]> git.ipfire.org Git - thirdparty/sarg.git/blame - authfail.c
Modular reading of some input log formats
[thirdparty/sarg.git] / authfail.c
CommitLineData
25697a35 1/*
94ff9470 2 * SARG Squid Analysis Report Generator http://sarg.sourceforge.net
61d965f3 3 * 1998, 2012
94ff9470
GS
4 *
5 * SARG donations:
6 * please look at http://sarg.sourceforge.net/donations.php
1164c474
FM
7 * Support:
8 * http://sourceforge.net/projects/sarg/forums/forum/363374
25697a35
GS
9 * ---------------------------------------------------------------------
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
24 *
25 */
26
27#include "include/conf.h"
5f3cfd1d 28#include "include/defs.h"
16b013cc
FM
29#include "include/readlog.h"
30
31//! Name of the file containing the unsorted authentication failure entries.
32static char authfail_unsort[MAXLEN]="";
33//! The file handle to write the entries.
34static FILE *fp_authfail=NULL;
35//! \c True if at least one anthentication failure entry exists.
36static bool authfail_exists=false;
37
38/*!
39Open a file to store the authentication failure.
40
41\return The file handle or NULL if no file is necessary.
42*/
43void authfail_open(void)
44{
45 if ((ReportType & REPORT_TYPE_AUTH_FAILURES) == 0) {
46 if (debugz) debugaz(_("Authentication failure report not produced as it is not requested\n"));
47 return;
48 }
49 if (Privacy) {
50 if (debugz) debugaz(_("Authentication failure report not produced because privacy option is active\n"));
51 return;
52 }
53
54 snprintf(authfail_unsort,sizeof(authfail_unsort),"%s/authfail.int_unsort",tmp);
55 if ((fp_authfail=MY_FOPEN(authfail_unsort,"w"))==NULL) {
56 debuga(_("(log) Cannot open file: %s - %s\n"),authfail_unsort,strerror(errno));
57 exit(EXIT_FAILURE);
58 }
59 return;
60}
61
62/*!
63Write one entry in the unsorted authentication file file provided that it is required.
64
65\param log_entry The entry to write into the log file.
66*/
67void authfail_write(const struct ReadLogStruct *log_entry)
68{
69 char date[80];
70
71 if (fp_authfail && (strstr(log_entry->HttpCode,"DENIED/401") != 0 || strstr(log_entry->HttpCode,"DENIED/407") != 0)) {
72 strftime(date,sizeof(date),"%d/%m/%Y\t%H:%M:%S",log_entry->EntryTime);
73 fprintf(fp_authfail, "%s\t%s\t%s\t%s\n",date,log_entry->User,log_entry->Ip,log_entry->Url);
74 authfail_exists=true;
75 }
76}
77
78/*!
79Close the file opened by authfail_open().
80*/
81void authfail_close(void)
82{
83 if (fp_authfail)
84 {
85 if (fclose(fp_authfail)==EOF)
86 {
87 debuga(_("Write error in %s: %s\n"),authfail_unsort,strerror(errno));
88 exit(EXIT_FAILURE);
89 }
90 fp_authfail=NULL;
91 }
92}
93
94/*!
95Tell the caller if a authentication failure report exists.
96
97\return \c True if the report is available or \c false if no report
98was generated.
99*/
100bool is_authfail(void)
101{
102 return(authfail_exists);
103}
104
25697a35 105
7ae50eee
FM
106static void show_ignored_auth(FILE *fp_ou,int count)
107{
108 char ignored[80];
109
110 snprintf(ignored,sizeof(ignored),ngettext("%d more authentication failure not shown here…","%d more authentication failures not shown here…",count),count);
111 fprintf(fp_ou,"<tr><td class=\"data\"></td><td class=\"data\"></td><td class=\"data\"></td><td class=\"data2 more\">%s</td></tr>\n",ignored);
112}
113
32e71fa4 114void authfail_report(void)
25697a35 115{
9bd92830
FM
116 FILE *fp_in = NULL, *fp_ou = NULL;
117
118 char *buf;
119 char *url;
16b013cc 120 char authfail_sort[MAXLEN];
9bd92830
FM
121 char report[MAXLEN];
122 char ip[MAXLEN];
16b013cc 123 char oip[MAXLEN]="";
9bd92830 124 char user[MAXLEN];
16b013cc
FM
125 char ouser[MAXLEN]="";
126 char ouser2[MAXLEN]="";
9bd92830
FM
127 char data[15];
128 char hora[15];
9bd92830 129 char csort[MAXLEN];
16b013cc
FM
130 int z=0;
131 int count=0;
132 int cstatus;
9bd92830
FM
133 int day,month,year;
134 bool new_user;
135 struct getwordstruct gwarea;
136 longline line;
137 struct userinfostruct *uinfo;
138 struct tm t;
139
16b013cc 140 if (!authfail_exists) {
b378aaf1
FM
141 if (!KeepTempLog && unlink(authfail_unsort))
142 debuga(_("Failed to delete \"%s\": %s\n"),authfail_unsort,strerror(errno));
9bd92830 143
16b013cc 144 authfail_unsort[0]='\0';
9f93fec3 145 if (debugz) debugaz(_("Authentication failures report not produced because it is empty\n"));
9bd92830
FM
146 return;
147 }
148
16b013cc 149 snprintf(authfail_sort,sizeof(authfail_sort),"%s/authfail.int_log",tmp);
9bd92830
FM
150 snprintf(report,sizeof(report),"%s/authfail.html",outdirname);
151
16b013cc 152 snprintf(csort,sizeof(csort),"sort -b -t \"\t\" -T \"%s\" -k 3,3 -k 5,5 -o \"%s\" \"%s\"", tmp, authfail_sort, authfail_unsort);
9bd92830
FM
153 cstatus=system(csort);
154 if (!WIFEXITED(cstatus) || WEXITSTATUS(cstatus)) {
155 debuga(_("sort command return status %d\n"),WEXITSTATUS(cstatus));
156 debuga(_("sort command: %s\n"),csort);
157 exit(EXIT_FAILURE);
158 }
16b013cc
FM
159 if((fp_in=MY_FOPEN(authfail_sort,"r"))==NULL) {
160 debuga(_("(authfail) Cannot open file %s\n"),authfail_sort);
9bd92830
FM
161 debuga(_("sort command: %s\n"),csort);
162 exit(EXIT_FAILURE);
163 }
b378aaf1
FM
164 if (!KeepTempLog && unlink(authfail_unsort)) {
165 debuga(_("Cannot delete \"%s\": %s\n"),authfail_unsort,strerror(errno));
08f9b029
FM
166 exit(EXIT_FAILURE);
167 }
16b013cc 168 authfail_unsort[0]='\0';
9bd92830
FM
169
170 if((fp_ou=MY_FOPEN(report,"w"))==NULL) {
007905af
FM
171 debuga(_("(authfail) Cannot open file %s\n"),report);
172 exit(EXIT_FAILURE);
9bd92830
FM
173 }
174
175 write_html_header(fp_ou,(IndexTree == INDEX_TREE_DATE) ? 3 : 1,_("Authentication Failures"),HTML_JS_NONE);
176 fputs("<tr><td class=\"header_c\">",fp_ou);
177 fprintf(fp_ou,_("Period: %s"),period.html);
178 fputs("</td></tr>\n",fp_ou);
179 fprintf(fp_ou,"<tr><th class=\"header_c\">%s</th></tr>\n",_("Authentication Failures"));
180 close_html_header(fp_ou);
181
182 fputs("<div class=\"report\"><table cellpadding=\"0\" cellspacing=\"2\">\n",fp_ou);
183 fprintf(fp_ou,"<tr><th class=\"header_l\">%s</th><th class=\"header_l\">%s</th><th class=\"header_l\">%s</th><th class=\"header_l\">%s</th></tr>\n",_("USERID"),_("IP/NAME"),_("DATE/TIME"),_("ACCESSED SITE"));
184
185 if ((line=longline_create())==NULL) {
16b013cc 186 debuga(_("Not enough memory to read file %s\n"),authfail_sort);
9bd92830
FM
187 exit(EXIT_FAILURE);
188 }
189
190 while((buf=longline_read(fp_in,line))!=NULL) {
191 getword_start(&gwarea,buf);
192 if (getword(data,sizeof(data),&gwarea,'\t')<0) {
16b013cc 193 debuga(_("There is a broken date in file %s\n"),authfail_sort);
9bd92830
FM
194 exit(EXIT_FAILURE);
195 }
196 if (getword(hora,sizeof(hora),&gwarea,'\t')<0) {
16b013cc 197 debuga(_("There is a broken time in file %s\n"),authfail_sort);
9bd92830
FM
198 exit(EXIT_FAILURE);
199 }
200 if (getword(user,sizeof(user),&gwarea,'\t')<0) {
16b013cc 201 debuga(_("There is a broken user ID in file %s\n"),authfail_sort);
9bd92830
FM
202 exit(EXIT_FAILURE);
203 }
204 if (getword(ip,sizeof(ip),&gwarea,'\t')<0) {
16b013cc 205 debuga(_("There is a broken IP address in file %s\n"),authfail_sort);
9bd92830
FM
206 exit(EXIT_FAILURE);
207 }
208 if (getword_ptr(buf,&url,&gwarea,'\t')<0) {
16b013cc 209 debuga(_("There is a broken url in file %s\n"),authfail_sort);
9bd92830
FM
210 exit(EXIT_FAILURE);
211 }
212 if (sscanf(data,"%d/%d/%d",&day,&month,&year)!=3) continue;
213 computedate(year,month,day,&t);
214 strftime(data,sizeof(data),"%x",&t);
215
216 uinfo=userinfo_find_from_id(user);
217 if (!uinfo) {
16b013cc 218 debuga(_("Unknown user ID %s in file %s\n"),user,authfail_sort);
9bd92830
FM
219 exit(EXIT_FAILURE);
220 }
221
222 new_user=false;
223 if(z == 0) {
224 strcpy(ouser,user);
225 strcpy(oip,ip);
226 z++;
227 new_user=true;
228 } else {
229 if(strcmp(ouser,user) != 0) {
230 strcpy(ouser,user);
231 new_user=true;
232 }
233 if(strcmp(oip,ip) != 0) {
234 strcpy(oip,ip);
235 new_user=true;
236 }
237 }
238
007905af
FM
239 if(AuthfailReportLimit>0) {
240 if(strcmp(ouser2,uinfo->label) == 0) {
9bd92830
FM
241 count++;
242 } else {
7ae50eee
FM
243 if(count>AuthfailReportLimit && AuthfailReportLimit>0)
244 show_ignored_auth(fp_ou,count-AuthfailReportLimit);
9bd92830
FM
245 count=1;
246 strcpy(ouser2,uinfo->label);
247 }
7ae50eee 248 if(count > AuthfailReportLimit)
9bd92830
FM
249 continue;
250 }
251
252 fputs("<tr>",fp_ou);
253 if (new_user)
254 fprintf(fp_ou,"<td class=\"data2\">%s</td><td class=\"data2\">%s</td>",uinfo->label,ip);
255 else
256 fputs("<td class=\"data2\"></td><td class=\"data2\"></td>",fp_ou);
257 fprintf(fp_ou,"<td class=\"data2\">%s-%s</td><td class=\"data2\">",data,hora);
67a93701 258 if(BlockIt[0]!='\0' && url[0]!=ALIAS_PREFIX) {
9bd92830
FM
259 fprintf(fp_ou,"<a href=\"%s%s?url=",wwwDocumentRoot,BlockIt);
260 output_html_url(fp_ou,url);
261 fputs("\"><img src=\"../images/sarg-squidguard-block.png\"></a>&nbsp;",fp_ou);
262 }
6fa33a32 263 output_html_link(fp_ou,url,100);
67a93701 264 fputs("</td></th>\n",fp_ou);
9bd92830
FM
265 }
266 fclose(fp_in);
267 longline_destroy(&line);
268
7ae50eee
FM
269 if(count>AuthfailReportLimit && AuthfailReportLimit>0)
270 show_ignored_auth(fp_ou,count-AuthfailReportLimit);
271
9bd92830
FM
272 fputs("</table></div>\n",fp_ou);
273 if (write_html_trailer(fp_ou)<0)
274 debuga(_("Write error in file %s\n"),report);
275 if (fclose(fp_ou)==EOF)
276 debuga(_("Failed to close file %s - %s\n"),report,strerror(errno));
277
b378aaf1 278 if (!KeepTempLog && unlink(authfail_sort)) {
16b013cc 279 debuga(_("Cannot delete %s - %s\n"),authfail_sort,strerror(errno));
08f9b029
FM
280 exit(EXIT_FAILURE);
281 }
9bd92830
FM
282
283 return;
25697a35 284}
16b013cc
FM
285
286/*!
287Remove any temporary file left by the authfail module.
288*/
289void authfail_cleanup(void)
290{
291 if (fp_authfail)
292 {
293 fclose(fp_authfail);
294 fp_authfail=NULL;
295 }
296 if(authfail_unsort[0]) {
297 if (unlink(authfail_unsort)==-1)
298 debuga(_("Failed to delete %s: %s\n"),authfail_unsort,strerror(errno));
299 }
300}