readfile.msql

sifi-0.1.6.tar.gz 出自http://www.ifi.unizh.ch/ikm/SINUS/firewall/ 一个linux的防火墙工具。

#!/home/fwadmin/database/bin/lite

funct convert_time(char $monat, uint $tag, char $stunde, uint $year)
/* Verwandelt die Datumsangaben der Logfiles in UNIX Datum*/
{
        if ($monat == "Jan") {$mon=1;}
        else {
         if ($monat == "Feb") {$mon=2;}
         else {
          if ($monat == "Mar") {$mon=3;}
          else {
           if ($monat == "Apr") {$mon=4;}
           else {
            if ($monat == "Mai") {$mon=5;}
            else {
             if ($monat == "Jun") {$mon=6;}
             else {
              if ($monat == "Jul") {$mon=7;}
              else {
               if ($monat == "Aug") {$mon=8;}
               else {
                if ($monat == "Sep") {$mon=9;}
                else {
                 if ($monat == "Oct") {$mon=10;}
                 else {
                  if ($monat == "Nov") {$mon=11;}
                  else {
                   if ($monat == "Dec") {$mon=12;}
                   else {
        }}}}}}}}}}}}         

        $stund = split($stunde,":");

        return(time2unixtime((uint)$stund[2],(uint)$stund[1],(uint)$stund[0] - 1,(uint)$tag,(uint)$mon,(uint)$year));
}

funct enter_rule(char $gete, int $sock)
/* Wir haben einen relevanten Eintrag also dann los*/
{
        $time=convert_time($gete[0],(uint) $gete[1],$gete[2],1996);
        $rule_type= strseg($gete[3],1,2);
        $rule_number = chop($gete[4]);
        $action = $gete[5];
        $protocol = $gete[6];
        $help=7;
        while ($gete[$help]!=""){$help=(uint) $help + 1;}
        $tofrom=split($gete[(uint) $help - 1],"->");
        $from=split($tofrom[0],":");
        $to=split($tofrom[1],":");
  
        $to[0]=sub($to[0],">","");
        
        $tonet=split($to[0],".");
        $fromnet=split($from[0],".");

        if ( 0 > msqlQuery($sock, "insert into F_LOG 
                          (datum, rule_type, rule_number, action,
                             protocol,
                             source_ip, source_port, source_name, source_net,
                             source_dom,
                             destination_ip, destination_port, destination_name,
                             destination_net, destination_dom
                          ) values
                       ($time,'$rule_type','$rule_number','$action',
                             '$protocol',
                             '$from[0]','$from[1]','UNKNOWN',
                             '$fromnet[0].$fromnet[1].$fromnet[2]',
                             'UNKNOWN',
                             '$to[0]','$to[1]','UNKNOWN',
                             '$tonet[0].$tonet[1].$tonet[2]',
                             'UNKNOWN')"))
            {
                echo("insert:Error : $ERRMSG\n");
            }

}

funct parse(char $get, int $sock, char $buffer)
/* Aufteilen einer Regel welche nicht last repeated ist */
{
            if ($get[3] =="(s")
            {
                enter_rule($get, $sock);
            }
            else
            {
                  msqlQuery($sock,"insert into REST (line)
                           values ('$buffer')");
                 /* echo("REST: $buffer");*/
            }
}

/* -------------------------Hier beginnt das Hauptprogramm -------------*/


       $sock = msqlConnect();
        if ($sock < 0)
        {
                echo("connect Error : $ERRMSG\n");
                exit(1);
        }
        if (msqlSelectDB($sock,"firewall") < 0)
        {
                echo("select Error : $ERRMSG\n");
                exit(1);
        }


$filename = "/tmp/logfile.tmp";
$fd = open($filename,"<");
$buf = readln($fd);
$buf = chop($buf);
while ($buf != "")
{
       $geteilOLD = $geteilt;
       $geteilt = split($buf," ");
   /* last message repeated */
       if ($geteilt[3]=="last")
       {
          $buf = "L "+$geteilt[0]+" "+$geteilt[1]+" "+$geteilt[2]+" "+$geteilOLD[3]+" "+$geteilOLD[4]+
                 " "+$geteilOLD[5]+" "+$geteilOLD[6]+" "+$geteilOLD[7]+" "+$geteilOLD[8]+" "+$geteilOLD[9]+
                 " "+$geteilOLD[10];

          /*Das Datum koennen wir vom neuen nehmen es wir wohl eher stimmen*/
          $geteilOLD[0]=$geteilt[0];
          $geteilOLD[1]=$geteilt[1];
          $geteilOLD[2]=$geteilt[2];
          while ((int) $geteilt[6]>0)
          {
          parse($geteilOLD,$sock,$buf);
          $geteilt[6] = (int) $geteilt[6] - 1;
          }
       }
   /* normale RULE */
       else
       {
           if ($geteilt[5] == "reject")
           {
                $buf1 = readln($fd);
                $geteilt[5] = $geteilt[5] + $geteilt[6];
                $geteilt[6] = $geteilt[7];
                $geteilt[7] = chop(sub($buf1,"                ",""));
                $buf= chop($buf) + " " + $geteilt[7];
                parse($geteilt,$sock, $buf);
           }
           else
           {
                parse($geteilt,$sock, $buf);
           }
       }
       $buf = readln($fd);
       $buf = chop($buf);
}
close($fd);