[people/stevee/guardian.git] / guardian

#!/usr/bin/perl
###############################################################################
#                                                                             #
# IPFire.org - A linux based firewall                                         #
# Copyright (C) 2015  IPFire Development Team                                 #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
###############################################################################

use strict;
use threads;
use threads::shared;
use Getopt::Long;
use Thread::Queue;
use Linux::Inotify2;
use Time::HiRes qw[ time sleep ];

require Guardian::Base;
require Guardian::Config;
require Guardian::Daemon;
require Guardian::Logger;
require Guardian::Parser;
require Guardian::Socket;

use warnings;

# Disable warnings of unjoinded threads when stopping guardian.
no warnings 'threads';

# Define version.
my $version ="2.0";

# Get and store the given command line arguments in a hash.
my %cmdargs = ();

&GetOptions (\%cmdargs,
	'foreground|f',
	'config|c=s',
	'help|h',
	'version|v',
);

# Show help / version information.
if (defined($cmdargs{"help"})) {
	print "Guardian $version \n";
	print "Usage: guardian <optional arguments>\n";
	print " -c, --config\t\tspecifiy a configuration file other than the default (/etc/guardian/guardian.conf)\n";
	print " -f, --foreground\trun in the foreground (doesn't fork, any output goes to STDOUT)\n";
	print " -h, --help\t\tshows this help\n";
	print " -v, --version\t\tdisplay programm version and exit.\n";
	exit;
} elsif (defined($cmdargs{"version"})) {
	print "Guardian $version \n";
	exit;
}

# Read-in the configuration file and store the settings.
# Push the may be given config file argument.
my %mainsettings = &Guardian::Config::UseConfig($cmdargs{"config"});

# Initialize Logger.
my $logger = Guardian::Logger->Init(%mainsettings);
$logger->Log("debug", "Logger successfully initialized...");

# Add the logger object to the mainsettings for passing
# it to the modules.
$mainsettings{Logger} = $logger;

# Redirect perls "die" messages to the logger before exiting.
$SIG{__DIE__} = sub { $logger->Log("err", "@_"); };

# Shared hash between the main process and all threads. It will store all
# monitored files and their current file position.
my %monitored_files :shared = ();

# Create the main queue. It is used to store and process all events which are
# reported and enqueued by the worker threads.
my $queue :shared = new Thread::Queue or die "Could not create new, empty queue. $!";;

# Array to store all currently running worker objects.
# (Does not include the socket thread)
my @running_workers;

# Check if guardian should be daemonized or keep in the foreground.
unless (defined($cmdargs{"foreground"})) {
	# Fork into background.
	&Guardian::Daemon::Daemonize();
} else {
	# Write PID (process-id).
	&Guardian::Daemon::WritePID();
}

# Call Init function to initzialize guardian.
&Init();

# Infinite main loop, which processes all queued events.
while(1) {
	# Get the amount of elements in our queue.
	# "undef" will be returned if it is empty.
	my $current_events = $queue->pending();

	# If there is at least one element enqued
	if($current_events > 0) {
		# Grab the data of the top enqueued event.
		my $event = $queue->peek();

		# Log processed event.
		$logger->Log("debug", "QUEUE - Processed event: $event");

		# Drop processed event from queue.
		$queue->dequeue();
	}

	# Sleep 10ms to reduce the load of the main process.
	sleep(0.01);
}

#
## Init function.
#
## This function contains code which has to be executed while guardian
## is starting.
#
sub Init () {
	# Setup signal handler.
	&SignalHandler();

	# Setup IPC mechanism via Socket in an own thread.
	threads->create(\&Socket);

	# Generate hash of monitored files.
	%monitored_files = &Guardian::Base::GenerateMonitoredFiles(\%mainsettings, \%monitored_files);

	# Start worker threads.
	&StartWorkers();
}

#
## Worker function.
#
## This function is responsible for monitoring modifications of the given logfile,
## read them and pass them to the message parser.
#
## To get file modifications the inotify subsystem of the linux kernel is used.
#
## In order to prevent from permanently read and keep files opened, or dealing
## with huge logfiles, at initialization time of the worker process, the file will
## be opened once and the cursor position of the end of file (EOF) get stored. When
## reading any newly added lines from the file, we directly can jump to the last
## known position and get these lines. Afterwards, we store the current curser position
## again, so we can do it in this way over and over again.
#
## All read lines get stored in an array, which will be passed to the Parser.
#
## If any response (action) from the parser get recieved, it will be put into the
## shared event queue.
#
sub Worker ($) {
	my $file = $_[0];

	# Signal handler to kill worker.
	$SIG{'KILL'} = sub { threads->exit(); };

	# Create inotify watcher.
	my $watcher = new Linux::Inotify2 or die "Could not use inotify. $!";

	# Monitor the specified file.
	$watcher->watch("$file", IN_MODIFY) or die "Could not monitor $file. $!";

	# Switch watcher into non-blocking mode.
	$watcher->blocking(0);

	# Log successfully spawned worker.
	$logger->Log("debug", "Spawned worker thread for: $file");

	# Infinite loop.
	while(1) {
		# Check for any events and perform them, if there
		# is a least one.
		if ($watcher->read) {
			my @message = ();

			# Obtain fileposition from hash.
			my $fileposition = $monitored_files{$file};

			# Open the file.
			open (FILE, $file) or die "Could not open $file. $!";

			# Seek to the last known position.
			seek (FILE, $fileposition, 0);

			# Get the log message.
			while (my $line = <FILE>) {
				# Remove any newlines.
				chomp $line;

				# Add all lines to the message array.
				push (@message, $line);
			}

			{
				# Lock shared hash.
				lock(%monitored_files);

				# Update fileposition.
				$monitored_files{$file} = tell(FILE);
			}

			# Close file.
			close(FILE);

			# Send filename and message to the parser,
			# which will return if an action has to be performed.
			my @action = &Guardian::Parser::Parser("$file", @message);

			# Send the action to the main process and put it into
			# the queue.
			if (@action) {
				# Lock the queue.
				lock($queue);

				# Put the required action into the queue.
				$queue->enqueue(@action);
			}
		} else {
			# Sleep for 10ms until the next round of the loop will start.
			sleep(0.01);
		}
	}
}

#
## Socket function.
#
## This function uses the Socket module to create and listen to an UNIX socket.
## It automatically accepts all incomming connections and pass the recieved
## data messages to the the Message_Parser function which is also part of the
## socket module.
#
## If a valid command has been sent through the socket, the corresponding event
## will be enqueued into the shared event queue.
#
sub Socket () {
	# Create the Server socket by calling the responsible function.
	my $server = &Guardian::Socket::Server();

	# Log successfull creation of socket.
	$logger->Log("debug", "Listening to Socket...");

        # Accept incomming connections from the socket.
        while (my $connection = $server->accept()) {
		# Autoflush the socket after the data
		# has been recieved.
		$connection->autoflush(1);

		# Gather all data from the connection.
		while (my $message = <$connection>) {
			# Remove any newlines.
			chomp($message);

			# Log recieved socket command.
			$logger->Log("debug", "Socket - Recieved message: $message");

			# Send the recieved data message to the
			# socket parser.
			my $action = &Guardian::Socket::Message_Parser($message);

			# If the parser returns to perform an action,
			# add it to the main event queue.
			if ($action) {
				# Lock the queue.
				lock($queue);

				# Enqueue the returned action.
				$queue->enqueue($action);
			}
		}
	}
}

#
## Function for capturing process signals.
#
## This function captures any sent process signals and will call various
## actions, basend on the captured signal.
#
sub SignalHandler {
	$SIG{INT} = \&Shutdown;
	$SIG{TERM} = \&Shutdown;
	$SIG{QUIT} = \&Shutdown;
	$SIG{HUP} = \&Reload;
}

#
## Function to start the workers (threads) for all monitored files.
#
## This function will loop through the hash of monitored files and will
## spawn an own thread based worker for each file. Every created worker will
## be added to the array of running workers.
#
sub StartWorkers () {
	# Loop through the hash which contains the monitored files and start
	# a worker thread for each single one.
	foreach my $file (keys %monitored_files) {
		$logger->Log("debug", "Starting worker thread for $file");
		# Create worker thread for the file.
		push @running_workers, threads->create(\&Worker,$file);
	}
}

#
## Function to stop all running workers.
#
## This function is used to stop all currently running workers and will be
## called when reloading or shutting down guardian.
#
sub StopWorkers () {
	# Loop through all running workers.
	foreach my $worker (@running_workers) {
		# Send the worker the "KILL" signal and detach the
		# thread so perl can do an automatically clean-up.
		$worker->kill('KILL');
	}
	$logger->Log("debug", "All workers are stopped now...");
}

#
## Reload function.
#
## This function will get called if the signal handler recieves a "SIGHUP" signal,
## or the reload command will be sent via socket connection. It is responsible for
## reloading all configure options and stopping/starting the worker threads.
#
sub Reload () {
	# Log reload.
	$logger->Log("info", "Reload configuration...");

	# Stop all running workers.
	&StopWorkers();

	# Re-read configuration file.
	%mainsettings = &Guardian::Config::UseConfig($cmdargs{"config"});

	# Update Logger settings.
	$logger = Guardian::Logger->Init(%mainsettings);

	# Update logger object in mainsettings hash.
	$mainsettings{Logger} = $logger;

	# Re-generate hash of monitored files.
	%monitored_files = &Guardian::Base::GenerateMonitoredFiles(\%mainsettings, \%monitored_files);

	# Restart the worker threads.
	&StartWorkers();
}

#
## Shutdown function.
#
## This function is used to do a clean shutdown of guardian. It will be called
## by the signal handler when recieving INT (2), QUIT (3) and TERM (15) signals.
#
sub Shutdown () {
	# Log shutdown.
	$logger->Log("info", "Shutting down...");

	# Stop all workers.
	&StopWorkers();

	# Remove socket file on exit.
	&Guardian::Socket::RemoveSocketFile();

	# Remove pid file on exit.
	&Guardian::Daemon::RemovePIDFile();

	# Sleep for one second to give perl some
	# time to proper clean up everything before
	# exiting.
	sleep(1);

	# Log good bye message.
	$logger->Log("debug", "Good Bye!");

	# Exit guardian.
	exit;
}
Commit	Line	Data
	1	#!/usr/bin/perl
	2	###############################################################################
	3	# #
	4	# IPFire.org - A linux based firewall #
	5	# Copyright (C) 2015 IPFire Development Team #
	6	# #
	7	# This program is free software: you can redistribute it and/or modify #
	8	# it under the terms of the GNU General Public License as published by #
	9	# the Free Software Foundation, either version 3 of the License, or #
	10	# (at your option) any later version. #
	11	# #
	12	# This program is distributed in the hope that it will be useful, #
	13	# but WITHOUT ANY WARRANTY; without even the implied warranty of #
	14	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
	15	# GNU General Public License for more details. #
	16	# #
	17	# You should have received a copy of the GNU General Public License #
	18	# along with this program. If not, see <http://www.gnu.org/licenses/>. #
	19	# #
	20	###############################################################################
	21
	22	use strict;
	23	use threads;
	24	use threads::shared;
	25	use Getopt::Long;
	26	use Thread::Queue;
	27	use Linux::Inotify2;
	28	use Time::HiRes qw[ time sleep ];
	29
	30	require Guardian::Base;
	31	require Guardian::Config;
	32	require Guardian::Daemon;
	33	require Guardian::Logger;
	34	require Guardian::Parser;
	35	require Guardian::Socket;
	36
	37	use warnings;
	38
	39	# Disable warnings of unjoinded threads when stopping guardian.
	40	no warnings 'threads';
	41
	42	# Define version.
	43	my $version ="2.0";
	44
	45	# Get and store the given command line arguments in a hash.
	46	my %cmdargs = ();
	47
	48	&GetOptions (\%cmdargs,
	49	'foreground\|f',
	50	'config\|c=s',
	51	'help\|h',
	52	'version\|v',
	53	);
	54
	55	# Show help / version information.
	56	if (defined($cmdargs{"help"})) {
	57	print "Guardian $version \n";
	58	print "Usage: guardian <optional arguments>\n";
	59	print " -c, --config\t\tspecifiy a configuration file other than the default (/etc/guardian/guardian.conf)\n";
	60	print " -f, --foreground\trun in the foreground (doesn't fork, any output goes to STDOUT)\n";
	61	print " -h, --help\t\tshows this help\n";
	62	print " -v, --version\t\tdisplay programm version and exit.\n";
	63	exit;
	64	} elsif (defined($cmdargs{"version"})) {
	65	print "Guardian $version \n";
	66	exit;
	67	}
	68
	69	# Read-in the configuration file and store the settings.
	70	# Push the may be given config file argument.
	71	my %mainsettings = &Guardian::Config::UseConfig($cmdargs{"config"});
	72
	73	# Initialize Logger.
	74	my $logger = Guardian::Logger->Init(%mainsettings);
	75	$logger->Log("debug", "Logger successfully initialized...");
	76
	77	# Add the logger object to the mainsettings for passing
	78	# it to the modules.
	79	$mainsettings{Logger} = $logger;
	80
	81	# Redirect perls "die" messages to the logger before exiting.
	82	$SIG{__DIE__} = sub { $logger->Log("err", "@_"); };
	83
	84	# Shared hash between the main process and all threads. It will store all
	85	# monitored files and their current file position.
	86	my %monitored_files :shared = ();
	87
	88	# Create the main queue. It is used to store and process all events which are
	89	# reported and enqueued by the worker threads.
	90	my $queue :shared = new Thread::Queue or die "Could not create new, empty queue. $!";;
	91
	92	# Array to store all currently running worker objects.
	93	# (Does not include the socket thread)
	94	my @running_workers;
	95
	96	# Check if guardian should be daemonized or keep in the foreground.
	97	unless (defined($cmdargs{"foreground"})) {
	98	# Fork into background.
	99	&Guardian::Daemon::Daemonize();
	100	} else {
	101	# Write PID (process-id).
	102	&Guardian::Daemon::WritePID();
	103	}
	104
	105	# Call Init function to initzialize guardian.
	106	&Init();
	107
	108	# Infinite main loop, which processes all queued events.
	109	while(1) {
	110	# Get the amount of elements in our queue.
	111	# "undef" will be returned if it is empty.
	112	my $current_events = $queue->pending();
	113
	114	# If there is at least one element enqued
	115	if($current_events > 0) {
	116	# Grab the data of the top enqueued event.
	117	my $event = $queue->peek();
	118
	119	# Log processed event.
	120	$logger->Log("debug", "QUEUE - Processed event: $event");
	121
	122	# Drop processed event from queue.
	123	$queue->dequeue();
	124	}
	125
	126	# Sleep 10ms to reduce the load of the main process.
	127	sleep(0.01);
	128	}
	129
	130	#
	131	## Init function.
	132	#
	133	## This function contains code which has to be executed while guardian
	134	## is starting.
	135	#
	136	sub Init () {
	137	# Setup signal handler.
	138	&SignalHandler();
	139
	140	# Setup IPC mechanism via Socket in an own thread.
	141	threads->create(\&Socket);
	142
	143	# Generate hash of monitored files.
	144	%monitored_files = &Guardian::Base::GenerateMonitoredFiles(\%mainsettings, \%monitored_files);
	145
	146	# Start worker threads.
	147	&StartWorkers();
	148	}
	149
	150	#
	151	## Worker function.
	152	#
	153	## This function is responsible for monitoring modifications of the given logfile,
	154	## read them and pass them to the message parser.
	155	#
	156	## To get file modifications the inotify subsystem of the linux kernel is used.
	157	#
	158	## In order to prevent from permanently read and keep files opened, or dealing
	159	## with huge logfiles, at initialization time of the worker process, the file will
	160	## be opened once and the cursor position of the end of file (EOF) get stored. When
	161	## reading any newly added lines from the file, we directly can jump to the last
	162	## known position and get these lines. Afterwards, we store the current curser position
	163	## again, so we can do it in this way over and over again.
	164	#
	165	## All read lines get stored in an array, which will be passed to the Parser.
	166	#
	167	## If any response (action) from the parser get recieved, it will be put into the
	168	## shared event queue.
	169	#
	170	sub Worker ($) {
	171	my $file = $_[0];
	172
	173	# Signal handler to kill worker.
	174	$SIG{'KILL'} = sub { threads->exit(); };
	175
	176	# Create inotify watcher.
	177	my $watcher = new Linux::Inotify2 or die "Could not use inotify. $!";
	178
	179	# Monitor the specified file.
	180	$watcher->watch("$file", IN_MODIFY) or die "Could not monitor $file. $!";
	181
	182	# Switch watcher into non-blocking mode.
	183	$watcher->blocking(0);
	184
	185	# Log successfully spawned worker.
	186	$logger->Log("debug", "Spawned worker thread for: $file");
	187
	188	# Infinite loop.
	189	while(1) {
	190	# Check for any events and perform them, if there
	191	# is a least one.
	192	if ($watcher->read) {
	193	my @message = ();
	194
	195	# Obtain fileposition from hash.
	196	my $fileposition = $monitored_files{$file};
	197
	198	# Open the file.
	199	open (FILE, $file) or die "Could not open $file. $!";
	200
	201	# Seek to the last known position.
	202	seek (FILE, $fileposition, 0);
	203
	204	# Get the log message.
	205	while (my $line = <FILE>) {
	206	# Remove any newlines.
	207	chomp $line;
	208
	209	# Add all lines to the message array.
	210	push (@message, $line);
	211	}
	212
	213	{
	214	# Lock shared hash.
	215	lock(%monitored_files);
	216
	217	# Update fileposition.
	218	$monitored_files{$file} = tell(FILE);
	219	}
	220
	221	# Close file.
	222	close(FILE);
	223
	224	# Send filename and message to the parser,
	225	# which will return if an action has to be performed.
	226	my @action = &Guardian::Parser::Parser("$file", @message);
	227
	228	# Send the action to the main process and put it into
	229	# the queue.
	230	if (@action) {
	231	# Lock the queue.
	232	lock($queue);
	233
	234	# Put the required action into the queue.
	235	$queue->enqueue(@action);
	236	}
	237	} else {
	238	# Sleep for 10ms until the next round of the loop will start.
	239	sleep(0.01);
	240	}
	241	}
	242	}
	243
	244	#
	245	## Socket function.
	246	#
	247	## This function uses the Socket module to create and listen to an UNIX socket.
	248	## It automatically accepts all incomming connections and pass the recieved
	249	## data messages to the the Message_Parser function which is also part of the
	250	## socket module.
	251	#
	252	## If a valid command has been sent through the socket, the corresponding event
	253	## will be enqueued into the shared event queue.
	254	#
	255	sub Socket () {
	256	# Create the Server socket by calling the responsible function.
	257	my $server = &Guardian::Socket::Server();
	258
	259	# Log successfull creation of socket.
	260	$logger->Log("debug", "Listening to Socket...");
	261
	262	# Accept incomming connections from the socket.
	263	while (my $connection = $server->accept()) {
	264	# Autoflush the socket after the data
	265	# has been recieved.
	266	$connection->autoflush(1);
	267
	268	# Gather all data from the connection.
	269	while (my $message = <$connection>) {
	270	# Remove any newlines.
	271	chomp($message);
	272
	273	# Log recieved socket command.
	274	$logger->Log("debug", "Socket - Recieved message: $message");
	275
	276	# Send the recieved data message to the
	277	# socket parser.
	278	my $action = &Guardian::Socket::Message_Parser($message);
	279
	280	# If the parser returns to perform an action,
	281	# add it to the main event queue.
	282	if ($action) {
	283	# Lock the queue.
	284	lock($queue);
	285
	286	# Enqueue the returned action.
	287	$queue->enqueue($action);
	288	}
	289	}
	290	}
	291	}
	292
	293	#
	294	## Function for capturing process signals.
	295	#
	296	## This function captures any sent process signals and will call various
	297	## actions, basend on the captured signal.
	298	#
	299	sub SignalHandler {
	300	$SIG{INT} = \&Shutdown;
	301	$SIG{TERM} = \&Shutdown;
	302	$SIG{QUIT} = \&Shutdown;
	303	$SIG{HUP} = \&Reload;
	304	}
	305
	306	#
	307	## Function to start the workers (threads) for all monitored files.
	308	#
	309	## This function will loop through the hash of monitored files and will
	310	## spawn an own thread based worker for each file. Every created worker will
	311	## be added to the array of running workers.
	312	#
	313	sub StartWorkers () {
	314	# Loop through the hash which contains the monitored files and start
	315	# a worker thread for each single one.
	316	foreach my $file (keys %monitored_files) {
	317	$logger->Log("debug", "Starting worker thread for $file");
	318	# Create worker thread for the file.
	319	push @running_workers, threads->create(\&Worker,$file);
	320	}
	321	}
	322
	323	#
	324	## Function to stop all running workers.
	325	#
	326	## This function is used to stop all currently running workers and will be
	327	## called when reloading or shutting down guardian.
	328	#
	329	sub StopWorkers () {
	330	# Loop through all running workers.
	331	foreach my $worker (@running_workers) {
	332	# Send the worker the "KILL" signal and detach the
	333	# thread so perl can do an automatically clean-up.
	334	$worker->kill('KILL');
	335	}
	336	$logger->Log("debug", "All workers are stopped now...");
	337	}
	338
	339	#
	340	## Reload function.
	341	#
	342	## This function will get called if the signal handler recieves a "SIGHUP" signal,
	343	## or the reload command will be sent via socket connection. It is responsible for
	344	## reloading all configure options and stopping/starting the worker threads.
	345	#
	346	sub Reload () {
	347	# Log reload.
	348	$logger->Log("info", "Reload configuration...");
	349
	350	# Stop all running workers.
	351	&StopWorkers();
	352
	353	# Re-read configuration file.
	354	%mainsettings = &Guardian::Config::UseConfig($cmdargs{"config"});
	355
	356	# Update Logger settings.
	357	$logger = Guardian::Logger->Init(%mainsettings);
	358
	359	# Update logger object in mainsettings hash.
	360	$mainsettings{Logger} = $logger;
	361
	362	# Re-generate hash of monitored files.
	363	%monitored_files = &Guardian::Base::GenerateMonitoredFiles(\%mainsettings, \%monitored_files);
	364
	365	# Restart the worker threads.
	366	&StartWorkers();
	367	}
	368
	369	#
	370	## Shutdown function.
	371	#
	372	## This function is used to do a clean shutdown of guardian. It will be called
	373	## by the signal handler when recieving INT (2), QUIT (3) and TERM (15) signals.
	374	#
	375	sub Shutdown () {
	376	# Log shutdown.
	377	$logger->Log("info", "Shutting down...");
	378
	379	# Stop all workers.
	380	&StopWorkers();
	381
	382	# Remove socket file on exit.
	383	&Guardian::Socket::RemoveSocketFile();
	384
	385	# Remove pid file on exit.
	386	&Guardian::Daemon::RemovePIDFile();
	387
	388	# Sleep for one second to give perl some
	389	# time to proper clean up everything before
	390	# exiting.
	391	sleep(1);
	392
	393	# Log good bye message.
	394	$logger->Log("debug", "Good Bye!");
	395
	396	# Exit guardian.
	397	exit;
	398	}