[people/stevee/guardian.git] / guardian

#!/usr/bin/perl
###############################################################################
#                                                                             #
# IPFire.org - A linux based firewall                                         #
# Copyright (C) 2015  IPFire Development Team                                 #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
###############################################################################

use strict;
use threads;
use threads::shared;
use Getopt::Long;
use Thread::Queue;
use Linux::Inotify2;

require Guardian::Config;
require Guardian::Parser;
require Guardian::Socket;

# Define version.
my $version ="2.0";

# Array to store the monitored logfiles.
my @monitored_files = (
	"/var/log/snort/alert",
);

# Get and store the given command line arguments in a hash.
my %cmdargs = ();

&GetOptions (\%cmdargs,
	'foreground|f',
	'config|c=s',
	'help|h',
	'version|v',
);

# Show help / version information.
if (defined($cmdargs{"help"})) {
	print "Guardian $version \n";
	print "Usage: guardian <optional arguments>\n";
	print " -c, --config\t\tspecifiy a configuration file other than the default (/etc/guardian/guardian.conf)\n";
	print " -f, --foreground\trun in the foreground (doesn't fork, any output goes to STDOUT)\n";
	print " -h, --help\t\tshows this help\n";
	print " -v, --version\t\tdisplay programm version and exit.\n";
	exit;
} elsif (defined($cmdargs{"version"})) {
	print "Guardian $version \n";
	exit;
}

# Read-in the configuration file and store the settings.
# Push the may be given config file argument.
my %mainsettings = &Guardian::Config::UseConfig($cmdargs{"config"});

# Create the main queue. It is used to store and process all events which are
# reported and enqueued by the worker threads.
my $queue :shared = new Thread::Queue or die "Could not create new, empty queue. $!\n";;

# Call Init function to initzialize guardian.
&Init();

# Infinite main loop, which processes all queued events.
while(1) {
	# Get the amount of elements in our queue.
	# "undef" will be returned if it is empty.
	my $current_events = $queue->pending();

	# If there is at least one element enqued
	if($current_events > 0) {
		# Grab the data of the top enqueued event.
		my $event = $queue->peek();

		print "Got event: $event\n";

		# Drop processed event from queue.
		$queue->dequeue();
	}

	# XXX
	# Temporary workaround to reduce the load of the main process.
	sleep(1);
}

#
## Init function.
#
## This function contains code which has to be executed while guardian
## is starting.
#
sub Init () {
	# Setup IPC mechanism via Socket in an own thread.
	threads->create(\&Socket);

	# Loop through the array of which files should be monitored and
	# create a worker thread for each single one.
	foreach my $monitored_file (@monitored_files) {
		# Check if the file exists and is readable.
		if (-r "$monitored_file") {
			# Create worker thread for the file.
			threads->create(\&Worker,$monitored_file);
		}
	}
}

#
## Worker function.
#
## This function is responsible for monitoring modifications of the given logfile,
## read them and pass them to the message parser.
#
## To get file modifications the inotify subsystem of the linux kernel is used.
#
## In order to prevent from permanently read and keep files opened, or dealing
## with huge logfiles, at initialization time of the worker process, the file will
## be opened once and the cursor position of the end of file (EOF) get stored. When
## reading any newly added lines from the file, we directly can jump to the last
## known position and get these lines. Afterwards, we store the current curser position
## again, so we can do it in this way over and over again.
#
## All read lines get stored in an array, which will be passed to the Parser.
#
## If any response (action) from the parser get recieved, it will be put into the
## shared event queue.
#
sub Worker ($) {
	my $file = @_[0];

	# Get the fileposition.
	my $fileposition = &Init_fileposition("$file");

	# Create inotify watcher.
	my $watcher = new Linux::Inotify2 or die "Could not use inotify. $!\n";

	# Monitor the specified file.
	$watcher->watch("$file", IN_MODIFY) or die "Could not monitor $file. $!\n";

	# Get all notifications.
	while ($watcher->read) {
		my @message = ();

		# Open the file.
		open (FILE, $file) or die "Could not open $file. $!\n";

		# Seek to the last known position.
		seek (FILE, $fileposition, 0);

		# Get the log message.
		while (my $line = <FILE>) {
			# Remove any newlines.
			chomp $line;

			# Add all lines to the message array.
			push (@message, $line);
		}

		# Update fileposition.
		$fileposition = tell(FILE);

		# Close file.
		close(FILE);

		# Send filename and message to the parser,
		# which will return if an action has to be performed.
		my @action = &Guardian::Parser::Parser("$file", @message);

		# Send the action to the main process and put it into
		# the queue.
		if (@action) {
			# Lock the queue.
			lock($queue);

			# Put the required action into the queue.
			$queue->enqueue(@action);
		}
	}
}

#
## Socket function.
#
## This function uses the Socket module to create and listen to an UNIX socket.
## It automatically accepts all incomming connections and pass the recieved
## data messages to the the Message_Parser function which is also part of the
## socket module.
#
## If a valid command has been sent through the socket, the corresponding event
## will be enqueued into the shared event queue.
#
sub Socket () {
	# Create the Server socket by calling the responsible function.
	my $server = &Guardian::Socket::Server();

        # Accept incomming connections from the socket.
        while (my $connection = $server->accept()) {
		# Autoflush the socket after the data
		# has been recieved.
		$connection->autoflush(1);

		# Gather all data from the connection.
		while (my $message = <$connection>) {
			# Remove any newlines.
			chomp($message);

			# Send the recieved data message to the
			# socket parser.
			my $action = &Guardian::Socket::Message_Parser($message);

			# If the parser returns to perform an action,
			# add it to the main event queue.
			if ($action) {
				# Lock the queue.
				lock($queue);

				# Enqueue the returned action.
				$queue->enqueue($action);
			}
		}
	}
}

#
## Function for fileposition initialization.
#
## This function is used to get the cursor position of the end of file (EOF) of
## a specified file.
#
## In order to prevent from permanently read and keep files opened, or dealing
## with huge logfiles, at initialization time of the worker processes, the file will
## be opened once and the cursor position of the end of file (EOF) get stored.
#
sub Init_fileposition ($) {
	my $file = $_[0];

	# Open the file.
	open(FILE, $file) or die "Could not open $file. $!\n";

	# Just seek to the end of the file (EOF).
	seek(FILE, 0, 2);

	# Get and store the position.
	my $position = tell(FILE),

	# Close the file again.
	close(FILE);

	# Return the position.
	return $position;
}
Commit	Line	Data
88d9af2c SS	1	#!/usr/bin/perl
	2	###############################################################################
	3	# #
	4	# IPFire.org - A linux based firewall #
	5	# Copyright (C) 2015 IPFire Development Team #
	6	# #
	7	# This program is free software: you can redistribute it and/or modify #
	8	# it under the terms of the GNU General Public License as published by #
	9	# the Free Software Foundation, either version 3 of the License, or #
	10	# (at your option) any later version. #
	11	# #
	12	# This program is distributed in the hope that it will be useful, #
	13	# but WITHOUT ANY WARRANTY; without even the implied warranty of #
	14	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
	15	# GNU General Public License for more details. #
	16	# #
	17	# You should have received a copy of the GNU General Public License #
	18	# along with this program. If not, see <http://www.gnu.org/licenses/>. #
	19	# #
	20	###############################################################################
	21
	22	use strict;
	23	use threads;
	24	use threads::shared;
45bf2a03	25	use Getopt::Long;
88d9af2c SS	26	use Thread::Queue;
	27	use Linux::Inotify2;
	28
45bf2a03	29	require Guardian::Config;
88d9af2c	30	require Guardian::Parser;
6abac3d4	31	require Guardian::Socket;
88d9af2c	32
45bf2a03 SS	33	# Define version.
	34	my $version ="2.0";
	35
88d9af2c SS	36	# Array to store the monitored logfiles.
	37	my @monitored_files = (
	38	"/var/log/snort/alert",
	39	);
	40
45bf2a03 SS	41	# Get and store the given command line arguments in a hash.
	42	my %cmdargs = ();
	43
	44	&GetOptions (\%cmdargs,
	45	'foreground\|f',
	46	'config\|c=s',
	47	'help\|h',
	48	'version\|v',
	49	);
	50
	51	# Show help / version information.
	52	if (defined($cmdargs{"help"})) {
	53	print "Guardian $version \n";
	54	print "Usage: guardian <optional arguments>\n";
	55	print " -c, --config\t\tspecifiy a configuration file other than the default (/etc/guardian/guardian.conf)\n";
	56	print " -f, --foreground\trun in the foreground (doesn't fork, any output goes to STDOUT)\n";
	57	print " -h, --help\t\tshows this help\n";
	58	print " -v, --version\t\tdisplay programm version and exit.\n";
	59	exit;
	60	} elsif (defined($cmdargs{"version"})) {
	61	print "Guardian $version \n";
	62	exit;
	63	}
	64
	65	# Read-in the configuration file and store the settings.
	66	# Push the may be given config file argument.
	67	my %mainsettings = &Guardian::Config::UseConfig($cmdargs{"config"});
	68
88d9af2c SS	69	# Create the main queue. It is used to store and process all events which are
	70	# reported and enqueued by the worker threads.
	71	my $queue :shared = new Thread::Queue or die "Could not create new, empty queue. $!\n";;
	72
	73	# Call Init function to initzialize guardian.
	74	&Init();
	75
	76	# Infinite main loop, which processes all queued events.
	77	while(1) {
	78	# Get the amount of elements in our queue.
	79	# "undef" will be returned if it is empty.
	80	my $current_events = $queue->pending();
	81
	82	# If there is at least one element enqued
	83	if($current_events > 0) {
	84	# Grab the data of the top enqueued event.
	85	my $event = $queue->peek();
	86
	87	print "Got event: $event\n";
	88
	89	# Drop processed event from queue.
	90	$queue->dequeue();
	91	}
	92
	93	# XXX
	94	# Temporary workaround to reduce the load of the main process.
	95	sleep(1);
	96	}
	97
	98	#
	99	## Init function.
	100	#
	101	## This function contains code which has to be executed while guardian
	102	## is starting.
	103	#
	104	sub Init () {
6abac3d4 SS	105	# Setup IPC mechanism via Socket in an own thread.
	106	threads->create(\&Socket);
	107
88d9af2c SS	108	# Loop through the array of which files should be monitored and
	109	# create a worker thread for each single one.
	110	foreach my $monitored_file (@monitored_files) {
	111	# Check if the file exists and is readable.
	112	if (-r "$monitored_file") {
	113	# Create worker thread for the file.
	114	threads->create(\&Worker,$monitored_file);
	115	}
	116	}
	117	}
	118
	119	#
	120	## Worker function.
	121	#
	122	## This function is responsible for monitoring modifications of the given logfile,
	123	## read them and pass them to the message parser.
	124	#
	125	## To get file modifications the inotify subsystem of the linux kernel is used.
	126	#
	127	## In order to prevent from permanently read and keep files opened, or dealing
	128	## with huge logfiles, at initialization time of the worker process, the file will
	129	## be opened once and the cursor position of the end of file (EOF) get stored. When
	130	## reading any newly added lines from the file, we directly can jump to the last
	131	## known position and get these lines. Afterwards, we store the current curser position
	132	## again, so we can do it in this way over and over again.
	133	#
	134	## All read lines get stored in an array, which will be passed to the Parser.
	135	#
	136	## If any response (action) from the parser get recieved, it will be put into the
	137	## shared event queue.
	138	#
	139	sub Worker ($) {
	140	my $file = @_[0];
	141
	142	# Get the fileposition.
	143	my $fileposition = &Init_fileposition("$file");
	144
	145	# Create inotify watcher.
	146	my $watcher = new Linux::Inotify2 or die "Could not use inotify. $!\n";
	147
	148	# Monitor the specified file.
	149	$watcher->watch("$file", IN_MODIFY) or die "Could not monitor $file. $!\n";
	150
	151	# Get all notifications.
	152	while ($watcher->read) {
	153	my @message = ();
	154
	155	# Open the file.
	156	open (FILE, $file) or die "Could not open $file. $!\n";
	157
	158	# Seek to the last known position.
	159	seek (FILE, $fileposition, 0);
	160
	161	# Get the log message.
	162	while (my $line = <FILE>) {
	163	# Remove any newlines.
	164	chomp $line;
	165
	166	# Add all lines to the message array.
	167	push (@message, $line);
	168	}
	169
	170	# Update fileposition.
	171	$fileposition = tell(FILE);
172
173	# Close file.
174	close(FILE);
175
176	# Send filename and message to the parser,
177	# which will return if an action has to be performed.
178	my @action = &Guardian::Parser::Parser("$file", @message);
179
180	# Send the action to the main process and put it into
181	# the queue.
182	if (@action) {
183	# Lock the queue.
184	lock($queue);
185
186	# Put the required action into the queue.
187	$queue->enqueue(@action);
188	}
189	}
190	}
191
6abac3d4 SS	192	#
	193	## Socket function.
	194	#
	195	## This function uses the Socket module to create and listen to an UNIX socket.
	196	## It automatically accepts all incomming connections and pass the recieved
	197	## data messages to the the Message_Parser function which is also part of the
	198	## socket module.
	199	#
	200	## If a valid command has been sent through the socket, the corresponding event
	201	## will be enqueued into the shared event queue.
	202	#
	203	sub Socket () {
	204	# Create the Server socket by calling the responsible function.
	205	my $server = &Guardian::Socket::Server();
	206
	207	# Accept incomming connections from the socket.
	208	while (my $connection = $server->accept()) {
	209	# Autoflush the socket after the data
	210	# has been recieved.
	211	$connection->autoflush(1);
	212
	213	# Gather all data from the connection.
	214	while (my $message = <$connection>) {
	215	# Remove any newlines.
	216	chomp($message);
	217
	218	# Send the recieved data message to the
	219	# socket parser.
	220	my $action = &Guardian::Socket::Message_Parser($message);
	221
	222	# If the parser returns to perform an action,
	223	# add it to the main event queue.
	224	if ($action) {
	225	# Lock the queue.
	226	lock($queue);
	227
	228	# Enqueue the returned action.
	229	$queue->enqueue($action);
	230	}
	231	}
	232	}
	233	}
	234
88d9af2c SS	235	#
	236	## Function for fileposition initialization.
	237	#
	238	## This function is used to get the cursor position of the end of file (EOF) of
	239	## a specified file.
	240	#
	241	## In order to prevent from permanently read and keep files opened, or dealing
	242	## with huge logfiles, at initialization time of the worker processes, the file will
	243	## be opened once and the cursor position of the end of file (EOF) get stored.
	244	#
	245	sub Init_fileposition ($) {
	246	my $file = $_[0];
	247
	248	# Open the file.
	249	open(FILE, $file) or die "Could not open $file. $!\n";
	250
	251	# Just seek to the end of the file (EOF).
	252	seek(FILE, 0, 2);
	253
	254	# Get and store the position.
	255	my $position = tell(FILE),
	256
	257	# Close the file again.
	258	close(FILE);
	259
	260	# Return the position.
	261	return $position;
	262	}