| line |
stmt |
bran |
cond |
sub |
pod |
time |
code |
|
1
|
|
|
|
|
|
|
#!/usr/bin/perl |
|
2
|
|
|
|
|
|
|
|
|
3
|
|
|
|
|
|
|
#======================================================================= |
|
4
|
|
|
|
|
|
|
# Log.pm / IPTables::Log |
|
5
|
|
|
|
|
|
|
# $Id: Log.pm 21 2010-12-17 21:07:37Z andys $ |
|
6
|
|
|
|
|
|
|
# $HeadURL: https://daedalus.dmz.dn7.org.uk/svn/IPTables-Log/trunk/IPTables-Log/lib/IPTables/Log.pm $ |
|
7
|
|
|
|
|
|
|
# (c)2009 Andy Smith |
|
8
|
|
|
|
|
|
|
#----------------------------------------------------------------------- |
|
9
|
|
|
|
|
|
|
#:Description |
|
10
|
|
|
|
|
|
|
# This is the main IPTables::Log class. |
|
11
|
|
|
|
|
|
|
#----------------------------------------------------------------------- |
|
12
|
|
|
|
|
|
|
#:Synopsis |
|
13
|
|
|
|
|
|
|
# |
|
14
|
|
|
|
|
|
|
# use IPTables::Log; |
|
15
|
|
|
|
|
|
|
# my $l = IPTables::Log->new; |
|
16
|
|
|
|
|
|
|
# my $s = $l->create_set; |
|
17
|
|
|
|
|
|
|
# my $r = $s->create_record({text => '...IN=eth0 OUT=eth1 MAC=00:...'}); |
|
18
|
|
|
|
|
|
|
# $r->parse; |
|
19
|
|
|
|
|
|
|
# $s->add($r); |
|
20
|
|
|
|
|
|
|
#======================================================================= |
|
21
|
|
|
|
|
|
|
|
|
22
|
|
|
|
|
|
|
# The pod (Perl Documentation) for this module is provided inline. For a |
|
23
|
|
|
|
|
|
|
# better-formatted version, please run:- |
|
24
|
|
|
|
|
|
|
# $ perldoc Log.pm |
|
25
|
|
|
|
|
|
|
|
|
26
|
|
|
|
|
|
|
=head1 NAME |
|
27
|
|
|
|
|
|
|
|
|
28
|
|
|
|
|
|
|
IPTables::Log - Parse iptables/netfilter syslog messages. |
|
29
|
|
|
|
|
|
|
|
|
30
|
|
|
|
|
|
|
=head1 SYNOPSIS |
|
31
|
|
|
|
|
|
|
|
|
32
|
|
|
|
|
|
|
use IPTables::Log; |
|
33
|
|
|
|
|
|
|
my $l = IPTables::Log->new; |
|
34
|
|
|
|
|
|
|
my $s = $l->create_set; |
|
35
|
|
|
|
|
|
|
my $r = $s->create_record({text => '...IN=eth0 OUT=eth1 MAC=00:...'}); |
|
36
|
|
|
|
|
|
|
$r->parse; |
|
37
|
|
|
|
|
|
|
$s->add($r); |
|
38
|
|
|
|
|
|
|
|
|
39
|
|
|
|
|
|
|
=head1 DEPENDENCIES |
|
40
|
|
|
|
|
|
|
|
|
41
|
|
|
|
|
|
|
=over 4 |
|
42
|
|
|
|
|
|
|
|
|
43
|
|
|
|
|
|
|
=item * Carp - for error generation |
|
44
|
|
|
|
|
|
|
|
|
45
|
|
|
|
|
|
|
=item * Class::Accessor - for accessor methods |
|
46
|
|
|
|
|
|
|
|
|
47
|
|
|
|
|
|
|
=item * Data::GUID - for GUID generation |
|
48
|
|
|
|
|
|
|
|
|
49
|
|
|
|
|
|
|
=item * NetAddr::IP - for the C and C methods |
|
50
|
|
|
|
|
|
|
|
|
51
|
|
|
|
|
|
|
=back |
|
52
|
|
|
|
|
|
|
|
|
53
|
|
|
|
|
|
|
=cut |
|
54
|
|
|
|
|
|
|
|
|
55
|
|
|
|
|
|
|
# Set our package name |
|
56
|
|
|
|
|
|
|
package IPTables::Log; |
|
57
|
|
|
|
|
|
|
|
|
58
|
|
|
|
|
|
|
# Set minimum version of Perl |
|
59
|
3
|
|
|
3
|
|
112030
|
use 5.010000; |
|
|
3
|
|
|
|
|
11
|
|
|
|
3
|
|
|
|
|
131
|
|
|
60
|
|
|
|
|
|
|
# Use strict and warnings |
|
61
|
3
|
|
|
3
|
|
18
|
use strict; |
|
|
3
|
|
|
|
|
5
|
|
|
|
3
|
|
|
|
|
104
|
|
|
62
|
3
|
|
|
3
|
|
16
|
use warnings; |
|
|
3
|
|
|
|
|
17
|
|
|
|
3
|
|
|
|
|
113
|
|
|
63
|
|
|
|
|
|
|
|
|
64
|
|
|
|
|
|
|
# Use Carp for errors |
|
65
|
3
|
|
|
3
|
|
23
|
use Carp; |
|
|
3
|
|
|
|
|
7
|
|
|
|
3
|
|
|
|
|
335
|
|
|
66
|
|
|
|
|
|
|
# Use IPTables::Log::Set |
|
67
|
3
|
|
|
3
|
|
2713
|
use IPTables::Log::Set; |
|
|
3
|
|
|
|
|
11
|
|
|
|
3
|
|
|
|
|
18
|
|
|
68
|
|
|
|
|
|
|
|
|
69
|
|
|
|
|
|
|
# Inherit from Class::Accessor to simplify accessor methods. |
|
70
|
3
|
|
|
3
|
|
122
|
use base qw(Class::Accessor); |
|
|
3
|
|
|
|
|
7
|
|
|
|
3
|
|
|
|
|
2277
|
|
|
71
|
|
|
|
|
|
|
__PACKAGE__->follow_best_practice; |
|
72
|
|
|
|
|
|
|
__PACKAGE__->mk_accessors( qw(raw debug) ); |
|
73
|
|
|
|
|
|
|
|
|
74
|
|
|
|
|
|
|
# Set version information |
|
75
|
|
|
|
|
|
|
our $VERSION; |
|
76
|
|
|
|
|
|
|
$VERSION = "0.0005"; |
|
77
|
|
|
|
|
|
|
|
|
78
|
|
|
|
|
|
|
# Hashes of colour |
|
79
|
|
|
|
|
|
|
my $clr = "[0m"; |
|
80
|
|
|
|
|
|
|
my $bold = "[1m"; |
|
81
|
|
|
|
|
|
|
my $fclr = {'red' => '[31;1m', |
|
82
|
|
|
|
|
|
|
'green' => '[32;1m', |
|
83
|
|
|
|
|
|
|
'yellow' => '[33;1m', |
|
84
|
|
|
|
|
|
|
'blue' => '[34;1m', |
|
85
|
|
|
|
|
|
|
'purple' => '[35;1m', |
|
86
|
|
|
|
|
|
|
'cyan' => '[36;1m'}; |
|
87
|
|
|
|
|
|
|
|
|
88
|
|
|
|
|
|
|
my $bclr = {'red' => '[41;1m', |
|
89
|
|
|
|
|
|
|
'green' => '[42;1m', |
|
90
|
|
|
|
|
|
|
'yellow' => '[43;1m', |
|
91
|
|
|
|
|
|
|
'blue' => '[44;1m', |
|
92
|
|
|
|
|
|
|
'purple' => '[45;1m', |
|
93
|
|
|
|
|
|
|
'cyan' => '[46;1m'}; |
|
94
|
|
|
|
|
|
|
|
|
95
|
|
|
|
|
|
|
# Generates a debug message if $self->debug == 1 |
|
96
|
|
|
|
|
|
|
sub debug |
|
97
|
|
|
|
|
|
|
{ |
|
98
|
8
|
|
|
8
|
0
|
12
|
my ($self, $msg) = @_; |
|
99
|
|
|
|
|
|
|
|
|
100
|
8
|
50
|
|
|
|
21
|
if($self->get_debug) |
|
101
|
|
|
|
|
|
|
{ |
|
102
|
0
|
|
|
|
|
0
|
print $bclr->{blue}.$fclr->{yellow}."D".$clr." ".$fclr->{green}.__PACKAGE__.$clr." ".$fclr->{purple}.$VERSION.$clr." | ".$msg."\n"; |
|
103
|
|
|
|
|
|
|
} |
|
104
|
|
|
|
|
|
|
} |
|
105
|
|
|
|
|
|
|
|
|
106
|
|
|
|
|
|
|
# As above, but doesn't append a newline |
|
107
|
|
|
|
|
|
|
sub debug_nolf |
|
108
|
|
|
|
|
|
|
{ |
|
109
|
0
|
|
|
0
|
0
|
0
|
my ($self, $msg) = @_; |
|
110
|
|
|
|
|
|
|
|
|
111
|
0
|
0
|
|
|
|
0
|
if($self->get_debug) |
|
112
|
|
|
|
|
|
|
{ |
|
113
|
0
|
|
|
|
|
0
|
print $bclr->{blue}.$fclr->{yellow}."D".$clr." ".$msg; |
|
114
|
|
|
|
|
|
|
} |
|
115
|
|
|
|
|
|
|
} |
|
116
|
|
|
|
|
|
|
|
|
117
|
|
|
|
|
|
|
# As per $self->debug, but prints additional information in a chosen colour |
|
118
|
|
|
|
|
|
|
sub debug_value |
|
119
|
|
|
|
|
|
|
{ |
|
120
|
0
|
|
|
0
|
0
|
0
|
my ($self, $text, $colour, $value) = @_; |
|
121
|
|
|
|
|
|
|
|
|
122
|
0
|
|
|
|
|
0
|
$self->debug($text." ".$self->fcolour($colour, $value)); |
|
123
|
|
|
|
|
|
|
} |
|
124
|
|
|
|
|
|
|
|
|
125
|
|
|
|
|
|
|
# Prints an error to STDERR |
|
126
|
|
|
|
|
|
|
sub error |
|
127
|
|
|
|
|
|
|
{ |
|
128
|
0
|
|
|
0
|
1
|
0
|
my ($self, $msg) = @_; |
|
129
|
|
|
|
|
|
|
|
|
130
|
0
|
|
|
|
|
0
|
print STDERR $fclr->{red}."E".$clr." ".$msg."\n"; |
|
131
|
|
|
|
|
|
|
} |
|
132
|
|
|
|
|
|
|
|
|
133
|
|
|
|
|
|
|
# Prints and error to STDERR, then 'croak's |
|
134
|
|
|
|
|
|
|
sub fatal |
|
135
|
|
|
|
|
|
|
{ |
|
136
|
0
|
|
|
0
|
0
|
0
|
my ($self, $msg) = @_; |
|
137
|
|
|
|
|
|
|
|
|
138
|
0
|
|
|
|
|
0
|
croak $bclr->{red}.$bold."!".$clr." ".$msg."\n"; |
|
139
|
|
|
|
|
|
|
} |
|
140
|
|
|
|
|
|
|
|
|
141
|
|
|
|
|
|
|
# Wrap given message in ANSI colour codes |
|
142
|
|
|
|
|
|
|
sub fcolour |
|
143
|
|
|
|
|
|
|
{ |
|
144
|
8
|
|
|
8
|
0
|
15
|
my ($self, $colour, $text) = @_; |
|
145
|
|
|
|
|
|
|
|
|
146
|
8
|
|
|
|
|
53
|
return $fclr->{$colour}.$text.$clr; |
|
147
|
|
|
|
|
|
|
} |
|
148
|
|
|
|
|
|
|
|
|
149
|
|
|
|
|
|
|
=head1 CONSTRUCTORS |
|
150
|
|
|
|
|
|
|
|
|
151
|
|
|
|
|
|
|
=head2 Log->new |
|
152
|
|
|
|
|
|
|
|
|
153
|
|
|
|
|
|
|
Creates a new C object. |
|
154
|
|
|
|
|
|
|
|
|
155
|
|
|
|
|
|
|
=head1 METHODS |
|
156
|
|
|
|
|
|
|
|
|
157
|
|
|
|
|
|
|
=head2 $log->create_set(I 0|1>) |
|
158
|
|
|
|
|
|
|
|
|
159
|
|
|
|
|
|
|
Creates a new C object. |
|
160
|
|
|
|
|
|
|
|
|
161
|
|
|
|
|
|
|
Setting I to B<1> makes L assume that the timestamp and hostname at the beginning of the message is missing (for example, if it's already been processed by another utility). |
|
162
|
|
|
|
|
|
|
|
|
163
|
|
|
|
|
|
|
See L and L for further details. |
|
164
|
|
|
|
|
|
|
|
|
165
|
|
|
|
|
|
|
=cut |
|
166
|
|
|
|
|
|
|
|
|
167
|
|
|
|
|
|
|
sub create_set |
|
168
|
|
|
|
|
|
|
{ |
|
169
|
2
|
|
|
2
|
1
|
1466
|
my ($self, $args) = @_; |
|
170
|
|
|
|
|
|
|
|
|
171
|
2
|
|
|
|
|
6
|
$args->{'log'} = $self; |
|
172
|
|
|
|
|
|
|
|
|
173
|
2
|
|
|
|
|
19
|
my $set = IPTables::Log::Set->create($args); |
|
174
|
|
|
|
|
|
|
|
|
175
|
2
|
|
|
|
|
14
|
return $set; |
|
176
|
|
|
|
|
|
|
} |
|
177
|
|
|
|
|
|
|
|
|
178
|
|
|
|
|
|
|
=head1 CAVEATS |
|
179
|
|
|
|
|
|
|
|
|
180
|
|
|
|
|
|
|
It parses log entries. It doesn't do much else, yet. |
|
181
|
|
|
|
|
|
|
|
|
182
|
|
|
|
|
|
|
=head1 BUGS |
|
183
|
|
|
|
|
|
|
|
|
184
|
|
|
|
|
|
|
None that I'm aware of ;-) |
|
185
|
|
|
|
|
|
|
|
|
186
|
|
|
|
|
|
|
=head1 AUTHOR |
|
187
|
|
|
|
|
|
|
|
|
188
|
|
|
|
|
|
|
This module was written by B . |
|
189
|
|
|
|
|
|
|
|
|
190
|
|
|
|
|
|
|
=head1 COPYRIGHT |
|
191
|
|
|
|
|
|
|
|
|
192
|
|
|
|
|
|
|
$Id: Log.pm 21 2010-12-17 21:07:37Z andys $ |
|
193
|
|
|
|
|
|
|
|
|
194
|
|
|
|
|
|
|
(c)2009 Andy Smith (L) |
|
195
|
|
|
|
|
|
|
|
|
196
|
|
|
|
|
|
|
This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself. |
|
197
|
|
|
|
|
|
|
|
|
198
|
|
|
|
|
|
|
=cut |
|
199
|
|
|
|
|
|
|
|
|
200
|
|
|
|
|
|
|
1 |