mapiruleparser.cc

网络流量采集及分析软件

                                    }
                                    
                                    parseFilterValue(filterVals, fvalue, &f);
                                    
                                    filters.push_back(f);
                                } else {
                                    throw Error("No filter definition for filter %s found", f.name.c_str());
                                }
                            } else {
                                throw Error("filter parameter parse error");
                            }
                        }
                            
                        ind++;
                    }
                    break;
                case 'a':
                  {
                      if (ind < argc) {
                          // only one action per -a parameter
                          action_t a;
                          
                          // action: <name> [<param>=<value> , ...]
                          a.name = args[ind++];
                          
                          // action parameters
                          while ((ind<argc) && (args[ind][0] != '-')) {
                              configItem_t item;
                              
                              // parse param
                              tmp = args[ind];
                              n = tmp.find("=");
                              if ((n > 0) && (n < (int)tmp.length()-1)) {
                                  item.name = tmp.substr(0,n);
                                  item.value = tmp.substr(n+1, tmp.length()-n);
                                  item.type = "String";
                                  // hack: if parameter method = <method> change name to name_<method>
                                  // and do not add this parameter
                                  if (item.name == "method") {
                                      a.name = a.name + "_" + item.value;
                                  } else {
                                      a.conf.push_back(item);
                                  }
                              } else {
                                  // else invalid parameter  
                                  throw Error("action parameter parse error");
                              }

                              ind++;
                          }
                          
                          actions.push_back(a);
                      }
                  }
                  break;
                case 'm':
                    while ((ind<argc) && (args[ind][0] != '-')) {
                        configItem_t item;

                        tmp = args[ind];
                        // skip the separating commas
                        if (tmp != ",") {
                            n = tmp.find("=");
                            if ((n > 0) && (n < (int)tmp.length()-1)) {
                                item.name = tmp.substr(0,n);
                                item.value = tmp.substr(n+1, tmp.length()-n);
                                item.type = "String";
                                if (item.name == "start") {
                                    item.name = "Start";
                                } else if (item.name == "stop") {
                                    item.name = "Stop";
                                } else if (item.name == "duration") {
                                    item.name = "Duration";
                                } else if (item.name == "interval") {
                                    item.name = "Interval";
                                } else if (item.name == "auto") {
                                    item.name = "auto"; 
                                } else if (item.name == "bidir") {
                                    item.name = "bidir"; 
                                } else {
                                    throw Error("unknown option %s", item.name.c_str());
                                }

                                miscs[item.name] = item;
                            } else {
                                throw Error("misc parse error");
                            }
                        }                       

                        ind++;
                    }
                    break;
                case 'e':
                  {
                      if (ind < argc) {
                          export_t e;
                          
                          while ((ind<argc) && (args[ind][0] != '-')) {
                              configItem_t item;
                              
                              tmp = args[ind];
                              n = tmp.find("=");
                              if ((n > 0) && (n < (int)tmp.length()-1)) {
                                  item.name = tmp.substr(0,n);
                                  item.value = tmp.substr(n+1, tmp.length()-n);
                                  item.type = "String";
                                  if (item.name == "target") {
                                      tmp = item.value;
                                      n = tmp.find(":");
                                      if ((n > 0) && (n < (int)tmp.length()-1)) {
                                          item.name = tmp.substr(0,n);
                                          if (item.name == "file") {
                                              e.name = "text_file";
                                              item.name = "Filename";
                                              item.value = tmp.substr(n+1, tmp.length()-n);
                                              e.conf.push_back(item);
                                          } else if (item.name == "ipfix") {
                                              e.name = "ipfix";
                                              n = tmp.find_first_not_of("/", n+1);
                                              n2 = tmp.find(":", n+1);
                                              if (n2 > 0) {
                                                  item.name = "Collector";
                                                  item.value = tmp.substr(n, n2-n);
                                                  e.conf.push_back(item);
                                                  item.name = "Port";
                                                  item.value = tmp.substr(n2+1, tmp.length()-n2);
                                                  e.conf.push_back(item);
                                              } else {
                                                  item.name = "Collector";
                                                  item.value = tmp.substr(n, tmp.length()-n);
                                                  e.conf.push_back(item);
                                              }
                                          }
                                          // scp not supported

                                         
                                      } else {
                                          throw Error("export target parse error");
                                      }
                                  } else {
                                      throw Error("unknown option '%s'", item.name.c_str());
                                  }

                                  exports.push_back(e);
                              } else {
                                  throw Error("export target parse error");
                              }    
                              
                              ind++;
                          } 
                      }
                  }
                  break;
                default:
                    throw Error(403, "add_task: unknown option %s", args[ind].c_str() );
                }
            }	
        }
  
#ifdef DEBUG
        // debug info
        log->dlog(ch, "rule %s.%s", sname.c_str(), rname.c_str());
        for (filterListIter_t i = filters.begin(); i != filters.end(); i++) {
            switch (i->mtype) {
            case FT_WILD:
                log->dlog(ch, " F %s&%s = *", i->name.c_str(), i->mask.getString().c_str());
                break;
            case FT_EXACT:
                log->dlog(ch, " F %s&%s = %s", i->name.c_str(), i->mask.getString().c_str(), 
                          i->value[0].getString().c_str());
                break;
            case FT_RANGE:
                log->dlog(ch, " F %s&%s = %s-%s", i->name.c_str(), i->mask.getString().c_str(), 
                          i->value[0].getString().c_str(), i->value[1].getString().c_str() );
                break;
            case FT_SET:
                string vals;
                for (int j=0; j < i->cnt; j++) {
                    vals += i->value[j].getString();
                    if (j < (i->cnt-1)) {
                        vals += ", ";
                    }
                }
                log->dlog(ch, " F %s&%s = %s", i->name.c_str(), i->mask.getString().c_str(), 
                          vals.c_str());
                break;
            }
        }
        for (actionListIter_t i = actions.begin(); i != actions.end(); i++) {
            log->dlog(ch, " A %s", i->name.c_str());
            for (configItemListIter_t j = i->conf.begin(); j != i->conf.end(); j++) {
                log->dlog(ch, "  C %s = %s", j->name.c_str(), j->value.c_str());
            }
        }
        for (exportListIter_t i = exports.begin(); i != exports.end(); i++) {
            log->dlog(ch, " E %s", i->name.c_str());
            for (configItemListIter_t j = i->conf.begin(); j != i->conf.end(); j++) {
                log->dlog(ch, "  C %s = %s", j->name.c_str(), j->value.c_str());
            }
        }
        for (miscListIter_t i = miscs.begin(); i != miscs.end(); i++) {
            log->dlog(ch, " C %s = %s", i->second.name.c_str(), i->second.value.c_str());
        }
#endif
    
        // add rule
        try {
            Rule *r = new Rule(now, sname, rname, filters, actions, exports, miscs);
            rules->push_back(r);
        } catch (Error &e) {
            log->elog(ch, e);
            throw e;
        }
    }
}