authfail.c

   1 /*
   2  * SARG Squid Analysis Report Generator      http://sarg.sourceforge.net
   3  *                                                            1998, 2010
   4  *
   5  * SARG donations:
   6  *      please look at http://sarg.sourceforge.net/donations.php
   7  * Support:
   8  *     http://sourceforge.net/projects/sarg/forums/forum/363374
   9  * ---------------------------------------------------------------------
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, write to the Free Software
  23  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  24  *
  25  */
  26
  27 #include "include/conf.h"
  28 #include "include/defs.h"
  29
  30 void authfail_report(void)
  31 {
  32
  33    FILE *fp_in = NULL, *fp_ou = NULL;
  34
  35    char *buf;
  36    char *url;
  37    char authfail_in[MAXLEN];
  38    char per[MAXLEN];
  39    char report[MAXLEN];
  40    char period[100];
  41    char ip[MAXLEN];
  42    char oip[MAXLEN];
  43    char user[MAXLEN];
  44    char ouser[MAXLEN];
  45    char ouser2[MAXLEN];
  46    char data[15];
  47    char hora[15];
  48    char tmp4[MAXLEN];
  49    char csort[MAXLEN];
  50    int  z=0;
  51    int  count=0;
  52    int  cstatus;
  53    int new_user;
  54    struct getwordstruct gwarea;
  55    struct longlinestruct line;
  56    struct userinfostruct *uinfo;
  57
  58    if(DataFile[0] != '\0') return;
  59
  60    ouser[0]='\0';
  61    ouser2[0]='\0';
  62
  63    sprintf(tmp4,"%s/sarg/authfail.log.unsort",TempDir);
  64
  65    if(!authfail_count) {
  66       unlink(tmp4);
  67       return;
  68    }
  69
  70    sprintf(authfail_in,"%s/authfail.log",TempDir);
  71    sprintf(per,"%s/sarg-period",dirname);
  72    sprintf(report,"%s/authfail.html",dirname);
  73
  74    if ((fp_in = fopen(per, "r")) == 0) {
  75       fprintf(stderr, "SARG: (authfail) %s: %s\n",text[45],per);
  76       exit(1);
  77    }
  78    if (!fgets(period,sizeof(period),fp_in)) {
  79       debuga(_("(authfail) read error in %s"),per);
  80       exit(1);
  81    }
  82    fclose(fp_in);
  83
  84    sprintf(csort,"sort -b -T \"%s\" -k 3,3 -k 5,5 -o \"%s\" \"%s\"", TempDir, authfail_in, tmp4);
  85    cstatus=system(csort);
  86    if (!WIFEXITED(cstatus) || WEXITSTATUS(cstatus)) {
  87       debuga(_("sort command return status %d"),WEXITSTATUS(cstatus));
  88       debuga(_("sort command: %s"),csort);
  89       exit(1);
  90    }
  91    if((fp_in=MY_FOPEN(authfail_in,"r"))==NULL) {
  92       fprintf(stderr, "SARG: (authfail) %s: %s\n",text[45],authfail_in);
  93       debuga(_("sort command: %s"),csort);
  94       exit(1);
  95    }
  96    unlink(tmp4);
  97
  98    if((fp_ou=MY_FOPEN(report,"w"))==NULL) {
  99      fprintf(stderr, "SARG: (authfail) %s: %s\n",text[45],report);
 100      exit(1);
 101    }
 102
 103    write_html_header(fp_ou,(IndexTree == INDEX_TREE_DATE) ? 3 : 1,_("Authentication Failures"));
 104    fprintf(fp_ou,"<tr><td class=\"header_l\">%s: %s</td></tr>\n",text[89],period);
 105    fprintf(fp_ou,"<tr><th class=\"header_c\">%s</th></tr>\n",text[117]);
 106    close_html_header(fp_ou);
 107
 108    fputs("<div class=\"report\"><table cellpadding=\"0\" cellspacing=\"2\">\n",fp_ou);
 109    fputs("<tr><td></td></tr>\n",fp_ou);
 110    fputs("<tr><td></td></tr>\n",fp_ou);
 111    fputs("<tr><td></td></tr>\n",fp_ou);
 112    fprintf(fp_ou,"<tr><th class=\"header_l\">%s</th><th class=\"header_l\">%s</th><th class=\"header_l\">%s</th><th class=\"header_l\">%s</th></tr>\n",text[98],text[111],text[110],text[91]);
 113
 114    if (longline_prepare(&line)<0) {
 115       debuga(_("Not enough memory to read file %s"),authfail_in);
 116       exit(1);
 117    }
 118
 119    while((buf=longline_read(fp_in,&line))!=NULL) {
 120       getword_start(&gwarea,buf);
 121       if (getword(data,sizeof(data),&gwarea,'\t')<0 || getword(hora,sizeof(hora),&gwarea,'\t')<0 ||
 122           getword(user,sizeof(user),&gwarea,'\t')<0 || getword(ip,sizeof(ip),&gwarea,'\t')<0) {
 123          debuga(_("There is a broken record or garbage in file %s"),authfail_in);
 124          exit(1);
 125       }
 126       if (getword_ptr(buf,&url,&gwarea,'\t')<0) {
 127          debuga(_("There is a broken url in file %s"),authfail_in);
 128          exit(1);
 129       }
 130
 131       uinfo=userinfo_find_from_id(user);
 132       if (!uinfo) {
 133          debuga(_("Unknown user ID %s in file %s"),user,authfail_in);
 134          exit(1);
 135       }
 136
 137       new_user=0;
 138       if(!z) {
 139          strcpy(ouser,user);
 140          strcpy(oip,ip);
 141          z++;
 142          new_user=1;
 143       } else {
 144          if(strcmp(ouser,user) != 0) {
 145             strcpy(ouser,user);
 146             new_user=1;
 147          }
 148          if(strcmp(oip,ip) != 0) {
 149             strcpy(oip,ip);
 150             new_user=1;
 151          }
 152       }
 153
 154      if(AuthfailReportLimit) {
 155         if(strcmp(ouser2,uinfo->label) == 0) {
 156             count++;
 157          } else {
 158             count=1;
 159             strcpy(ouser2,uinfo->label);
 160          }
 161          if(count >= AuthfailReportLimit)
 162             continue;
 163       }
 164
 165       fputs("<tr>",fp_ou);
 166       if (new_user)
 167          fprintf(fp_ou,"<td class=\"data2\">%s</td><td class=\"data2\">%s</td>",uinfo->label,ip);
 168       else
 169          fputs("<td class=\"data2\"></td><td class=\"data2\"></td>",fp_ou);
 170       fprintf(fp_ou,"<td class=\"data2\">%s-%s</td><td class=\"data2\">",data,hora);
 171       if(BlockIt[0]!='\0') {
 172          fprintf(fp_ou,"<a href=\"%s%s?url=",wwwDocumentRoot,BlockIt);
 173          output_html_url(fp_ou,url);
 174          fputs("\"><img src=\"../images/sarg-squidguard-block.png\"></a>&nbsp;",fp_ou);
 175       }
 176       fputs("<a href=\"",fp_ou);
 177       output_html_url(fp_ou,url);
 178       fputs("\">",fp_ou);
 179       output_html_string(fp_ou,url,100);
 180       fputs("</a></td></th>\n",fp_ou);
 181    }
 182    fclose(fp_in);
 183    longline_free(&line);
 184
 185    fputs("</table></div>\n",fp_ou);
 186    write_html_trailer(fp_ou);
 187    fclose(fp_ou);
 188
 189    unlink(authfail_in);
 190
 191    return;
 192 }