Changeset 185 for trunk/src

Timestamp:

Oct 29, 2008, 8:59:18 PM (16 years ago)

Author:

katerina

Message:

Bugfixes for log monitoring, samba logfile parser.

Location:

trunk/src

Files:

• sh_cat.c (modified) (2 diffs)
• sh_hash.c (modified) (9 diffs)
• sh_log_check.c (modified) (5 diffs)
• sh_log_evalrule.c (modified) (14 diffs)
• sh_log_parse_apache.c (modified) (8 diffs)
• sh_log_parse_pacct.c (modified) (1 diff)
• sh_log_parse_samba.c (added)
• sh_string.c (modified) (1 diff)
• sh_unix.c (modified) (2 diffs)
• sh_utils.c (modified) (2 diffs)

trunk/src/sh_cat.c

@@ -272 +272 @@
   { MSG_E_ACCESS,    SH_ERR_ERR,     ERR,   N_("msg=\"File not accessible\" userid=\"%ld\" path=\"%s\"")},
   { MSG_E_READ,      SH_ERR_ERR,     ERR,   N_("msg=\"Not accessible or not a regular file\" path=\"%s\"")},
+  { MSG_E_NOTREG,    SH_ERR_ERR,     ERR,   N_("msg=\"Not a regular file\" path=\"%s\"")},
   { MSG_E_TIMEOUT,   SH_ERR_ERR,     ERR,   N_("msg=\"Timeout (%d sec) while checksumming file\" path=\"%s\"")},
   { MSG_NODEV,       SH_ERR_ERR,     ERR,   N_("msg=\"Device not available or timeout during read attempt\" userid=\"%ld\" path=\"%s\"")},
@@ -599 +600 @@
   { MSG_E_ACCESS,    SH_ERR_ERR,     ERR,   N_("msg=<File not accessible>, userid=<%ld>, path=<%s>")},
   { MSG_E_READ,      SH_ERR_ERR,     ERR,   N_("msg=<Not accessible or not a regular file>, path=<%s>")},
+  { MSG_E_NOTREG,    SH_ERR_ERR,     ERR,   N_("msg=<Not a regular file>, path=<%s>")},
   { MSG_E_TIMEOUT,   SH_ERR_ERR,     ERR,   N_("msg=<Timeout (%d sec) while checksumming file>, path=<%s>")},
   { MSG_NODEV,       SH_ERR_ERR,     ERR,   N_("msg=<Device not available or timeout during read attempt>, userid=<%ld>, path=<%s>")},

trunk/src/sh_hash.c

@@ -1139 +1139 @@
   char hashbuf[KEYBUF_SIZE];
 
+  int  retval  = 0;
+  int  exitval = EXIT_SUCCESS;
+
   SL_ENTER(_("sh_hash_init"));
 
@@ -1170 +1173 @@
           sh_error_handle ((-1), FIL__, __LINE__, fd, MSG_EXIT_ABORT1, 
                            sh.prg_name);
-          aud_exit (FIL__, __LINE__, EXIT_FAILURE);
+          retval = 1; exitval = EXIT_FAILURE;
+          goto unlock_and_return;
         }
       sl_rewind (fd);
@@ -1196 +1200 @@
             sh_error_handle ((-1), FIL__, __LINE__, fd, MSG_EXIT_ABORT1, 
                              sh.prg_name);
-            aud_exit (FIL__, __LINE__, EXIT_FAILURE);
+            retval = 1; exitval = EXIT_FAILURE;
+            goto unlock_and_return;
           }
         
@@ -1216 +1221 @@
                                file_path('D', 'R') )
                              );
-            aud_exit (FIL__, __LINE__, EXIT_FAILURE);
+            retval = 1; exitval = EXIT_FAILURE;
+            goto unlock_and_return;
           }
         sl_rewind (fd);
@@ -1226 +1232 @@
       TPT((0, FIL__, __LINE__, _("msg=<Terminate.>\n")));
       --sig_raised; --sig_urgent;
-      aud_exit (FIL__, __LINE__, EXIT_SUCCESS);
+      retval = 1; exitval = EXIT_SUCCESS;
+      goto unlock_and_return;
     }
 
@@ -1251 +1258 @@
           TPT((0, FIL__, __LINE__, _("msg=<Terminate.>\n")));
           --sig_raised; --sig_urgent;
-          aud_exit (FIL__, __LINE__, EXIT_SUCCESS);
+          retval = 1; exitval = EXIT_SUCCESS;
+          goto unlock_and_return;
         }
 
@@ -1307 +1315 @@
   if (0 != sh_gpg_check_sign (0, fd, 2))
     {
-      aud_exit (FIL__, __LINE__, EXIT_FAILURE);
+      retval = 1; exitval = EXIT_FAILURE;
+      goto unlock_and_return;
     }
   sl_rewind (fd);
@@ -1328 +1337 @@
           TPT((0, FIL__, __LINE__, _("msg=<Terminate.>\n")));
           --sig_raised; --sig_urgent;
-          aud_exit (FIL__, __LINE__, EXIT_SUCCESS);
+          retval = 1; exitval = EXIT_SUCCESS;
+          goto unlock_and_return;
         }
 
@@ -1357 +1367 @@
   ; /* 'label at end of compound statement */
   SH_MUTEX_UNLOCK(mutex_hash);
-  SL_RET0(_("sh_hash_init"));
+  if (retval == 0)
+    {
+      SL_RET0(_("sh_hash_init"));
+    }
+  aud_exit (FIL__, __LINE__, exitval);
 }
   

trunk/src/sh_log_check.c

@@ -29 +29 @@
  */
 struct sh_logfile_type sh_logtypes_def[] = {
-    {  "SYSLOG", NULL,          sh_parse_syslog, NULL },
-    {  "APACHE", NULL,          sh_parse_apache, sh_eval_fileinfo_apache },
+    {  "SYSLOG", NULL,            sh_parse_syslog, NULL },
+    {  "SAMBA",  sh_read_samba,   sh_parse_samba,  NULL },
+    {  "APACHE", NULL,            sh_parse_apache, sh_eval_fileinfo_apache },
 #if defined(HAVE_SYS_ACCT_H)
-    {  "PACCT",  sh_read_pacct, sh_parse_pacct,  NULL },
+    {  "PACCT",  sh_read_pacct,   sh_parse_pacct,  NULL },
 #endif
 };
@@ -369 +370 @@
               {
                 logrecord->filename = thisfile->filename;
-
-                sh_eval_process_msg(logrecord);
+                
+                /* Don't report if 'init', just set file pointer
+                 */
+                if (sh.flag.checkSum != SH_CHECK_INIT)
+                  {
+                    sh_eval_process_msg(logrecord);
+                  }
 
                 if (logrecord->message) 
@@ -378 +384 @@
                 if (logrecord->prefix)
                   sh_string_destroy(&(logrecord->prefix));
+                if (logrecord->timestr)
+                  sh_string_destroy(&(logrecord->timestr));
                 SH_FREE(logrecord);
               }
@@ -383 +391 @@
         else
           {
-            (void) sh_string_truncate(record, 0);
+            record = sh_string_new(0);
             break;
           }
@@ -617 +625 @@
           return NULL;
         }
+      return s;
+    }
+
+  if (0 != sh_open_for_reader(logfile))
+    goto start_read;
+
+  return NULL;
+}
+
+/******************************************************
+ *  Reader for continued text files 
+ */
+sh_string * sh_cont_reader (sh_string * s, struct sh_logfile * logfile, char*cont)
+{
+  int         status;
+  char      * tmp;
+  sh_string * str;
+  int         remain = 8192;
+  int         count  = 0;
+
+  if (!sh_string_truncate(s, 0))
+    return NULL;
+
+ start_read:
+
+  if (logfile->fp)
+    {
+      str = sh_string_new(0);
+
+      /* Result cannot be larger than 8192, thus cast is ok
+       */
+      status = (int) sh_string_read(str, logfile->fp, 8192);
+
+      if (status > 0)
+        {
+          
+          do {
+            s       = sh_string_add (s, str);
+            count  += status;
+            remain -= status;
+
+            if (remain <= 0)
+              {
+                return s;
+              }
+
+            status = (int) sh_string_read_cont(str, logfile->fp, count, cont);
+
+            if (status == 0)
+              {
+                return s;
+              }
+          }
+          while (status > 0);
+        }
+
+      if (status <= 0)
+        {
+          fgetpos(logfile->fp, &(logfile->offset));
+          fclose(logfile->fp);
+          logfile->fp = NULL;
+          sh_string_destroy(&s);
+          if (status == 0)
+            {
+              return NULL;
+            }
+
+          SH_MUTEX_LOCK(mutex_thread_nolog);
+          tmp = sh_util_safe_name (logfile->filename);
+          sh_error_handle((-1), FIL__, __LINE__, 0, MSG_LOGMON_EREAD,
+                          tmp);
+          SH_FREE(tmp);
+          SH_MUTEX_UNLOCK(mutex_thread_nolog);
+
+          return NULL;
+        }
+
       return s;
     }

trunk/src/sh_log_evalrule.c

@@ -170 +170 @@
   ng->rule_extra  = group_extra;
   ng->ovector     = NULL;
+  ng->ovecnum     = 0;
   ng->captures    = 0;
   ng->counterlist = NULL;
   ng->queue       = NULL;
   ng->nextrule    = NULL;
-
-  /* 
-   * Insert at end, to keep user-defined order 
-   */ 
-  ng->next   = NULL;
-  if (grouplist) 
-    {
-      tmp = grouplist; 
-      while (tmp->next != NULL) { tmp = tmp->next; }
-      tmp->next = ng;
-    } else {
-      grouplist = ng;
-    }
+  ng->next        = NULL;
 
   if (!host_open)
@@ -202 +191 @@
 
   /* 
-   * If there is an open host group, add it to its
-   * rulegroups
-   */
+   * Insert at end, to keep user-defined order 
+   */ 
+
   if (host_open)
     {
+      if (grouplist) 
+        {
+          tmp = grouplist; 
+          while (tmp->next != NULL) { tmp = tmp->next; }
+          tmp->next = ng;
+        } else {
+          grouplist = ng;
+        }
+
+
+      /* 
+       * If there is an open host group, add it to its
+       * rulegroups
+       */
+
       if (host_open->rulegroups) 
         {
@@ -214 +218 @@
         } else {
           host_open->rulegroups = ng;
-        }
+        }
     }
 
@@ -427 +431 @@
   nr->captures    = captures;
   nr->ovector     = SH_ALLOC(sizeof(int) * (captures+1) * 3);
+  nr->ovecnum     = 0;
   nr->counterlist = NULL;
   nr->queue       = queue;
@@ -441 +446 @@
         {
           tmp = group_open->nextrule; 
-          while (tmp->next != NULL) { tmp = tmp->next; }
-          tmp->next = nr;
+          while (tmp->nextrule != NULL) { tmp = tmp->nextrule; } /* next -> nextrule */
+          tmp->nextrule = nr;                                    /* next -> nextrule */
         } else {
           group_open->nextrule = nr;
@@ -454 +459 @@
   else
     {
-      /* 
-       * Add rule as member to grouplist, to facilitate cleanup
-       */
-      if (grouplist) 
-        {
-          tmp = grouplist; 
-          while (tmp->next != NULL) { tmp = tmp->next; }
-          tmp->next = nr;
-        } else {
-          grouplist = nr;
-        }
-
       if (!host_open)
         {
           if (0 != sh_eval_hadd("^.*"))
             {
+              SH_FREE(nr->ovector);
               SH_FREE(nr);
               return -1;
@@ -475 +469 @@
         }
 
-      /* 
-       * Add rule to host rulegroups
-       */
       if (host_open)
         {
+          /* 
+           * Add rule as member to grouplist, to facilitate cleanup
+           */
+#if 0
+          if (grouplist) 
+            {
+              tmp = grouplist; 
+              while (tmp->next != NULL) { tmp = tmp->next; }
+              tmp->next = nr;
+            } else {
+              grouplist = nr;
+            }
+#endif
+
+          /* 
+           * Add rule to host rulegroups
+           */
           if (host_open->rulegroups) 
             {
@@ -488 +496 @@
               while (tmp->nextrule != NULL) { tmp = tmp->nextrule; }
               tmp->nextrule = nr;
-            } else {
+            } 
+          else 
+            {
               /* First rule goes to host_open->rulegroups */
               host_open->rulegroups = nr;
@@ -495 +505 @@
       else
         {
+          SH_FREE(nr->ovector);
           SH_FREE(nr);
           return -1;
@@ -505 +516 @@
 void sh_eval_cleanup()
 {
-  struct sh_geval * nr;
   struct sh_geval * tmp;
 
@@ -512 +522 @@
   struct sh_heval * htmp;
 
-  gtmp = grouplist;
-  while (gtmp)
-    {
+  while (grouplist)
+    {
+      gtmp      = grouplist;
+      grouplist = gtmp->next;
+
       if (gtmp->label)      sh_string_destroy(&(gtmp->label));
       if (gtmp->rule_extra) (*pcre_free)(gtmp->rule_extra);
@@ -522 +534 @@
       if (gtmp->ovector)
         SH_FREE(gtmp->ovector);
-      if (gtmp->nextrule)
-        {
-          tmp = gtmp->nextrule;
-          do {
-            nr  = tmp->nextrule;
-            if (tmp->rule_extra) (*pcre_free)(tmp->rule_extra);
-            if (tmp->rule)       (*pcre_free)(tmp->rule);
-            if (tmp->counterlist)
-              zAVLFreeTree(tmp->counterlist, sh_ceval_free);
-            if (tmp->ovector)
-              SH_FREE(tmp->ovector);
-            SH_FREE(tmp);
-            tmp = nr;
-          } while (tmp);
-        }
-      grouplist = gtmp->next;
+
+      while (gtmp->nextrule)
+        {
+          tmp            = gtmp->nextrule;
+          gtmp->nextrule = tmp->nextrule;
+
+          if (tmp->rule_extra) (*pcre_free)(tmp->rule_extra);
+          if (tmp->rule)       (*pcre_free)(tmp->rule);
+          if (tmp->counterlist)
+            zAVLFreeTree(tmp->counterlist, sh_ceval_free);
+          if (tmp->ovector)
+            SH_FREE(tmp->ovector);
+          SH_FREE(tmp);
+        }
+
       SH_FREE(gtmp);
-      gtmp = grouplist;
     }
 
@@ -678 +688 @@
   SH_MUTEX_LOCK(mutex_thread_nolog);
   tmp = sh_util_safe_name (record->filename);
-  msg = sh_util_safe_name (sh_string_str(record->message));
-  ttt = sh_util_safe_name (sh_string_str(record->timestr));
+  msg = sh_util_safe_name_keepspace (sh_string_str(record->message));
+  ttt = sh_util_safe_name_keepspace (sh_string_str(record->timestr));
   sh_error_handle (severity, FIL__, __LINE__, 0, MSG_LOGMON_REP,
                    msg,
@@ -697 +707 @@
   SH_MUTEX_LOCK(mutex_thread_nolog);
   tmp = sh_util_safe_name (sh_string_str(path));
-  msg = sh_util_safe_name (sh_string_str(message));
+  msg = sh_util_safe_name_keepspace (sh_string_str(message));
   sh_error_handle (severity, FIL__, __LINE__, 0, MSG_LOGMON_SUM,
                    msg,

trunk/src/sh_log_parse_apache.c

@@ -47 +47 @@
   int    pos_status;
   int    pos_time;
+  int    format_time;
 };
 
+static const char lf_error0[]    = N_("%error");
 static const char lf_common0[]   = N_("%h %l %u %t \"%r\" %>s %b");
 static const char lf_combined0[] = N_("%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"");
@@ -73 +75 @@
   volatile int          p_status = -1;
   volatile int          p_time = -1;
+  volatile int          f_time = -1;
   const char * error;
   int          erroffset;
@@ -89 +92 @@
       new    = sh_util_strdup(_(lf_combined0));
     }
+  else if (0 == strncmp("error", str, 8))
+    {
+      new    = sh_util_strdup(_(lf_error0));
+    }
   else
     {
@@ -156 +163 @@
           sh_string_add_from_char(re_string, p);
           p_time = i+1;
+          f_time = 1;
+        }
+      else if (token[0] == '%' && token[1] == 'e' && 0 == strcmp(token, _("%error"))) 
+        {
+          p = _("\\[([^\\]]+)\\]");
+          sh_string_add_from_char(re_string, p);
+          p_time = i+1; f_time = 2; ++i;
+
+          sh_string_add_from_char(re_string, " ");
+          p = _("\\[([^\\]]+)\\]");
+          sh_string_add_from_char(re_string, p);
+          p_status = i+1;
+
+          sh_string_add_from_char(re_string, " ");
+          p = _("(.*)");
+          sh_string_add_from_char(re_string, p);
+
+          break;
         }
       else
@@ -208 +233 @@
   result->pos_status    = p_status;
   result->pos_time      = p_time;
+  result->format_time   = f_time;
 
   SH_FREE(splits);
@@ -262 +288 @@
           res = 0;
           timestamp = 0;
+          info->format_time = 1;
           sl_strlcpy(tstr, _("01/Jan/1970:00:00:00"), sizeof(tstr));
         }
@@ -268 +295 @@
         {
           struct tm btime;
-          char * ptr, * q;
+          char * ptr = NULL, * q;
           
           /* example: 01/Jun/2008:07:55:28 +0200 */
 
-          q = strchr(tstr, ' ');
-          if (q) *q = '\0';
-
-          ptr = /*@i@*/strptime(tstr, "%d/%b/%Y:%T", &btime);
+          if (info->format_time == 1)
+            {
+              q = strchr(tstr, ' ');
+              if (q) *q = '\0';
+              
+              ptr = /*@i@*/strptime(tstr, "%d/%b/%Y:%T", &btime);
+            }
+          else if (info->format_time == 2)
+            {
+              ptr = /*@i@*/strptime(tstr, "%a %b %d %T %Y", &btime);
+            }
+
           if (ptr && *ptr == '\0')
             {
@@ -294 +329 @@
       else
         {
-          sl_strlcpy(sstr, _("000"), sizeof(sstr)); /* FIXME API */
+          sl_strlcpy(sstr, _("000"), sizeof(sstr));
         }
 

trunk/src/sh_log_parse_pacct.c

@@ -277 +277 @@
     }
 
+  if (record)
+    sh_string_destroy(&record);
   return NULL;
 }

trunk/src/sh_string.c

@@ -204 +204 @@
 #define SH_STRING_PARCEL 120
 
+static
+size_t sh_string_read_int(sh_string * s, FILE * fp, size_t maxlen, char *start);
+
 size_t sh_string_read(sh_string * s, FILE * fp, size_t maxlen)
 {
+  return sh_string_read_int(s, fp, maxlen, NULL);
+}
+
+size_t sh_string_read_cont(sh_string * s, FILE * fp, size_t maxlen, char *cont)
+{
+  return sh_string_read_int(s, fp, maxlen, cont);
+}
+
+size_t sh_string_read_int(sh_string * s, FILE * fp, size_t maxlen, char *start)
+{
+
+  /* case 0) start != NULL and first char not in 'start'
+   */
+  if (start)
+    {
+      int first = fgetc(fp);
+
+      if (first == EOF)
+        {
+          sh_string_truncate(s, 0);
+          if (ferror(fp))
+            return -1;
+          return 0;
+        }
+
+      if (NULL == strchr(start, first))
+        {
+          ungetc(first, fp);
+          return 0;
+        }
+      ungetc(first, fp);
+    }
 
   /* case 1) EOF or error 

trunk/src/sh_unix.c

@@ -3500 +3500 @@
    */
 
-  else    /* fstat_return != 0 or !S_ISREG(fbuf->st_mode) */
-    {
-      fstat_return = errno;
+  else    /* fstat_return != 0 or !S_ISREG(fbuf.st_mode) */
+    {
+      uid_t   euid;
+      int fstat_errval = errno;
       if (fileHash != NULL)
         sl_strlcpy(fileHash, SH_KEY_NULL, KEY_LEN+1);
@@ -3509 +3510 @@
         {
           tmp2 = sh_util_safe_name (theFile->fullpath);
-          sh_error_handle (level, FIL__, __LINE__, fstat_return, MSG_E_READ,
-                           tmp2);
+
+          if (fstat_return != 0)
+            {
+              (void) sl_get_euid(&euid);
+              sh_error_handle (level, FIL__, __LINE__, fstat_errval, 
+                               MSG_E_ACCESS, (long) euid, tmp2);
+            }
+          else if (!S_ISREG(fbuf.st_mode))
+            {
+              sh_error_handle (level, FIL__, __LINE__, fstat_errval, 
+                               MSG_E_NOTREG, tmp2);
+            }
+          else
+            {
+              sh_error_handle (level, FIL__, __LINE__, fstat_errval, 
+                               MSG_E_READ, tmp2);
+            }
           SH_FREE(tmp2);
         }

trunk/src/sh_utils.c

@@ -1881 +1881 @@
 }
 
-    
+#define SH_ESCAPE_SPACE      1
+#define SH_DONT_ESCAPE_SPACE 0    
+char * sh_util_safe_name_int (const char * name, int escape_space);
+
+char * sh_util_safe_name (const char * name)
+{
+  return sh_util_safe_name_int (name, SH_ESCAPE_SPACE); 
+}
+
+char * sh_util_safe_name_keepspace (const char * name)
+{
+  return sh_util_safe_name_int (name, SH_DONT_ESCAPE_SPACE); 
+}
+
 /* returns freshly allocated memory, return value should be free'd
  */
-char * sh_util_safe_name (const char * name)
+char * sh_util_safe_name_int (const char * name, int escape_space)
 {
   register int  i = 0;
@@ -1971 +1984 @@
 #endif
     } else if ( (*p) == ' ') {     /* space            */
-      retval[i] = '\\'; ++i; 
-      retval[i] = ' ';
+      if (escape_space) {
+        retval[i] = '\\'; ++i; 
+        retval[i] = ' ';
+      }
+      else {
+        retval[i] = *p;
+      }
 #ifdef SH_USE_XML
     } else if ( (*p) == '"') {     /* double quote     */