root/trunk/src/rules_mgmt.c @ 63

/*
 * File: rules_mgmt.c
 * 
 * Authors: ANDREU Francois-Xavier 
 *
 * Copyright (C) 2005 2006 2007 GIP RENATER 
 */

/*  This file is part of renetcol. 
 *
 *  renetcol is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  renetcol is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with renetcol; if not, write to the Free Software
 *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 */

#include <syslog.h>
#include "rules_mgmt.h"

void 
printRuleDef(RuleDefPtr rdPtr)
{
  if (rdPtr != NULL){
    fprintf(stderr, "  ft: %hu\n", rdPtr->fieldType);
    fprintf(stderr, "  check: %hu\n", rdPtr->check);
    fprintf(stderr, "  operator: %hu\n", rdPtr->operator);
    if (rdPtr->value!=NULL) {
      fprintf(stderr, "  mask: %hu\n", rdPtr->value->mask);
      switch (rdPtr->value->valueLength){
      case 1:
        fprintf(stderr, "  char value: %hu\n", rdPtr->value->stor.cvalue);
        break;
      case 2:
        fprintf(stderr, "  short value: %hu\n", rdPtr->value->stor.svalue);
        break;
      case 4:
        fprintf(stderr, "  long value: %lu\n", rdPtr->value->stor.lvalue);
        break;
      case 16:
        fprintf(stderr, "  16 bytes : ");
        fprintf(stderr, "%hx:", ntohl(rdPtr->value->stor.tabAdd6[0])>>16);
        fprintf(stderr, "%hx:", ntohl(rdPtr->value->stor.tabAdd6[0])<<16>>16);
        fprintf(stderr, "%hx:", ntohl(rdPtr->value->stor.tabAdd6[1])>>16);
        fprintf(stderr, "%hx:", ntohl(rdPtr->value->stor.tabAdd6[1])<<16>>16);
        fprintf(stderr, "%hx:", ntohl(rdPtr->value->stor.tabAdd6[2])>>16);
        fprintf(stderr, "%hx:", ntohl(rdPtr->value->stor.tabAdd6[2])<<16>>16);
        fprintf(stderr, "%hx:", ntohl(rdPtr->value->stor.tabAdd6[3])>>16);
        fprintf(stderr, "%hx\n", ntohl(rdPtr->value->stor.tabAdd6[3])<<16>>16);
        break;
      default:
        fprintf(stderr,"  no check\n");
        break;
      }
    } else {
      fprintf(stderr,"  no check\n");
    }
    printRuleDef(rdPtr->next);
  }
}

void 
printRule(RulesPtr rPtr)
{
  if (rPtr!=NULL){
    fprintf(stderr, "\nid: %hu\n", rPtr->id);
    if (rPtr->prev) { fprintf(stderr, "\nid prev: %hu\n", rPtr->prev->id);}
    if (rPtr->next) { fprintf(stderr, "\nid next: %hu\n", rPtr->next->id);}
    fprintf(stderr, "Name: %s\n", rPtr->ruleName);    
/*     puts (asctime (& rPtr->begin)); */
/*     puts (asctime (& rPtr->end)); */
    printRuleDef(rPtr->def);
    if (rPtr->host){
      printHostDef(rPtr->host);
    }
/*     invPrintFieldSet(rPtr->fieldToRecord); */
    printRule(rPtr->next);
  }
}

/*
 *
 */
unsigned short
getNewId(RulesPtr rPtr){
  RulesPtr tmp = rPtr;
  unsigned short ctr = 0;

  while (tmp){
    if (tmp->id > ctr){
      ctr = tmp->id;
    }
    tmp = tmp->next;
  }
  return ctr+1;
}

void 
freeValue(ValuesPtr vPtr)
{
  free(vPtr);
  vPtr = NULL;
}

void
freeRuleDef(RuleDefPtr rdPtr)
{
  RuleDefPtr tmp;
  if (rdPtr) {
    tmp = rdPtr->next;
    freeValue(rdPtr->value);
    free(rdPtr);
    rdPtr = NULL;
    freeRuleDef(tmp);
  }
}

void
freeRule(RulesPtr rPtr)
{
  if (rPtr->def) {freeRuleDef(rPtr->def);}
  if (rPtr->fieldToRecord) {freeField(rPtr->fieldToRecord);}
  if (rPtr->host) {freeRemoteHost(rPtr->host);}
  if (rPtr->fileName) {freeFile(rPtr->fileName);}
  if (rPtr->db) {freeDb(rPtr->db);}
  free(rPtr);
  rPtr = NULL;
}

RulesPtr
delRule(RulesPtr rPtr, RulesPtr firstrPtr)
{
  RulesPtr tmp = NULL;
  if (rPtr==firstrPtr) {
    if (rPtr->next) {
      tmp = rPtr->next;
      tmp->prev = NULL;
      freeRule(rPtr);
      return tmp; 
    }else{
      freeRule(rPtr);
      return NULL;
    }
  } else {
    if (rPtr->prev->next) { rPtr->prev->next = rPtr->next;}
    if (rPtr->next) {rPtr->next->prev = rPtr->prev;}
    freeRule(rPtr);
    return firstrPtr;
  }
}

RulesPtr
getRules(RulesPtr rPtr, char *filename)
{
  FILE *ruleFile;
  RulesPtr tmp = NULL;
  RulesPtr tmp2 = NULL;
  time_t hour;
  char line[512];
  char lineCopy[512];
  char str1[256];
  char str2[256];
  char strTok[1];
  char strName[100];
  char strOutputType[20];
  int cptLine;
  
  if ((ruleFile = fopen(filename, "r")) == NULL) {
    syslog(LOG_ERR, "error during %s opening\n", filename);
    exit(1);
  }
  cptLine=0;
  time (& hour);
  /*    tmp->begin = localtime (& hour); */
  /*    tmp->end = localtime (& hour); */
  /*     strptime( begin, "%Y%m%d%H%M%S", & tmp->begin); */
  /*     strptime( end, "%Y%m%d%H%M%S", & tmp->end); */
  while ( fgets(line, 512, ruleFile) != 0) {    
    if ( strspn(line, "#") == 0 ) {
      strcpy(lineCopy, line);
      if (strncmp("N", lineCopy, 1) == 0){
        if (sscanf(line, "%1s %s\n",
                   strTok,        
                   strName) == 0) {
          syslog(LOG_ERR, "Error in file %s, line %d\n", 
                  filename, cptLine);
          exit(1);
        } else {
          rPtr = tmp;
          tmp = NULL;
          tmp = (RulesPtr) malloc(sizeof(struct Rules));
          if (tmp==NULL) {
            syslog(LOG_ERR, "ERROR in malloc in getRule function\n");
            exit(1);
          } else {
            tmp->id = getNewId(rPtr);
            tmp->def = NULL;
            tmp->fieldToRecord = NULL;
            tmp->host = NULL;
            tmp->fileName = NULL;
            tmp->db = NULL;
            tmp->next = rPtr;
            /* rPtr->prev = tmp; */
            tmp->prev = NULL;
          }
          tmp->ruleName = (char *) malloc((strlen(strName)+1)*sizeof(char));
          strcpy(tmp->ruleName, strName);
        }
      }
      if (strncmp("O", lineCopy, 1) == 0){
        if (sscanf(line, "%1s %s %s %s\n",
                   strTok,        
                   strOutputType,
                   str1,
                   str2) == 0) {
          syslog(LOG_ERR, "Error in file %s, line %d\n", 
                  filename, cptLine);
          exit(1);
        } else {
          /* switch output type */
          if (strcmp("file", strOutputType) == 0){
            tmp->type = 1;
            tmp->fileName = addFileDef(tmp->fileName, str1, str2);
          }
          if (strcmp("socket", strOutputType) == 0){
            tmp->type = 2;
            tmp->host = addRemoteHostDef(tmp->host, str1, str2);
          }
          if (strcmp("base", strOutputType) == 0){
            tmp->type = 3;
            tmp->db = addDataBase(tmp->db, str1, str2);
          }
        }
      }
      if (strncmp("C", lineCopy, 1) == 0){
        tmp->def = addRuleDef(tmp->def, lineCopy);
      }
      if (strncmp("A", lineCopy, 1) == 0){
        syslog(LOG_INFO,"Aggregation mode isn't yet implemented\n");
      }
      if (strncmp("R", lineCopy, 1) == 0){
        tmp->fieldToRecord = addFields(tmp->fieldToRecord, lineCopy);
      }
      cptLine++;
    }
    /*     tmp->prev = NULL; */
  }
  tmp2 = tmp;
  for ( ; tmp2; tmp2=tmp2->next) {
    if (tmp2->next) {
      tmp2->next->prev = tmp2;
    } 
  }
  fclose(ruleFile);
  return tmp; 
}

RulesPtr 
getLightRules(RulesPtr rPtr, char *filename)
{
  FILE *ruleFile;
  RulesPtr tmp = NULL;
  RulesPtr tmp2 = NULL;
  time_t hour;
  char line[512];
  char lineCopy[512];
  char str1[256];
  char str2[256];
  char strTok[1];
  char strName[100];
  char strOutputType[20];
  int cptLine;
  
  if (!(ruleFile = fopen(filename, "r"))) {
    syslog(LOG_ERR, "error during %s opening\n", filename);
    exit(1);
  }
  cptLine=0;
  time (& hour);
  /*    tmp->begin = localtime (& hour); */
  /*    tmp->end = localtime (& hour); */
  /*     strptime( begin, "%Y%m%d%H%M%S", & tmp->begin); */
  /*     strptime( end, "%Y%m%d%H%M%S", & tmp->end); */
  while ( fgets(line, 512, ruleFile) != 0) {    
    if ( strspn(line, "#") == 0 ) {
      strcpy(lineCopy, line);
      if (strncmp("N", lineCopy, 1) == 0){
        if (sscanf(line, "%1s %s\n",
                   strTok,        
                   strName) == 0) {
          syslog(LOG_ERR, "Error in file %s, line %d\n", 
                  filename, cptLine);
          exit(1);
        } else {
          rPtr = tmp;
          tmp = NULL;
          tmp = (RulesPtr) malloc(sizeof(struct Rules));
          if (tmp==NULL) {
            syslog(LOG_ERR, "ERROR in malloc in getRule function\n");
            exit(1);
          } else {
            tmp->id = getNewId(rPtr);
            tmp->def = NULL;
            tmp->fieldToRecord = NULL;
            tmp->host = NULL;
            tmp->fileName = NULL;
            tmp->db = NULL;
            tmp->next = rPtr;
            tmp->prev = NULL;
          }
          tmp->ruleName = (char *) malloc((strlen(strName)+1)*sizeof(char));
          strcpy(tmp->ruleName, strName);
        }
      }
      if (strncmp("O", lineCopy, 1) == 0){
        if (sscanf(line, "%1s %s %s %s\n",
                   strTok,        
                   strOutputType,
                   str1,
                   str2) == 0) {
          syslog(LOG_ERR, "Error in file %s, line %d\n", 
                  filename, cptLine);
          exit(1);
        } else {
          /* switch output type */
          if (strcmp("file", strOutputType) == 0){
            tmp->type = 1;
          }
          if (strcmp("socket", strOutputType) == 0){
            tmp->type = 2;
          }
          if (strcmp("base", strOutputType) == 0){
            tmp->type = 3;
          }
        }
      }
      if (strncmp("C", lineCopy, 1) == 0){
        tmp->def = addRuleDef(tmp->def, lineCopy);
      }
      if (strncmp("A", lineCopy, 1) == 0){
        syslog(LOG_INFO,"Aggregation mode isn't yet implemented");
      }
      if (strncmp("R", lineCopy, 1) == 0){
        tmp->fieldToRecord = addFields(tmp->fieldToRecord, lineCopy);
      }
      cptLine++;
    }
  }
  tmp2 = tmp;
  for ( ; tmp2; tmp2=tmp2->next) {
    if (tmp2->next) {
      tmp2->next->prev = tmp2;
    } 
  }
  fclose(ruleFile);
  return tmp;
}

FilePtr
addFileDef(FilePtr fPtr, char *str1, char *str2)
{
/*   fprintf(stderr,"add file def: %s %s \n", str1, str2); */
  return NULL;
}

RemoteHostPtr
addRemoteHostDef(RemoteHostPtr rPtr, char *str1, char *str2)
{
  RemoteHostPtr tmp = NULL;
  tmp = (RemoteHostPtr) malloc(sizeof(struct RemoteHost));
  if (tmp==NULL) {
    syslog(LOG_ERR, "ERROR in malloc in addRemoteHostDef function");
    exit(1);
  } else {
    tmp->hostAddressPtr = (struct sockaddr_storage*)
      malloc(sizeof(struct sockaddr_storage));
    if (tmp->hostAddressPtr==NULL) {
      syslog(LOG_ERR, "ERROR in malloc in addRemoteHostDef function");
      exit(1);
    } else {
      if ((tmp->sockId=create_socket( str1, str2, tmp->hostAddressPtr))==0)
        return NULL;
      tmp->next = rPtr;
    }
  }
  return tmp;
}

DbPtr
addDataBase(DbPtr dPtr, char *str1, char *str2){
  syslog(LOG_INFO,"DB output not in this release");
  return NULL;
}

FieldPtr
addFields (FieldPtr fp, char *ftr)
{
  /* for each token "R" in the tests string */
  /* build a field structure */
  /* return a list of field */
  static char * fields;
  fields = strtok(ftr, "R");
  while (fields != NULL) {
    unsigned short type;
    unsigned short length;
    if (sscanf(fields, " %hu %hu ", &type, &length) == 0) {
      syslog(LOG_ERR, 
              "Errors in definition of fields to record: wrong syntax");
      exit(1);
    } else {
      if (type == 0){
        return NULL; /* all fields must be recorded */
      } else {
        fp = addField(fp, type, length);
      }
    }
    fields = strtok(NULL, "R");    
  }
  return fp;
}

RuleDefPtr 
addRuleDef(RuleDefPtr rdPtr, char *tests)
{
  /* for each token "C" in the tests string */
  /* build a rule_def struct */
  /* return the list of rule_def */
  RuleDefPtr tmp = NULL;
  static char * fields;
  unsigned short operatorToNumber = 0;

  fields = strtok(tests, "C");
  while (fields != NULL) {
    static unsigned short ft;
    char operator[2];
    char value[42];
    tmp = (RuleDefPtr) malloc(sizeof(struct RuleDef));
    if (tmp==NULL) {
      syslog(LOG_ERR, "ERROR in malloc in addRuleDef function");
      exit(1);
    } else { 
      if (sscanf(fields, " %hu %1s %s", &ft, operator, value)==0) {
        syslog(LOG_ERR, "Errors in Tests definition : wrong syntax");
        exit(1);
      }
      /* operator possibilities : > < = b t (belong, table) */
      if (strcmp(operator,">")==0) {
        operatorToNumber = 0; /* FIXME why operatorToNumber ? */
        tmp->operator = 0;
      }
      if (strcmp(operator,"<")==0) {
        operatorToNumber = 1;
        tmp->operator = 1;
      }
      if (strcmp(operator,"=")==0) {
        operatorToNumber = 2;
        tmp->operator = 2;
      }
      tmp->fieldType = ft;
      tmp->value = NULL;
      if ((ft==25) || (ft==7) || (ft==11) || (ft==10) || (ft==14) ){
          tmp->value = addValue(tmp->value, operatorToNumber, value);
      } else if ((ft==1)){
          tmp->value = addLValue(tmp->value, operatorToNumber, value);
      } else if ( (ft==0) || (ft==8) || (ft==12) || (ft==15) || (ft==18) ){
          tmp->value = addAddress(tmp->value, operatorToNumber, value);
      } else if ( (ft==27) || (ft==28) || (ft==62) || (ft==63) ){
          tmp->value = addV6Address(tmp->value, operatorToNumber, value);
      } else if ( (ft==60) || (ft==46) ){
          tmp->value = addCValue(tmp->value, operatorToNumber, value);
      } else {
        syslog(LOG_INFO, 
                "You can't compare the field <%hu> in this release, sorry",
                ft); 
      }
      tmp->check = 0;
      tmp->next = rdPtr;
      if (rdPtr!=NULL) { rdPtr->prev = tmp;}
      tmp->prev = NULL;
      rdPtr=tmp;
    }
    fields = strtok(NULL, "C");
  }
  return tmp;
}

ValuesPtr
addAddress(ValuesPtr vPtr, unsigned short op, char *val)
{
  ValuesPtr tmp;
  unsigned short v0, v1, v2, v3;
  unsigned char buffer4[4];
  static char *token;
  static char mask[4];
  int lg = 0;
  int lgMask = 0;
  static char value[16];
  tmp = (ValuesPtr) malloc(sizeof(struct Values));
  if (tmp==NULL) {
    syslog(LOG_ERR, "ERROR in malloc in addAddress function");
    exit(1);
  } else {
    if ( (token=memccpy(value, val, '/', strlen(val)))==NULL) {
      /* address case */
      if (sscanf(value, "%hu.%hu.%hu.%hu", &v0, &v1, &v2, &v3) == 0) {
        syslog(LOG_ERR, "Errors in Tests definition : wrong IPv4 value");
        exit(1);
      }
      buffer4[3] = (unsigned char)v0;
      buffer4[2] = (unsigned char)v1;
      buffer4[1] = (unsigned char)v2;
      buffer4[0] = (unsigned char)v3;   
      tmp->valueLength = 4;
      tmp->mask = 32;
      tmp->stor.lvalue = *((unsigned long*)(&buffer4));
      tmp->mask = 32;
      tmp->next = vPtr;
    } else {
      lg = strlen(value);
      lgMask = strlen(token);
      value[lg-1-lgMask] = '\0';
      strcpy( mask, strchr(val,'/')+1);
      if (sscanf(value, "%hu.%hu.%hu.%hu", &v0, &v1, &v2, &v3) == 0) {
        syslog(LOG_ERR, "Errors in Tests definition : wrong IPv4 value");
        exit(1);
      }
      buffer4[3] = (unsigned char)v0;
      buffer4[2] = (unsigned char)v1;
      buffer4[1] = (unsigned char)v2;
      buffer4[0] = (unsigned char)v3;   
      tmp->valueLength = 4;
      tmp->mask = atoi(mask);
      tmp->stor.lvalue = *((unsigned long*)(&buffer4));
      tmp->next = vPtr;      
    }
  }
  return tmp;
}

ValuesPtr
addV6Address(ValuesPtr vPtr, unsigned short op, char *val)
{
  ValuesPtr tmp;
  struct in6_addr v6addr;
  char netw_form[16];
  int result;
  static char value[30];
  static char mask[4];
  static char *token;
  int lg = 0;
  int lgMask = 0;
  tmp = (ValuesPtr) malloc(sizeof(struct Values));
  if (tmp==NULL) {
    syslog(LOG_ERR, "ERROR in malloc in addV6Address function");
    exit(1);
  } else {
    if ( (token=memccpy(value, val, '/', strlen(val)))==NULL) {
      /* address case */
      result = inet_pton(AF_INET6, val, netw_form);
      switch(result) {
      case 0 : 
        syslog(LOG_ERR," inet_pton : Invalid IPv6 Address");
        exit(1);
        break;
      case -1: 
        syslog(LOG_ERR," inet_pton : AF unknown");
        exit(1);
        break;
      }
      memcpy(&v6addr, netw_form, sizeof(netw_form));
      tmp->valueLength = 16;
      tmp->mask = 128;
      tmp->stor.tabAdd6[0] = v6addr.s6_addr32[0];
      tmp->stor.tabAdd6[1] = v6addr.s6_addr32[1];
      tmp->stor.tabAdd6[2] = v6addr.s6_addr32[2];
      tmp->stor.tabAdd6[3] = v6addr.s6_addr32[3];
      tmp->next = vPtr;
    } else {
      lg = strlen(value);
      lgMask = strlen(token);
      value[lg-1-lgMask] = '\0';
      strcpy( mask, strchr(val,'/')+1);
      result = inet_pton(AF_INET6, value, netw_form);
      switch(result) {
      case 0 :
        syslog(LOG_ERR," inet_pton : Invalid IPv6 Address");
        exit(1);
        break;
      case -1:
        syslog(LOG_ERR," inet_pton : AF unknown");
        exit(1);
        break;
      }
      memcpy(&v6addr, netw_form, sizeof(netw_form));
      tmp->valueLength = 16;
      tmp->mask = atoi(mask);
      tmp->stor.tabAdd6[0] = v6addr.s6_addr32[0];
      tmp->stor.tabAdd6[1] = v6addr.s6_addr32[1];
      tmp->stor.tabAdd6[2] = v6addr.s6_addr32[2];
      tmp->stor.tabAdd6[3] = v6addr.s6_addr32[3];
      tmp->next = vPtr;
    }
  }
  return tmp;
}

ValuesPtr
addValue(ValuesPtr vPtr, unsigned short op, char *val)
{
  ValuesPtr tmp;
  char value[10];

  tmp = (ValuesPtr) malloc(sizeof(struct Values));
  if (tmp==NULL) {
    syslog(LOG_ERR, "ERROR in malloc in addValue function");
    exit(1);
  } else {
    if (sscanf(val, "%s", value) == 0) {
      syslog(LOG_ERR, "Errors in Tests definition : wrong short value");
      exit(1);
    }   
    tmp->valueLength = 2;
    tmp->stor.svalue = (unsigned short) atoi(value);
    tmp->next = vPtr;
  }
  return tmp;
}

ValuesPtr
addLValue(ValuesPtr vPtr, unsigned short op, char *val)
{
  ValuesPtr tmp;
  char value[11];

  tmp = (ValuesPtr) malloc(sizeof(struct Values));
  if (tmp==NULL) {
    syslog(LOG_ERR, "ERROR in malloc in addValue function");
    exit(1);
  } else {
    if (sscanf(val, "%s", value) == 0) {
      syslog(LOG_ERR, "Errors in Tests definition : wrong long value");
      exit(1);
    }   
    tmp->valueLength = 4;
    tmp->stor.lvalue = (unsigned long) atol(value);
    tmp->next = vPtr;
  }
  return tmp;
}

ValuesPtr
addCValue(ValuesPtr vPtr, unsigned short op, char *val)
{
  ValuesPtr tmp;
  char value[10];

  tmp = (ValuesPtr) malloc(sizeof(struct Values));
  if (tmp==NULL) {
    syslog(LOG_ERR, "ERROR in malloc in addValue function");
    exit(1);
  } else {
    if (sscanf(val, "%s", value) == 0) {
      syslog(LOG_ERR, "Errors in Tests definition : wrong char value");
      exit(1);
    }   
    tmp->valueLength = 1;
    tmp->stor.cvalue = (unsigned short) atoi(value);
    tmp->next = vPtr;
  }
  return tmp;
}