示例#1
0
文件: main.c 项目: farsightsec/axa
void AXA_NORETURN
stop(int status)
{
	if (el_e != NULL) {
		if (el_history)
			history(el_history, &el_event, H_SAVE,
					history_savefile);
		history_end(el_history);
		el_end(el_e);
	}
	close_in_files();
	fflush(stderr);
	fflush(stdout);
	disconnect(false);
	if (nmsg_input != NULL)
		nmsg_input_close(&nmsg_input);
	if (nmsg_pres != NULL)
		nmsg_output_close(&nmsg_pres);	/* this closes stdout */
	out_close(false);

	axa_unload_fields();
	axa_unload_client_config();

	axa_io_cleanup();

	exit(status);
}
void ConfigFile::_Close()
{
/*
	功能:关闭输入输出流
	参数:无
	返回值:无
*/
   in_close();
   out_close();
}
示例#3
0
文件: output.c 项目: farsightsec/axa
void
out_flush(void)
{
	nmsg_res res;
	ssize_t wlen;

	if (time_out_flush.tv_sec == 0)
		return;

	if (out_buf_len != 0) {
		wlen = write(out_fd, &out_buf[out_buf_base],
			     out_buf_len - out_buf_base);
		if (wlen < 0) {
			if (errno != EAGAIN && errno != EWOULDBLOCK
			    && errno != EINTR) {
				error_msg("write(%s): %s",
					  out_addr, strerror(errno));
				out_close(true);
			}
		} else {
			out_buf_base += wlen;
			if (out_buf_base >= out_buf_len)
				out_buf_base = out_buf_len = 0;
		}
	}

	if (out_nmsg_output != NULL) {
		res = nmsg_output_flush(out_nmsg_output);
		if (res != nmsg_res_success
		    &&  (out_sock_type != SOCK_DGRAM
			 || res != nmsg_res_errno
			 || !AXA_IGNORED_UDP_ERRNO(errno))) {
			error_msg("nmsg_output_flush(forward): %s",
				  nmsg_res_lookup(res));
			out_close(true);
		}
	}

	time_out_flush.tv_sec = 0;
}
示例#4
0
LOCAL void
processTemplate(tTemplate* pTF)
{
    forInfo.fi_depth = 0;

    /*
     *  IF the template file does not specify any output suffixes,
     *  THEN we will generate to standard out with the suffix set to zNoSfx.
     *  With output going to stdout, we don't try to remove output on errors.
     */
    if (pOutSpecList == NULL) {
        do_stdout_tpl(pTF);
        return;
    }

    do  {
        tOutSpec*  pOS    = pOutSpecList;

        /*
         * We cannot be in Scheme processing.  We've either just started
         * or we've made a long jump from our own code.  If we've made a
         * long jump, we've printed a message that is sufficient and we
         * don't need to print any scheme expressions.
         */
        pzLastScheme = NULL;

        /*
         *  HOW was that we got here?
         */
        switch (setjmp(fileAbort)) {
        case SUCCESS:
            if (OPT_VALUE_TRACE >= TRACE_EVERYTHING) {
                fprintf(pfTrace, PROC_TPL_START, pOS->zSuffix);
                fflush(pfTrace);
            }
            /*
             *  Set the output file name buffer.
             *  It may get switched inside open_output.
             */
            open_output(pOS);
            memcpy(&fpRoot, pCurFp, sizeof(fpRoot));
            AGFREE(pCurFp);
            pCurFp         = &fpRoot;
            pzCurSfx       = pOS->zSuffix;
            currDefCtx     = rootDefCtx;
            pCurFp->flags &= ~FPF_FREE;
            pCurFp->pPrev  = NULL;
            generateBlock(pTF, pTF->aMacros, pTF->aMacros + pTF->macroCt);

            do  {
                out_close(AG_FALSE);  /* keep output */
            } while (pCurFp->pPrev != NULL);
            break;

        case PROBLEM:
            /*
             *  We got here by a long jump.  Close/purge the open files.
             */
            do  {
                out_close(AG_TRUE);  /* discard output */
            } while (pCurFp->pPrev != NULL);
            pzLastScheme = NULL; /* "problem" means "drop current output". */
            break;

        default:
            fprintf(pfTrace, PROC_TPL_BOGUS_RET, pzOopsPrefix);
            pzOopsPrefix = zNil;
            /* FALLTHROUGH */

        case FAILURE:
            /*
             *  We got here by a long jump.  Close/purge the open files.
             */
            do  {
                out_close(AG_TRUE);  /* discard output */
            } while (pCurFp->pPrev != NULL);

            /*
             *  On failure (or unknown jump type), we quit the program, too.
             */
            procState = PROC_STATE_ABORTING;
            do pOS = nextOutSpec(pOS);
            while (pOS != NULL);
            exit(EXIT_FAILURE);
        }

        pOutSpecList = nextOutSpec(pOS);
    } while (pOutSpecList != NULL);
}
示例#5
0
文件: output.c 项目: farsightsec/axa
/* forward watch hits as NMSG messages */
bool
out_whit_nmsg(axa_p_whit_t *whit, size_t whit_len)
{
	nmsg_message_t msg;
	struct timespec ts;
	static const union {
		uint    e;
		uint8_t	c[0];
	} pkt_enum = { .e = NMSG__BASE__PACKET_TYPE__IP };
	size_t len;
	struct timeval now;
	nmsg_res res;
	bool result;

	switch ((axa_p_whit_enum_t)whit->hdr.type) {
	case AXA_P_WHIT_NMSG:
		/* pass NMSG messages along */
		if (whit2nmsg(&msg, whit, whit_len) == AXA_W2N_RES_FRAGMENT) {
			if (axa_debug != 0)
				printf("ignoring NMSG fragment from "
						AXA_OP_CH_PREFIX"%d",
						AXA_P2H_CH(whit->hdr.ch));
			return (false);
		}
		if (msg == NULL)
			return (false);
		break;

	case AXA_P_WHIT_IP:
		/* Convert raw IP packets to nmsg BASE_PACKET */
		len = whit_len - sizeof(whit->ip.hdr);
		if (AXA_P2H32(whit->ip.hdr.ip_len) != len)
			return (false);	/* Ignore incomplete packets. */

		if (!out_nmsg_mod_checked) {
			out_nmsg_mod_checked = true;
			out_nmsg_mod = nmsg_msgmod_lookup(NMSG_VENDOR_BASE_ID,
						NMSG_VENDOR_BASE_PACKET_ID);
			if (out_nmsg_mod == NULL) {
				out_error("cannot get BASE_PACKET module");
				return (false);
			}
			res = nmsg_msgmod_init(out_nmsg_mod, &out_nmsg_clos);
			if (res != nmsg_res_success) {
				out_error("cannot init BASE_PACKET module");
				out_nmsg_mod = NULL;
				return (false);
			}
		}
		if (out_nmsg_mod == NULL) {
			out_error("cannot forward IP as NMSG messages"
				  " without PACKET nmsg_msgmod");
			return (false);
		}

		msg = nmsg_message_init(out_nmsg_mod);
		AXA_ASSERT(msg != NULL);
		res = nmsg_message_set_field(msg, "payload_type", 0,
					     pkt_enum.c, sizeof(pkt_enum));
		AXA_ASSERT(res == nmsg_res_success);
		res = nmsg_message_set_field(msg, "payload", 0,
					     whit->ip.b, len);
		AXA_ASSERT(res == nmsg_res_success);
		ts.tv_sec = AXA_P2H32(whit->ip.hdr.tv.tv_sec);
		ts.tv_nsec = AXA_P2H32(whit->ip.hdr.tv.tv_usec) * 1000;
		nmsg_message_set_time(msg, &ts);
		break;

#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wunreachable-code"
	default:
		out_error("cannot forward SRA #%d messages as NMSG messages",
			  whit->hdr.type);
		return (false);
#pragma clang diagnostic pop
	}

	res = nmsg_output_write(out_nmsg_output, msg);
	if (res == nmsg_res_success) {
		result = true;
	} else {
		result = false;

		gettimeofday(&now, NULL);
		if (out_sock_type != SOCK_DGRAM
		    || res != nmsg_res_errno
		    || !AXA_IGNORED_UDP_ERRNO(errno)) {
			/* Stop on non-UDP errors. */
			clear_prompt();
			error_msg("nmsg_output_write(): %s",
				  nmsg_res_lookup(res));
			out_close(false);
			disconnect(true);
		} else if (output_errno != errno
			   || 60*1000 <= axa_elapsed_ms(&now,
							&output_errno_time)
			   || axa_debug >= AXA_DEBUG_TRACE) {
			/* Report occasional identical UDP errors. */
			output_errno = errno;
			gettimeofday(&output_errno_time, NULL);
			clear_prompt();
			error_msg("nmsg_output_write(): %s",
				  strerror(output_errno));
		}
	}

	nmsg_message_destroy(&msg);
	if (time_out_flush.tv_sec == 0)
		gettimeofday(&time_out_flush, NULL);

	return (result);
}
示例#6
0
static void
unbuffered(const char *arg0, int argc, char **argv)
{
  TINO_BUF	buf;

  if (!line_cont_suffix && !flag_hexdump)
    if (flag_localtime || flag_linecount || flag_utc || flag_verbose)
      line_cont_suffix = "\n";
  producer = 0;
  if (argc)
    {
      int	fds[2], redir[TINO_OPEN_MAX], fdmax, i;

      if (tino_file_pipeE(fds))
	tino_exit("cannot create pipe");

      fdmax = fd_in<3 ? 3 : fd_in+1;

      for (i=fdmax; --i>=0; )
        redir[i] = -1;				/* preserve all FDs	*/

      if (fd_in<0)
        fd_in = 1;

      redir[2] = flag_both ? fds[1] : 2;	/* catch stderr on -d, too	*/
      if (fd_in==2)
        redir[1] = redir[2];			/* swap stdin/stderr on -i2	*/
      redir[fd_in] = fds[1];			/* catch the given FD */

      /* catch the child's output for preprocessing
       */
      producer = tino_fork_execO(redir, fdmax, argv, NULL, 0, NULL);
      tino_file_closeE(fds[1]);

      fd_in = fds[0];

#if 0
      /* Following is a mess.  It is only needed for a consumer, though.
       * With a producer we see EOF on the pipe.
       * Shall be handled implicitely by a library somehow:
       */
      tino_sigset(SIGCHLD, terminate);
      terminate();	/* catch early terminated childs	*/
#endif
    }

  tino_buf_initO(&buf);
  if (producer && flag_verbose)
    {
      start_line(1, 1);
      add_prefix("start");
      for (; *argv; argv++)
	add_prefix(" '%s'", *argv);	/* XXX TODO sadly, escape is implemented in tino_io, not in tino_buf	*/
      add_prefix("\n");
      out_open();
      tino_data_putsA(&out, tino_buf_get_sN(&prefix));
    }

  if (fd_in<0)
    fd_in = 0;
  while (tino_buf_readE(&buf, fd_in, -1))
    {
      size_t		n;

      out_open();
      /* XXX TODO MISSING:
       * for flag_buffer==1 or flag_buffer==2
       * immediately write STDOUT(1),
       * but buffer STDERR(dump_line)
       */
      while ((n=tino_buf_get_lenO(&buf))>0)
	{
	  const char	*ptr;
	  size_t	k, p;

	  ptr	= tino_buf_getN(&buf);
	  p	= 0;
	  for (k=0; k<n; k++)
	    if (ptr[k]==line_terminator)
	      {
		dump_line(ptr+p, k-p, 1);
		p	= k+1;
	      }
	  /* k=n	*/
	  if (flag_buffer && p)
	    n = p;	/* do not output incomplete line	*/
	  else if ((flag_buffer>1 && n<=99999) || flag_buffer>2)
	    break;		/* buffer fragments	*/

	  /* We shall, nonblockingly, read additional input data here,
	   * if available.  Leave this to future.
	   */
	  TINO_XXX;

	  if (p<n)
	    dump_line(ptr+p, n-p, 0);
	  if (flag_cat)
	    tino_buf_advanceO(&buf, n);
	  else if (tino_buf_write_away_allE(&buf, 1, n))
	    {
	      /* silently drop out	*/
	      *tino_main_errflag	= 1;
	      break;
	    }
	  if (flag_buffer)
	    break;
	}
      out_flush();
    }
  {
      size_t		n;

      /* in case of flag_buffer: send the rest	*/
      if ((n=tino_buf_get_lenO(&buf))>0)
	{
	  const char	*ptr;

	  out_open();
	  ptr	= tino_buf_getN(&buf);
	  dump_line(ptr, n, 0);
	  if (!flag_cat && tino_buf_write_away_allE(&buf, 1, n))
	    *tino_main_errflag	= 1;
	}
  }
  if (producer)
    {
      char *cause;

#if 0
      tino_sigdummy(SIGCHLD);	/* prevent reentrance of waitpid()	*/
#endif
      /* wait for child to finish after the pipe was closed,
       * so give the child the chance to terminate.
       */
      tino_file_closeE(0);
      *tino_main_errflag	= tino_wait_child_exact(producer, &cause);
      if (flag_verbose)
	{
	  start_line(1, 1);
	  add_prefix("end %s\n", cause);
	  out_open();
	  tino_data_putsA(&out, tino_buf_get_sN(&prefix));
	}
    }
  out_close();			/* close(2)	*/
}
示例#7
0
static void
out_flush(void)
{
  if (out_is_open>0)
    out_close();
}