squidguard_log.c

   1 /*
   2  * AUTHOR: Pedro Lineu Orso                         pedro.orso@gmail.com
   3  *                                                            1998, 2008
   4  * SARG Squid Analysis Report Generator      http://sarg.sourceforge.net
   5  *
   6  * SARG donations:
   7  *      please look at http://sarg.sourceforge.net/donations.php
   8  * ---------------------------------------------------------------------
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  23  *
  24  */
  25
  26 #include "include/conf.h"
  27 #include "include/defs.h"
  28
  29 static char **files_done = NULL;
  30 static int nfiles_done = 0;
  31
  32
  33 static void read_log(const char *wentp, FILE *fp_ou)
  34 {
  35    FILE *fp_in = NULL;
  36    char bufbsf[255];
  37    char leks[5], sep[2], res[MAXLEN];
  38    char mon[10], hour[15];
  39    char list[MAXLEN];
  40    char wdata[127];
  41    int  idata=0;
  42    int  i;
  43
  44    if(debug) {
  45       strcpy(buf,text[7]);
  46       if (getword(urly,sizeof(urly),buf,' ')<0 || getword(href,sizeof(href),buf,' ')<0) {
  47          printf("SARG: Maybe you have a broken record or garbage in your %s string.\n",text[7]);
  48          exit(1);
  49       }
  50       sprintf(msg,"%s squidGuard %s: %s",urly,buf,wentp);
  51       debuga(msg);
  52    }
  53
  54    /* With squidGuard, you can log groups in only one log file.
  55       We must parse each log files only one time.  Example :
  56       dest porn {
  57           domainlist porn/domains
  58           urllist    porn/urls
  59           log file1.log
  60       }
  61       dest aggressive {
  62           domainlist aggressive/domains
  63           urllist    aggressive/urls
  64           log file2.log
  65       }
  66       dest audio-video {
  67           domainlist audio-video/domains
  68           urllist    audio-video/urls
  69           log file1.log
  70       }
  71    */
  72    for (i=0; i<nfiles_done; i++)
  73       if (!strcmp(wentp, files_done[i])) return;
  74
  75    nfiles_done++;
  76    files_done = realloc(files_done, nfiles_done*sizeof(char *));
  77    if (!files_done) {
  78        perror("parse squidGuard - realloc");
  79        exit(EXIT_FAILURE);
  80    }
  81    files_done[nfiles_done-1] = strdup(wentp);
  82    if (!files_done[nfiles_done-1]) {
  83        perror("parse squidGuard - strdup");
  84        exit(EXIT_FAILURE);
  85    }
  86
  87    if ((fp_in=fopen(wentp,"r"))==NULL) {
  88       fprintf(stderr, "SARG: (squidguard) %s: %s\n",text[8],wentp);
  89       exit(1);
  90    }
  91
  92    while (fgets(buf,sizeof(buf),fp_in) != NULL) {
  93       if(strlen(SquidGuardLogFormat) > 0) {
  94          strcpy(bufbsf,SquidGuardLogFormat);
  95          leks[0]='\0';
  96          if (getword(leks,sizeof(leks),bufbsf,'#')<0) {
  97             printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",wentp);
  98             exit(1);
  99          }
 100          while(strcmp(leks,"end") != 0) {
 101             if (getword(leks,sizeof(leks),bufbsf,'#')<0 || getword(sep,sizeof(sep),bufbsf,'#')<0) {
 102                printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",wentp);
 103                exit(1);
 104             }
 105             if(strcmp(leks,"end") != 0) {
 106                if (getword(res,sizeof(res),buf,sep[0])<0) {
 107                   printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",wentp);
 108                   exit(1);
 109                }
 110                if(strcmp(leks,"year") == 0)
 111                   strcpy(year,res);
 112                else if(strcmp(leks,"year") == 0)
 113                   strcpy(year,res);
 114                else if(strcmp(leks,"mon") == 0)
 115                   strcpy(mon,res);
 116                else if(strcmp(leks,"day") == 0)
 117                   strcpy(day,res);
 118                else if(strcmp(leks,"hour") == 0)
 119                   strcpy(hour,res);
 120                else if(strcmp(leks,"list") == 0)
 121                   strcpy(list,res);
 122                else if(strcmp(leks,"ip") == 0)
 123                   strcpy(ip,res);
 124                else if(strcmp(leks,"user") == 0)
 125                   strcpy(user,res);
 126                else if(strcmp(leks,"url") == 0)
 127                   strcpy(url,res);
 128             }
 129          }
 130       } else {
 131          if (getword(year,sizeof(year),buf,'-')<0 || getword(mon,sizeof(mon),buf,'-')<0 ||
 132              getword(day,sizeof(day),buf,' ')<0 || getword(hour,sizeof(hour),buf,' ')<0 ||
 133              getword(list,sizeof(list),buf,'/')<0 || getword(list,sizeof(list),buf,'/')<0 ||
 134              getword(tmp5,sizeof(tmp5),buf,'/')<0 || getword(tmp5,sizeof(tmp5),buf,'/')<0 ||
 135              getword(url,sizeof(url),buf,'/')<0 || getword(tmp5,sizeof(tmp5),buf,' ')<0 ||
 136              getword(ip,sizeof(ip),buf,'/')<0 || getword(user,sizeof(user),buf,' ')<0 ||
 137              getword(user,sizeof(user),buf,' ')<0) {
 138             printf("SARG: Maybe you have a broken record or garbage in your %s file.\n",wentp);
 139             exit(1);
 140           }
 141       }
 142
 143       sprintf(warea,"%s%s%s",year,mon,day);
 144       sprintf(wdata,"%s%s%s",year,mon,day);
 145       idata = atoi(wdata);
 146
 147       if(strcmp(SquidguardIgnoreDate,"on") == 0) {
 148          if(idata < dfrom || idata > duntil)
 149             continue;
 150       }
 151
 152       if (strcmp(user,"-") == 0) {
 153          strcpy(user,ip);
 154          bzero(ip, 30);
 155       }
 156       fprintf(fp_ou,"%s %s%s%s %s %s %s %s\n",user,year,mon,day,hour,ip,url,list);
 157       squidguard_count++;
 158    }
 159    if (fp_in) fclose(fp_in);
 160    return;
 161 }
 162
 163
 164 void squidguard_log(void)
 165 {
 166    FILE *fp_ou = NULL, *fp_guard = NULL;
 167    char guard_in[MAXLEN];
 168    char guard_ou[MAXLEN];
 169    char logdir[MAXLEN];
 170    char year[10], day[10], mon[10];
 171    char user[MAXLEN];
 172    int  y;
 173    int cstatus;
 174    char *str;
 175    char *str2;
 176
 177    str2 = user;
 178
 179    if(strlen(SquidGuardConf) < 1 && strlen(SquidGuardLogAlternate) < 1)
 180      return;
 181
 182    if (strlen(SquidGuardLogAlternate) > 0)
 183       SquidGuardConf[0]='\0';
 184
 185    sprintf(guard_in,"%s/squidguard.unsort",tmp);
 186    sprintf(guard_ou,"%s/squidguard.log",tmp);
 187    if((fp_ou=fopen(guard_in,"a"))==NULL) {
 188       fprintf(stderr, "SARG: (squidguard) %s: %s\n",text[8],guard_in);
 189       exit(1);
 190    }
 191
 192    bzero(day, 3);
 193    bzero(mon, 4);
 194    bzero(year, 5);
 195
 196    if(strcmp(SquidguardIgnoreDate,"on") == 0) {
 197       if(strcmp(df,"e") == 0) {
 198          strncpy(day,period,2);
 199          strncpy(mon,period+2,3);
 200          strncpy(year,period+5,4);
 201          conv_month(mon);
 202          sprintf(warea,"%s%s%s",year,mon,day);
 203          dfrom=atoi(warea);
 204          strncpy(day,period+10,2);
 205          strncpy(mon,period+12,3);
 206          strncpy(year,period+15,4);
 207          conv_month(mon);
 208          sprintf(warea,"%s%s%s",year,mon,day);
 209          duntil=atoi(warea);
 210       } else {
 211          strncpy(day,period+7,2);
 212          strncpy(mon,period+4,3);
 213          strncpy(year,period,4);
 214          conv_month(mon);
 215          sprintf(warea,"%s%s%s",year,mon,day);
 216          dfrom=atoi(warea);
 217          strncpy(day,period+17,2);
 218          strncpy(mon,period+14,3);
 219          strncpy(year,period+10,4);
 220          conv_month(mon);
 221          sprintf(warea,"%s%s%s",year,mon,day);
 222          duntil=atoi(warea);
 223       }
 224    }
 225
 226    if(strlen(SquidGuardConf) > 0) {
 227       if(access(SquidGuardConf, R_OK) != 0) {
 228          sprintf(msg,"Cannot open squidGuard config file: %s",SquidGuardConf);
 229          debuga(msg);
 230          exit(1);
 231       }
 232
 233       if((fp_guard=fopen(SquidGuardConf,"r"))==NULL) {
 234          fprintf(stderr, "SARG: (squidguard) %s: %s\n",text[8],SquidGuardConf);
 235          exit(1);
 236       }
 237
 238       logdir[0]=0;
 239       while(fgets(buf,sizeof(buf),fp_guard)!=NULL) {
 240          if(strstr(buf,"\n") != 0)
 241             buf[strlen(buf)-1]='\0';
 242          if((str=get_param_value("logdir",buf))!=NULL) {
 243             if (getword(logdir,sizeof(logdir),str,' ')<0) {
 244                printf("SARG: Maybe you have an invalid logdir line in your %s file.\n",SquidGuardConf);
 245                exit(1);
 246             }
 247          } else if((str=get_param_value("log",buf))!=NULL) {
 248             if((str2=get_param_value("anonymous",str))!=NULL)
 249                str=str2;
 250
 251             /*
 252             If logdir is defined, we prepend it to the log file name, otherwise, we assume
 253             the log directive provides an absolute file name to the log file. Therefore,
 254             we don't need to add an additionnal / at the beginning of the log file name.
 255             */
 256             y=(logdir[0]) ? sprintf(wentp,"%s/",logdir) : 0;
 257             /*
 258             Spaces are allowed in the name of the log file. The file name ends at the first #
 259             because it is assumed it is an end of line comment. Any space before the # is then
 260             removed. Any control character (i.e. a character with a code lower than 32) ends
 261             the file name. That includes the terminating zero.
 262             */
 263             while((unsigned char)*str>=' ' && *str!='#' && y<sizeof(wentp)-1)
 264                wentp[y++]=*str++;
 265             if(*str=='#') {
 266                str--;
 267                while(*str==' ' && y>0) {
 268                   str--;
 269                   y--;
 270                }
 271             }
 272             wentp[y]=0;
 273             read_log(wentp,fp_ou);
 274          }
 275       }
 276    } else {
 277       sprintf(wentp,"%s",SquidGuardLogAlternate);
 278       read_log(wentp,fp_ou);
 279    }
 280
 281    if (fp_guard) fclose(fp_guard);
 282    if (fp_ou) fclose(fp_ou);
 283
 284    if(debug) {
 285       sprintf(msg,"%s: %s",text[54],guard_ou);
 286       debuga(msg);
 287    }
 288
 289    sprintf(tmp6,"sort -k 1,1 -k 2,2 -k 4,4 '%s' -o '%s'",guard_in, guard_ou);
 290    cstatus=system(tmp6);
 291    if (!WIFEXITED(cstatus) || WEXITSTATUS(cstatus)) {
 292       fprintf(stderr, "SARG: sort command return status %d\n",WEXITSTATUS(cstatus));
 293       fprintf(stderr, "SARG: sort command: %s\n",tmp6);
 294       exit(1);
 295    }
 296
 297    unlink(guard_in);
 298    return;
 299 }