pattern.c File Reference

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <pcre.h>
#include "strutil.h"

Include dependency graph for pattern.c:

Go to the source code of this file.

Data Structures
struct	_pattern
Typedefs
typedef _pattern	pat_t
Functions
void	dumpPats (void)
static pcre *	patrx (const char *buf, char *errbuf, size_t ebufsz)
int	patternMatch (char *filename, char *str, int *ip)
int	loadPatterns (char *file, char *ebuf, size_t ebsiz)
Variables
static pat_t **	_pats
static int	_patcnt = 0
static int	_regxerr = 0

---

Typedef Documentation

typedef struct _pattern pat_t

pat_t is a structure containing information about a pattern to be matched by patternMatch()

---

Function Documentation

void dumpPats (  void   )

dumpPats is a simple program that should dump out the pattern information stored for each pattern in essentially the same format as configured. Definition at line 36 of file pattern.c. References _patcnt, _pats, _pattern::logdef, _pattern::logrx, _pattern::match, _pattern::matchrx, and _pattern::pos. Referenced by main(). { int i; pat_t *p; printf(">> Pattern Dump << \n"); for(i = 0; i < _patcnt; i++) { p = _pats[i]; printf("Pattern %d PCRE:[%s,%s,%s]: %s:%s:%s@%d\n\n", i, (p->logrx != NULL) ? "yes" : "no", (p->matchrx[0] != NULL) ? "yes" : "no", (p->matchrx[1] != NULL) ? "yes" : "no", p->logdef,p->match[0],p->match[1],p->pos); } }

int loadPatterns (  char *  file, char *  ebuf, size_t  ebsiz )

loadPatterns loads the patterns into the pattern storage from the pattern file. On error -1 is returned and ebuf contains an error message. On success 0 is returned. Definition at line 109 of file pattern.c. References _pattern::logdef, _pattern::logrx, _pattern::match, _pattern::matchrx, patrx(), _pattern::pos, and trim(). Referenced by main(). { char eb2[10240]; char buf[1024], name[1024], val[1024]; char *p, *ep, *p1; int ipp, i, line = 0; struct cfgitem *c; pat_t x; FILE *f; if((f = fopen(file,"r")) == NULL) { snprintf(ebuf,ebsiz,"%s(%d) Cannot open config file \"%s\": %m",file,line); return -1; } while((p = fgets(buf,sizeof(buf)-1,f)) != NULL) { line ++; if(*p == '#') continue; if((p = strchr(buf,'#')) != NULL) *p = '\0'; p = trim(buf); if(*p == '\0' || strlen(p) == 0) continue; x.logdef = p; if((p = strchr(x.logdef,':')) == NULL) continue; *p++ = '\0'; x.match[0] = p; if((p = strchr(x.match[0],':')) == NULL) continue; *p++ = '\0'; x.match[1] = p; if((p = strchr(x.match[1],'@')) == NULL) continue; *p++ = '\0'; if((x.pos = atoi(p)) <= 0) { snprintf(ebuf,ebsiz,"%s:(%d) Invalid position specified in rule.",file,line); fclose(f); return -1; } if(strncmp(x.logdef,"//",2) == 0) { if((x.logrx = patrx(x.logdef,eb2,sizeof(eb2))) == NULL) snprintf(ebuf,ebsiz,"%s(%d): WARNING: pcre compile failed for logmatch: %s",file,line,eb2); } else x.logrx = NULL; for(i = 0; i < 2; i++) { x.matchrx[i] = NULL; if(x.match[i][0] == '/') { if((x.matchrx[i] = patrx(x.match[i],eb2,sizeof(eb2))) == NULL) snprintf(ebuf,ebsiz,"%s(%d): WARNING: pcre compile failed for match %d: %s",file,line,i+1,eb2); } } // // realloc and catenation of pattern to pats // ipp = _patcnt ++; if((_pats = realloc(_pats,(sizeof(pat_t *)*_patcnt))) == NULL){ snprintf(ebuf,ebsiz,"%s(%d): Could not allocate space for pat_t: %m",file,line); fclose(f); return -1; } if((_pats[ipp] = calloc(sizeof(pat_t),1)) == NULL) { snprintf(ebuf,ebsiz,"%s(%d): Could not allocate space for pat_t: %m",file,line); fclose(f); return -1; } x.logdef = strdup(x.logdef); for(i = 0; i < 2; i++) x.match[i] = strdup(x.match[i]); *_pats[ipp] = x; } fclose(f); return 0; } Here is the call graph for this function:

static pcre* patrx (  const char *  buf, char *  errbuf, size_t  ebufsz )  [static]

compile a PCRE regex for use later Definition at line 53 of file pattern.c. Referenced by loadPatterns(). { pcre *p; char *errptr; int eoff; char rebuf[10240]; memset(rebuf,'\0',sizeof(rebuf)); strncpy(rebuf,&buf[1],strlen(buf)-2); if((p = pcre_compile(rebuf,0,(const char **)&errptr, &eoff,NULL)) == NULL) { strncpy(errbuf,errptr,ebufsz); return NULL; } return p; }

int patternMatch (  char *  filename, char *  str, int *  ip )

patternMatch matches str against the stored patterns. We loop through all patterns and check the logfile definition, and the two match definitions. If all three match we end up dropping through to the end of the loop and we return 0 otherwise we return -1 which indicates there is no match in any of the patterns Definition at line 73 of file pattern.c. References _patcnt, _pats, and _pattern::logrx. Referenced by secwatch(). { int i, j; pat_t *p; for(i = 0; i < _patcnt; i++) { p = _pats[i]; if(p->logrx != NULL) { if(pcre_exec(p->logrx,NULL,filename,strlen(filename),0,0,NULL,0) <= 0) continue; } else { if(strpos(filename,p->logdef) < 0) continue; } if(p->matchrx[0] != NULL) { if(pcre_exec(p->matchrx[0],NULL,str,strlen(str),0,0,NULL,0) <= 0) continue; } else { if(strpos(str,p->match[0]) <= 0) continue; } if(p->matchrx[1] != NULL) { if(pcre_exec(p->matchrx[1],NULL,str,strlen(str),0,0,NULL,0) <= 0) continue; } else { if(strpos(str,p->match[1]) <= 0) continue; } *ip = p->pos; return 0; } return -1; }

---

Variable Documentation

int _patcnt = 0 [static]

Definition at line 28 of file pattern.c. Referenced by dumpPats(), and patternMatch().

pat_t** _pats [static]

Definition at line 27 of file pattern.c. Referenced by dumpPats(), and patternMatch().

int _regxerr = 0 [static]

Definition at line 29 of file pattern.c.

---