Socket.pm: Fix detection and deletion of an existing socket file.
[people/stevee/guardian.git] / guardian
CommitLineData
88d9af2c
SS
1#!/usr/bin/perl
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
5# Copyright (C) 2015 IPFire Development Team #
6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
21
22use strict;
23use threads;
24use threads::shared;
45bf2a03 25use Getopt::Long;
88d9af2c
SS
26use Thread::Queue;
27use Linux::Inotify2;
28
45bf2a03 29require Guardian::Config;
88d9af2c 30require Guardian::Parser;
6abac3d4 31require Guardian::Socket;
88d9af2c 32
45bf2a03
SS
33# Define version.
34my $version ="2.0";
35
88d9af2c
SS
36# Array to store the monitored logfiles.
37my @monitored_files = (
38 "/var/log/snort/alert",
39);
40
45bf2a03
SS
41# Get and store the given command line arguments in a hash.
42my %cmdargs = ();
43
44&GetOptions (\%cmdargs,
45 'foreground|f',
46 'config|c=s',
47 'help|h',
48 'version|v',
49);
50
51# Show help / version information.
52if (defined($cmdargs{"help"})) {
53 print "Guardian $version \n";
54 print "Usage: guardian <optional arguments>\n";
55 print " -c, --config\t\tspecifiy a configuration file other than the default (/etc/guardian/guardian.conf)\n";
56 print " -f, --foreground\trun in the foreground (doesn't fork, any output goes to STDOUT)\n";
57 print " -h, --help\t\tshows this help\n";
58 print " -v, --version\t\tdisplay programm version and exit.\n";
59 exit;
60} elsif (defined($cmdargs{"version"})) {
61 print "Guardian $version \n";
62 exit;
63}
64
65# Read-in the configuration file and store the settings.
66# Push the may be given config file argument.
67my %mainsettings = &Guardian::Config::UseConfig($cmdargs{"config"});
68
88d9af2c
SS
69# Create the main queue. It is used to store and process all events which are
70# reported and enqueued by the worker threads.
71my $queue :shared = new Thread::Queue or die "Could not create new, empty queue. $!\n";;
72
73# Call Init function to initzialize guardian.
74&Init();
75
76# Infinite main loop, which processes all queued events.
77while(1) {
78 # Get the amount of elements in our queue.
79 # "undef" will be returned if it is empty.
80 my $current_events = $queue->pending();
81
82 # If there is at least one element enqued
83 if($current_events > 0) {
84 # Grab the data of the top enqueued event.
85 my $event = $queue->peek();
86
87 print "Got event: $event\n";
88
89 # Drop processed event from queue.
90 $queue->dequeue();
91 }
92
93 # XXX
94 # Temporary workaround to reduce the load of the main process.
95 sleep(1);
96}
97
98#
99## Init function.
100#
101## This function contains code which has to be executed while guardian
102## is starting.
103#
104sub Init () {
6abac3d4
SS
105 # Setup IPC mechanism via Socket in an own thread.
106 threads->create(\&Socket);
107
88d9af2c
SS
108 # Loop through the array of which files should be monitored and
109 # create a worker thread for each single one.
110 foreach my $monitored_file (@monitored_files) {
111 # Check if the file exists and is readable.
112 if (-r "$monitored_file") {
113 # Create worker thread for the file.
114 threads->create(\&Worker,$monitored_file);
115 }
116 }
117}
118
119#
120## Worker function.
121#
122## This function is responsible for monitoring modifications of the given logfile,
123## read them and pass them to the message parser.
124#
125## To get file modifications the inotify subsystem of the linux kernel is used.
126#
127## In order to prevent from permanently read and keep files opened, or dealing
128## with huge logfiles, at initialization time of the worker process, the file will
129## be opened once and the cursor position of the end of file (EOF) get stored. When
130## reading any newly added lines from the file, we directly can jump to the last
131## known position and get these lines. Afterwards, we store the current curser position
132## again, so we can do it in this way over and over again.
133#
134## All read lines get stored in an array, which will be passed to the Parser.
135#
136## If any response (action) from the parser get recieved, it will be put into the
137## shared event queue.
138#
139sub Worker ($) {
140 my $file = @_[0];
141
142 # Get the fileposition.
143 my $fileposition = &Init_fileposition("$file");
144
145 # Create inotify watcher.
146 my $watcher = new Linux::Inotify2 or die "Could not use inotify. $!\n";
147
148 # Monitor the specified file.
149 $watcher->watch("$file", IN_MODIFY) or die "Could not monitor $file. $!\n";
150
151 # Get all notifications.
152 while ($watcher->read) {
153 my @message = ();
154
155 # Open the file.
156 open (FILE, $file) or die "Could not open $file. $!\n";
157
158 # Seek to the last known position.
159 seek (FILE, $fileposition, 0);
160
161 # Get the log message.
162 while (my $line = <FILE>) {
163 # Remove any newlines.
164 chomp $line;
165
166 # Add all lines to the message array.
167 push (@message, $line);
168 }
169
170 # Update fileposition.
171 $fileposition = tell(FILE);
172
173 # Close file.
174 close(FILE);
175
176 # Send filename and message to the parser,
177 # which will return if an action has to be performed.
178 my @action = &Guardian::Parser::Parser("$file", @message);
179
180 # Send the action to the main process and put it into
181 # the queue.
182 if (@action) {
183 # Lock the queue.
184 lock($queue);
185
186 # Put the required action into the queue.
187 $queue->enqueue(@action);
188 }
189 }
190}
191
6abac3d4
SS
192#
193## Socket function.
194#
195## This function uses the Socket module to create and listen to an UNIX socket.
196## It automatically accepts all incomming connections and pass the recieved
197## data messages to the the Message_Parser function which is also part of the
198## socket module.
199#
200## If a valid command has been sent through the socket, the corresponding event
201## will be enqueued into the shared event queue.
202#
203sub Socket () {
204 # Create the Server socket by calling the responsible function.
205 my $server = &Guardian::Socket::Server();
206
207 # Accept incomming connections from the socket.
208 while (my $connection = $server->accept()) {
209 # Autoflush the socket after the data
210 # has been recieved.
211 $connection->autoflush(1);
212
213 # Gather all data from the connection.
214 while (my $message = <$connection>) {
215 # Remove any newlines.
216 chomp($message);
217
218 # Send the recieved data message to the
219 # socket parser.
220 my $action = &Guardian::Socket::Message_Parser($message);
221
222 # If the parser returns to perform an action,
223 # add it to the main event queue.
224 if ($action) {
225 # Lock the queue.
226 lock($queue);
227
228 # Enqueue the returned action.
229 $queue->enqueue($action);
230 }
231 }
232 }
233}
234
88d9af2c
SS
235#
236## Function for fileposition initialization.
237#
238## This function is used to get the cursor position of the end of file (EOF) of
239## a specified file.
240#
241## In order to prevent from permanently read and keep files opened, or dealing
242## with huge logfiles, at initialization time of the worker processes, the file will
243## be opened once and the cursor position of the end of file (EOF) get stored.
244#
245sub Init_fileposition ($) {
246 my $file = $_[0];
247
248 # Open the file.
249 open(FILE, $file) or die "Could not open $file. $!\n";
250
251 # Just seek to the end of the file (EOF).
252 seek(FILE, 0, 2);
253
254 # Get and store the position.
255 my $position = tell(FILE),
256
257 # Close the file again.
258 close(FILE);
259
260 # Return the position.
261 return $position;
262}