|
1
|
1 /***************************************************************************
|
|
|
2 * Copyright (C) 2005 by 510 Software Group *
|
|
|
3 * *
|
|
|
4 * *
|
|
|
5 * This program is free software; you can redistribute it and/or modify *
|
|
|
6 * it under the terms of the GNU General Public License as published by *
|
|
|
7 * the Free Software Foundation; either version 2 of the License, or *
|
|
|
8 * (at your option) any later version. *
|
|
|
9 * *
|
|
|
10 * This program is distributed in the hope that it will be useful, *
|
|
|
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
|
|
|
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
|
|
|
13 * GNU General Public License for more details. *
|
|
|
14 * *
|
|
|
15 * You should have received a copy of the GNU General Public License *
|
|
|
16 * along with this program; if not, write to the *
|
|
|
17 * Free Software Foundation, Inc., *
|
|
|
18 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
|
|
|
19 ***************************************************************************/
|
|
|
20
|
|
|
21
|
|
|
22 class SYSLOGCONFIG;
|
|
3
|
23 class CONFIG;
|
|
|
24
|
|
|
25 struct IPPAIR {
|
|
|
26 int first;
|
|
|
27 int last;
|
|
|
28 int cidr;
|
|
|
29 };
|
|
|
30
|
|
|
31 class PATTERN {
|
|
|
32 char * pattern; // owned by the string table
|
|
|
33 regex_t re;
|
|
|
34 int index; // zero based substring of the regex match that contains the ip address or hostname
|
|
4
|
35 int amount; // count to add to the ip address leaky bucket
|
|
35
|
36 char * message; // for logging, owned by the string table
|
|
3
|
37 public:
|
|
|
38 ~PATTERN();
|
|
35
|
39 PATTERN(TOKEN &tok, char *pattern_, int index_, int amount_, char *msg_);
|
|
20
|
40 bool process(char *buf, CONFIG &con, char *file_name, int pattern_index);
|
|
3
|
41 void dump(int level);
|
|
|
42 };
|
|
1
|
43
|
|
|
44 typedef SYSLOGCONFIG * SYSLOGCONFIGP;
|
|
3
|
45 typedef PATTERN * PATTERNP;
|
|
1
|
46 typedef list<SYSLOGCONFIGP> syslogconfig_list;
|
|
3
|
47 typedef list<IPPAIR> ippair_list;
|
|
|
48 typedef list<PATTERNP> pattern_list;
|
|
2
|
49 const int buflen = 1024;
|
|
1
|
50
|
|
|
51 class SYSLOGCONFIG {
|
|
4
|
52 TOKEN * tokp;
|
|
1
|
53 char * file_name; // name of the syslog file
|
|
3
|
54 pattern_list patterns; // owns the patterns
|
|
2
|
55 int fd;
|
|
4
|
56 struct stat openfdstat;
|
|
2
|
57 int len; // bytes in the buffer
|
|
|
58 char buf[buflen];
|
|
1
|
59 public:
|
|
3
|
60 SYSLOGCONFIG(TOKEN &tok, char *file_name_);
|
|
1
|
61 ~SYSLOGCONFIG();
|
|
4
|
62 bool failed() { return (fd == -1); };
|
|
|
63 void open(bool msg);
|
|
|
64 bool read(CONFIG &con);
|
|
|
65 void close();
|
|
3
|
66 void add_pattern(PATTERNP pat);
|
|
|
67 void process(CONFIG &con);
|
|
1
|
68 void dump(int level);
|
|
|
69 };
|
|
|
70
|
|
3
|
71 class CONFIG {
|
|
|
72 public:
|
|
1
|
73 // the only mutable stuff once it has been loaded from the config file
|
|
|
74 int reference_count; // protected by the global config_mutex
|
|
|
75 // all the rest is constant after loading from the config file
|
|
|
76 int generation;
|
|
|
77 time_t load_time;
|
|
|
78 string_set config_files;
|
|
3
|
79 int threshold;
|
|
|
80 ippair_list ignore; // owns all the ippairs
|
|
27
|
81 char * add_command; // owned by the string table
|
|
|
82 char * remove_command; // ""
|
|
3
|
83 syslogconfig_list syslogconfigs; // owns all the syslogconfigs
|
|
1
|
84
|
|
|
85 CONFIG();
|
|
|
86 ~CONFIG();
|
|
27
|
87 void set_add(char *add) { add_command = add; };
|
|
|
88 void set_remove(char *remove) { remove_command = remove; };
|
|
|
89 void set_threshold(int threshold_) { threshold = threshold_; };
|
|
|
90 int get_threshold() { return threshold; };
|
|
2
|
91 void add_syslogconfig(SYSLOGCONFIGP con);
|
|
3
|
92 void add_pair(IPPAIR pair);
|
|
2
|
93 void dump();
|
|
|
94 void read();
|
|
4
|
95 void sleep(int duration, time_t &previous);
|
|
3
|
96 bool looking(int ip);
|
|
1
|
97 };
|
|
|
98
|
|
|
99 void discard(string_set &s);
|
|
|
100 char* register_string(string_set &s, char *name);
|
|
|
101 char* register_string(char *name);
|
|
3
|
102 int ip_address(char *have);
|
|
1
|
103 bool load_conf(CONFIG &dc, char *fn);
|
|
|
104 void token_init();
|
|
|
105
|
|
27
|
106 extern char *token_add;
|
|
3
|
107 extern char *token_bucket;
|
|
1
|
108 extern char *token_file;
|
|
3
|
109 extern char *token_ignore;
|
|
1
|
110 extern char *token_include;
|
|
3
|
111 extern char *token_index;
|
|
1
|
112 extern char *token_lbrace;
|
|
3
|
113 extern char *token_pattern;
|
|
1
|
114 extern char *token_rbrace;
|
|
27
|
115 extern char *token_remove;
|
|
1
|
116 extern char *token_semi;
|
|
3
|
117 extern char *token_slash;
|
|
|
118 extern char *token_threshold;
|
|
1
|
119
|
