annotate src/syslogconfig.cpp @ 34:a3fee10284e2 stable-1-6 **INVALID**

gpl3
author carl
date Sun, 09 Sep 2007 15:46:03 -0700
parents 601bc0e075e1
children d2ceebcf6595
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1
551433a01cab initial coding
carl
parents:
diff changeset
1 /***************************************************************************
551433a01cab initial coding
carl
parents:
diff changeset
2 * Copyright (C) 2005 by 510 Software Group *
551433a01cab initial coding
carl
parents:
diff changeset
3 * *
551433a01cab initial coding
carl
parents:
diff changeset
4 * *
551433a01cab initial coding
carl
parents:
diff changeset
5 * This program is free software; you can redistribute it and/or modify *
551433a01cab initial coding
carl
parents:
diff changeset
6 * it under the terms of the GNU General Public License as published by *
551433a01cab initial coding
carl
parents:
diff changeset
7 * the Free Software Foundation; either version 2 of the License, or *
551433a01cab initial coding
carl
parents:
diff changeset
8 * (at your option) any later version. *
551433a01cab initial coding
carl
parents:
diff changeset
9 * *
551433a01cab initial coding
carl
parents:
diff changeset
10 * This program is distributed in the hope that it will be useful, *
551433a01cab initial coding
carl
parents:
diff changeset
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
551433a01cab initial coding
carl
parents:
diff changeset
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
551433a01cab initial coding
carl
parents:
diff changeset
13 * GNU General Public License for more details. *
551433a01cab initial coding
carl
parents:
diff changeset
14 * *
551433a01cab initial coding
carl
parents:
diff changeset
15 * You should have received a copy of the GNU General Public License *
551433a01cab initial coding
carl
parents:
diff changeset
16 * along with this program; if not, write to the *
551433a01cab initial coding
carl
parents:
diff changeset
17 * Free Software Foundation, Inc., *
551433a01cab initial coding
carl
parents:
diff changeset
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
551433a01cab initial coding
carl
parents:
diff changeset
19 ***************************************************************************/
551433a01cab initial coding
carl
parents:
diff changeset
20
551433a01cab initial coding
carl
parents:
diff changeset
21 #include "includes.h"
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
22 #include <fcntl.h>
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
23 #include <sys/socket.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
24 #include <netinet/in.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
25 #include <arpa/inet.h>
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
26 #include <netdb.h>
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
27 #include <limits.h>
1
551433a01cab initial coding
carl
parents:
diff changeset
28
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
29 static char* syslogconfig_version = "$Id$";
1
551433a01cab initial coding
carl
parents:
diff changeset
30
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
31 char *token_add;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
32 char *token_bucket;
1
551433a01cab initial coding
carl
parents:
diff changeset
33 char *token_file;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
34 char *token_ignore;
1
551433a01cab initial coding
carl
parents:
diff changeset
35 char *token_include;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
36 char *token_index;
1
551433a01cab initial coding
carl
parents:
diff changeset
37 char *token_lbrace;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
38 char *token_pattern;
1
551433a01cab initial coding
carl
parents:
diff changeset
39 char *token_rbrace;
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
40 char *token_remove;
1
551433a01cab initial coding
carl
parents:
diff changeset
41 char *token_semi;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
42 char *token_slash;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
43 char *token_threshold;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
44
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
45 struct ltint
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
46 {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
47 bool operator()(const int s1, const int s2) const
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
48 {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
49 return (unsigned)s1 < (unsigned)s2;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
50 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
51 };
1
551433a01cab initial coding
carl
parents:
diff changeset
52
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
53 struct bucket {
2737ab01659a initial coding
carl
parents: 3
diff changeset
54 int count;
2737ab01659a initial coding
carl
parents: 3
diff changeset
55 bool latch; // true iff ever count>threshold
2737ab01659a initial coding
carl
parents: 3
diff changeset
56 };
2737ab01659a initial coding
carl
parents: 3
diff changeset
57
1
551433a01cab initial coding
carl
parents:
diff changeset
58 string_set all_strings; // owns all the strings, only modified by the config loader thread
551433a01cab initial coding
carl
parents:
diff changeset
59 const int maxlen = 1000; // used for snprintf buffers
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
60 typedef map<int, bucket, ltint> ip_buckets;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
61
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
62 class IPR {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
63 ip_buckets violations;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
64 public:
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
65 void add(int ip, int amount, CONFIG &con, char *file_name, int pattern_index);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
66 void leak(int amount, CONFIG &con);
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
67 void update(int ip, bool added, char *file_name, int pattern_index);
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
68 void changed(CONFIG &con, int ip, bool added);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
69 };
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
70
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
71 IPR recorder;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
72
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
73
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
74 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
75 //
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
76 void IPR::add(int ip, int amount, CONFIG &con, char *file_name, int pattern_index) {
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
77 if (con.looking(ip)) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
78 ip_buckets::iterator i = violations.find(ip);
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
79 if (i == violations.end()) {
2737ab01659a initial coding
carl
parents: 3
diff changeset
80 bucket b;
2737ab01659a initial coding
carl
parents: 3
diff changeset
81 b.count = amount;
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
82 b.latch = (con.get_threshold() <= b.count);
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
83 violations[ip] = b;
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
84 if (b.latch) {
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
85 update(ip, true, file_name, pattern_index);
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
86 changed(con, ip, true);
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
87 }
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
88 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
89 else {
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
90 bucket &b = (*i).second;
2737ab01659a initial coding
carl
parents: 3
diff changeset
91 if (b.count < (INT_MAX-amount)) {
2737ab01659a initial coding
carl
parents: 3
diff changeset
92 int t = con.get_threshold();
2737ab01659a initial coding
carl
parents: 3
diff changeset
93 int c = b.count;
2737ab01659a initial coding
carl
parents: 3
diff changeset
94 b.count += amount;
2737ab01659a initial coding
carl
parents: 3
diff changeset
95 if ((!b.latch) && (c < t) && (t <= b.count)) {
2737ab01659a initial coding
carl
parents: 3
diff changeset
96 b.latch = true;
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
97 update(ip, true, file_name, pattern_index);
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
98 changed(con, ip, true);
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
99 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
100 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
101 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
102 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
103 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
104
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
105
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
106 void IPR::leak(int amount, CONFIG &con) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
107 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); ) {
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
108 int ip = (*i).first;
2737ab01659a initial coding
carl
parents: 3
diff changeset
109 bucket &b = (*i).second;
2737ab01659a initial coding
carl
parents: 3
diff changeset
110 if (b.count <= amount) {
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
111 if (b.latch) {
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
112 update(ip, false, NULL, 0);
24
ec051169fdfd don't flush input chain, use -D option instead
carl
parents: 20
diff changeset
113 changed(con, ip, false);
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
114 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
115 violations.erase(i++);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
116 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
117 else {
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
118 b.count -= amount;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
119 i++;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
120 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
121 }
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
122 }
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
123
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
124
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
125 void IPR::update(int ip, bool added, char *file_name, int pattern_index) {
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
126 if (debug_syslog > 2) {
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
127 char buf[maxlen];
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
128 in_addr ad;
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
129 ad.s_addr = htonl(ip);
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
130 if (added) snprintf(buf, maxlen, "dropping traffic from/to %s based on pattern match %d in %s", inet_ntoa(ad), pattern_index, file_name);
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
131 else snprintf(buf, maxlen, "allowing traffic from/to %s", inet_ntoa(ad));
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
132 my_syslog(buf);
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
133 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
134 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
135
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
136
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
137 void IPR::changed(CONFIG &con, int ip, bool added) {
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
138 int t = con.get_threshold();
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
139 char buf[maxlen];
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
140 if (added) {
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
141 bucket &b = violations[ip];
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
142 if (con.looking(ip) && (b.count > t)) {
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
143 in_addr ad;
2737ab01659a initial coding
carl
parents: 3
diff changeset
144 ad.s_addr = htonl(ip);
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
145 snprintf(buf, maxlen, con.add_command, inet_ntoa(ad));
5
276c4edc8521 initial coding
carl
parents: 4
diff changeset
146 system(buf);
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
147 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
148 }
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
149 else {
24
ec051169fdfd don't flush input chain, use -D option instead
carl
parents: 20
diff changeset
150 in_addr ad;
ec051169fdfd don't flush input chain, use -D option instead
carl
parents: 20
diff changeset
151 ad.s_addr = htonl(ip);
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
152 snprintf(buf, maxlen, con.remove_command, inet_ntoa(ad));
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
153 system(buf);
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
154 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
155 }
1
551433a01cab initial coding
carl
parents:
diff changeset
156
551433a01cab initial coding
carl
parents:
diff changeset
157
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
158 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
159 //
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
160 int ip_address(char *have);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
161 int ip_address(char *have) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
162 int ipaddr = 0;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
163 in_addr ip;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
164 if (inet_aton(have, &ip)) ipaddr = ip.s_addr;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
165 else {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
166 struct hostent *host = gethostbyname(have);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
167 if (host && host->h_addrtype == AF_INET) memcpy(&ipaddr, host->h_addr, sizeof(ipaddr));
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
168 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
169 return ntohl(ipaddr);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
170 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
171
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
172
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
173 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
174 //
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
175 PATTERN::PATTERN(TOKEN &tok, char *pattern_, int index_, int amount_) {
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
176 pattern = pattern_;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
177 index = index_;
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
178 amount = amount_;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
179 if (pattern) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
180 int rc = regcomp(&re, pattern, REG_ICASE | REG_EXTENDED);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
181 if (rc) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
182 char bu[maxlen];
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
183 regerror(rc, &re, bu, maxlen);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
184 char buf[maxlen];
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
185 snprintf(buf, sizeof(buf), "pattern %s not valid - %s", pattern, bu);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
186 tok.token_error(buf);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
187 pattern = NULL;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
188 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
189 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
190 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
191
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
192
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
193 PATTERN::~PATTERN() {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
194 regfree(&re);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
195 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
196
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
197
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
198 bool PATTERN::process(char *buf, CONFIG &con, char *file_name, int pattern_index) {
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
199 if (pattern) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
200 const int nmatch = index+1;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
201 regmatch_t match[nmatch];
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
202 if (0 == regexec(&re, buf, nmatch, match, 0)) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
203 int s = match[index].rm_so;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
204 int e = match[index].rm_eo;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
205 if (s != -1) {
5
276c4edc8521 initial coding
carl
parents: 4
diff changeset
206 if (debug_syslog > 3) {
276c4edc8521 initial coding
carl
parents: 4
diff changeset
207 my_syslog(buf); // show lines with matches
276c4edc8521 initial coding
carl
parents: 4
diff changeset
208 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
209 buf[e] = '\0';
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
210 int ip = ip_address(buf+s);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
211 if (ip) {
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
212 recorder.add(ip, amount, con, file_name, pattern_index);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
213 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
214 return true;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
215 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
216 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
217 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
218 return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
219 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
220
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
221
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
222 void PATTERN::dump(int level) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
223 char indent[maxlen];
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
224 int i = min(maxlen-1, level*4);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
225 memset(indent, ' ', i);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
226 indent[i] = '\0';
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
227 printf("%s pattern \"%s\" {; \n", indent, pattern);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
228 printf("%s index %d; \n", indent, index);
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
229 printf("%s bucket %d; \n", indent, amount);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
230 printf("%s }; \n", indent);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
231 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
232
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
233
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
234 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
235 //
1
551433a01cab initial coding
carl
parents:
diff changeset
236 CONFIG::CONFIG() {
551433a01cab initial coding
carl
parents:
diff changeset
237 reference_count = 0;
551433a01cab initial coding
carl
parents:
diff changeset
238 generation = 0;
551433a01cab initial coding
carl
parents:
diff changeset
239 load_time = 0;
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
240 threshold = 500;
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
241 add_command = "/sbin/iptables -I INPUT --src %s --jump DROP";
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
242 remove_command = "/sbin/iptables -D INPUT --src %s --jump DROP";
1
551433a01cab initial coding
carl
parents:
diff changeset
243 }
551433a01cab initial coding
carl
parents:
diff changeset
244
551433a01cab initial coding
carl
parents:
diff changeset
245
551433a01cab initial coding
carl
parents:
diff changeset
246 CONFIG::~CONFIG() {
551433a01cab initial coding
carl
parents:
diff changeset
247 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
551433a01cab initial coding
carl
parents:
diff changeset
248 SYSLOGCONFIG *c = *i;
551433a01cab initial coding
carl
parents:
diff changeset
249 delete c;
551433a01cab initial coding
carl
parents:
diff changeset
250 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
251 ignore.clear();
1
551433a01cab initial coding
carl
parents:
diff changeset
252 }
551433a01cab initial coding
carl
parents:
diff changeset
253
551433a01cab initial coding
carl
parents:
diff changeset
254
551433a01cab initial coding
carl
parents:
diff changeset
255 void CONFIG::add_syslogconfig(SYSLOGCONFIGP con) {
551433a01cab initial coding
carl
parents:
diff changeset
256 syslogconfigs.push_back(con);
551433a01cab initial coding
carl
parents:
diff changeset
257 }
551433a01cab initial coding
carl
parents:
diff changeset
258
551433a01cab initial coding
carl
parents:
diff changeset
259
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
260 void CONFIG::add_pair(IPPAIR pair) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
261 ignore.push_back(pair);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
262 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
263
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
264
1
551433a01cab initial coding
carl
parents:
diff changeset
265 void CONFIG::dump() {
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
266 printf(" threshold %d; \n\n", threshold);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
267
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
268 printf(" add_command \"%s\"; \n", add_command);
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
269 printf(" remove_command \"%s\"; \n\n", remove_command);
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
270
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
271 printf(" ignore { \n");
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
272 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
273 IPPAIR &p = *i;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
274 in_addr ip;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
275 ip.s_addr = htonl(p.first);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
276 printf(" %s/%d; \n", inet_ntoa(ip), p.cidr);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
277 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
278 printf(" }; \n\n");
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
279
1
551433a01cab initial coding
carl
parents:
diff changeset
280 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
551433a01cab initial coding
carl
parents:
diff changeset
281 SYSLOGCONFIGP c = *i;
551433a01cab initial coding
carl
parents:
diff changeset
282 c->dump(0);
551433a01cab initial coding
carl
parents:
diff changeset
283 }
551433a01cab initial coding
carl
parents:
diff changeset
284 }
551433a01cab initial coding
carl
parents:
diff changeset
285
551433a01cab initial coding
carl
parents:
diff changeset
286
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
287 void CONFIG::read() {
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
288 while (true) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
289 bool have = false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
290 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
291 SYSLOGCONFIGP c = *i;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
292 have |= c->read(*this);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
293 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
294 if (!have) break;
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
295 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
296 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
297
6e88da080f08 initial coding
carl
parents: 1
diff changeset
298
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
299 void CONFIG::sleep(int duration, time_t &previous) {
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
300 ::sleep(duration);
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
301 time_t now = time(NULL);
2737ab01659a initial coding
carl
parents: 3
diff changeset
302 recorder.leak(now-previous, *this);
2737ab01659a initial coding
carl
parents: 3
diff changeset
303 previous = now;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
304 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
305
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
306
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
307 bool CONFIG::looking(int ip) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
308 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
309 IPPAIR &p = *i;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
310 if ((p.first <= ip) && (ip <= p.last)) return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
311 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
312 return true;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
313 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
314
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
315 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
316 //
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
317 SYSLOGCONFIG::SYSLOGCONFIG(TOKEN &tok, char *file_name_) {
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
318 tokp = &tok;
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
319 file_name = file_name_;
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
320 open(true);
1
551433a01cab initial coding
carl
parents:
diff changeset
321 }
551433a01cab initial coding
carl
parents:
diff changeset
322
551433a01cab initial coding
carl
parents:
diff changeset
323
551433a01cab initial coding
carl
parents:
diff changeset
324 SYSLOGCONFIG::~SYSLOGCONFIG() {
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
325 close();
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
326 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
327 PATTERN *p = *i;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
328 delete p;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
329 }
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
330 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
331
6e88da080f08 initial coding
carl
parents: 1
diff changeset
332
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
333 void SYSLOGCONFIG::open(bool msg) {
2737ab01659a initial coding
carl
parents: 3
diff changeset
334 fd = ::open(file_name, O_RDONLY);
2737ab01659a initial coding
carl
parents: 3
diff changeset
335 len = 0;
2737ab01659a initial coding
carl
parents: 3
diff changeset
336 if (fd == -1) {
2737ab01659a initial coding
carl
parents: 3
diff changeset
337 if (msg) {
2737ab01659a initial coding
carl
parents: 3
diff changeset
338 char buf[maxlen];
2737ab01659a initial coding
carl
parents: 3
diff changeset
339 snprintf(buf, sizeof(buf), "syslog file %s not readable", file_name);
2737ab01659a initial coding
carl
parents: 3
diff changeset
340 tokp->token_error(buf);
2737ab01659a initial coding
carl
parents: 3
diff changeset
341 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
342 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
343 else {
5
276c4edc8521 initial coding
carl
parents: 4
diff changeset
344 if (debug_syslog > 1) {
276c4edc8521 initial coding
carl
parents: 4
diff changeset
345 snprintf(buf, sizeof(buf), "syslog file %s opened", file_name);
276c4edc8521 initial coding
carl
parents: 4
diff changeset
346 my_syslog(buf);
276c4edc8521 initial coding
carl
parents: 4
diff changeset
347 }
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
348 lseek(fd, 0, SEEK_END);
2737ab01659a initial coding
carl
parents: 3
diff changeset
349 if (fstat(fd, &openfdstat)) {
2737ab01659a initial coding
carl
parents: 3
diff changeset
350 close();
2737ab01659a initial coding
carl
parents: 3
diff changeset
351 snprintf(buf, sizeof(buf), "syslog file %s cannot stat after open", file_name);
2737ab01659a initial coding
carl
parents: 3
diff changeset
352 tokp->token_error(buf);
2737ab01659a initial coding
carl
parents: 3
diff changeset
353 }
31
carl
parents: 28
diff changeset
354 // specify that this fd gets closed on exec, so that selinux
carl
parents: 28
diff changeset
355 // won't complain about iptables trying to read log files.
carl
parents: 28
diff changeset
356 int oldflags = fcntl(fd, F_GETFD, 0);
carl
parents: 28
diff changeset
357 if (oldflags >= 0) {
carl
parents: 28
diff changeset
358 fcntl(fd, F_SETFD, oldflags | FD_CLOEXEC);
carl
parents: 28
diff changeset
359 }
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
360 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
361 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
362
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
363
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
364 bool SYSLOGCONFIG::read(CONFIG &con) {
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
365 if (failed()) {
2737ab01659a initial coding
carl
parents: 3
diff changeset
366 open(false);
2737ab01659a initial coding
carl
parents: 3
diff changeset
367 if (failed()) return false;
2737ab01659a initial coding
carl
parents: 3
diff changeset
368 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
369 int n = ::read(fd, buf+len, buflen-len);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
370 bool have = (n > 0);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
371 if (have) {
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
372 len += n;
6e88da080f08 initial coding
carl
parents: 1
diff changeset
373 while (true) {
6e88da080f08 initial coding
carl
parents: 1
diff changeset
374 char *p = (char*)memchr(buf, '\n', len);
6e88da080f08 initial coding
carl
parents: 1
diff changeset
375 if (!p) break;
6e88da080f08 initial coding
carl
parents: 1
diff changeset
376 n = p-buf;
6e88da080f08 initial coding
carl
parents: 1
diff changeset
377 *p = '\0';
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
378 process(con); // process null terminated string
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
379 len -= n+1;
6e88da080f08 initial coding
carl
parents: 1
diff changeset
380 memmove(buf, p+1, len);
6e88da080f08 initial coding
carl
parents: 1
diff changeset
381 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
382 // no <lf> in a full buffer
6e88da080f08 initial coding
carl
parents: 1
diff changeset
383 if (len == buflen) len = 0;
6e88da080f08 initial coding
carl
parents: 1
diff changeset
384 }
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
385 else {
2737ab01659a initial coding
carl
parents: 3
diff changeset
386 // check for file close
2737ab01659a initial coding
carl
parents: 3
diff changeset
387 struct stat filenamest;
2737ab01659a initial coding
carl
parents: 3
diff changeset
388 if (0 == stat(file_name, &filenamest)) {
2737ab01659a initial coding
carl
parents: 3
diff changeset
389 if ((filenamest.st_dev != openfdstat.st_dev) ||
2737ab01659a initial coding
carl
parents: 3
diff changeset
390 (filenamest.st_ino != openfdstat.st_ino)) {
2737ab01659a initial coding
carl
parents: 3
diff changeset
391 close();
2737ab01659a initial coding
carl
parents: 3
diff changeset
392 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
393 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
394 else {
2737ab01659a initial coding
carl
parents: 3
diff changeset
395 // filename no longer exists
2737ab01659a initial coding
carl
parents: 3
diff changeset
396 close();
2737ab01659a initial coding
carl
parents: 3
diff changeset
397 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
398 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
399 return have;
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
400 }
6e88da080f08 initial coding
carl
parents: 1
diff changeset
401
6e88da080f08 initial coding
carl
parents: 1
diff changeset
402
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
403 void SYSLOGCONFIG::close() {
5
276c4edc8521 initial coding
carl
parents: 4
diff changeset
404 if (debug_syslog > 1) {
276c4edc8521 initial coding
carl
parents: 4
diff changeset
405 snprintf(buf, sizeof(buf), "syslog file %s closed", file_name);
276c4edc8521 initial coding
carl
parents: 4
diff changeset
406 my_syslog(buf);
276c4edc8521 initial coding
carl
parents: 4
diff changeset
407 }
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
408 if (fd != -1) ::close(fd);
2737ab01659a initial coding
carl
parents: 3
diff changeset
409 fd = -1;
2737ab01659a initial coding
carl
parents: 3
diff changeset
410 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
411
2737ab01659a initial coding
carl
parents: 3
diff changeset
412
2737ab01659a initial coding
carl
parents: 3
diff changeset
413 void SYSLOGCONFIG::add_pattern(PATTERNP pat) {
2737ab01659a initial coding
carl
parents: 3
diff changeset
414 patterns.push_back(pat);
2737ab01659a initial coding
carl
parents: 3
diff changeset
415 }
2737ab01659a initial coding
carl
parents: 3
diff changeset
416
2737ab01659a initial coding
carl
parents: 3
diff changeset
417
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
418 void SYSLOGCONFIG::process(CONFIG &con) {
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
419 int pi=0;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
420 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
421 PATTERN *p = *i;
20
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
422 if (p->process(buf, con, file_name, pi)) break;
0d65c3de34fd add better logging
carl
parents: 12
diff changeset
423 pi++;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
424 }
1
551433a01cab initial coding
carl
parents:
diff changeset
425 }
551433a01cab initial coding
carl
parents:
diff changeset
426
551433a01cab initial coding
carl
parents:
diff changeset
427
551433a01cab initial coding
carl
parents:
diff changeset
428 void SYSLOGCONFIG::dump(int level) {
551433a01cab initial coding
carl
parents:
diff changeset
429 char indent[maxlen];
551433a01cab initial coding
carl
parents:
diff changeset
430 int i = min(maxlen-1, level*4);
551433a01cab initial coding
carl
parents:
diff changeset
431 memset(indent, ' ', i);
551433a01cab initial coding
carl
parents:
diff changeset
432 indent[i] = '\0';
551433a01cab initial coding
carl
parents:
diff changeset
433 char buf[maxlen];
551433a01cab initial coding
carl
parents:
diff changeset
434 printf("%s file \"%s\" {\n", indent, file_name);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
435 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
436 PATTERN *p = *i;
4
2737ab01659a initial coding
carl
parents: 3
diff changeset
437 p->dump(level+1);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
438 }
1
551433a01cab initial coding
carl
parents:
diff changeset
439 printf("%s }; \n", indent);
551433a01cab initial coding
carl
parents:
diff changeset
440 }
551433a01cab initial coding
carl
parents:
diff changeset
441
551433a01cab initial coding
carl
parents:
diff changeset
442
551433a01cab initial coding
carl
parents:
diff changeset
443 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
444 // helper to discard the strings held by a string_set
551433a01cab initial coding
carl
parents:
diff changeset
445 //
551433a01cab initial coding
carl
parents:
diff changeset
446 void discard(string_set &s) {
551433a01cab initial coding
carl
parents:
diff changeset
447 for (string_set::iterator i=s.begin(); i!=s.end(); i++) {
551433a01cab initial coding
carl
parents:
diff changeset
448 free(*i);
551433a01cab initial coding
carl
parents:
diff changeset
449 }
551433a01cab initial coding
carl
parents:
diff changeset
450 s.clear();
551433a01cab initial coding
carl
parents:
diff changeset
451 }
551433a01cab initial coding
carl
parents:
diff changeset
452
551433a01cab initial coding
carl
parents:
diff changeset
453
551433a01cab initial coding
carl
parents:
diff changeset
454 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
455 // helper to register a string in a string set
551433a01cab initial coding
carl
parents:
diff changeset
456 //
551433a01cab initial coding
carl
parents:
diff changeset
457 char* register_string(string_set &s, char *name) {
551433a01cab initial coding
carl
parents:
diff changeset
458 string_set::iterator i = s.find(name);
551433a01cab initial coding
carl
parents:
diff changeset
459 if (i != s.end()) return *i;
551433a01cab initial coding
carl
parents:
diff changeset
460 char *x = strdup(name);
551433a01cab initial coding
carl
parents:
diff changeset
461 s.insert(x);
551433a01cab initial coding
carl
parents:
diff changeset
462 return x;
551433a01cab initial coding
carl
parents:
diff changeset
463 }
551433a01cab initial coding
carl
parents:
diff changeset
464
551433a01cab initial coding
carl
parents:
diff changeset
465
551433a01cab initial coding
carl
parents:
diff changeset
466 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
467 // register a global string
551433a01cab initial coding
carl
parents:
diff changeset
468 //
551433a01cab initial coding
carl
parents:
diff changeset
469 char* register_string(char *name) {
551433a01cab initial coding
carl
parents:
diff changeset
470 return register_string(all_strings, name);
551433a01cab initial coding
carl
parents:
diff changeset
471 }
551433a01cab initial coding
carl
parents:
diff changeset
472
551433a01cab initial coding
carl
parents:
diff changeset
473
551433a01cab initial coding
carl
parents:
diff changeset
474 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
475 //
551433a01cab initial coding
carl
parents:
diff changeset
476 bool tsa(TOKEN &tok, char *token);
551433a01cab initial coding
carl
parents:
diff changeset
477 bool tsa(TOKEN &tok, char *token) {
551433a01cab initial coding
carl
parents:
diff changeset
478 char *have = tok.next();
551433a01cab initial coding
carl
parents:
diff changeset
479 if (have == token) return true;
551433a01cab initial coding
carl
parents:
diff changeset
480 tok.token_error(token, have);
551433a01cab initial coding
carl
parents:
diff changeset
481 return false;
551433a01cab initial coding
carl
parents:
diff changeset
482 }
551433a01cab initial coding
carl
parents:
diff changeset
483
551433a01cab initial coding
carl
parents:
diff changeset
484
551433a01cab initial coding
carl
parents:
diff changeset
485 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
486 //
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
487 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
488 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
489 char *pat = tok.next();
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
490 int ind, buc;
1
551433a01cab initial coding
carl
parents:
diff changeset
491 if (!tsa(tok, token_lbrace)) return false;
551433a01cab initial coding
carl
parents:
diff changeset
492 while (true) {
551433a01cab initial coding
carl
parents:
diff changeset
493 char *have = tok.next();
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
494 if (!have) break;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
495 if (have == token_rbrace) break;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
496 if (have == token_index) {
1
551433a01cab initial coding
carl
parents:
diff changeset
497 have = tok.next();
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
498 ind = atoi(have);
1
551433a01cab initial coding
carl
parents:
diff changeset
499 if (!tsa(tok, token_semi)) return false;
551433a01cab initial coding
carl
parents:
diff changeset
500 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
501 else if (have == token_bucket) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
502 have = tok.next();
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
503 buc = atoi(have);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
504 if (!tsa(tok, token_semi)) return false;
1
551433a01cab initial coding
carl
parents:
diff changeset
505 }
551433a01cab initial coding
carl
parents:
diff changeset
506 else {
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
507 tok.token_error("index/bucket", have);
1
551433a01cab initial coding
carl
parents:
diff changeset
508 return false;
551433a01cab initial coding
carl
parents:
diff changeset
509 }
551433a01cab initial coding
carl
parents:
diff changeset
510 }
551433a01cab initial coding
carl
parents:
diff changeset
511 if (!tsa(tok, token_semi)) return false;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
512 PATTERNP patt = new PATTERN(tok, pat, ind, buc);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
513 con.add_pattern(patt);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
514 return true;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
515 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
516
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
517
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
518 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
519 //
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
520 bool parse_ignore(TOKEN &tok, CONFIG &dc);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
521 bool parse_ignore(TOKEN &tok, CONFIG &dc) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
522 if (!tsa(tok, token_lbrace)) return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
523 while (true) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
524 char *have = tok.next();
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
525 if (!have) break;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
526 if (have == token_rbrace) break;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
527 int ipaddr = ip_address(have);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
528 if (ipaddr == 0) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
529 tok.token_error("ip address", have);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
530 return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
531 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
532 if (!tsa(tok, token_slash)) return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
533 have = tok.next();
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
534 int mask = atoi(have);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
535 if ((mask < 8) || (mask > 32)) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
536 tok.token_error("cidr 8..32 value", have);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
537 return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
538 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
539 if (!tsa(tok, token_semi)) return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
540 IPPAIR pair;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
541 const int masks[33] = {0xffffffff, // 0
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
542 0x7fffffff, // 1
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
543 0x3fffffff, // 2
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
544 0x1fffffff, // 3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
545 0x0fffffff, // 4
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
546 0x07ffffff, // 5
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
547 0x03ffffff, // 6
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
548 0x01ffffff, // 7
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
549 0x00ffffff, // 8
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
550 0x007fffff, // 9
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
551 0x003fffff, // 10
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
552 0x001fffff, // 11
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
553 0x000fffff, // 12
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
554 0x0007ffff, // 13
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
555 0x0003ffff, // 14
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
556 0x0001ffff, // 15
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
557 0x0000ffff, // 16
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
558 0x00007fff, // 17
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
559 0x00003fff, // 18
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
560 0x00001fff, // 19
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
561 0x00000fff, // 20
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
562 0x000007ff, // 21
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
563 0x000003ff, // 22
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
564 0x000001ff, // 23
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
565 0x000000ff, // 24
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
566 0x0000007f, // 25
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
567 0x0000003f, // 26
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
568 0x0000001f, // 27
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
569 0x0000000f, // 28
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
570 0x00000007, // 29
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
571 0x00000003, // 30
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
572 0x00000001, // 31
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
573 0x00000000}; // 32
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
574 pair.first = ipaddr;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
575 pair.last = ipaddr | masks[mask];
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
576 pair.cidr = mask;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
577 dc.add_pair(pair);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
578 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
579 if (!tsa(tok, token_semi)) return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
580 return true;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
581 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
582
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
583
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
584 ////////////////////////////////////////////////
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
585 //
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
586 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
587 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
588 char *name = tok.next();
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
589 if (!tsa(tok, token_lbrace)) return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
590 SYSLOGCONFIGP con = new SYSLOGCONFIG(tok, name);
2
6e88da080f08 initial coding
carl
parents: 1
diff changeset
591 if (con->failed()) {
6e88da080f08 initial coding
carl
parents: 1
diff changeset
592 delete con;
6e88da080f08 initial coding
carl
parents: 1
diff changeset
593 return false;
6e88da080f08 initial coding
carl
parents: 1
diff changeset
594 }
1
551433a01cab initial coding
carl
parents:
diff changeset
595 dc.add_syslogconfig(con);
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
596 while (true) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
597 char *have = tok.next();
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
598 if (!have) break;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
599 if (have == token_rbrace) break;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
600 if (have == token_pattern) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
601 if (!parse_pattern(tok, *con)) return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
602 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
603 else {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
604 tok.token_error("pattern", have);
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
605 return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
606 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
607 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
608 if (!tsa(tok, token_semi)) return false;
1
551433a01cab initial coding
carl
parents:
diff changeset
609 return true;
551433a01cab initial coding
carl
parents:
diff changeset
610 }
551433a01cab initial coding
carl
parents:
diff changeset
611
551433a01cab initial coding
carl
parents:
diff changeset
612
551433a01cab initial coding
carl
parents:
diff changeset
613 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
614 // parse a config file
551433a01cab initial coding
carl
parents:
diff changeset
615 //
551433a01cab initial coding
carl
parents:
diff changeset
616 bool load_conf(CONFIG &dc, char *fn) {
551433a01cab initial coding
carl
parents:
diff changeset
617 int count = 0;
551433a01cab initial coding
carl
parents:
diff changeset
618 TOKEN tok(fn, &dc.config_files);
551433a01cab initial coding
carl
parents:
diff changeset
619 while (true) {
551433a01cab initial coding
carl
parents:
diff changeset
620 char *have = tok.next();
551433a01cab initial coding
carl
parents:
diff changeset
621 if (!have) break;
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
622 if (have == token_threshold) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
623 have = tok.next();
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
624 dc.set_threshold(atoi(have));
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
625 if (!tsa(tok, token_semi)) return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
626 }
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
627 else if (have == token_ignore) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
628 if (!parse_ignore(tok, dc)) return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
629 }
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
630 else if (have == token_add) {
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
631 have = tok.next();
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
632 dc.set_add(have);
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
633 if (!tsa(tok, token_semi)) return false;
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
634 }
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
635 else if (have == token_remove) {
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
636 have = tok.next();
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
637 dc.set_remove(have);
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
638 if (!tsa(tok, token_semi)) return false;
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
639 }
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
640 else if (have == token_file) {
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
641 if (!parse_syslogconfig(tok, dc)) return false;
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
642 count++;
1
551433a01cab initial coding
carl
parents:
diff changeset
643 }
551433a01cab initial coding
carl
parents:
diff changeset
644 else {
28
6465d8640489 make add/remove commands configureable
carl
parents: 27
diff changeset
645 tok.token_error("threshold/ignore/add_command/remove_command/file", have);
1
551433a01cab initial coding
carl
parents:
diff changeset
646 return false;
551433a01cab initial coding
carl
parents:
diff changeset
647 }
551433a01cab initial coding
carl
parents:
diff changeset
648 }
551433a01cab initial coding
carl
parents:
diff changeset
649 tok.token_error("load_conf() found %d syslog files in %s", count, fn);
551433a01cab initial coding
carl
parents:
diff changeset
650 return (!dc.syslogconfigs.empty());
551433a01cab initial coding
carl
parents:
diff changeset
651 }
551433a01cab initial coding
carl
parents:
diff changeset
652
551433a01cab initial coding
carl
parents:
diff changeset
653
551433a01cab initial coding
carl
parents:
diff changeset
654 ////////////////////////////////////////////////
551433a01cab initial coding
carl
parents:
diff changeset
655 // init the tokens
551433a01cab initial coding
carl
parents:
diff changeset
656 //
551433a01cab initial coding
carl
parents:
diff changeset
657 void token_init() {
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
658 token_add = register_string("add_command");
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
659 token_bucket = register_string("bucket");
1
551433a01cab initial coding
carl
parents:
diff changeset
660 token_file = register_string("file");
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
661 token_ignore = register_string("ignore");
1
551433a01cab initial coding
carl
parents:
diff changeset
662 token_include = register_string("include");
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
663 token_index = register_string("index");
1
551433a01cab initial coding
carl
parents:
diff changeset
664 token_lbrace = register_string("{");
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
665 token_pattern = register_string("pattern");
1
551433a01cab initial coding
carl
parents:
diff changeset
666 token_rbrace = register_string("}");
27
28fec0c67646 make add/remove commands configureable
carl
parents: 24
diff changeset
667 token_remove = register_string("remove_command");
1
551433a01cab initial coding
carl
parents:
diff changeset
668 token_semi = register_string(";");
3
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
669 token_slash = register_string("/");
8fe310e5cd44 initial coding
carl
parents: 2
diff changeset
670 token_threshold = register_string("threshold");
1
551433a01cab initial coding
carl
parents:
diff changeset
671 }