line |
stmt |
bran |
cond |
sub |
pod |
time |
code |
1
|
|
|
|
|
|
|
#!/usr/bin/perl |
2
|
|
|
|
|
|
|
|
3
|
|
|
|
|
|
|
#======================================================================= |
4
|
|
|
|
|
|
|
# Log.pm / IPTables::Log |
5
|
|
|
|
|
|
|
# $Id: Log.pm 21 2010-12-17 21:07:37Z andys $ |
6
|
|
|
|
|
|
|
# $HeadURL: https://daedalus.dmz.dn7.org.uk/svn/IPTables-Log/trunk/IPTables-Log/lib/IPTables/Log.pm $ |
7
|
|
|
|
|
|
|
# (c)2009 Andy Smith |
8
|
|
|
|
|
|
|
#----------------------------------------------------------------------- |
9
|
|
|
|
|
|
|
#:Description |
10
|
|
|
|
|
|
|
# This is the main IPTables::Log class. |
11
|
|
|
|
|
|
|
#----------------------------------------------------------------------- |
12
|
|
|
|
|
|
|
#:Synopsis |
13
|
|
|
|
|
|
|
# |
14
|
|
|
|
|
|
|
# use IPTables::Log; |
15
|
|
|
|
|
|
|
# my $l = IPTables::Log->new; |
16
|
|
|
|
|
|
|
# my $s = $l->create_set; |
17
|
|
|
|
|
|
|
# my $r = $s->create_record({text => '...IN=eth0 OUT=eth1 MAC=00:...'}); |
18
|
|
|
|
|
|
|
# $r->parse; |
19
|
|
|
|
|
|
|
# $s->add($r); |
20
|
|
|
|
|
|
|
#======================================================================= |
21
|
|
|
|
|
|
|
|
22
|
|
|
|
|
|
|
# The pod (Perl Documentation) for this module is provided inline. For a |
23
|
|
|
|
|
|
|
# better-formatted version, please run:- |
24
|
|
|
|
|
|
|
# $ perldoc Log.pm |
25
|
|
|
|
|
|
|
|
26
|
|
|
|
|
|
|
=head1 NAME |
27
|
|
|
|
|
|
|
|
28
|
|
|
|
|
|
|
IPTables::Log - Parse iptables/netfilter syslog messages. |
29
|
|
|
|
|
|
|
|
30
|
|
|
|
|
|
|
=head1 SYNOPSIS |
31
|
|
|
|
|
|
|
|
32
|
|
|
|
|
|
|
use IPTables::Log; |
33
|
|
|
|
|
|
|
my $l = IPTables::Log->new; |
34
|
|
|
|
|
|
|
my $s = $l->create_set; |
35
|
|
|
|
|
|
|
my $r = $s->create_record({text => '...IN=eth0 OUT=eth1 MAC=00:...'}); |
36
|
|
|
|
|
|
|
$r->parse; |
37
|
|
|
|
|
|
|
$s->add($r); |
38
|
|
|
|
|
|
|
|
39
|
|
|
|
|
|
|
=head1 DEPENDENCIES |
40
|
|
|
|
|
|
|
|
41
|
|
|
|
|
|
|
=over 4 |
42
|
|
|
|
|
|
|
|
43
|
|
|
|
|
|
|
=item * Carp - for error generation |
44
|
|
|
|
|
|
|
|
45
|
|
|
|
|
|
|
=item * Class::Accessor - for accessor methods |
46
|
|
|
|
|
|
|
|
47
|
|
|
|
|
|
|
=item * Data::GUID - for GUID generation |
48
|
|
|
|
|
|
|
|
49
|
|
|
|
|
|
|
=item * NetAddr::IP - for the C and C methods |
50
|
|
|
|
|
|
|
|
51
|
|
|
|
|
|
|
=back |
52
|
|
|
|
|
|
|
|
53
|
|
|
|
|
|
|
=cut |
54
|
|
|
|
|
|
|
|
55
|
|
|
|
|
|
|
# Set our package name |
56
|
|
|
|
|
|
|
package IPTables::Log; |
57
|
|
|
|
|
|
|
|
58
|
|
|
|
|
|
|
# Set minimum version of Perl |
59
|
3
|
|
|
3
|
|
112030
|
use 5.010000; |
|
3
|
|
|
|
|
11
|
|
|
3
|
|
|
|
|
131
|
|
60
|
|
|
|
|
|
|
# Use strict and warnings |
61
|
3
|
|
|
3
|
|
18
|
use strict; |
|
3
|
|
|
|
|
5
|
|
|
3
|
|
|
|
|
104
|
|
62
|
3
|
|
|
3
|
|
16
|
use warnings; |
|
3
|
|
|
|
|
17
|
|
|
3
|
|
|
|
|
113
|
|
63
|
|
|
|
|
|
|
|
64
|
|
|
|
|
|
|
# Use Carp for errors |
65
|
3
|
|
|
3
|
|
23
|
use Carp; |
|
3
|
|
|
|
|
7
|
|
|
3
|
|
|
|
|
335
|
|
66
|
|
|
|
|
|
|
# Use IPTables::Log::Set |
67
|
3
|
|
|
3
|
|
2713
|
use IPTables::Log::Set; |
|
3
|
|
|
|
|
11
|
|
|
3
|
|
|
|
|
18
|
|
68
|
|
|
|
|
|
|
|
69
|
|
|
|
|
|
|
# Inherit from Class::Accessor to simplify accessor methods. |
70
|
3
|
|
|
3
|
|
122
|
use base qw(Class::Accessor); |
|
3
|
|
|
|
|
7
|
|
|
3
|
|
|
|
|
2277
|
|
71
|
|
|
|
|
|
|
__PACKAGE__->follow_best_practice; |
72
|
|
|
|
|
|
|
__PACKAGE__->mk_accessors( qw(raw debug) ); |
73
|
|
|
|
|
|
|
|
74
|
|
|
|
|
|
|
# Set version information |
75
|
|
|
|
|
|
|
our $VERSION; |
76
|
|
|
|
|
|
|
$VERSION = "0.0005"; |
77
|
|
|
|
|
|
|
|
78
|
|
|
|
|
|
|
# Hashes of colour |
79
|
|
|
|
|
|
|
my $clr = "[0m"; |
80
|
|
|
|
|
|
|
my $bold = "[1m"; |
81
|
|
|
|
|
|
|
my $fclr = {'red' => '[31;1m', |
82
|
|
|
|
|
|
|
'green' => '[32;1m', |
83
|
|
|
|
|
|
|
'yellow' => '[33;1m', |
84
|
|
|
|
|
|
|
'blue' => '[34;1m', |
85
|
|
|
|
|
|
|
'purple' => '[35;1m', |
86
|
|
|
|
|
|
|
'cyan' => '[36;1m'}; |
87
|
|
|
|
|
|
|
|
88
|
|
|
|
|
|
|
my $bclr = {'red' => '[41;1m', |
89
|
|
|
|
|
|
|
'green' => '[42;1m', |
90
|
|
|
|
|
|
|
'yellow' => '[43;1m', |
91
|
|
|
|
|
|
|
'blue' => '[44;1m', |
92
|
|
|
|
|
|
|
'purple' => '[45;1m', |
93
|
|
|
|
|
|
|
'cyan' => '[46;1m'}; |
94
|
|
|
|
|
|
|
|
95
|
|
|
|
|
|
|
# Generates a debug message if $self->debug == 1 |
96
|
|
|
|
|
|
|
sub debug |
97
|
|
|
|
|
|
|
{ |
98
|
8
|
|
|
8
|
0
|
12
|
my ($self, $msg) = @_; |
99
|
|
|
|
|
|
|
|
100
|
8
|
50
|
|
|
|
21
|
if($self->get_debug) |
101
|
|
|
|
|
|
|
{ |
102
|
0
|
|
|
|
|
0
|
print $bclr->{blue}.$fclr->{yellow}."D".$clr." ".$fclr->{green}.__PACKAGE__.$clr." ".$fclr->{purple}.$VERSION.$clr." | ".$msg."\n"; |
103
|
|
|
|
|
|
|
} |
104
|
|
|
|
|
|
|
} |
105
|
|
|
|
|
|
|
|
106
|
|
|
|
|
|
|
# As above, but doesn't append a newline |
107
|
|
|
|
|
|
|
sub debug_nolf |
108
|
|
|
|
|
|
|
{ |
109
|
0
|
|
|
0
|
0
|
0
|
my ($self, $msg) = @_; |
110
|
|
|
|
|
|
|
|
111
|
0
|
0
|
|
|
|
0
|
if($self->get_debug) |
112
|
|
|
|
|
|
|
{ |
113
|
0
|
|
|
|
|
0
|
print $bclr->{blue}.$fclr->{yellow}."D".$clr." ".$msg; |
114
|
|
|
|
|
|
|
} |
115
|
|
|
|
|
|
|
} |
116
|
|
|
|
|
|
|
|
117
|
|
|
|
|
|
|
# As per $self->debug, but prints additional information in a chosen colour |
118
|
|
|
|
|
|
|
sub debug_value |
119
|
|
|
|
|
|
|
{ |
120
|
0
|
|
|
0
|
0
|
0
|
my ($self, $text, $colour, $value) = @_; |
121
|
|
|
|
|
|
|
|
122
|
0
|
|
|
|
|
0
|
$self->debug($text." ".$self->fcolour($colour, $value)); |
123
|
|
|
|
|
|
|
} |
124
|
|
|
|
|
|
|
|
125
|
|
|
|
|
|
|
# Prints an error to STDERR |
126
|
|
|
|
|
|
|
sub error |
127
|
|
|
|
|
|
|
{ |
128
|
0
|
|
|
0
|
1
|
0
|
my ($self, $msg) = @_; |
129
|
|
|
|
|
|
|
|
130
|
0
|
|
|
|
|
0
|
print STDERR $fclr->{red}."E".$clr." ".$msg."\n"; |
131
|
|
|
|
|
|
|
} |
132
|
|
|
|
|
|
|
|
133
|
|
|
|
|
|
|
# Prints and error to STDERR, then 'croak's |
134
|
|
|
|
|
|
|
sub fatal |
135
|
|
|
|
|
|
|
{ |
136
|
0
|
|
|
0
|
0
|
0
|
my ($self, $msg) = @_; |
137
|
|
|
|
|
|
|
|
138
|
0
|
|
|
|
|
0
|
croak $bclr->{red}.$bold."!".$clr." ".$msg."\n"; |
139
|
|
|
|
|
|
|
} |
140
|
|
|
|
|
|
|
|
141
|
|
|
|
|
|
|
# Wrap given message in ANSI colour codes |
142
|
|
|
|
|
|
|
sub fcolour |
143
|
|
|
|
|
|
|
{ |
144
|
8
|
|
|
8
|
0
|
15
|
my ($self, $colour, $text) = @_; |
145
|
|
|
|
|
|
|
|
146
|
8
|
|
|
|
|
53
|
return $fclr->{$colour}.$text.$clr; |
147
|
|
|
|
|
|
|
} |
148
|
|
|
|
|
|
|
|
149
|
|
|
|
|
|
|
=head1 CONSTRUCTORS |
150
|
|
|
|
|
|
|
|
151
|
|
|
|
|
|
|
=head2 Log->new |
152
|
|
|
|
|
|
|
|
153
|
|
|
|
|
|
|
Creates a new C object. |
154
|
|
|
|
|
|
|
|
155
|
|
|
|
|
|
|
=head1 METHODS |
156
|
|
|
|
|
|
|
|
157
|
|
|
|
|
|
|
=head2 $log->create_set(I 0|1>) |
158
|
|
|
|
|
|
|
|
159
|
|
|
|
|
|
|
Creates a new C object. |
160
|
|
|
|
|
|
|
|
161
|
|
|
|
|
|
|
Setting I to B<1> makes L assume that the timestamp and hostname at the beginning of the message is missing (for example, if it's already been processed by another utility). |
162
|
|
|
|
|
|
|
|
163
|
|
|
|
|
|
|
See L and L for further details. |
164
|
|
|
|
|
|
|
|
165
|
|
|
|
|
|
|
=cut |
166
|
|
|
|
|
|
|
|
167
|
|
|
|
|
|
|
sub create_set |
168
|
|
|
|
|
|
|
{ |
169
|
2
|
|
|
2
|
1
|
1466
|
my ($self, $args) = @_; |
170
|
|
|
|
|
|
|
|
171
|
2
|
|
|
|
|
6
|
$args->{'log'} = $self; |
172
|
|
|
|
|
|
|
|
173
|
2
|
|
|
|
|
19
|
my $set = IPTables::Log::Set->create($args); |
174
|
|
|
|
|
|
|
|
175
|
2
|
|
|
|
|
14
|
return $set; |
176
|
|
|
|
|
|
|
} |
177
|
|
|
|
|
|
|
|
178
|
|
|
|
|
|
|
=head1 CAVEATS |
179
|
|
|
|
|
|
|
|
180
|
|
|
|
|
|
|
It parses log entries. It doesn't do much else, yet. |
181
|
|
|
|
|
|
|
|
182
|
|
|
|
|
|
|
=head1 BUGS |
183
|
|
|
|
|
|
|
|
184
|
|
|
|
|
|
|
None that I'm aware of ;-) |
185
|
|
|
|
|
|
|
|
186
|
|
|
|
|
|
|
=head1 AUTHOR |
187
|
|
|
|
|
|
|
|
188
|
|
|
|
|
|
|
This module was written by B . |
189
|
|
|
|
|
|
|
|
190
|
|
|
|
|
|
|
=head1 COPYRIGHT |
191
|
|
|
|
|
|
|
|
192
|
|
|
|
|
|
|
$Id: Log.pm 21 2010-12-17 21:07:37Z andys $ |
193
|
|
|
|
|
|
|
|
194
|
|
|
|
|
|
|
(c)2009 Andy Smith (L) |
195
|
|
|
|
|
|
|
|
196
|
|
|
|
|
|
|
This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself. |
197
|
|
|
|
|
|
|
|
198
|
|
|
|
|
|
|
=cut |
199
|
|
|
|
|
|
|
|
200
|
|
|
|
|
|
|
1 |