syslog2iptables: src/syslogconfig.cpp annotate

annotate src/syslogconfig.cpp @ 76:c6c8a2102a3e

add more logging when blocked addresses move to higher scale values

author	Carl Byington <carl@five-ten-sg.com>
date	Wed, 15 Jul 2020 13:38:43 -0700
parents	0e736950a117
children	831d0b46bbd2

rev	line source
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	1 /*
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	2
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	3 Copyright (c) 2007 Carl Byington - 510 Software Group, released under
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	4 the GPL version 3 or any later version at your choice available at
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	5 http://www.gnu.org/licenses/gpl-3.0.txt
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	6
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	7 */
1 551433a01cab initial coding carl parents: diff changeset	8
551433a01cab initial coding carl parents: diff changeset	9 #include "includes.h"
2 6e88da080f08 initial coding carl parents: 1 diff changeset	10 #include <fcntl.h>
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	11 #include <sys/socket.h>
8fe310e5cd44 initial coding carl parents: 2 diff changeset	12 #include <netinet/in.h>
8fe310e5cd44 initial coding carl parents: 2 diff changeset	13 #include <arpa/inet.h>
8fe310e5cd44 initial coding carl parents: 2 diff changeset	14 #include <netdb.h>
4 2737ab01659a initial coding carl parents: 3 diff changeset	15 #include <limits.h>
1 551433a01cab initial coding carl parents: diff changeset	16
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	17 const char *token_add;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	18 const char *token_bucket;
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	19 const char *token_context;
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	20 const char *token_file;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	21 const char *token_ignore;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	22 const char *token_include;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	23 const char *token_index;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	24 const char *token_lbrace;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	25 const char *token_message;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	26 const char *token_pattern;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	27 const char *token_rbrace;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	28 const char *token_remove;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	29 const char *token_semi;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	30 const char *token_slash;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	31 const char *token_threshold;
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	32 string_set all_strings;// owns all the strings, only modified by the config loader thread
76 c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	33 recorder_map recorders; // all the recorders are named by their context
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	34 const int maxlen = 1000; // used for snprintf buffers
58 b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	35 const int scale_max = 500000;
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	36
8fe310e5cd44 initial coding carl parents: 2 diff changeset	37
8fe310e5cd44 initial coding carl parents: 2 diff changeset	38 ////////////////////////////////////////////////
8fe310e5cd44 initial coding carl parents: 2 diff changeset	39 //
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	40
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	41 IPR::IPR() {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	42 reference_count = 0;
58 b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	43 daily_timer = 86400;
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	44 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	45
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	46 IPR* IPR::find(const char* name) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	47 recorder_map::iterator m = recorders.find(name);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	48 if (m == recorders.end()) recorders[name] = new IPR;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	49 recorders[name]->reference(1);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	50 return recorders[name];
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	51 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	52
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	53
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	54 void IPR::release(const char* name) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	55 recorder_map::iterator m = recorders.find(name);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	56 IPR* i = (*m).second;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	57 int r = i->reference(-1);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	58 if (r == 0) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	59 delete i;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	60 recorders.erase(m);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	61 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	62 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	63
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	64
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	65 void IPR::add(int ip, int amount, CONTEXT &con, const char file_name, int pattern_index, const char message) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	66 if (con.looking(ip)) {
63 60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	67 if (amount > 0) {
76 c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	68 int original_amount = amount;
63 60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	69 ip_buckets::iterator j = repeat_offenders.find(ip);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	70 int scale = (j == repeat_offenders.end()) ? 1 : (*j).second.count;
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	71 amount *= scale;
58 b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	72
63 60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	73 ip_buckets::iterator i = violations.find(ip);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	74 if (i == violations.end()) {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	75 bucket b;
76 c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	76 b.count = amount;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	77 b.blocked = (con.get_threshold() <= b.count);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	78 b.max_scale = 1;
63 60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	79 violations[ip] = b;
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	80 if (b.blocked) {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	81 update(ip, true, scale, file_name, pattern_index, message);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	82 changed(con, ip, true);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	83 }
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	84 }
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	85 else {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	86 bucket &b = (*i).second;
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	87 if ((b.count >= 0) && (b.count < 2600000)) {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	88 // good authentication (count<0) prevents blocking
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	89 // not much point in blocking for more than a month
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	90 b.count += amount;
76 c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	91 int threshold = con.get_threshold();
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	92 if (b.blocked) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	93 int effective_scale = 1;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	94 while (original_amount * effective_scale < b.count) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	95 effective_scale = effective_scale * 3 / 2;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	96 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	97 if (effective_scale > b.max_scale) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	98 b.max_scale = effective_scale;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	99 if (debug_syslog > 2) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	100 char buf[maxlen];
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	101 in_addr ad;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	102 ad.s_addr = htonl(ip);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	103 if (message) snprintf(buf, maxlen, "upgrade dropping traffic from/to %s based on %s in %s, scale %d", inet_ntoa(ad), message, file_name, effective_scale);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	104 else snprintf(buf, maxlen, "upgrade dropping traffic from/to %s based on pattern match %d in %s, scale %d", inet_ntoa(ad), pattern_index, file_name, effective_scale);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	105 my_syslog(buf);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	106 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	107 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	108 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	109 if ((!b.blocked) && (threshold <= b.count)) {
63 60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	110 b.blocked = true;
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	111 update(ip, true, scale, file_name, pattern_index, message);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	112 changed(con, ip, true);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	113 }
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	114 }
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	115 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	116 }
63 60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	117
69 0e736950a117 fix post uninstall script; allow config bucket count zero to disable a pattern Carl Byington <carl@five-ten-sg.com> parents: 63 diff changeset	118 else if (amount < 0) {
63 60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	119 char buf[maxlen];
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	120 in_addr ad;
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	121 ad.s_addr = htonl(ip);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	122 snprintf(buf, maxlen, "%s for %s", message, inet_ntoa(ad));
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	123 my_syslog(buf);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	124
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	125 ip_buckets::iterator j = repeat_offenders.find(ip);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	126 if (j != repeat_offenders.end()) {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	127 repeat_offenders.erase(j++);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	128 snprintf(buf, maxlen, "removing %s from repeat offenders", inet_ntoa(ad));
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	129 my_syslog(buf);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	130 }
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	131 ip_buckets::iterator i = violations.find(ip);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	132 if (i == violations.end()) {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	133 bucket b;
76 c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	134 b.count = amount;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	135 b.blocked = false;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	136 b.max_scale = 1;
63 60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	137 violations[ip] = b;
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	138 }
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	139 else {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	140 bucket &b = (*i).second;
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	141 b.count = amount;
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	142 if (b.blocked) {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	143 update(ip, false, 0, NULL, 0, NULL);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	144 changed(con, ip, false);
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	145 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	146 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	147 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	148 }
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	149 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	150
8fe310e5cd44 initial coding carl parents: 2 diff changeset	151
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	152 void IPR::leak(int amount, CONTEXT &con) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	153 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); ) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	154 int ip = (*i).first;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	155 bucket &b = (*i).second;
63 60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	156 if (b.count < 0) {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	157 if (b.count >= -amount) violations.erase(i++);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	158 else {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	159 b.count += amount;
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	160 i++;
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	161 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	162 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	163 else {
63 60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	164 if (b.count <= amount) {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	165 if (b.blocked) {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	166 update(ip, false, 0, NULL, 0, NULL);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	167 changed(con, ip, false);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	168 }
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	169 violations.erase(i++);
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	170 }
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	171 else {
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	172 b.count -= amount;
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	173 i++;
60f59936fabb good authentication prevents ip blocking for awhile Carl Byington <carl@five-ten-sg.com> parents: 59 diff changeset	174 }
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	175 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	176 }
58 b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	177 daily_timer -= amount;
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	178 if (daily_timer < 0) {
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	179 daily_timer = 86400;
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	180 for (ip_buckets::iterator j=repeat_offenders.begin(); j!=repeat_offenders.end(); ) {
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	181 int ip = (*j).first;
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	182 bucket &b = (*j).second;
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	183 b.count = b.count * 2 / 3;
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	184 if (b.count <= 2) {
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	185 repeat_offenders.erase(j++);
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	186 char buf[maxlen];
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	187 in_addr ad;
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	188 ad.s_addr = htonl(ip);
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	189 snprintf(buf, maxlen, "removing %s from repeat offenders", inet_ntoa(ad));
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	190 my_syslog(buf);
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	191 }
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	192 else {
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	193 j++;
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	194 }
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	195 }
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	196 }
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	197 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	198
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	199
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	200 void IPR::free_all(CONTEXT &con) {
37 e4eb969dfc4a shutdown removes iptables entries that we added carl parents: 36 diff changeset	201 if (debug_syslog > 2) {
e4eb969dfc4a shutdown removes iptables entries that we added carl parents: 36 diff changeset	202 my_syslog("syslog2iptables shutting down");
e4eb969dfc4a shutdown removes iptables entries that we added carl parents: 36 diff changeset	203 }
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	204 for (ip_buckets::iterator i=violations.begin(); i!=violations.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	205 int ip = (*i).first;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	206 bucket &b = (*i).second;
58 b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	207 if (b.blocked) {
b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	208 update(ip, false, 0, NULL, 0, NULL);
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	209 changed(con, ip, false);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	210 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	211 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	212 violations.clear();
20 0d65c3de34fd add better logging carl parents: 12 diff changeset	213 }
0d65c3de34fd add better logging carl parents: 12 diff changeset	214
0d65c3de34fd add better logging carl parents: 12 diff changeset	215
58 b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	216 void IPR::update(int ip, bool added, int scale, const char file_name, int pattern_index, const char message) {
76 c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	217 char buf[maxlen];
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	218 in_addr ad;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	219 ad.s_addr = htonl(ip);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	220 if (added) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	221 if (debug_syslog > 2) {
58 b45dddebe8fc Add exponential increase in penalty for repeat offenders Carl Byington <carl@five-ten-sg.com> parents: 51 diff changeset	222 if (message) snprintf(buf, maxlen, "dropping traffic from/to %s based on %s in %s, scale %d", inet_ntoa(ad), message, file_name, scale);
76 c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	223 else snprintf(buf, maxlen, "dropping traffic from/to %s based on pattern match %d in %s, scale %d", inet_ntoa(ad), pattern_index, file_name, scale);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	224 my_syslog(buf);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	225 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	226 ip_buckets::iterator j = repeat_offenders.find(ip);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	227 if (j == repeat_offenders.end()) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	228 bucket b;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	229 b.count = 2;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	230 b.blocked = true; // unused
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	231 b.max_scale = 1; // unused
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	232 repeat_offenders[ip] = b;
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	233 }
76 c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	234 else {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	235 bucket &b = (*j).second;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	236 if (b.count < scale_max) b.count = b.count * 3 / 2;
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	237 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	238 }
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	239 else {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	240 if (debug_syslog > 2) {
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	241 snprintf(buf, maxlen, "allowing traffic from/to %s", inet_ntoa(ad));
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	242 my_syslog(buf);
c6c8a2102a3e add more logging when blocked addresses move to higher scale values Carl Byington <carl@five-ten-sg.com> parents: 69 diff changeset	243 }
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	244 }
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	245 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	246
8fe310e5cd44 initial coding carl parents: 2 diff changeset	247
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	248 void IPR::changed(CONTEXT &con, int ip, bool added) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	249 int t = con.get_threshold();
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	250 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	251 if (added) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	252 bucket &b = violations[ip];
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	253 if (con.looking(ip) && (b.count > t)) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	254 in_addr ad;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	255 ad.s_addr = htonl(ip);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	256 snprintf(buf, maxlen, con.add_command, inet_ntoa(ad));
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	257 system(buf);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	258 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	259 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	260 else {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	261 in_addr ad;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	262 ad.s_addr = htonl(ip);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	263 snprintf(buf, maxlen, con.remove_command, inet_ntoa(ad));
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	264 system(buf);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	265 }
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	266 }
1 551433a01cab initial coding carl parents: diff changeset	267
551433a01cab initial coding carl parents: diff changeset	268
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	269 ////////////////////////////////////////////////
8fe310e5cd44 initial coding carl parents: 2 diff changeset	270 //
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	271 int ip_address(const char *have);
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	272 int ip_address(const char *have) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	273 int ipaddr = 0;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	274 in_addr ip;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	275 if (inet_aton(have, &ip)) ipaddr = ip.s_addr;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	276 else {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	277 struct hostent *host = gethostbyname(have);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	278 if (host && host->h_addrtype == AF_INET) memcpy(&ipaddr, host->h_addr, sizeof(ipaddr));
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	279 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	280 return ntohl(ipaddr);
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	281 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	282
8fe310e5cd44 initial coding carl parents: 2 diff changeset	283
8fe310e5cd44 initial coding carl parents: 2 diff changeset	284 ////////////////////////////////////////////////
8fe310e5cd44 initial coding carl parents: 2 diff changeset	285 //
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	286 PATTERN::PATTERN(TOKEN &tok, const char pattern_, int index_, int amount_, const char msg_) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	287 pattern = pattern_;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	288 index = index_;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	289 amount = amount_;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	290 message = msg_;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	291 if (pattern) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	292 int rc = regcomp(&re, pattern, REG_ICASE \| REG_EXTENDED);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	293 if (rc) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	294 char bu[maxlen];
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	295 regerror(rc, &re, bu, maxlen);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	296 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	297 snprintf(buf, sizeof(buf), "pattern %s not valid - %s", pattern, bu);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	298 tok.token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	299 pattern = NULL;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	300 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	301 }
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	302 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	303
8fe310e5cd44 initial coding carl parents: 2 diff changeset	304
8fe310e5cd44 initial coding carl parents: 2 diff changeset	305 PATTERN::~PATTERN() {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	306 regfree(&re);
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	307 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	308
8fe310e5cd44 initial coding carl parents: 2 diff changeset	309
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	310 bool PATTERN::process(char buf, CONTEXT &con, const char file_name, int pattern_index) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	311 if (pattern) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	312 const int nmatch = index+1;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	313 regmatch_t match[nmatch];
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	314 if (0 == regexec(&re, buf, nmatch, match, 0)) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	315 int s = match[index].rm_so;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	316 int e = match[index].rm_eo;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	317 if (s != -1) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	318 if (debug_syslog > 3) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	319 my_syslog(buf); // show lines with matches
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	320 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	321 buf[e] = '\0';
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	322 int ip = ip_address(buf+s);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	323 if (ip) {
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	324 con.recorder->add(ip, amount, con, file_name, pattern_index, message);
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	325 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	326 return true;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	327 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	328 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	329 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	330 return false;
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	331 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	332
8fe310e5cd44 initial coding carl parents: 2 diff changeset	333
8fe310e5cd44 initial coding carl parents: 2 diff changeset	334 void PATTERN::dump(int level) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	335 char indent[maxlen];
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	336 int i = min(maxlen-1, level*4);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	337 memset(indent, ' ', i);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	338 indent[i] = '\0';
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	339 printf("%s pattern \"%s\" {; \n", indent, pattern);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	340 printf("%s index %d; \n", indent, index);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	341 printf("%s bucket %d; \n", indent, amount);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	342 if (message) printf("%s message \"%s\"; \n", indent, message);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	343 printf("%s }; \n", indent);
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	344 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	345
8fe310e5cd44 initial coding carl parents: 2 diff changeset	346
8fe310e5cd44 initial coding carl parents: 2 diff changeset	347 ////////////////////////////////////////////////
8fe310e5cd44 initial coding carl parents: 2 diff changeset	348 //
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	349 CONTEXT::CONTEXT(const char *nam) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	350 name = nam;
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	351 threshold = 500;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	352 add_command = "/sbin/iptables -I INPUT --src %s --jump DROP";
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	353 remove_command = "/sbin/iptables -D INPUT --src %s --jump DROP";
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	354 recorder = IPR::find(name);
1 551433a01cab initial coding carl parents: diff changeset	355 }
551433a01cab initial coding carl parents: diff changeset	356
551433a01cab initial coding carl parents: diff changeset	357
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	358 ////////////////////////////////////////////////
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	359 //
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	360 CONTEXT::~CONTEXT() {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	361 ignore.clear();
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	362 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	363 SYSLOGCONFIG c = i;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	364 delete c;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	365 }
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	366 IPR::release(name);
1 551433a01cab initial coding carl parents: diff changeset	367 }
551433a01cab initial coding carl parents: diff changeset	368
551433a01cab initial coding carl parents: diff changeset	369
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	370 void CONTEXT::add_syslogconfig(SYSLOGCONFIGP con) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	371 syslogconfigs.push_back(con);
1 551433a01cab initial coding carl parents: diff changeset	372 }
551433a01cab initial coding carl parents: diff changeset	373
551433a01cab initial coding carl parents: diff changeset	374
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	375 void CONTEXT::add_pair(IPPAIR pair) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	376 ignore.push_back(pair);
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	377 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	378
8fe310e5cd44 initial coding carl parents: 2 diff changeset	379
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	380 void CONTEXT::dump() {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	381 string indents(" ");
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	382 const char *indent = indents.c_str();
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	383
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	384 printf("context %s {\n", name);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	385 printf("%s threshold %d; \n\n", indent, threshold);
27 28fec0c67646 make add/remove commands configureable carl parents: 24 diff changeset	386
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	387 printf("%s add_command \"%s\"; \n", indent, add_command);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	388 printf("%s remove_command \"%s\"; \n\n", indent, remove_command);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	389
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	390 printf("%s ignore { \n", indent);
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	391 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	392 IPPAIR &p = *i;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	393 in_addr ip;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	394 ip.s_addr = htonl(p.first);
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	395 printf("%s %s/%d; \n", indent, inet_ntoa(ip), p.cidr);
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	396 }
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	397 printf("%s }; \n\n", indent);
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	398
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	399 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	400 SYSLOGCONFIGP c = *i;
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	401 c->dump(1);
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	402 }
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	403 printf("}; \n\n");
1 551433a01cab initial coding carl parents: diff changeset	404 }
551433a01cab initial coding carl parents: diff changeset	405
551433a01cab initial coding carl parents: diff changeset	406
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	407 void CONTEXT::read(CONFIG &con) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	408 while (true) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	409 bool have = false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	410 for (syslogconfig_list::iterator i=syslogconfigs.begin(); i!=syslogconfigs.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	411 SYSLOGCONFIGP c = *i;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	412 have \|= c->read(*this);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	413 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	414 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	415 }
2 6e88da080f08 initial coding carl parents: 1 diff changeset	416 }
6e88da080f08 initial coding carl parents: 1 diff changeset	417
6e88da080f08 initial coding carl parents: 1 diff changeset	418
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	419 void CONTEXT::free_all() {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	420 recorder->free_all(*this);
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	421 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	422
8fe310e5cd44 initial coding carl parents: 2 diff changeset	423
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	424 void CONTEXT::leak(int delta) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	425 recorder->leak(delta, *this);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	426
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	427 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	428
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	429
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	430 bool CONTEXT::looking(int ip) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	431 for (ippair_list::iterator i=ignore.begin(); i!=ignore.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	432 IPPAIR &p = *i;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	433 if ((p.first <= ip) && (ip <= p.last)) return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	434 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	435 return true;
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	436 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	437
8fe310e5cd44 initial coding carl parents: 2 diff changeset	438 ////////////////////////////////////////////////
8fe310e5cd44 initial coding carl parents: 2 diff changeset	439 //
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	440 CONFIG::CONFIG() {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	441 reference_count = 0;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	442 generation = 0;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	443 load_time = 0;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	444 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	445
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	446
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	447 CONFIG::~CONFIG() {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	448 for (context_list::iterator i=contexts.begin(); i!=contexts.end(); i++) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	449 CONTEXT c = i;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	450 delete c;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	451 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	452 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	453
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	454
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	455 void CONFIG::dump() {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	456 for (context_list::iterator i=contexts.begin(); i!=contexts.end(); i++) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	457 CONTEXTP c = *i;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	458 c->dump();
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	459 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	460 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	461
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	462
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	463 void CONFIG::read() {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	464 for (context_list::iterator i=contexts.begin(); i!=contexts.end(); i++) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	465 CONTEXT c = i;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	466 c->read(*this);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	467 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	468 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	469
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	470
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	471 void CONFIG::sleep(int duration, time_t &previous) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	472 ::sleep(duration);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	473 time_t now = time(NULL);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	474 for (context_list::iterator i=contexts.begin(); i!=contexts.end(); i++) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	475 CONTEXT c = i;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	476 c->leak(now-previous);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	477 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	478 previous = now;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	479 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	480
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	481
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	482 void CONFIG::free_all() {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	483 for (context_list::iterator i=contexts.begin(); i!=contexts.end(); i++) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	484 CONTEXT c = i;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	485 c->free_all();
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	486 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	487 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	488
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	489
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	490 ////////////////////////////////////////////////
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	491 //
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	492 SYSLOGCONFIG::SYSLOGCONFIG(TOKEN &tok, const char *file_name_) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	493 tokp = &tok;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	494 file_name = file_name_;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	495 open(true);
1 551433a01cab initial coding carl parents: diff changeset	496 }
551433a01cab initial coding carl parents: diff changeset	497
551433a01cab initial coding carl parents: diff changeset	498
551433a01cab initial coding carl parents: diff changeset	499 SYSLOGCONFIG::~SYSLOGCONFIG() {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	500 close();
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	501 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	502 PATTERN p = i;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	503 delete p;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	504 }
2 6e88da080f08 initial coding carl parents: 1 diff changeset	505 }
6e88da080f08 initial coding carl parents: 1 diff changeset	506
6e88da080f08 initial coding carl parents: 1 diff changeset	507
4 2737ab01659a initial coding carl parents: 3 diff changeset	508 void SYSLOGCONFIG::open(bool msg) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	509 fd = ::open(file_name, O_RDONLY);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	510 len = 0;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	511 if (fd == -1) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	512 if (msg) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	513 char buf[maxlen];
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	514 snprintf(buf, sizeof(buf), "syslog file %s not readable", file_name);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	515 tokp->token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	516 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	517 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	518 else {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	519 if (debug_syslog > 1) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	520 snprintf(buf, sizeof(buf), "syslog file %s opened", file_name);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	521 my_syslog(buf);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	522 }
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	523 if (msg) lseek(fd, 0, SEEK_END);
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	524 if (fstat(fd, &openfdstat)) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	525 close();
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	526 snprintf(buf, sizeof(buf), "syslog file %s cannot stat after open", file_name);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	527 tokp->token_error(buf);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	528 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	529 // specify that this fd gets closed on exec, so that selinux
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	530 // won't complain about iptables trying to read log files.
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	531 int oldflags = fcntl(fd, F_GETFD, 0);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	532 if (oldflags >= 0) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	533 fcntl(fd, F_SETFD, oldflags \| FD_CLOEXEC);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	534 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	535 }
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	536 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	537
8fe310e5cd44 initial coding carl parents: 2 diff changeset	538
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	539 bool SYSLOGCONFIG::read(CONTEXT &con) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	540 if (failed()) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	541 open(false);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	542 if (failed()) return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	543 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	544 int n = ::read(fd, buf+len, buflen-len);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	545 bool have = (n > 0);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	546 if (have) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	547 len += n;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	548 while (true) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	549 char p = (char)memchr(buf, '\n', len);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	550 if (!p) break;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	551 n = p-buf;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	552 *p = '\0';
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	553 process(con); // process null terminated string
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	554 len -= n+1;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	555 memmove(buf, p+1, len);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	556 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	557 // no <lf> in a full buffer
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	558 if (len == buflen) len = 0;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	559 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	560 else {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	561 // check for file close
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	562 struct stat filenamest;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	563 if (0 == stat(file_name, &filenamest)) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	564 if ((filenamest.st_dev != openfdstat.st_dev) \|\|
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	565 (filenamest.st_ino != openfdstat.st_ino)) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	566 close();
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	567 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	568 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	569 else {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	570 // filename no longer exists
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	571 close();
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	572 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	573 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	574 return have;
2 6e88da080f08 initial coding carl parents: 1 diff changeset	575 }
6e88da080f08 initial coding carl parents: 1 diff changeset	576
6e88da080f08 initial coding carl parents: 1 diff changeset	577
4 2737ab01659a initial coding carl parents: 3 diff changeset	578 void SYSLOGCONFIG::close() {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	579 if (debug_syslog > 1) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	580 snprintf(buf, sizeof(buf), "syslog file %s closed", file_name);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	581 my_syslog(buf);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	582 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	583 if (fd != -1) ::close(fd);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	584 fd = -1;
4 2737ab01659a initial coding carl parents: 3 diff changeset	585 }
2737ab01659a initial coding carl parents: 3 diff changeset	586
2737ab01659a initial coding carl parents: 3 diff changeset	587
2737ab01659a initial coding carl parents: 3 diff changeset	588 void SYSLOGCONFIG::add_pattern(PATTERNP pat) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	589 patterns.push_back(pat);
4 2737ab01659a initial coding carl parents: 3 diff changeset	590 }
2737ab01659a initial coding carl parents: 3 diff changeset	591
2737ab01659a initial coding carl parents: 3 diff changeset	592
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	593 void SYSLOGCONFIG::process(CONTEXT &con) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	594 int pi=0;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	595 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	596 PATTERN p = i;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	597 if (p->process(buf, con, file_name, pi)) break;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	598 pi++;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	599 }
1 551433a01cab initial coding carl parents: diff changeset	600 }
551433a01cab initial coding carl parents: diff changeset	601
551433a01cab initial coding carl parents: diff changeset	602
551433a01cab initial coding carl parents: diff changeset	603 void SYSLOGCONFIG::dump(int level) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	604 char indent[maxlen];
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	605 int i = min(maxlen-1, level*4);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	606 memset(indent, ' ', i);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	607 indent[i] = '\0';
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	608 printf("%s file \"%s\" {\n", indent, file_name);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	609 for (pattern_list::iterator i=patterns.begin(); i!=patterns.end(); i++) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	610 PATTERN p = i;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	611 p->dump(level+1);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	612 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	613 printf("%s }; \n", indent);
1 551433a01cab initial coding carl parents: diff changeset	614 }
551433a01cab initial coding carl parents: diff changeset	615
551433a01cab initial coding carl parents: diff changeset	616
551433a01cab initial coding carl parents: diff changeset	617 ////////////////////////////////////////////////
551433a01cab initial coding carl parents: diff changeset	618 // helper to discard the strings held by a string_set
551433a01cab initial coding carl parents: diff changeset	619 //
551433a01cab initial coding carl parents: diff changeset	620 void discard(string_set &s) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	621 for (string_set::iterator i=s.begin(); i!=s.end(); i++) {
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	622 free((void)i);
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	623 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	624 s.clear();
1 551433a01cab initial coding carl parents: diff changeset	625 }
551433a01cab initial coding carl parents: diff changeset	626
551433a01cab initial coding carl parents: diff changeset	627
551433a01cab initial coding carl parents: diff changeset	628 ////////////////////////////////////////////////
551433a01cab initial coding carl parents: diff changeset	629 // helper to register a string in a string set
551433a01cab initial coding carl parents: diff changeset	630 //
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	631 const char* register_string(string_set &s, const char *name) {
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	632 string_set::const_iterator i = s.find(name);
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	633 if (i != s.end()) return *i;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	634 char *x = strdup(name);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	635 s.insert(x);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	636 return x;
1 551433a01cab initial coding carl parents: diff changeset	637 }
551433a01cab initial coding carl parents: diff changeset	638
551433a01cab initial coding carl parents: diff changeset	639
551433a01cab initial coding carl parents: diff changeset	640 ////////////////////////////////////////////////
551433a01cab initial coding carl parents: diff changeset	641 // register a global string
551433a01cab initial coding carl parents: diff changeset	642 //
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	643 const char* register_string(const char *name) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	644 return register_string(all_strings, name);
1 551433a01cab initial coding carl parents: diff changeset	645 }
551433a01cab initial coding carl parents: diff changeset	646
551433a01cab initial coding carl parents: diff changeset	647
551433a01cab initial coding carl parents: diff changeset	648 ////////////////////////////////////////////////
38 26c29da3fbdf shutdown removes iptables entries that we added carl parents: 37 diff changeset	649 // clear all global strings, helper for valgrind checking
26c29da3fbdf shutdown removes iptables entries that we added carl parents: 37 diff changeset	650 //
26c29da3fbdf shutdown removes iptables entries that we added carl parents: 37 diff changeset	651 void clear_strings() {
26c29da3fbdf shutdown removes iptables entries that we added carl parents: 37 diff changeset	652 discard(all_strings);
26c29da3fbdf shutdown removes iptables entries that we added carl parents: 37 diff changeset	653 }
26c29da3fbdf shutdown removes iptables entries that we added carl parents: 37 diff changeset	654
26c29da3fbdf shutdown removes iptables entries that we added carl parents: 37 diff changeset	655
26c29da3fbdf shutdown removes iptables entries that we added carl parents: 37 diff changeset	656 ////////////////////////////////////////////////
1 551433a01cab initial coding carl parents: diff changeset	657 //
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	658 bool tsa(TOKEN &tok, const char *token);
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	659 bool tsa(TOKEN &tok, const char *token) {
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	660 const char *have = tok.next();
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	661 if (have == token) return true;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	662 tok.token_error(token, have);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	663 return false;
1 551433a01cab initial coding carl parents: diff changeset	664 }
551433a01cab initial coding carl parents: diff changeset	665
551433a01cab initial coding carl parents: diff changeset	666
551433a01cab initial coding carl parents: diff changeset	667 ////////////////////////////////////////////////
551433a01cab initial coding carl parents: diff changeset	668 //
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	669 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con, CONTEXT &me);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	670 bool parse_pattern(TOKEN &tok, SYSLOGCONFIG &con, CONTEXT &me) {
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	671 const char *pat = tok.next();
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	672 int ind = 0;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	673 int buc = 0;
ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	674 const char *msg = NULL;
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	675 if (!tsa(tok, token_lbrace)) return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	676 while (true) {
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	677 const char *have = tok.next();
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	678 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	679 if (have == token_rbrace) break;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	680 if (have == token_index) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	681 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	682 ind = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	683 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	684 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	685 else if (have == token_bucket) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	686 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	687 buc = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	688 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	689 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	690 else if (have == token_message) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	691 msg = tok.next();
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	692 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	693 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	694 else {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	695 tok.token_error("index/bucket", have);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	696 return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	697 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	698 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	699 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	700 PATTERNP patt = new PATTERN(tok, pat, ind, buc, msg);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	701 con.add_pattern(patt);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	702 return true;
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	703 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	704
8fe310e5cd44 initial coding carl parents: 2 diff changeset	705
8fe310e5cd44 initial coding carl parents: 2 diff changeset	706 ////////////////////////////////////////////////
8fe310e5cd44 initial coding carl parents: 2 diff changeset	707 //
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	708 bool parse_ignore(TOKEN &tok, CONFIG &dc, CONTEXT &me);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	709 bool parse_ignore(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	710 if (!tsa(tok, token_lbrace)) return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	711 while (true) {
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	712 const char *have = tok.next();
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	713 if (!have) break;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	714 if (have == token_rbrace) break;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	715 int ipaddr = ip_address(have);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	716 if (ipaddr == 0) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	717 tok.token_error("ip address", have);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	718 return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	719 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	720 if (!tsa(tok, token_slash)) return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	721 have = tok.next();
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	722 int mask = atoi(have);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	723 if ((mask < 8) \|\| (mask > 32)) {
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	724 tok.token_error("cidr 8..32 value", have);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	725 return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	726 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	727 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	728 IPPAIR pair;
59 f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	729 const unsigned int masks[33] = {0xffffffff, // 0
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	730 0x7fffffff, // 1
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	731 0x3fffffff, // 2
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	732 0x1fffffff, // 3
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	733 0x0fffffff, // 4
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	734 0x07ffffff, // 5
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	735 0x03ffffff, // 6
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	736 0x01ffffff, // 7
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	737 0x00ffffff, // 8
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	738 0x007fffff, // 9
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	739 0x003fffff, // 10
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	740 0x001fffff, // 11
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	741 0x000fffff, // 12
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	742 0x0007ffff, // 13
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	743 0x0003ffff, // 14
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	744 0x0001ffff, // 15
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	745 0x0000ffff, // 16
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	746 0x00007fff, // 17
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	747 0x00003fff, // 18
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	748 0x00001fff, // 19
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	749 0x00000fff, // 20
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	750 0x000007ff, // 21
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	751 0x000003ff, // 22
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	752 0x000001ff, // 23
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	753 0x000000ff, // 24
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	754 0x0000007f, // 25
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	755 0x0000003f, // 26
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	756 0x0000001f, // 27
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	757 0x0000000f, // 28
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	758 0x00000007, // 29
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	759 0x00000003, // 30
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	760 0x00000001, // 31
f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	761 0x00000000}; // 32
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	762 pair.first = ipaddr;
59 f133196b8591 fix c++11 compiler warnings Carl Byington <carl@five-ten-sg.com> parents: 58 diff changeset	763 pair.last = ipaddr \| (int)masks[mask];
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	764 pair.cidr = mask;
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	765 me.add_pair(pair);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	766 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	767 if (!tsa(tok, token_semi)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	768 return true;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	769 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	770
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	771
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	772 ////////////////////////////////////////////////
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	773 //
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	774 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc, CONTEXT &me);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	775 bool parse_syslogconfig(TOKEN &tok, CONFIG &dc, CONTEXT &me) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	776 const char *name = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	777 if (!tsa(tok, token_lbrace)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	778 SYSLOGCONFIGP con = new SYSLOGCONFIG(tok, name);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	779 if (con->failed()) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	780 delete con;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	781 return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	782 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	783 me.add_syslogconfig(con);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	784 while (true) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	785 const char *have = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	786 if (!have) break;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	787 if (have == token_rbrace) break;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	788 if (have == token_pattern) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	789 if (!parse_pattern(tok, *con, me)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	790 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	791 else {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	792 tok.token_error("pattern", have);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	793 return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	794 }
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	795 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	796 if (!tsa(tok, token_semi)) return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	797 return true;
3 8fe310e5cd44 initial coding carl parents: 2 diff changeset	798 }
8fe310e5cd44 initial coding carl parents: 2 diff changeset	799
8fe310e5cd44 initial coding carl parents: 2 diff changeset	800
8fe310e5cd44 initial coding carl parents: 2 diff changeset	801 ////////////////////////////////////////////////
8fe310e5cd44 initial coding carl parents: 2 diff changeset	802 //
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	803 bool parse_context(TOKEN &tok, CONFIG &dc, CONTEXTP parent);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	804 bool parse_context(TOKEN &tok, CONFIG &dc, CONTEXTP parent) {
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	805 const char *name = tok.next();
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	806 if (!tsa(tok, token_lbrace)) return false;
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	807 CONTEXTP con = new CONTEXT(name);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	808
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	809 while (true) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	810 const char *have = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	811 if (!have) break;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	812 if (have == token_rbrace) break; // done
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	813 if (have == token_threshold) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	814 have = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	815 con->set_threshold(atoi(have));
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	816 if (!tsa(tok, token_semi)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	817 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	818 else if (have == token_ignore) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	819 if (!parse_ignore(tok, dc, *con)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	820 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	821 else if (have == token_add) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	822 have = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	823 con->set_add(have);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	824 if (!tsa(tok, token_semi)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	825 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	826 else if (have == token_remove) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	827 have = tok.next();
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	828 con->set_remove(have);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	829 if (!tsa(tok, token_semi)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	830 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	831 else if (have == token_file) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	832 if (!parse_syslogconfig(tok, dc, *con)) return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	833 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	834 else {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	835 tok.token_error("threshold/ignore/add_command/remove_command/file", have);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	836 return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	837 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	838 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	839 if (!tsa(tok, token_semi)) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	840 delete con;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	841 return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	842 }
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	843 dc.add_context(con);
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	844 return true;
1 551433a01cab initial coding carl parents: diff changeset	845 }
551433a01cab initial coding carl parents: diff changeset	846
551433a01cab initial coding carl parents: diff changeset	847
551433a01cab initial coding carl parents: diff changeset	848 ////////////////////////////////////////////////
551433a01cab initial coding carl parents: diff changeset	849 // parse a config file
551433a01cab initial coding carl parents: diff changeset	850 //
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	851 bool load_conf(CONFIG &dc, const char *fn) {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	852 int count = 0;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	853 TOKEN tok(fn, &dc.config_files);
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	854 while (true) {
48 ba0259c9e411 Fixes to compile on Fedora 9 and for const correctness Carl Byington <carl@five-ten-sg.com> parents: 42 diff changeset	855 const char *have = tok.next();
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	856 if (!have) break;
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	857 if (have == token_context) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	858 if (!parse_context(tok, dc, NULL)) {
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	859 tok.token_error("load_conf() failed to parse context");
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	860 return false;
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	861 }
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	862 else count++;
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	863 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	864 else {
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	865 tok.token_error(token_context, have);
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	866 return false;
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	867 }
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	868 }
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	869 tok.token_error("load_conf() found %d contexts in %s", count, fn);
206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	870 return (!dc.contexts.empty());
1 551433a01cab initial coding carl parents: diff changeset	871 }
551433a01cab initial coding carl parents: diff changeset	872
551433a01cab initial coding carl parents: diff changeset	873
551433a01cab initial coding carl parents: diff changeset	874 ////////////////////////////////////////////////
551433a01cab initial coding carl parents: diff changeset	875 // init the tokens
551433a01cab initial coding carl parents: diff changeset	876 //
551433a01cab initial coding carl parents: diff changeset	877 void token_init() {
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	878 token_add = register_string("add_command");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	879 token_bucket = register_string("bucket");
51 206448c00b55 Allow multiple contexts with independent add/remove commands. Carl Byington <carl@five-ten-sg.com> parents: 48 diff changeset	880 token_context = register_string("context");
36 6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	881 token_file = register_string("file");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	882 token_ignore = register_string("ignore");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	883 token_include = register_string("include");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	884 token_index = register_string("index");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	885 token_lbrace = register_string("{");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	886 token_message = register_string("message");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	887 token_pattern = register_string("pattern");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	888 token_rbrace = register_string("}");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	889 token_remove = register_string("remove_command");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	890 token_semi = register_string(";");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	891 token_slash = register_string("/");
6a2f26976898 shutdown removes iptables entries that we added carl parents: 35 diff changeset	892 token_threshold = register_string("threshold");
1 551433a01cab initial coding carl parents: diff changeset	893 }

Mercurial > syslog2iptables

annotate src/syslogconfig.cpp @ 76:c6c8a2102a3e