rulefileparser.cc

网络流量采集及分析软件

/*  \file   RuleFileParser.cc

    Copyright 2003-2004 Fraunhofer Institute for Open Communication Systems (FOKUS),
                        Berlin, Germany

    This file is part of Network Measurement and Accounting System (NETMATE).

    NETMATE is free software; you can redistribute it and/or modify 
    it under the terms of the GNU General Public License as published by 
    the Free Software Foundation; either version 2 of the License, or
    (at your option) any later version.

    NETMATE is distributed in the hope that it will be useful, 
    but WITHOUT ANY WARRANTY; without even the implied warranty of 
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this software; if not, write to the Free Software 
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

    Description:
    parse rule files

    $Id: RuleFileParser.cc,v 1.1.1.1 2004/12/23 05:52:35 s_zander Exp $

*/

#include "RuleFileParser.h"
#include "ParserFcts.h"
#include "constants.h"


RuleFileParser::RuleFileParser(string filename)
    : XMLParser(RULEFILE_DTD, filename, "RULESET")
{
    log = Logger::getInstance();
    ch = log->createChannel("RuleFileParser" );
}


RuleFileParser::RuleFileParser(char *buf, int len)
    : XMLParser(RULEFILE_DTD, buf, len, "RULESET")
{
    log = Logger::getInstance();
    ch = log->createChannel("RuleFileParser" );
}


configItem_t RuleFileParser::parsePref(xmlNodePtr cur)
{
    configItem_t item;

    item.name = xmlCharToString(xmlGetProp(cur, (const xmlChar *)"NAME"));
    if (item.name.empty()) {
        throw Error("Rule Parser Error: missing name at line %d", XML_GET_LINE(cur));
    }
    item.value = xmlCharToString(xmlNodeListGetString(XMLDoc, cur->xmlChildrenNode, 1));
    if (item.value.empty()) {
        throw Error("Rule Parser Error: missing value at line %d", XML_GET_LINE(cur));
    }
    item.type = xmlCharToString(xmlGetProp(cur, (const xmlChar *)"TYPE"));

    // check if item can be parsed
    try {
        ParserFcts::parseItem(item.type, item.value);
    } catch (Error &e) {    
        throw Error("Rule Parser Error: parse value error at line %d: %s", XML_GET_LINE(cur), 
                    e.getError().c_str());
    }

    return item;
}

string RuleFileParser::lookup(filterValList_t *filterVals, string fvalue, filter_t *f)
{
    filterValListIter_t iter2 = filterVals->find(fvalue);
    if (iter2 != filterVals->end()) {
        if (iter2->second.type == f->type) {
            // substitute filter value
            fvalue = iter2->second.svalue;
        } else {
            throw Error("filter value type mismatch: %s given but %s expected", 
                        iter2->second.type.c_str(), f->type.c_str());
        }
    }

    return fvalue;
}


void RuleFileParser::parseFilterValue(filterValList_t *filterVals, string value, filter_t *f)
{
    int n;

    if (value == "*") {
        f->mtype = FT_WILD;
        f->cnt = 1;
    } else if ((n = value.find("-")) > 0) {
        f->mtype = FT_RANGE;
        f->value[0] = FilterValue(f->type, lookup(filterVals, value.substr(0,n),f));
        f->value[1] = FilterValue(f->type, lookup(filterVals, value.substr(n+1, value.length()-n+1),f));
        f->cnt = 2;
    } else if ((n = value.find(",")) > 0) {
        int lastn = 0;
        int c = 0;

        n = -1;
        f->mtype = FT_SET;
        while (((n = value.find(",", lastn)) > 0) && (c<(MAX_FILTER_SET_SIZE-1))) {
            f->value[c] = FilterValue(f->type, lookup(filterVals, value.substr(lastn, n-lastn),f));
            c++;
            lastn = n+1;
        }
        f->value[c] = FilterValue(f->type, lookup(filterVals, value.substr(lastn, n-lastn),f));
        f->cnt = c+1;
        if ((n > 0) && (f->cnt == MAX_FILTER_SET_SIZE)) {
            throw Error("more than %d filters specified in set", MAX_FILTER_SET_SIZE);
        }
    } else {
        f->mtype = FT_EXACT;
        f->value[0] = FilterValue(f->type, lookup(filterVals, value,f));
        f->cnt = 1;
    }
}


void RuleFileParser::parse(filterDefList_t *filterDefs, filterValList_t *filterVals, ruleDB_t *rules)
{
    xmlNodePtr cur, cur2, cur3;
    string sname;
    miscList_t globalMiscList;
    actionList_t globalActionList;
    exportList_t globalExportList;
    time_t now = time(NULL);

    cur = xmlDocGetRootElement(XMLDoc);

    sname = xmlCharToString(xmlGetProp(cur, (const xmlChar *)"ID"));

#ifdef DEBUG
    log->dlog(ch, "ruleset %s", sname.c_str());
#endif

    cur = cur->xmlChildrenNode;

    while (cur != NULL) {
	
        if ((!xmlStrcmp(cur->name, (const xmlChar *)"GLOBAL")) && (cur->ns == ns)) {
            // parse global settings

            cur2 = cur->xmlChildrenNode;

            while (cur2 != NULL) {
                // get PREF
                if ((!xmlStrcmp(cur2->name, (const xmlChar *)"PREF")) && (cur2->ns == ns)) {
                    // parse
                    configItem_t item = parsePref(cur2); 	
                    // add
                    globalMiscList[item.name] = item;
#ifdef DEBUG
                    log->dlog(ch, "C %s = %s", item.name.c_str(), item.value.c_str());
#endif
                }

                if ((!xmlStrcmp(cur2->name, (const xmlChar *)"ACTION")) && (cur2->ns == ns)) {
                    action_t a;

                    a.name = xmlCharToString(xmlGetProp(cur2, (const xmlChar *)"NAME"));
                    if (a.name.empty()) {
                        throw Error("Rule Parser Error: missing name at line %d", XML_GET_LINE(cur2));
                    }

                    cur3 = cur2->xmlChildrenNode;

                    while (cur3 != NULL) {
                        // get action specific PREFs
                        if ((!xmlStrcmp(cur3->name, (const xmlChar *)"PREF")) && (cur3->ns == ns)) {
                            configItem_t item;
                            // parse
                            item = parsePref(cur3); 	
                            // add
                            a.conf.push_back(item);
                        }

                        cur3 = cur3->next;
                    }

                    globalActionList.push_back(a);
                }

                if ((!xmlStrcmp(cur2->name, (const xmlChar *)"EXPORT")) && (cur2->ns == ns)) {
                    export_t e;

                    e.name = xmlCharToString(xmlGetProp(cur2, (const xmlChar *)"NAME"));
                    if (e.name.empty()) {
                        throw Error("Rule Parser Error: missing name at line %d", XML_GET_LINE(cur2));
                    }

                    cur3 = cur2->xmlChildrenNode;

                    while (cur3 != NULL) {
                        // get action specific PREFs
                        if ((!xmlStrcmp(cur3->name, (const xmlChar *)"PREF")) && (cur3->ns == ns)) {
                            configItem_t item;
                            // parse
                            item = parsePref(cur3); 	
                            // add
                            e.conf.push_back(item);
                        }

                        cur3 = cur3->next;
                    }

                    globalExportList.push_back(e);
                }
	
                cur2 = cur2->next;
            }
        }
	
        if ((!xmlStrcmp(cur->name, (const xmlChar *)"RULE")) && (cur->ns == ns)) {
            string rname;
            filterList_t filters;
            actionList_t actions = globalActionList;
            exportList_t exports = globalExportList;