1 /*
2 * Argus Software
3 * Copyright (c) 2000-2016 QoSient, LLC
4 * All rights reserved.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2, or (at your option)
9 * any later version.
10
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 *
20 */
21
22 /*
23 * raevent.c - event for ra* client programs.
24 * add application specific code, stir and enjoy.
25 */
26
27 /*
28 * $Id: //depot/argus/clients/examples/raevent/raevent.c#8 $
29 * $DateTime: 2016/06/01 15:17:28 $
30 * $Change: 3148 $
31 */
32
33 #ifdef HAVE_CONFIG_H
34 #include "argus_config.h"
35 #endif
36
37 #if defined(CYGWIN)
38 #define USE_IPV6
39 #endif
40
41 #include <unistd.h>
42 #include <stdlib.h>
43
44 #include <argus_compat.h>
45
46 #include <rabins.h>
47 #include <argus_util.h>
48 #include <argus_client.h>
49 #include <argus_main.h>
50 #include <argus_filter.h>
51 #include <signal.h>
52 #include <ctype.h>
53
54 void
ArgusClientInit(struct ArgusParserStruct * parser)55 ArgusClientInit (struct ArgusParserStruct *parser)
56 {
57 struct ArgusModeStruct *mode = NULL;
58 parser->RaWriteOut = 0;
59
60 if (!(parser->RaInitialized)) {
61 (void) signal (SIGHUP, (void (*)(int)) RaParseComplete);
62 (void) signal (SIGTERM, (void (*)(int)) RaParseComplete);
63 (void) signal (SIGQUIT, (void (*)(int)) RaParseComplete);
64 (void) signal (SIGINT, (void (*)(int)) RaParseComplete);
65
66 if ((mode = parser->ArgusModeList) != NULL) {
67 while (mode) {
68 if (!(strncasecmp (mode->mode, "poll", 4)))
69 parser->RaPollMode++;
70 mode = mode->nxt;
71 }
72 }
73
74 parser->RaInitialized++;
75 }
76 }
77
RaArgusInputComplete(struct ArgusInput * input)78 void RaArgusInputComplete (struct ArgusInput *input) { return; }
79
80
81 void
RaParseComplete(int sig)82 RaParseComplete (int sig)
83 {
84 if (sig >= 0) {
85 if ((sig == SIGINT) || (sig == SIGQUIT)) {
86 ArgusShutDown(sig);
87 exit(0);
88 }
89 }
90 }
91
92
93 void
ArgusClientTimeout()94 ArgusClientTimeout ()
95 {
96 #ifdef ARGUSDEBUG
97 ArgusDebug (6, "ArgusClientTimeout()\n");
98 #endif
99 }
100
101 void
parse_arg(int argc,char ** argv)102 parse_arg (int argc, char**argv)
103 {}
104
105 void
usage()106 usage ()
107 {
108 extern char version[];
109
110 fprintf (stdout, "Raevent Version %s\n", version);
111 fprintf (stdout, "usage: %s \n", ArgusParser->ArgusProgramName);
112 fprintf (stdout, "usage: %s [options] -S remoteServer [- filter-expression]\n", ArgusParser->ArgusProgramName);
113 fprintf (stdout, "usage: %s [options] -r argusDataFile [- filter-expression]\n\n", ArgusParser->ArgusProgramName);
114
115 fprintf (stdout, "options: -A print record summaries on termination.\n");
116 fprintf (stdout, " -b dump packet-matching code.\n");
117 fprintf (stdout, " -c <char> specify a delimiter <char> for output columns.\n");
118 #if defined (ARGUSDEBUG)
119 fprintf (stdout, " -D <level> specify debug level\n");
120 #endif
121 fprintf (stdout, " -F <conffile> read configuration from <conffile>.\n");
122 fprintf (stdout, " -h print help.\n");
123 fprintf (stdout, " -n don't convert numbers to names.\n");
124 fprintf (stdout, " -p <digits> print fractional time with <digits> precision.\n");
125 fprintf (stdout, " -q quiet mode. don't print record outputs.\n");
126 fprintf (stdout, " -r <file> read argus data <file>. '-' denotes stdin.\n");
127 fprintf (stdout, " -R <dir> recursively process files in directory\n");
128 fprintf (stdout, " -S <host[:port]> specify remote argus <host> and optional port\n");
129 fprintf (stdout, " number.\n");
130 fprintf (stdout, " -t <timerange> specify <timerange> for reading records.\n");
131 fprintf (stdout, " format: timeSpecification[-timeSpecification]\n");
132 fprintf (stdout, " timeSpecification: [[[yyyy/]mm/]dd.]hh[:mm[:ss]]\n");
133 fprintf (stdout, " [yyyy/]mm/dd\n");
134 fprintf (stdout, " -%%d{yMdhms}\n");
135 fprintf (stdout, " -T <secs> attach to remote server for T seconds.\n");
136 fprintf (stdout, " -u print time in Unix time format.\n");
137 #ifdef ARGUS_SASL
138 fprintf (stdout, " -U <user/auth> specify <user/auth> authentication information.\n");
139 #endif
140 fprintf (stdout, " -w <file> write output to <file>. '-' denotes stdout.\n");
141 fflush (stdout);
142 exit(1);
143 }
144
145 #if defined(HAVE_ZLIB_H)
146 #include <zlib.h>
147 #endif
148
149 void
RaProcessRecord(struct ArgusParserStruct * parser,struct ArgusRecordStruct * argus)150 RaProcessRecord (struct ArgusParserStruct *parser, struct ArgusRecordStruct *argus)
151 {
152 switch (argus->hdr.type & 0xF0) {
153 case ARGUS_NETFLOW:
154 case ARGUS_FAR:
155 break;
156
157 case ARGUS_MAR:
158 RaProcessManRecord (parser, argus);
159 break;
160
161 case ARGUS_EVENT: {
162 if (parser->ArgusWfileList != NULL) {
163 struct ArgusWfileStruct *wfile = NULL;
164 struct ArgusListObjectStruct *lobj = NULL;
165 int i, count = parser->ArgusWfileList->count;
166
167 if ((lobj = parser->ArgusWfileList->start) != NULL) {
168 for (i = 0; i < count; i++) {
169 if ((wfile = (struct ArgusWfileStruct *) lobj) != NULL) {
170 int retn = 1;
171 if (wfile->filterstr) {
172 struct nff_insn *wfcode = wfile->filter.bf_insns;
173 retn = ArgusFilterRecord (wfcode, argus);
174 }
175
176 if (retn != 0) {
177 if ((parser->exceptfile == NULL) || strcmp(wfile->filename, parser->exceptfile)) {
178 struct ArgusRecord *argusrec = NULL;
179 static char sbuf[0x10000];
180 if ((argusrec = ArgusGenerateRecord (argus, 0L, sbuf)) != NULL) {
181 #ifdef _LITTLE_ENDIAN
182 ArgusHtoN(argusrec);
183 #endif
184 ArgusWriteNewLogfile (parser, argus->input, wfile, argusrec);
185 }
186 }
187 }
188 }
189
190 lobj = lobj->nxt;
191 }
192 }
193
194 } else {
195 struct ArgusTimeObject *time = (void *)argus->dsrs[ARGUS_TIME_INDEX];
196 struct ArgusDataStruct *data = NULL;
197
198 if ((data = (void *)argus->dsrs[ARGUS_SRCUSERDATA_INDEX]) == NULL)
199 if ((data = (void *)argus->dsrs[ARGUS_DSTUSERDATA_INDEX]) == NULL)
200 return;
201
202 if (!parser->qflag) {
203 struct timeval tvpbuf, *tvp = &tvpbuf;
204 char buf[0x10000], *ptr = buf;
205 char tbuf[129], sbuf[129], *sptr = sbuf;
206 char *dptr = data->array;
207 unsigned long len = 0x10000;
208 int cnt = 0;
209
210 if (parser->Lflag && !(parser->ArgusPrintXml)) {
211 }
212
213 #if defined(HAVE_ZLIB_H)
214 if (data->hdr.subtype & ARGUS_DATA_COMPRESS) {
215 bzero (ptr, sizeof(buf));
216 uncompress((Bytef *)ptr, (uLongf *)&len, (Bytef *)&data->array, data->count);
217 dptr = ptr;
218 cnt = data->size;
219 } else {
220 #endif
221 cnt = data->count;
222 #if defined(HAVE_ZLIB_H)
223 }
224 #endif
225
226 bzero (tbuf, sizeof(tbuf));
227 bzero (sptr, sizeof(sbuf));
228 tvp->tv_sec = time->src.start.tv_sec;
229 tvp->tv_usec = time->src.start.tv_usec;
230
231 ArgusPrintTime(parser, tbuf, tvp);
232 ArgusPrintSourceID(parser, sptr, argus, 24);
233
234 while (isspace((int)sbuf[strlen(sbuf) - 1]))
235 sbuf[strlen(sbuf) - 1] = '\0';
236
237 while (isspace((int)*sptr)) sptr++;
238
239 if (!(parser->ArgusPrintXml)) {
240 if (fprintf (stdout, "event[%d]=\n%s:srcid=%s:%s\n", cnt, tbuf, sptr, dptr) < 0)
241 RaParseComplete(SIGQUIT);
242 } else {
243 if (fprintf (stdout, "%s\n", dptr) < 0)
244 RaParseComplete(SIGQUIT);
245 }
246 fflush (stdout);
247 }
248 }
249 break;
250 }
251 }
252 }
253
RaSendArgusRecord(struct ArgusRecordStruct * argus)254 int RaSendArgusRecord(struct ArgusRecordStruct *argus) {return 0;}
255
256 void ArgusWindowClose(void);
257
ArgusWindowClose(void)258 void ArgusWindowClose(void) {
259 #ifdef ARGUSDEBUG
260 ArgusDebug (6, "ArgusWindowClose () returning\n");
261 #endif
262 }
263
264 void
RaProcessManRecord(struct ArgusParserStruct * parser,struct ArgusRecordStruct * argus)265 RaProcessManRecord (struct ArgusParserStruct *parser, struct ArgusRecordStruct *argus)
266 {
267 static char buf[MAXSTRLEN];
268
269 if (parser->ArgusWfileList != NULL) {
270 struct ArgusWfileStruct *wfile = NULL;
271 struct ArgusListObjectStruct *lobj = NULL;
272 int i, count = parser->ArgusWfileList->count;
273
274 if ((lobj = parser->ArgusWfileList->start) != NULL) {
275 for (i = 0; i < count; i++) {
276 if ((wfile = (struct ArgusWfileStruct *) lobj) != NULL) {
277 int retn = 1;
278 if (wfile->filterstr) {
279 struct nff_insn *wfcode = wfile->filter.bf_insns;
280 retn = ArgusFilterRecord (wfcode, argus);
281 }
282
283 if (retn != 0) {
284 if ((parser->exceptfile == NULL) || strcmp(wfile->filename, parser->exceptfile)) {
285 struct ArgusRecord *argusrec = NULL;
286 static char sbuf[0x10000];
287 if ((argusrec = ArgusGenerateRecord (argus, 0L, sbuf)) != NULL) {
288 #ifdef _LITTLE_ENDIAN
289 ArgusHtoN(argusrec);
290 #endif
291 ArgusWriteNewLogfile (parser, argus->input, wfile, argusrec);
292 }
293 }
294 }
295 }
296
297 lobj = lobj->nxt;
298 }
299 }
300
301 } else {
302
303 if ((parser->ArgusPrintMan) && (!parser->qflag)) {
304 if (parser->Lflag && !(parser->ArgusPrintXml)) {
305 if (parser->RaLabel == NULL)
306 parser->RaLabel = ArgusGenerateLabel(parser, argus);
307
308 if (!(parser->RaLabelCounter++ % parser->Lflag))
309 printf ("%s\n", parser->RaLabel);
310
311 if (parser->Lflag < 0)
312 parser->Lflag = 0;
313 }
314
315 bzero (buf, sizeof(buf));
316 ArgusPrintRecord(parser, buf, argus, MAXSTRLEN);
317
318 if (fprintf (stdout, "%s\n", buf) < 0)
319 RaParseComplete(SIGQUIT);
320 fflush (stdout);
321 }
322 }
323
324 #ifdef ARGUSDEBUG
325 {
326 struct ArgusRecord *rec = (struct ArgusRecord *) argus->dsrs[0];
327 if (rec != NULL) {
328 struct ArgusMarStruct *mar = &rec->ar_un.mar;
329 ArgusDebug (6, "RaProcessManRecord (0x%x, 0x%x) mar parsed 0x%x", parser, argus, mar);
330 } else
331 ArgusDebug (6, "RaProcessManRecord (0x%x, 0x%x) mar parsed", parser, argus);
332 }
333 #endif
334 }
335