|
36
|
1 /*
|
|
|
2
|
|
|
3 Copyright (c) 2007 Carl Byington - 510 Software Group, released under
|
|
|
4 the GPL version 3 or any later version at your choice available at
|
|
|
5 http://www.gnu.org/licenses/gpl-3.0.txt
|
|
|
6
|
|
|
7 */
|
|
1
|
8
|
|
|
9
|
|
|
10 class SYSLOGCONFIG;
|
|
3
|
11 class CONFIG;
|
|
|
12
|
|
|
13 struct IPPAIR {
|
|
|
14 int first;
|
|
|
15 int last;
|
|
|
16 int cidr;
|
|
|
17 };
|
|
|
18
|
|
|
19 class PATTERN {
|
|
|
20 char * pattern; // owned by the string table
|
|
|
21 regex_t re;
|
|
|
22 int index; // zero based substring of the regex match that contains the ip address or hostname
|
|
4
|
23 int amount; // count to add to the ip address leaky bucket
|
|
35
|
24 char * message; // for logging, owned by the string table
|
|
3
|
25 public:
|
|
|
26 ~PATTERN();
|
|
35
|
27 PATTERN(TOKEN &tok, char *pattern_, int index_, int amount_, char *msg_);
|
|
20
|
28 bool process(char *buf, CONFIG &con, char *file_name, int pattern_index);
|
|
3
|
29 void dump(int level);
|
|
|
30 };
|
|
1
|
31
|
|
|
32 typedef SYSLOGCONFIG * SYSLOGCONFIGP;
|
|
3
|
33 typedef PATTERN * PATTERNP;
|
|
1
|
34 typedef list<SYSLOGCONFIGP> syslogconfig_list;
|
|
3
|
35 typedef list<IPPAIR> ippair_list;
|
|
|
36 typedef list<PATTERNP> pattern_list;
|
|
2
|
37 const int buflen = 1024;
|
|
1
|
38
|
|
|
39 class SYSLOGCONFIG {
|
|
4
|
40 TOKEN * tokp;
|
|
1
|
41 char * file_name; // name of the syslog file
|
|
3
|
42 pattern_list patterns; // owns the patterns
|
|
2
|
43 int fd;
|
|
4
|
44 struct stat openfdstat;
|
|
2
|
45 int len; // bytes in the buffer
|
|
|
46 char buf[buflen];
|
|
1
|
47 public:
|
|
3
|
48 SYSLOGCONFIG(TOKEN &tok, char *file_name_);
|
|
1
|
49 ~SYSLOGCONFIG();
|
|
4
|
50 bool failed() { return (fd == -1); };
|
|
|
51 void open(bool msg);
|
|
|
52 bool read(CONFIG &con);
|
|
|
53 void close();
|
|
3
|
54 void add_pattern(PATTERNP pat);
|
|
|
55 void process(CONFIG &con);
|
|
1
|
56 void dump(int level);
|
|
|
57 };
|
|
|
58
|
|
3
|
59 class CONFIG {
|
|
|
60 public:
|
|
1
|
61 // the only mutable stuff once it has been loaded from the config file
|
|
|
62 int reference_count; // protected by the global config_mutex
|
|
|
63 // all the rest is constant after loading from the config file
|
|
|
64 int generation;
|
|
|
65 time_t load_time;
|
|
|
66 string_set config_files;
|
|
3
|
67 int threshold;
|
|
|
68 ippair_list ignore; // owns all the ippairs
|
|
27
|
69 char * add_command; // owned by the string table
|
|
|
70 char * remove_command; // ""
|
|
3
|
71 syslogconfig_list syslogconfigs; // owns all the syslogconfigs
|
|
1
|
72
|
|
|
73 CONFIG();
|
|
|
74 ~CONFIG();
|
|
27
|
75 void set_add(char *add) { add_command = add; };
|
|
|
76 void set_remove(char *remove) { remove_command = remove; };
|
|
|
77 void set_threshold(int threshold_) { threshold = threshold_; };
|
|
|
78 int get_threshold() { return threshold; };
|
|
2
|
79 void add_syslogconfig(SYSLOGCONFIGP con);
|
|
3
|
80 void add_pair(IPPAIR pair);
|
|
2
|
81 void dump();
|
|
|
82 void read();
|
|
4
|
83 void sleep(int duration, time_t &previous);
|
|
36
|
84 void free_all();
|
|
3
|
85 bool looking(int ip);
|
|
1
|
86 };
|
|
|
87
|
|
|
88 void discard(string_set &s);
|
|
|
89 char* register_string(string_set &s, char *name);
|
|
|
90 char* register_string(char *name);
|
|
38
|
91 void clear_strings();
|
|
3
|
92 int ip_address(char *have);
|
|
1
|
93 bool load_conf(CONFIG &dc, char *fn);
|
|
|
94 void token_init();
|
|
|
95
|
|
27
|
96 extern char *token_add;
|
|
3
|
97 extern char *token_bucket;
|
|
1
|
98 extern char *token_file;
|
|
3
|
99 extern char *token_ignore;
|
|
1
|
100 extern char *token_include;
|
|
3
|
101 extern char *token_index;
|
|
1
|
102 extern char *token_lbrace;
|
|
3
|
103 extern char *token_pattern;
|
|
1
|
104 extern char *token_rbrace;
|
|
27
|
105 extern char *token_remove;
|
|
1
|
106 extern char *token_semi;
|
|
3
|
107 extern char *token_slash;
|
|
|
108 extern char *token_threshold;
|
|
1
|
109
|
