X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;f=src%2Fos_csyslogd%2Fcsyslogd.c;h=21cf651b90f6679daa4e1acb9c0bd274c23ba66a;hb=HEAD;hp=97d7ff9b719933c77739732a70547dd39872a247;hpb=301048b51990573e58a30dc4a5bb4ec285cad554;p=ossec-hids.git

diff --git a/src/os_csyslogd/csyslogd.c b/src/os_csyslogd/csyslogd.c
old mode 100755
new mode 100644
index 97d7ff9..21cf651
--- a/src/os_csyslogd/csyslogd.c
+++ b/src/os_csyslogd/csyslogd.c
@@ -1,5 +1,3 @@
-/* @(#) $Id$ */
-
 /* Copyright (C) 2009 Trend Micro Inc.
  * All rights reserved.
  *
@@ -7,90 +5,174 @@
  * and/or modify it under the terms of the GNU General Public
  * License (version 2) as published by the FSF - Free Software
  * Foundation.
- *
- * License details at the LICENSE file included with OSSEC or 
- * online at: http://www.ossec.net/en/licensing.html
  */
 
-
-
+#include "shared.h"
 #include "csyslogd.h"
 #include "os_net/os_net.h"
 
+/* Global variables */
+char __shost[512];
+char __shost_long[512];
 
 
-/* OS_SyslogD: Monitor the alerts and sends them via syslog.
- * Only return in case of error.
+/* Monitor the alerts and send them via syslog
+ * Only return in case of error
  */
 void OS_CSyslogD(SyslogConfig **syslog_config)
 {
     int s = 0;
-    time_t tm;     
-    struct tm *p;       
-
+    time_t tm;
+    struct tm *p;
+    int tries = 0;
     file_queue *fileq;
     alert_data *al_data;
 
-
-    /* Getting currently time before starting */
+    /* Get current time before starting */
     tm = time(NULL);
-    p = localtime(&tm);	
+    p = localtime(&tm);
 
-
-    /* Initating file queue - to read the alerts */
+    /* Initialize file queue to read the alerts */
     os_calloc(1, sizeof(file_queue), fileq);
-    Init_FileQueue(fileq, p, 0);
-
+    while ( (Init_FileQueue(fileq, p, 0) ) < 0 ) {
+        tries++;
+        if ( tries > OS_CSYSLOGD_MAX_TRIES ) {
+            merror("%s: ERROR: Could not open queue after %d tries, exiting!",
+                   ARGV0, tries
+                  );
+            exit(1);
+        }
+        sleep(1);
+    }
+    debug1("%s: INFO: File queue connected.", ARGV0 );
 
-    /* Connecting to syslog. */
+    /* Connect to syslog */
     s = 0;
-    while(syslog_config[s])
-    {
+    while (syslog_config[s]) {
         syslog_config[s]->socket = OS_ConnectUDP(syslog_config[s]->port,
                                                  syslog_config[s]->server);
-        if(syslog_config[s]->socket < 0)
-        {
+        if (syslog_config[s]->socket < 0) {
             merror(CONNS_ERROR, ARGV0, syslog_config[s]->server);
-        }
-        else
-        {
-            merror("%s: INFO: Forwarding alerts via syslog to: '%s:%d'.", 
-                   ARGV0, syslog_config[s]->server, syslog_config[s]->port); 
+        } else {
+            merror("%s: INFO: Forwarding alerts via syslog to: '%s:%s'.",
+                   ARGV0, syslog_config[s]->server, syslog_config[s]->port);
         }
 
         s++;
     }
 
-
-    
-    /* Infinite loop reading the alerts and inserting them. */
-    while(1)
-    {
+    /* Infinite loop reading the alerts and inserting them */
+    while (1) {
         tm = time(NULL);
         p = localtime(&tm);
 
-
         /* Get message if available (timeout of 5 seconds) */
         al_data = Read_FileMon(fileq, p, 5);
-        if(!al_data)
-        {
+        if (!al_data) {
             continue;
         }
 
-
-
-        /* Sending via syslog */
+        /* Send via syslog */
         s = 0;
-        while(syslog_config[s])
-        {
+        while (syslog_config[s]) {
             OS_Alert_SendSyslog(al_data, syslog_config[s]);
             s++;
         }
 
-
-        /* Clearing the memory */
+        /* Clear the memory */
         FreeAlertData(al_data);
     }
 }
 
-/* EOF */
+/* Format Field for output */
+int field_add_string(char *dest, size_t size, const char *format, const char *value )
+{
+    char buffer[OS_SIZE_2048];
+    int len = 0;
+    int dest_sz = size - strlen(dest);
+
+    /* Not enough room in the buffer? */
+    if (dest_sz <= 0 ) {
+        return -1;
+    }
+
+    if (value != NULL &&
+            (
+                ((value[0] != '(') && (value[1] != 'n') && (value[2] != 'o')) ||
+                ((value[0] != '(') && (value[1] != 'u') && (value[2] != 'n')) ||
+                ((value[0] != 'u') && (value[1] != 'n') && (value[4] != 'k'))
+            )
+       ) {
+        len = snprintf(buffer, sizeof(buffer) - dest_sz - 1, format, value);
+        strncat(dest, buffer, dest_sz);
+    }
+
+    return len;
+}
+
+/* Add a field, but truncate if too long */
+int field_add_truncated(char *dest, size_t size, const char *format, const char *value, int fmt_size )
+{
+    char buffer[OS_SIZE_2048];
+
+    int available_sz = size - strlen(dest);
+    int total_sz = strlen(value) + strlen(format) - fmt_size;
+    int field_sz = available_sz - strlen(format) + fmt_size;
+
+    int len = 0;
+    char trailer[] = "...";
+    char *truncated = NULL;
+
+    /* Not enough room in the buffer? */
+    if (available_sz <= 0 ) {
+        return -1;
+    }
+
+    if (
+        ((value[0] != '(') && (value[1] != 'n') && (value[2] != 'o')) ||
+        ((value[0] != '(') && (value[1] != 'u') && (value[2] != 'n')) ||
+        ((value[0] != 'u') && (value[1] != 'n') && (value[4] != 'k'))
+       ) {
+
+        if ( (truncated = (char *) malloc(field_sz + 1)) != NULL ) {
+            if ( total_sz > available_sz ) {
+                /* Truncate and add a trailer */
+                os_substr(truncated, value, 0, field_sz - strlen(trailer));
+                strcat(truncated, trailer);
+            } else {
+                strncpy(truncated, value, field_sz);
+            }
+
+            len = snprintf(buffer, available_sz, format, truncated);
+            strncat(dest, buffer, available_sz);
+        } else {
+            /* Memory Error */
+            len = -3;
+        }
+    }
+    /* Free the temporary pointer */
+    free(truncated);
+
+    return len;
+}
+
+/* Handle integers in the second position */
+int field_add_int(char *dest, size_t size, const char *format, const int value )
+{
+    char buffer[255];
+    int len = 0;
+    int dest_sz = size - strlen(dest);
+
+    /* Not enough room in the buffer? */
+    if (dest_sz <= 0 ) {
+        return -1;
+    }
+
+    if ( value > 0 ) {
+        len = snprintf(buffer, sizeof(buffer), format, value);
+        strncat(dest, buffer, dest_sz);
+    }
+
+    return len;
+}
+