]> git.ipfire.org Git - thirdparty/sarg.git/blame - authfail.c
Protection against buffer overflows in getword and friends and report the origin...
[thirdparty/sarg.git] / authfail.c
CommitLineData
25697a35 1/*
c37945ed
FM
2 * AUTHOR: Pedro Lineu Orso pedro.orso@gmail.com
3 * 1998, 2008
94ff9470
GS
4 * SARG Squid Analysis Report Generator http://sarg.sourceforge.net
5 *
6 * SARG donations:
7 * please look at http://sarg.sourceforge.net/donations.php
25697a35
GS
8 * ---------------------------------------------------------------------
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
19 *
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
23 *
24 */
25
26#include "include/conf.h"
27
28void authfail_report()
29{
30
31 FILE *fp_in = NULL, *fp_ou = NULL;
32
33 char url[MAXLEN];
25697a35
GS
34 char html2[MAXLEN];
35 char authfail_in[MAXLEN];
36 char per[MAXLEN];
37 char report[MAXLEN];
d6e703cc 38 char period[100];
25697a35
GS
39 char ip[MAXLEN];
40 char oip[MAXLEN];
41 char user[MAXLEN];
42 char ouser[MAXLEN];
43 char ouser2[MAXLEN];
44 char data[15];
45 char hora[15];
25697a35
GS
46 char *str;
47 int z=0;
48 int count=0;
49
50 if(strlen(DataFile) > 0) return;
51
52 ouser[0]='\0';
53
491b862f 54 sprintf(tmp4,"%s/sarg/authfail.log.unsort",TempDir);
25697a35
GS
55
56 if(!authfail_count) {
57 unlink(tmp4);
58 return;
59 }
60
61 sprintf(authfail_in,"%s/authfail.log",TempDir);
d6e703cc 62 sprintf(per,"%s/sarg-period",dirname);
25697a35
GS
63 sprintf(report,"%s/authfail.html",dirname);
64
94ff9470 65 sprintf(csort,"sort -b -T %s -k 3,3 -k 5,5 -o '%s' '%s'", TempDir, authfail_in, tmp4);
25697a35
GS
66 system(csort);
67 unlink(tmp4);
68
69 if ((fp_in = fopen(per, "r")) == 0) {
70 fprintf(stderr, "SARG: (authfail) %s: %s\n",text[45],per);
71 exit(1);
72 }
73
d6e703cc 74 fgets(period,sizeof(period),fp_in);
25697a35
GS
75 fclose(fp_in);
76
77 if((fp_in=fopen(authfail_in,"r"))==NULL) {
78 fprintf(stderr, "SARG: (authfail) %s: %s\n",text[45],authfail_in);
79 exit(1);
80 }
81
82 if((fp_ou=fopen(report,"w"))==NULL) {
83 fprintf(stderr, "SARG: (authfail) %s: %s\n",text[45],report);
84 exit(1);
85 }
86
d6e703cc 87 fprintf(fp_ou, "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n<html>\n<head>\n <meta http-equiv=\"Content-Type\" content=\"text/html; charset=%s\">\n",CharSet);
25697a35
GS
88 css(fp_ou);
89 fputs("</head>\n",fp_ou);
d6e703cc
FM
90 if(strlen(FontFace) > 0) fprintf(fp_ou,"<font face=%s>\n",FontFace);
91 fprintf(fp_ou,"<body bgcolor=%s text=%s background='%s'>\n",BgColor,TxColor,BgImage);
92 if(strlen(LogoImage) > 0) fprintf(fp_ou, "<center><table cellpadding=\"0\" cellspacing=\"0\">\n<tr><th class=\"logo\"><img src='%s' border=0 align=absmiddle width=%s height=%s>&nbsp;%s</th></tr>\n<tr><td height=\"5\"></td></tr>\n</table>\n",LogoImage,Width,Height,LogoText);
25697a35 93
491b862f
GS
94 if(strcmp(IndexTree,"date") == 0)
95 show_sarg(fp_ou, "../../..");
96 else
97 show_sarg(fp_ou,"..");
25697a35
GS
98 fputs("<center><table cellpadding=0 cellspacing=0>\n",fp_ou);
99 sprintf(url,"<tr><th class=\"title\">%s</th></tr>\n",Title);
100 fputs(url,fp_ou);
101
d6e703cc 102 sprintf(url,"<tr><td class=\"header\">%s: %s</td></tr>\n",text[89],period);
25697a35 103 fputs(url,fp_ou);
d6e703cc 104 sprintf(url,"<tr><th class=\"header3\">%s</th></tr>\n",text[117]);
25697a35
GS
105 fputs(url,fp_ou);
106 fputs("</table></center>\n",fp_ou);
107
108 fputs("<center><table cellpadding=0 cellspacing=2>\n",fp_ou);
109 fputs("<tr><td></td></tr>\n",fp_ou);
110 fputs("<tr><td></td></tr>\n",fp_ou);
111 fputs("<tr><td></td></tr>\n",fp_ou);
112 sprintf(url,"<tr><th class=\"header\">%s</th><th class=\"header\">%s</th><th class=\"header\">%s</th><th class=\"header\">%s</th></tr>\n",text[98],text[111],text[110],text[91]);
113 fputs(url,fp_ou);
114
115 while(fgets(buf,sizeof(buf),fp_in)!=NULL) {
4bcb77cf
FM
116 if (getword_multisep(data,sizeof(data),buf,' ')<0 || getword_multisep(hora,sizeof(hora),buf,' ')<0 ||
117 getword_multisep(user,sizeof(user),buf,' ')<0 || getword_multisep(ip,sizeof(ip),buf,' ')<0 ||
118 getword_multisep(url,sizeof(url),buf,' ')<0) {
119 printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",authfail_in);
120 exit(1);
121 }
25697a35
GS
122
123 if((str=(char *) strstr(user, "_")) != (char *) NULL ) {
124 if((str=(char *) strstr(str+1, "_")) != (char *) NULL )
125 fixip(user);
126 }
127
128 if(strcmp(Ip2Name,"yes") == 0)
129 ip2name(ip);
130
131 if(!z) {
132 strcpy(ouser,user);
133 strcpy(oip,ip);
134 z++;
135 } else {
136 if(strcmp(ouser,user) == 0)
137 user[0]='\0';
138 if(user[0] != '\0')
139 strcpy(ouser,user);
140 if(strcmp(oip,ip) == 0)
141 ip[0]='\0';
142 if(ip[0] != '\0')
143 strcpy(oip,ip);
144 }
145
146 if(UserTabFile[0] != '\0') {
147 sprintf(warea,":%s:",user);
148 if((str=(char *) strstr(userfile,warea)) != (char *) NULL ) {
149 z1=0;
150 str2=(char *) strstr(str+1,":");
151 str2++;
152 bzero(name, MAXLEN);
153 while(str2[z1] != ':') {
154 name[z1]=str2[z1];
155 z1++;
156 }
157 } else strcpy(name,user);
158 } else strcpy(name,user);
159
94ff9470
GS
160 if(dotinuser && strstr(name,"_")) {
161 str2=(char *)subs(name,"_",".");
162 strcpy(name,str2);
163 }
164
25697a35
GS
165 if(AuthfailReportLimit) {
166 if(strcmp(ouser2,name) == 0) {
167 count++;
168 } else {
169 count=1;
170 strcpy(ouser2,name);
171 }
172 if(count >= AuthfailReportLimit)
173 continue;
174 }
175
176 sprintf(html2,"<tr><td class=\"data2\">%s</td><td class=\"data2\">%s</td><td class=\"data2\">%s-%s</td><td class=\"data2\">%s<a href=\"%s\">%s</a></td></th>\n",name,ip,data,hora,BlockImage,url,url);
177 fputs(html2,fp_ou);
178 }
179
180 fputs("</table>\n",fp_ou);
181
182 show_info(fp_ou);
183
184 fputs("</body>\n</html>\n",fp_ou);
185
186 fclose(fp_in);
187 fclose(fp_ou);
188
189 unlink(authfail_in);
190
191 return;
192}