/src/config/localfile-config.c
C | 455 lines | 348 code | 69 blank | 38 comment | 121 complexity | 383b6c3bbaca256877f5d347dc3ec6b2 MD5 | raw file
Possible License(s): GPL-2.0
- /* @(#) $Id$ */
- /* Copyright (C) 2009 Trend Micro Inc.
- * All right reserved.
- *
- * This program is a free software; you can redistribute it
- * and/or modify it under the terms of the GNU General Public
- * License (version 2) as published by the FSF - Free Software
- * Foundation
- */
-
- #include "shared.h"
- #include "localfile-config.h"
- int Read_Localfile(XML_NODE node, void *d1, void *d2)
- {
- int pl = 0;
- int i = 0;
-
- int glob_set = 0;
-
- #ifndef WIN32
- int glob_offset = 0;
- #endif
- /* XML Definitions */
- char *xml_localfile_location = "location";
- char *xml_localfile_command = "command";
- char *xml_localfile_logformat = "log_format";
- char *xml_localfile_frequency = "frequency";
- char *xml_localfile_alias = "alias";
- logreader *logf;
- logreader_config *log_config;
- log_config = (logreader_config *)d1;
- /* If config is not set, we need to create it */
- if(!log_config->config)
- {
- os_calloc(2, sizeof(logreader), log_config->config);
- logf = log_config->config;
- logf[0].file = NULL;
- logf[0].command = NULL;
- logf[0].alias = NULL;
- logf[0].logformat = NULL;
- logf[1].file = NULL;
- logf[1].command = NULL;
- logf[1].alias = NULL;
- logf[1].logformat = NULL;
- }
- else
- {
- logf = log_config->config;
- while(logf[pl].file != NULL)
- {
- pl++;
- }
-
- /* Allocating more memory */
- os_realloc(logf, (pl +2)*sizeof(logreader), log_config->config);
- logf = log_config->config;
- logf[pl +1].file = NULL;
- logf[pl +1].command = NULL;
- logf[pl +1].alias = NULL;
- logf[pl +1].logformat = NULL;
- }
-
- logf[pl].file = NULL;
- logf[pl].command = NULL;
- logf[pl].alias = NULL;
- logf[pl].logformat = NULL;
- logf[pl].fp = NULL;
- logf[pl].ffile = NULL;
- logf[pl].djb_program_name = NULL;
- logf[pl].ign = 360;
-
- /* Searching for entries related to files */
- i = 0;
- while(node[i])
- {
- if(!node[i]->element)
- {
- merror(XML_ELEMNULL, ARGV0);
- return(OS_INVALID);
- }
- else if(!node[i]->content)
- {
- merror(XML_VALUENULL, ARGV0, node[i]->element);
- return(OS_INVALID);
- }
- else if(strcmp(node[i]->element,xml_localfile_command) == 0)
- {
- /* We don't accept remote commands from the manager - just in case. */
- if(log_config->agent_cfg == 1)
- {
- merror("%s: Remote commands are not accepted from the manager. "
- "Ignoring it on the agent.conf", ARGV0);
- logf[pl].file = NULL;
- logf[pl].ffile = NULL;
- logf[pl].command = NULL;
- logf[pl].alias = NULL;
- logf[pl].logformat = NULL;
- logf[pl].fp = NULL;
- return(OS_INVALID);
- }
- os_strdup(node[i]->content, logf[pl].file);
- logf[pl].command = logf[pl].file;
- }
- else if(strcmp(node[i]->element,xml_localfile_frequency) == 0)
- {
- if(!OS_StrIsNum(node[i]->content))
- {
- merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
- return(OS_INVALID);
- }
- logf[pl].ign = atoi(node[i]->content);
- }
- else if(strcmp(node[i]->element,xml_localfile_location) == 0)
- {
- #ifdef WIN32
- /* Expand variables on Windows. */
- if(strchr(node[i]->content, '%'))
- {
- int expandreturn = 0;
- char newfile[OS_MAXSTR +1];
- newfile[OS_MAXSTR] = '\0';
- expandreturn = ExpandEnvironmentStrings(node[i]->content,
- newfile, OS_MAXSTR);
- if((expandreturn > 0) && (expandreturn < OS_MAXSTR))
- {
- free(node[i]->content);
- os_strdup(newfile, node[i]->content);
- }
- }
- #endif
- /* This is a glob*.
- * We will call this file multiple times until
- * there is no one else available.
- */
- #ifndef WIN32 /* No windows support for glob */
- if(strchr(node[i]->content, '*') ||
- strchr(node[i]->content, '?') ||
- strchr(node[i]->content, '['))
- {
- glob_t g;
-
- /* Setting ot the first entry of the glob */
- if(glob_set == 0)
- glob_set = pl +1;
-
- if(glob(node[i]->content, 0, NULL, &g) != 0)
- {
- merror(GLOB_ERROR, ARGV0, node[i]->content);
- os_strdup(node[i]->content, logf[pl].file);
- i++;
- continue;
- }
-
- /* Checking for the last entry */
- if((g.gl_pathv[glob_offset]) == NULL)
- {
- /* Checking when nothing is found. */
- if(glob_offset == 0)
- {
- merror(GLOB_NFOUND, ARGV0, node[i]->content);
- return(OS_INVALID);
- }
- i++;
- continue;
- }
- /* Checking for strftime on globs too. */
- if(strchr(g.gl_pathv[glob_offset], '%'))
- {
- struct tm *p;
- time_t l_time = time(0);
- char lfile[OS_FLSIZE + 1];
- size_t ret;
- p = localtime(&l_time);
- lfile[OS_FLSIZE] = '\0';
- ret = strftime(lfile, OS_FLSIZE, g.gl_pathv[glob_offset], p);
- if(ret == 0)
- {
- merror(PARSE_ERROR, ARGV0, g.gl_pathv[glob_offset]);
- return(OS_INVALID);
- }
- os_strdup(g.gl_pathv[glob_offset], logf[pl].ffile);
- os_strdup(g.gl_pathv[glob_offset], logf[pl].file);
- }
- else
- {
- os_strdup(g.gl_pathv[glob_offset], logf[pl].file);
- }
-
- glob_offset++;
- globfree(&g);
- /* Now we need to create another file entry */
- pl++;
- os_realloc(logf, (pl +2)*sizeof(logreader), log_config->config);
- logf = log_config->config;
-
- logf[pl].file = NULL;
- logf[pl].alias = NULL;
- logf[pl].logformat = NULL;
- logf[pl].fp = NULL;
- logf[pl].ffile = NULL;
-
- logf[pl +1].file = NULL;
- logf[pl +1].alias = NULL;
- logf[pl +1].logformat = NULL;
- /* We can not increment the file count in here */
- continue;
- }
- else if(strchr(node[i]->content, '%'))
- #else
- if(strchr(node[i]->content, '%'))
- #endif /* WIN32 */
- /* We need the format file (based on date) */
- {
- struct tm *p;
- time_t l_time = time(0);
- char lfile[OS_FLSIZE + 1];
- size_t ret;
- p = localtime(&l_time);
- lfile[OS_FLSIZE] = '\0';
- ret = strftime(lfile, OS_FLSIZE, node[i]->content, p);
- if(ret == 0)
- {
- merror(PARSE_ERROR, ARGV0, node[i]->content);
- return(OS_INVALID);
- }
- os_strdup(node[i]->content, logf[pl].ffile);
- os_strdup(node[i]->content, logf[pl].file);
- }
-
-
- /* Normal file */
- else
- {
- os_strdup(node[i]->content, logf[pl].file);
- }
- }
- /* Getting log format */
- else if(strcasecmp(node[i]->element,xml_localfile_logformat) == 0)
- {
- os_strdup(node[i]->content, logf[pl].logformat);
- if(strcmp(logf[pl].logformat, "syslog") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "generic") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "snort-full") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "snort-fast") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "apache") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "iis") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "squid") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "nmapg") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "mysql_log") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "mssql_log") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "postgresql_log") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "djb-multilog") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "syslog-pipe") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "command") == 0)
- {
- }
- else if(strcmp(logf[pl].logformat, "full_command") == 0)
- {
- }
- else if(strncmp(logf[pl].logformat, "multi-line", 10) == 0)
- {
- int x = 0;
- logf[pl].logformat+=10;
- while(logf[pl].logformat[0] == ' ')
- logf[pl].logformat++;
-
- if(logf[pl].logformat[0] != ':')
- {
- merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
- return(OS_INVALID);
- }
- logf[pl].logformat++;
- while(*logf[pl].logformat == ' ')
- logf[pl].logformat++;
-
- while(logf[pl].logformat[x] >= '0' && logf[pl].logformat[x] <= '9')
- x++;
- while(logf[pl].logformat[x] == ' ')
- x++;
- if(logf[pl].logformat[x] != '\0')
- {
- merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
- return(OS_INVALID);
- }
- }
- else if(strcmp(logf[pl].logformat, EVENTLOG) == 0)
- {
- }
- else
- {
- merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
- return(OS_INVALID);
- }
- }
- else if(strcasecmp(node[i]->element,xml_localfile_alias) == 0)
- {
- os_strdup(node[i]->content, logf[pl].alias);
- }
- else
- {
- merror(XML_INVELEM, ARGV0, node[i]->element);
- return(OS_INVALID);
- }
- i++;
- }
- /* Validating glob entries */
- if(glob_set)
- {
- char *format;
-
- /* Getting log format */
- if(logf[pl].logformat)
- {
- format = logf[pl].logformat;
- }
- else if(logf[glob_set -1].logformat)
- {
- format = logf[glob_set -1].logformat;
- }
- else
- {
- merror(MISS_LOG_FORMAT, ARGV0);
- return(OS_INVALID);
- }
- /* The last entry is always null on glob */
- pl--;
- /* Setting format for all entries */
- for(i = (glob_set -1); i<= pl; i++)
- {
- /* Every entry must be valid */
- if(!logf[i].file)
- {
- merror(MISS_FILE, ARGV0);
- return(OS_INVALID);
- }
-
- if(logf[i].logformat == NULL)
- {
- logf[i].logformat = format;
- }
- }
- }
- /* Missing log format */
- if(!logf[pl].logformat)
- {
- merror(MISS_LOG_FORMAT, ARGV0);
- return(OS_INVALID);
- }
- /* Missing file */
- if(!logf[pl].file)
- {
- merror(MISS_FILE, ARGV0);
- return(OS_INVALID);
- }
-
- /* Verifying a valid event log config */
- if(strcmp(logf[pl].logformat, EVENTLOG) == 0)
- {
- if((strcmp(logf[pl].file, "Application") != 0)&&
- (strcmp(logf[pl].file, "System") != 0)&&
- (strcmp(logf[pl].file, "Security") != 0))
- {
- /* Invalid event log */
- merror(NSTD_EVTLOG, ARGV0, logf[pl].file);
- return(0);
- }
- }
- if((strcmp(logf[pl].logformat, "command") == 0)||
- (strcmp(logf[pl].logformat, "full_command") == 0))
- {
- if(!logf[pl].command)
- {
- merror("%s: ERROR: Missing 'command' argument. "
- "This option will be ignored.", ARGV0);
- }
- }
- return(0);
- }
- /* EOF */