|
1
|
1 /***************************************************************************
|
|
|
2 * Copyright (C) 2005 by 510 Software Group *
|
|
|
3 * *
|
|
|
4 * *
|
|
|
5 * This program is free software; you can redistribute it and/or modify *
|
|
|
6 * it under the terms of the GNU General Public License as published by *
|
|
|
7 * the Free Software Foundation; either version 2 of the License, or *
|
|
|
8 * (at your option) any later version. *
|
|
|
9 * *
|
|
|
10 * This program is distributed in the hope that it will be useful, *
|
|
|
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
|
|
|
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
|
|
|
13 * GNU General Public License for more details. *
|
|
|
14 * *
|
|
|
15 * You should have received a copy of the GNU General Public License *
|
|
|
16 * along with this program; if not, write to the *
|
|
|
17 * Free Software Foundation, Inc., *
|
|
|
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
|
|
|
19 ***************************************************************************/
|
|
|
20
|
|
|
21
|
|
|
22 class SYSLOGCONFIG;
|
|
3
|
23 class CONFIG;
|
|
|
24
|
|
|
25 struct IPPAIR {
|
|
|
26 int first;
|
|
|
27 int last;
|
|
|
28 int cidr;
|
|
|
29 };
|
|
|
30
|
|
|
31 class PATTERN {
|
|
|
32 char * pattern; // owned by the string table
|
|
|
33 regex_t re;
|
|
|
34 int index; // zero based substring of the regex match that contains the ip address or hostname
|
|
4
|
35 int amount; // count to add to the ip address leaky bucket
|
|
3
|
36 public:
|
|
|
37 ~PATTERN();
|
|
4
|
38 PATTERN(TOKEN &tok, char *pattern_, int index_, int amount_);
|
|
20
|
39 bool process(char *buf, CONFIG &con, char *file_name, int pattern_index);
|
|
3
|
40 void dump(int level);
|
|
|
41 };
|
|
1
|
42
|
|
|
43 typedef SYSLOGCONFIG * SYSLOGCONFIGP;
|
|
3
|
44 typedef PATTERN * PATTERNP;
|
|
1
|
45 typedef list<SYSLOGCONFIGP> syslogconfig_list;
|
|
3
|
46 typedef list<IPPAIR> ippair_list;
|
|
|
47 typedef list<PATTERNP> pattern_list;
|
|
2
|
48 const int buflen = 1024;
|
|
1
|
49
|
|
|
50 class SYSLOGCONFIG {
|
|
4
|
51 TOKEN * tokp;
|
|
1
|
52 char * file_name; // name of the syslog file
|
|
3
|
53 pattern_list patterns; // owns the patterns
|
|
2
|
54 int fd;
|
|
4
|
55 struct stat openfdstat;
|
|
2
|
56 int len; // bytes in the buffer
|
|
|
57 char buf[buflen];
|
|
1
|
58 public:
|
|
3
|
59 SYSLOGCONFIG(TOKEN &tok, char *file_name_);
|
|
1
|
60 ~SYSLOGCONFIG();
|
|
4
|
61 bool failed() { return (fd == -1); };
|
|
|
62 void open(bool msg);
|
|
|
63 bool read(CONFIG &con);
|
|
|
64 void close();
|
|
3
|
65 void add_pattern(PATTERNP pat);
|
|
|
66 void process(CONFIG &con);
|
|
1
|
67 void dump(int level);
|
|
|
68 };
|
|
|
69
|
|
3
|
70 class CONFIG {
|
|
|
71 public:
|
|
1
|
72 // the only mutable stuff once it has been loaded from the config file
|
|
|
73 int reference_count; // protected by the global config_mutex
|
|
|
74 // all the rest is constant after loading from the config file
|
|
|
75 int generation;
|
|
|
76 time_t load_time;
|
|
|
77 string_set config_files;
|
|
3
|
78 int threshold;
|
|
|
79 ippair_list ignore; // owns all the ippairs
|
|
27
|
80 char * add_command; // owned by the string table
|
|
|
81 char * remove_command; // ""
|
|
3
|
82 syslogconfig_list syslogconfigs; // owns all the syslogconfigs
|
|
1
|
83
|
|
|
84 CONFIG();
|
|
|
85 ~CONFIG();
|
|
27
|
86 void set_add(char *add) { add_command = add; };
|
|
|
87 void set_remove(char *remove) { remove_command = remove; };
|
|
|
88 void set_threshold(int threshold_) { threshold = threshold_; };
|
|
|
89 int get_threshold() { return threshold; };
|
|
2
|
90 void add_syslogconfig(SYSLOGCONFIGP con);
|
|
3
|
91 void add_pair(IPPAIR pair);
|
|
2
|
92 void dump();
|
|
|
93 void read();
|
|
4
|
94 void sleep(int duration, time_t &previous);
|
|
3
|
95 bool looking(int ip);
|
|
1
|
96 };
|
|
|
97
|
|
|
98 void discard(string_set &s);
|
|
|
99 char* register_string(string_set &s, char *name);
|
|
|
100 char* register_string(char *name);
|
|
3
|
101 int ip_address(char *have);
|
|
1
|
102 bool load_conf(CONFIG &dc, char *fn);
|
|
|
103 void token_init();
|
|
|
104
|
|
27
|
105 extern char *token_add;
|
|
3
|
106 extern char *token_bucket;
|
|
1
|
107 extern char *token_file;
|
|
3
|
108 extern char *token_ignore;
|
|
1
|
109 extern char *token_include;
|
|
3
|
110 extern char *token_index;
|
|
1
|
111 extern char *token_lbrace;
|
|
3
|
112 extern char *token_pattern;
|
|
1
|
113 extern char *token_rbrace;
|
|
27
|
114 extern char *token_remove;
|
|
1
|
115 extern char *token_semi;
|
|
3
|
116 extern char *token_slash;
|
|
|
117 extern char *token_threshold;
|
|
1
|
118
|
