pattern", have);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
793 return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
794 }
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
795 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
796 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
797 return true;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
798 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
799
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
800
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
801 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
802 //
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
803 bool parse_context(TOKEN &tok, CONFIG &dc, CONTEXTP parent);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
804 bool parse_context(TOKEN &tok, CONFIG &dc, CONTEXTP parent) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
805 const char *name = tok.next();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
806 if (!tsa(tok, token_lbrace)) return false;
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
807 CONTEXTP con = new CONTEXT(name);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
808
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
809 while (true) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
810 const char *have = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
811 if (!have) break;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
812 if (have == token_rbrace) break; // done
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
813 if (have == token_threshold) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
814 have = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
815 con->set_threshold(atoi(have));
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
816 if (!tsa(tok, token_semi)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
817 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
818 else if (have == token_ignore) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
819 if (!parse_ignore(tok, dc, *con)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
820 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
821 else if (have == token_add) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
822 have = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
823 con->set_add(have);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
824 if (!tsa(tok, token_semi)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
825 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
826 else if (have == token_remove) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
827 have = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
828 con->set_remove(have);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
829 if (!tsa(tok, token_semi)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
830 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
831 else if (have == token_file) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
832 if (!parse_syslogconfig(tok, dc, *con)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
833 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
834 else {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
835 tok.token_error("threshold/ignore/add_command/remove_command/file", have);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
836 return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
837 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
838 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
839 if (!tsa(tok, token_semi)) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
840 delete con;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
841 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
842 }
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
843 dc.add_context(con);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
844 return true;
1
551433a01cab initial coding
carl
parents:
diff changeset
845 }
551433a01cab initial coding
carl
parents:
diff changeset
846
551433a01cab initial coding
carl
parents:
diff changeset
847
551433a01cab initial coding
carl
parents:
diff changeset
848 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
849 // parse a config file
551433a01cab initial coding
carl
parents:
diff changeset
850 //
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
851 bool load_conf(CONFIG &dc, const char *fn) {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
852 int count = 0;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
853 TOKEN tok(fn, &dc.config_files);
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
854 while (true) {
48
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness
Carl Byington <carl@five-ten-sg.com>
parents: 42
diff changeset
855 const char *have = tok.next();
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
856 if (!have) break;
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
857 if (have == token_context) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
858 if (!parse_context(tok, dc, NULL)) {
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
859 tok.token_error("load_conf() failed to parse context");
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
860 return false;
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
861 }
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
862 else count++;
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
863 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
864 else {
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
865 tok.token_error(token_context, have);
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
866 return false;
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
867 }
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
868 }
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
869 tok.token_error("load_conf() found %d contexts in %s", count, fn);
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
870 return (!dc.contexts.empty());
1
551433a01cab initial coding
carl
parents:
diff changeset
871 }
551433a01cab initial coding
carl
parents:
diff changeset
872
551433a01cab initial coding
carl
parents:
diff changeset
873
551433a01cab initial coding
carl
parents:
diff changeset
874 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
875 // init the tokens
551433a01cab initial coding
carl
parents:
diff changeset
876 //
551433a01cab initial coding
carl
parents:
diff changeset
877 void token_init() {
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
878 token_add = register_string("add_command");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
879 token_bucket = register_string("bucket");
51
206448c00b55 Allow multiple contexts with independent add/remove commands.
Carl Byington <carl@five-ten-sg.com>
parents: 48
diff changeset
880 token_context = register_string("context");
36
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
881 token_file = register_string("file");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
882 token_ignore = register_string("ignore");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
883 token_include = register_string("include");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
884 token_index = register_string("index");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
885 token_lbrace = register_string("{");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
886 token_message = register_string("message");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
887 token_pattern = register_string("pattern");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
888 token_rbrace = register_string("}");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
889 token_remove = register_string("remove_command");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
890 token_semi = register_string(";");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
891 token_slash = register_string("/");
6a2f26976898 shutdown removes iptables entries that we added
carl
parents: 35
diff changeset
892 token_threshold = register_string("threshold");
1
551433a01cab initial coding
carl
parents:
diff changeset
893 }