1
|
1 /***************************************************************************
|
|
2 * Copyright (C) 2005 by 510 Software Group *
|
|
3 * *
|
|
4 * *
|
|
5 * This program is free software; you can redistribute it and/or modify *
|
|
6 * it under the terms of the GNU General Public License as published by *
|
|
7 * the Free Software Foundation; either version 2 of the License, or *
|
|
8 * (at your option) any later version. *
|
|
9 * *
|
|
10 * This program is distributed in the hope that it will be useful, *
|
|
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
|
|
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
|
|
13 * GNU General Public License for more details. *
|
|
14 * *
|
|
15 * You should have received a copy of the GNU General Public License *
|
|
16 * along with this program; if not, write to the *
|
|
17 * Free Software Foundation, Inc., *
|
|
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
|
|
19 ***************************************************************************/
|
|
20
|
|
21 #include "includes.h"
|
2
|
22 #include <fcntl.h>
|
3
|
23 #include <sys/socket.h>
|
|
24 #include <netinet/in.h>
|
|
25 #include <arpa/inet.h>
|
|
26 #include <netdb.h>
|
1
|
27
|
|
28 static char* syslogconfig_version="$Id$";
|
|
29
|
3
|
30 char *token_bucket;
|
1
|
31 char *token_file;
|
3
|
32 char *token_ignore;
|
1
|
33 char *token_include;
|
3
|
34 char *token_index;
|
1
|
35 char *token_lbrace;
|
3
|
36 char *token_pattern;
|
1
|
37 char *token_rbrace;
|
|
38 char *token_semi;
|
3
|
39 char *token_slash;
|
|
40 char *token_threshold;
|
|
41
|
|
42 struct ltint
|
|
43 {
|
|
44 bool operator()(const int s1, const int s2) const
|
|
45 {
|
|
46 return (unsigned)s1 < (unsigned)s2;
|
|
47 }
|
|
48 };
|
1
|
49
|
|
50 string_set all_strings; // owns all the strings, only modified by the config loader thread
|
|
51 const int maxlen = 1000; // used for snprintf buffers
|
3
|
52 typedef map<int, int, ltint> ip_buckets;
|
|
53
|
|
54 class IPR {
|
|
55 ip_buckets violations;
|
|
56 public:
|
|
57 void add(int ip, int bucket, CONFIG &con);
|
|
58 void changed(CONFIG &con);
|
|
59 void leak(int amount, CONFIG &con);
|
|
60 };
|
|
61
|
|
62 IPR recorder;
|
|
63
|
|
64
|
|
65 ////////////////////////////////////////////////
|
|
66 //
|
|
67 void IPR::add(int ip, int bucket, CONFIG &con) {
|
|
68 if (con.looking(ip)) {
|
|
69 ip_buckets::iterator i = violations.find(ip);
|
|
70 if (i == violations.end()) violations[ip] = bucket;
|
|
71 else {
|
|
72 (*i).second += bucket;
|
|
73 if ((*i).second > con.get_threshold()) changed(con);
|
|
74 }
|
|
75 }
|
|
76 }
|
|
77
|
|
78
|
|
79 void IPR::leak(int amount, CONFIG &con) {
|
|
80 bool ch = false;
|
|
81 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); ) {
|
|
82 int ip = (*i).first;
|
|
83 int n = (*i).second;
|
|
84 in_addr ad;
|
|
85 ad.s_addr = htonl(ip);
|
|
86 char buf[maxlen];
|
|
87 snprintf(buf, maxlen, "leak %s with %d count", inet_ntoa(ad), n);
|
|
88 my_syslog(buf);
|
|
89 if (n <= amount) {
|
|
90 ch = true;
|
|
91 violations.erase(i++);
|
|
92 }
|
|
93 else {
|
|
94 (*i).second -= amount;
|
|
95 i++;
|
|
96 }
|
|
97 }
|
|
98 if (ch) changed(con);
|
|
99 }
|
|
100
|
|
101
|
|
102 void IPR::changed(CONFIG &con) {
|
|
103 my_syslog("**** dump");
|
|
104 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); i++) {
|
|
105 int ip = (*i).first;
|
|
106 int n = (*i).second;
|
|
107 in_addr ad;
|
|
108 ad.s_addr = htonl(ip);
|
|
109 char buf[maxlen];
|
|
110 snprintf(buf, maxlen, "%s with %d count", inet_ntoa(ad), n);
|
|
111 my_syslog(buf);
|
|
112 }
|
|
113 }
|
1
|
114
|
|
115
|
3
|
116 ////////////////////////////////////////////////
|
|
117 //
|
|
118 int ip_address(char *have);
|
|
119 int ip_address(char *have) {
|
|
120 int ipaddr = 0;
|
|
121 in_addr ip;
|
|
122 if (inet_aton(have, &ip)) ipaddr = ip.s_addr;
|
|
123 else {
|
|
124 struct hostent *host = gethostbyname(have);
|
|
125 if (host && host->h_addrtype == AF_INET) memcpy(&ipaddr, host->h_addr, sizeof(ipaddr));
|
|
126 }
|
|
127 return ntohl(ipaddr);
|
|
128 }
|
|
129
|
|
130
|
|
131 ////////////////////////////////////////////////
|
|
132 //
|
|
133 PATTERN::PATTERN(TOKEN &tok, char *pattern_, int index_, int bucket_) {
|
|
134 pattern = pattern_;
|
|
135 index = index_;
|
|
136 bucket = bucket_;
|
|
137 if (pattern) {
|
|
138 int rc = regcomp(&re, pattern, REG_ICASE | REG_EXTENDED);
|
|
139 if (rc) {
|
|
140 char bu[maxlen];
|
|
141 regerror(rc, &re, bu, maxlen);
|
|
142 char buf[maxlen];
|
|
143 snprintf(buf, sizeof(buf), "pattern %s not valid - %s", pattern, bu);
|
|
144 tok.token_error(buf);
|
|
145 pattern = NULL;
|
|
146 }
|
|
147 }
|
|
148 }
|
|
149
|
|
150
|
|
151 PATTERN::~PATTERN() {
|
|
152 regfree(&re);
|
|
153 }
|
|
154
|
|
155
|
|
156 bool PATTERN::process(char *buf, CONFIG &con) {
|
|
157 if (pattern) {
|
|
158 const int nmatch = index+1;
|
|
159 regmatch_t match[nmatch];
|
|
160 if (0 == regexec(&re, buf, nmatch, match, 0)) {
|
|
161 int s = match[index].rm_so;
|
|
162 int e = match[index].rm_eo;
|
|
163 // char bu[maxlen];
|
|
164 // snprintf(bu, maxlen, "re match from %d to %d", s, e);
|
|
165 // my_syslog(bu);
|
|
166 if (s != -1) {
|
|
167 my_syslog(buf);
|
|
168 buf[e] = '\0';
|
|
169 int ip = ip_address(buf+s);
|
|
170 if (ip) {
|
|
171 my_syslog(buf+s);
|
|
172 recorder.add(ip, bucket, con);
|
|
173 }
|
|
174 return true;
|
|
175 }
|
|
176 }
|
|
177 }
|
|
178 return false;
|
|
179 }
|
|
180
|
|
181
|
|
182 void PATTERN::dump(int level) {
|
|
183 char indent[maxlen];
|
|
184 int i = min(maxlen-1, level*4);
|
|
185 memset(indent, ' ', i);
|
|
186 indent[i] = '\0';
|
|
187 printf("%s pattern \"%s\" {; \n", indent, pattern);
|
|
188 printf("%s index %d; \n", indent, index);
|
|
189 printf("%s bucket %d; \n", indent, bucket);
|
|
190 printf("%s }; \n", indent);
|
|
191 }
|
|
192
|
|
193
|
|
194 ////////////////////////////////////////////////
|
|
195 //
|
1
|
196 CONFIG::CONFIG() {
|
|
197 reference_count = 0;
|
|
198 generation = 0;
|
|
199 load_time = 0;
|
|
200 }
|
|
201
|
|
202
|
|
203 CONFIG::~CONFIG() {
|
|
204 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
|
|
205 SYSLOGCONFIG *c = *i;
|
|
206 delete c;
|
|
207 }
|
3
|
208 ignore.clear();
|
1
|
209 }
|
|
210
|
|
211
|
|
212 void CONFIG::add_syslogconfig(SYSLOGCONFIGP con) {
|
|
213 syslogconfigs.push_back(con);
|
|
214 }
|
|
215
|
|
216
|
3
|
217 void CONFIG::add_pair(IPPAIR pair) {
|
|
218 ignore.push_back(pair);
|
|
219 }
|
|
220
|
|
221
|
1
|
222 void CONFIG::dump() {
|
3
|
223 printf(" threshold %d; \n\n", threshold);
|
|
224
|
|
225 printf(" ignore { \n");
|
|
226 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
|
|
227 IPPAIR &p = *i;
|
|
228 in_addr ip;
|
|
229 ip.s_addr = htonl(p.first);
|
|
230 printf(" %s/%d; \n", inet_ntoa(ip), p.cidr);
|
|
231 }
|
|
232 printf(" }; \n\n");
|
|
233
|
1
|
234 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
|
|
235 SYSLOGCONFIGP c = *i;
|
|
236 c->dump(0);
|
|
237 }
|
|
238 }
|
|
239
|
|
240
|
2
|
241 void CONFIG::read() {
|
3
|
242 while (true) {
|
|
243 bool have = false;
|
|
244 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
|
|
245 SYSLOGCONFIGP c = *i;
|
|
246 have |= c->read(*this);
|
|
247 }
|
|
248 break; //!!
|
|
249 if (!have) break;
|
2
|
250 }
|
|
251 }
|
|
252
|
|
253
|
3
|
254 void CONFIG::sleep(int duration) {
|
|
255 ::sleep(duration);
|
|
256 recorder.leak(duration, *this);
|
|
257 }
|
|
258
|
|
259
|
|
260 bool CONFIG::looking(int ip) {
|
|
261 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
|
|
262 IPPAIR &p = *i;
|
|
263 if ((p.first <= ip) && (ip <= p.last)) return false;
|
|
264 }
|
|
265 return true;
|
|
266 }
|
|
267
|
|
268 ////////////////////////////////////////////////
|
|
269 //
|
|
270 SYSLOGCONFIG::SYSLOGCONFIG(TOKEN &tok, char *file_name_) {
|
2
|
271 file_name = file_name_;
|
|
272 fd = open(file_name, O_RDONLY);
|
|
273 len = 0;
|
|
274 if (fd == -1) {
|
|
275 char buf[maxlen];
|
|
276 snprintf(buf, sizeof(buf), "syslog file %s not readable", file_name);
|
|
277 tok.token_error(buf);
|
|
278 }
|
|
279 else {
|
3
|
280 //lseek(fd, 0, SEEK_END); //!!
|
2
|
281 }
|
1
|
282 }
|
|
283
|
|
284
|
|
285 SYSLOGCONFIG::~SYSLOGCONFIG() {
|
2
|
286 if (fd != -1) close(fd);
|
|
287 fd = -1;
|
3
|
288 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
|
|
289 PATTERN *p = *i;
|
|
290 delete p;
|
|
291 }
|
2
|
292 }
|
|
293
|
|
294
|
3
|
295 void SYSLOGCONFIG::add_pattern(PATTERNP pat) {
|
|
296 patterns.push_back(pat);
|
|
297 }
|
|
298
|
|
299
|
|
300 bool SYSLOGCONFIG::read(CONFIG &con) {
|
|
301 if (failed()) return false;
|
|
302 int n = ::read(fd, buf+len, buflen-len);
|
|
303 bool have = (n > 0);
|
|
304 if (have) {
|
2
|
305 len += n;
|
|
306 while (true) {
|
|
307 char *p = (char*)memchr(buf, '\n', len);
|
|
308 if (!p) break;
|
|
309 n = p-buf;
|
|
310 *p = '\0';
|
3
|
311 process(con); // process null terminated string
|
2
|
312 len -= n+1;
|
|
313 memmove(buf, p+1, len);
|
|
314 }
|
|
315 // no <lf> in a full buffer
|
|
316 if (len == buflen) len = 0;
|
|
317 }
|
3
|
318 return have;
|
2
|
319 }
|
|
320
|
|
321
|
3
|
322 void SYSLOGCONFIG::process(CONFIG &con) {
|
|
323 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
|
|
324 PATTERN *p = *i;
|
|
325 if (p->process(buf, con)) break;
|
|
326 }
|
1
|
327 }
|
|
328
|
|
329
|
|
330 void SYSLOGCONFIG::dump(int level) {
|
|
331 char indent[maxlen];
|
|
332 int i = min(maxlen-1, level*4);
|
|
333 memset(indent, ' ', i);
|
|
334 indent[i] = '\0';
|
|
335 char buf[maxlen];
|
|
336 printf("%s file \"%s\" {\n", indent, file_name);
|
3
|
337 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
|
|
338 PATTERN *p = *i;
|
|
339 p->dump(level);
|
|
340 }
|
1
|
341 printf("%s }; \n", indent);
|
|
342 }
|
|
343
|
|
344
|
|
345 ////////////////////////////////////////////////
|
|
346 // helper to discard the strings held by a string_set
|
|
347 //
|
|
348 void discard(string_set &s) {
|
|
349 for (string_set::iterator i=s.begin(); i!=s.end(); i++) {
|
|
350 free(*i);
|
|
351 }
|
|
352 s.clear();
|
|
353 }
|
|
354
|
|
355
|
|
356 ////////////////////////////////////////////////
|
|
357 // helper to register a string in a string set
|
|
358 //
|
|
359 char* register_string(string_set &s, char *name) {
|
|
360 string_set::iterator i = s.find(name);
|
|
361 if (i != s.end()) return *i;
|
|
362 char *x = strdup(name);
|
|
363 s.insert(x);
|
|
364 return x;
|
|
365 }
|
|
366
|
|
367
|
|
368 ////////////////////////////////////////////////
|
|
369 // register a global string
|
|
370 //
|
|
371 char* register_string(char *name) {
|
|
372 return register_string(all_strings, name);
|
|
373 }
|
|
374
|
|
375
|
|
376 ////////////////////////////////////////////////
|
|
377 //
|
|
378 bool tsa(TOKEN &tok, char *token);
|
|
379 bool tsa(TOKEN &tok, char *token) {
|
|
380 char *have = tok.next();
|
|
381 if (have == token) return true;
|
|
382 tok.token_error(token, have);
|
|
383 return false;
|
|
384 }
|
|
385
|
|
386
|
|
387 ////////////////////////////////////////////////
|
|
388 //
|
3
|
389 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con);
|
|
390 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con) {
|
|
391 char *pat = tok.next();
|
|
392 int ind, buc;
|
1
|
393 if (!tsa(tok, token_lbrace)) return false;
|
|
394 while (true) {
|
|
395 char *have = tok.next();
|
3
|
396 if (!have) break;
|
|
397 if (have == token_rbrace) break;
|
|
398 if (have == token_index) {
|
1
|
399 have = tok.next();
|
3
|
400 ind = atoi(have);
|
1
|
401 if (!tsa(tok, token_semi)) return false;
|
|
402 }
|
3
|
403 else if (have == token_bucket) {
|
|
404 have = tok.next();
|
|
405 buc = atoi(have);
|
|
406 if (!tsa(tok, token_semi)) return false;
|
1
|
407 }
|
|
408 else {
|
3
|
409 tok.token_error("index/bucket", have);
|
1
|
410 return false;
|
|
411 }
|
|
412 }
|
|
413 if (!tsa(tok, token_semi)) return false;
|
3
|
414 PATTERNP patt = new PATTERN(tok, pat, ind, buc);
|
|
415 con.add_pattern(patt);
|
|
416 return true;
|
|
417 }
|
|
418
|
|
419
|
|
420 ////////////////////////////////////////////////
|
|
421 //
|
|
422 bool parse_ignore(TOKEN &tok, CONFIG &dc);
|
|
423 bool parse_ignore(TOKEN &tok, CONFIG &dc) {
|
|
424 if (!tsa(tok, token_lbrace)) return false;
|
|
425 while (true) {
|
|
426 char *have = tok.next();
|
|
427 if (!have) break;
|
|
428 if (have == token_rbrace) break;
|
|
429 int ipaddr = ip_address(have);
|
|
430 if (ipaddr == 0) {
|
|
431 tok.token_error("ip address", have);
|
|
432 return false;
|
|
433 }
|
|
434 if (!tsa(tok, token_slash)) return false;
|
|
435 have = tok.next();
|
|
436 int mask = atoi(have);
|
|
437 if ((mask < 8) || (mask > 32)) {
|
|
438 tok.token_error("cidr 8..32 value", have);
|
|
439 return false;
|
|
440 }
|
|
441 if (!tsa(tok, token_semi)) return false;
|
|
442 IPPAIR pair;
|
|
443 const int masks[33] = {0xffffffff, // 0
|
|
444 0x7fffffff, // 1
|
|
445 0x3fffffff, // 2
|
|
446 0x1fffffff, // 3
|
|
447 0x0fffffff, // 4
|
|
448 0x07ffffff, // 5
|
|
449 0x03ffffff, // 6
|
|
450 0x01ffffff, // 7
|
|
451 0x00ffffff, // 8
|
|
452 0x007fffff, // 9
|
|
453 0x003fffff, // 10
|
|
454 0x001fffff, // 11
|
|
455 0x000fffff, // 12
|
|
456 0x0007ffff, // 13
|
|
457 0x0003ffff, // 14
|
|
458 0x0001ffff, // 15
|
|
459 0x0000ffff, // 16
|
|
460 0x00007fff, // 17
|
|
461 0x00003fff, // 18
|
|
462 0x00001fff, // 19
|
|
463 0x00000fff, // 20
|
|
464 0x000007ff, // 21
|
|
465 0x000003ff, // 22
|
|
466 0x000001ff, // 23
|
|
467 0x000000ff, // 24
|
|
468 0x0000007f, // 25
|
|
469 0x0000003f, // 26
|
|
470 0x0000001f, // 27
|
|
471 0x0000000f, // 28
|
|
472 0x00000007, // 29
|
|
473 0x00000003, // 30
|
|
474 0x00000001, // 31
|
|
475 0x00000000}; // 32
|
|
476 pair.first = ipaddr;
|
|
477 pair.last = ipaddr | masks[mask];
|
|
478 pair.cidr = mask;
|
|
479 dc.add_pair(pair);
|
|
480 }
|
|
481 if (!tsa(tok, token_semi)) return false;
|
|
482 return true;
|
|
483 }
|
|
484
|
|
485
|
|
486 ////////////////////////////////////////////////
|
|
487 //
|
|
488 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc);
|
|
489 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc) {
|
|
490 char *name = tok.next();
|
|
491 if (!tsa(tok, token_lbrace)) return false;
|
|
492 SYSLOGCONFIGP con = new SYSLOGCONFIG(tok, name);
|
2
|
493 if (con->failed()) {
|
|
494 delete con;
|
|
495 return false;
|
|
496 }
|
1
|
497 dc.add_syslogconfig(con);
|
3
|
498 while (true) {
|
|
499 char *have = tok.next();
|
|
500 if (!have) break;
|
|
501 if (have == token_rbrace) break;
|
|
502 if (have == token_pattern) {
|
|
503 if (!parse_pattern(tok, *con)) return false;
|
|
504 }
|
|
505 else {
|
|
506 tok.token_error("pattern", have);
|
|
507 return false;
|
|
508 }
|
|
509 }
|
|
510 if (!tsa(tok, token_semi)) return false;
|
1
|
511 return true;
|
|
512 }
|
|
513
|
|
514
|
|
515 ////////////////////////////////////////////////
|
|
516 // parse a config file
|
|
517 //
|
|
518 bool load_conf(CONFIG &dc, char *fn) {
|
|
519 int count = 0;
|
|
520 TOKEN tok(fn, &dc.config_files);
|
|
521 while (true) {
|
|
522 char *have = tok.next();
|
|
523 if (!have) break;
|
3
|
524 if (have == token_threshold) {
|
|
525 have = tok.next();
|
|
526 dc.set_threshold(atoi(have));
|
|
527 if (!tsa(tok, token_semi)) return false;
|
|
528 }
|
|
529 else if (have == token_ignore) {
|
|
530 if (!parse_ignore(tok, dc)) return false;
|
|
531 }
|
|
532 else if (have == token_file) {
|
|
533 if (!parse_syslogconfig(tok, dc)) return false;
|
|
534 count++;
|
1
|
535 }
|
|
536 else {
|
3
|
537 tok.token_error("threshold/ignore/file", have);
|
1
|
538 return false;
|
|
539 }
|
|
540 }
|
|
541 tok.token_error("load_conf() found %d syslog files in %s", count, fn);
|
|
542 return (!dc.syslogconfigs.empty());
|
|
543 }
|
|
544
|
|
545
|
|
546 ////////////////////////////////////////////////
|
|
547 // init the tokens
|
|
548 //
|
|
549 void token_init() {
|
3
|
550 token_bucket = register_string("bucket");
|
1
|
551 token_file = register_string("file");
|
3
|
552 token_ignore = register_string("ignore");
|
1
|
553 token_include = register_string("include");
|
3
|
554 token_index = register_string("index");
|
1
|
555 token_lbrace = register_string("{");
|
3
|
556 token_pattern = register_string("pattern");
|
1
|
557 token_rbrace = register_string("}");
|
|
558 token_semi = register_string(";");
|
3
|
559 token_slash = register_string("/");
|
|
560 token_threshold = register_string("threshold");
|
1
|
561 }
|