]>
Commit | Line | Data |
---|---|---|
88d9af2c SS |
1 | #!/usr/bin/perl |
2 | ############################################################################### | |
3 | # # | |
4 | # IPFire.org - A linux based firewall # | |
5 | # Copyright (C) 2015 IPFire Development Team # | |
6 | # # | |
7 | # This program is free software: you can redistribute it and/or modify # | |
8 | # it under the terms of the GNU General Public License as published by # | |
9 | # the Free Software Foundation, either version 3 of the License, or # | |
10 | # (at your option) any later version. # | |
11 | # # | |
12 | # This program is distributed in the hope that it will be useful, # | |
13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of # | |
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # | |
15 | # GNU General Public License for more details. # | |
16 | # # | |
17 | # You should have received a copy of the GNU General Public License # | |
18 | # along with this program. If not, see <http://www.gnu.org/licenses/>. # | |
19 | # # | |
20 | ############################################################################### | |
21 | ||
22 | use strict; | |
23 | use threads; | |
24 | use threads::shared; | |
25 | use Thread::Queue; | |
26 | use Linux::Inotify2; | |
27 | ||
28 | require Guardian::Parser; | |
29 | ||
30 | # Array to store the monitored logfiles. | |
31 | my @monitored_files = ( | |
32 | "/var/log/snort/alert", | |
33 | ); | |
34 | ||
35 | # Create the main queue. It is used to store and process all events which are | |
36 | # reported and enqueued by the worker threads. | |
37 | my $queue :shared = new Thread::Queue or die "Could not create new, empty queue. $!\n";; | |
38 | ||
39 | # Call Init function to initzialize guardian. | |
40 | &Init(); | |
41 | ||
42 | # Infinite main loop, which processes all queued events. | |
43 | while(1) { | |
44 | # Get the amount of elements in our queue. | |
45 | # "undef" will be returned if it is empty. | |
46 | my $current_events = $queue->pending(); | |
47 | ||
48 | # If there is at least one element enqued | |
49 | if($current_events > 0) { | |
50 | # Grab the data of the top enqueued event. | |
51 | my $event = $queue->peek(); | |
52 | ||
53 | print "Got event: $event\n"; | |
54 | ||
55 | # Drop processed event from queue. | |
56 | $queue->dequeue(); | |
57 | } | |
58 | ||
59 | # XXX | |
60 | # Temporary workaround to reduce the load of the main process. | |
61 | sleep(1); | |
62 | } | |
63 | ||
64 | # | |
65 | ## Init function. | |
66 | # | |
67 | ## This function contains code which has to be executed while guardian | |
68 | ## is starting. | |
69 | # | |
70 | sub Init () { | |
71 | # Loop through the array of which files should be monitored and | |
72 | # create a worker thread for each single one. | |
73 | foreach my $monitored_file (@monitored_files) { | |
74 | # Check if the file exists and is readable. | |
75 | if (-r "$monitored_file") { | |
76 | # Create worker thread for the file. | |
77 | threads->create(\&Worker,$monitored_file); | |
78 | } | |
79 | } | |
80 | } | |
81 | ||
82 | # | |
83 | ## Worker function. | |
84 | # | |
85 | ## This function is responsible for monitoring modifications of the given logfile, | |
86 | ## read them and pass them to the message parser. | |
87 | # | |
88 | ## To get file modifications the inotify subsystem of the linux kernel is used. | |
89 | # | |
90 | ## In order to prevent from permanently read and keep files opened, or dealing | |
91 | ## with huge logfiles, at initialization time of the worker process, the file will | |
92 | ## be opened once and the cursor position of the end of file (EOF) get stored. When | |
93 | ## reading any newly added lines from the file, we directly can jump to the last | |
94 | ## known position and get these lines. Afterwards, we store the current curser position | |
95 | ## again, so we can do it in this way over and over again. | |
96 | # | |
97 | ## All read lines get stored in an array, which will be passed to the Parser. | |
98 | # | |
99 | ## If any response (action) from the parser get recieved, it will be put into the | |
100 | ## shared event queue. | |
101 | # | |
102 | sub Worker ($) { | |
103 | my $file = @_[0]; | |
104 | ||
105 | # Get the fileposition. | |
106 | my $fileposition = &Init_fileposition("$file"); | |
107 | ||
108 | # Create inotify watcher. | |
109 | my $watcher = new Linux::Inotify2 or die "Could not use inotify. $!\n"; | |
110 | ||
111 | # Monitor the specified file. | |
112 | $watcher->watch("$file", IN_MODIFY) or die "Could not monitor $file. $!\n"; | |
113 | ||
114 | # Get all notifications. | |
115 | while ($watcher->read) { | |
116 | my @message = (); | |
117 | ||
118 | # Open the file. | |
119 | open (FILE, $file) or die "Could not open $file. $!\n"; | |
120 | ||
121 | # Seek to the last known position. | |
122 | seek (FILE, $fileposition, 0); | |
123 | ||
124 | # Get the log message. | |
125 | while (my $line = <FILE>) { | |
126 | # Remove any newlines. | |
127 | chomp $line; | |
128 | ||
129 | # Add all lines to the message array. | |
130 | push (@message, $line); | |
131 | } | |
132 | ||
133 | # Update fileposition. | |
134 | $fileposition = tell(FILE); | |
135 | ||
136 | # Close file. | |
137 | close(FILE); | |
138 | ||
139 | # Send filename and message to the parser, | |
140 | # which will return if an action has to be performed. | |
141 | my @action = &Guardian::Parser::Parser("$file", @message); | |
142 | ||
143 | # Send the action to the main process and put it into | |
144 | # the queue. | |
145 | if (@action) { | |
146 | # Lock the queue. | |
147 | lock($queue); | |
148 | ||
149 | # Put the required action into the queue. | |
150 | $queue->enqueue(@action); | |
151 | } | |
152 | } | |
153 | } | |
154 | ||
155 | # | |
156 | ## Function for fileposition initialization. | |
157 | # | |
158 | ## This function is used to get the cursor position of the end of file (EOF) of | |
159 | ## a specified file. | |
160 | # | |
161 | ## In order to prevent from permanently read and keep files opened, or dealing | |
162 | ## with huge logfiles, at initialization time of the worker processes, the file will | |
163 | ## be opened once and the cursor position of the end of file (EOF) get stored. | |
164 | # | |
165 | sub Init_fileposition ($) { | |
166 | my $file = $_[0]; | |
167 | ||
168 | # Open the file. | |
169 | open(FILE, $file) or die "Could not open $file. $!\n"; | |
170 | ||
171 | # Just seek to the end of the file (EOF). | |
172 | seek(FILE, 0, 2); | |
173 | ||
174 | # Get and store the position. | |
175 | my $position = tell(FILE), | |
176 | ||
177 | # Close the file again. | |
178 | close(FILE); | |
179 | ||
180 | # Return the position. | |
181 | return $position; | |
182 | } |