host/ihost-perl/ihost.pl

#!/usr/bin/perl -w

# 
# i-scream central monitoring system
# Copyright (C) 2000-2002 i-scream
# 
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
# 
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
# 
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
#

# -----------------------------------------------------------
# Perl i-scream Host.
# http://www.i-scream.org.uk
#
# An all-in-one script to act as an i-scream host on
# a typical Unix/Linux box.
#
# $Author: tdb $
# $Id: ihost.pl,v 1.48 2002/05/11 17:20:07 tdb Exp $
#------------------------------------------------------------

$| = 1;

use strict;
use IO::Socket;
use Sys::Hostname;

use vars qw (
             $filter_manager_addr
             $filter_manager_port
             $seq_no
             $udp_update_time
             $tcp_update_time
             $last_udp_time
             $last_tcp_time
             $last_modified
             $udp_port
             $tcp_port
             $filter_addr
             $file_list
             $fqdn
             $pidfile
             $retry_wait
             $ostype
             $key
             @data
            );

if (@ARGV != 2) {
    die "Usage: ihost.pl [i-scream filter manager] [TCP port]\n";
}

$filter_manager_addr = $ARGV[0];
$filter_manager_port = $ARGV[1];

$seq_no = 1;
$retry_wait = 60;

# work out our platform, if we can.
$ostype = `uname -s`;
chomp $ostype;
$ostype = "unknown" if not defined $ostype;

# write our PID to a file
# use home dir by default
#$pidfile = $ENV{"HOME"};
# or drop it in /var/tmp if we can't find HOME
$pidfile = "/var/tmp" if not defined $pidfile;
$pidfile .= "/.ihost.pid";
&write_pid();

&tcp_configure();
&send_tcp_heartbeat();
&send_udp_packet();

$last_udp_time = time;
$last_tcp_time = time;
while (1) {
    my($time) = time;
    if ($time >= $last_udp_time + $udp_update_time) {
        &send_udp_packet();
        $last_udp_time = $time;
    }
    if ($time >= $last_tcp_time + $tcp_update_time) {
        &send_tcp_heartbeat();
        $last_tcp_time = $time;
    }
    my($next_udp) = $udp_update_time - $time + $last_udp_time;
    my($next_tcp) = $tcp_update_time - $time + $last_tcp_time;
    my($delay);
    if ($next_udp < $next_tcp) {
        $delay = $next_udp
    }
    else {
        $delay = $next_tcp;
    }
    sleep $delay;
}

# we'll probably never get here...
`rm -f $pidfile`;
exit(0);


#-----------------------------------------------------------------------
# wait_then_retry
# Waits for the period of time specified in $retry_wait, then attempts
# to reconfigure with the server.
#-----------------------------------------------------------------------
sub wait_then_retry() {
    print "Will retry configuration with filter manager in $retry_wait seconds.\n";
    sleep $retry_wait;
}


#-----------------------------------------------------------------------
# tcp_configure
# Establishes a TCP connection to the specified i-scream filter manager.
# The host then requests details from the server, such as the intervals
# at which to send UDP packets.
#-----------------------------------------------------------------------
sub tcp_configure() {
    
    while (1) {
        my($sock) = new IO::Socket::INET(
                                         PeerAddr => $filter_manager_addr,
                                         PeerPort => $filter_manager_port,
                                         Proto => 'tcp'
                                        ) or die "Cannot connect!";
        if (!defined $sock) {
            print "IHOST ERROR: Could not connect to $filter_manager_addr:$filter_manager_port.\n";
            print "Please check that there is an i-scream server at this address.\n";
            wait_then_retry();
            next;
        }

        # Now run through the configuration process...
        my($response);
    
        print $sock "STARTCONFIG\n";
        $response = <$sock>;
        if ($response && !($response eq "OK\n")) {
            print "The i-scream server rejected the STARTCONFIG command.\n";
            close($sock);
            wait_then_retry();
            next;
        }

        print "Config started okay.\n";
    
        print $sock "LASTMODIFIED\n";
        $response = <$sock>;
        if (!$response || $response eq "ERROR\n") {
            print "The i-scream server did not provide the LASTMODIFIED value.\n";
            close($sock);
            wait_then_retry();
            next;
        }
        chomp $response;
        $last_modified = $response;
    
        print "Config last modified: ". (scalar localtime $last_modified/1000) . "\n";

        print $sock "FILELIST\n";
        $response = <$sock>;
        if (!$response || $response eq "ERROR\n") {
            print "The i-scream server did not provide a configuration file list.\n";
            close($sock);
            wait_then_retry();
            next;
        }
        chomp $response;
        $file_list = $response;

        print "File list obtained: $file_list\n";

        print $sock "FQDN\n";
        $response = <$sock>;
        if (!$response || $response eq "ERROR\n") {
            print "The i-scream server did not tell us our FQDN.\n";
            close($sock);
            wait_then_retry();
            next;
        }
        chomp $response;
        $fqdn = $response;

        print "FQDN returned: $fqdn\n";

        print $sock "UDPUpdateTime\n";
        $response = <$sock>;
        if (!$response || $response eq "ERROR\n") {
            print "The i-scream server did not give us a UDPUpdateTime.\n";
            close($sock);
            wait_then_retry();
            next;
        }
        chomp $response;
        $udp_update_time = $response;

        print $sock "TCPUpdateTime\n";
        $response = <$sock>;
        if (!$response || $response eq "ERROR\n") {
            print "The i-scream server did not give us a TCPUpdateTime.\n";
            close($sock);
            wait_then_retry();
            next;
        }
        chomp $response;
        $tcp_update_time = $response;
    
        print "UDP packet period: $udp_update_time seconds.\nTCP heartbeat period: $tcp_update_time seconds.\n";

        print $sock "ENDCONFIG\n";
        $response = <$sock>;
        if ($response && !($response eq "OK\n")) {
            print "ENDCONFIG command to server failed.  Terminated.\n";
            close($sock);
            wait_then_retry();
            next;
        }

        print "Config ended.\n";
    
        print $sock "FILTER\n";
        $response = <$sock>;
        if (!$response) {
            print "Failed: Could not get a filter address from the filter manager.\n";
            close($sock);
            wait_then_retry();
            next;
        }
        chomp $response;
        if ($response eq "ERROR") {
            print "There are no active configured filters for your host.\n";
            close($sock);
            wait_then_retry();
            next;
        }
        $response =~ /^(.*);(.*);(.*)/;
        ($filter_addr, $udp_port, $tcp_port) = ($1, $2, $3);
        unless (defined($filter_addr) && defined($udp_port) && defined($tcp_port)) {
            print "Failed: Filter address response from server did not make sense: $response\n";
            close($sock);
            wait_then_retry();
            next;
        }
    
        print "Got filter data ($filter_addr, $udp_port, $tcp_port)\n";

        print $sock "END\n";
        $response = <$sock>;
        if ($response && ($response eq "OK\n")) {
            print "Host successfully configured via TCP.\n"
        }
        else {
            print "The server failed the host configuration on the END command.\n";
            close($sock);
            wait_then_retry();
            next;
        }
    
        close($sock);

        print "Configuration finished sucessfully!\n";
        last;
    }
    return;
}


#-----------------------------------------------------------------------
# send_udp_packet
# Sends a UDP packet to an i-scream filter.
# The packet contains XML markup describing some of the machine's state.
# Receipt of UDP packets is not guaranteed.
#-----------------------------------------------------------------------
sub send_udp_packet() {

    my($plugins_dir) = "plugins";
    
    opendir PLUGINS, $plugins_dir;
    my(@plugins) = readdir PLUGINS;
    foreach my $plugin (@plugins) {
        push @data, `$plugins_dir/$plugin $ostype` if -x "$plugins_dir/$plugin" && -f "$plugins_dir/$plugin";
    }
    
    # get some extra data
    my($date) = time;
    my($ip);
    $ip = inet_ntoa(scalar(gethostbyname(hostname())) || 'localhost') or $ip = 'localhost';
    
    # add some extra data to the array
    push(@data, "packet.attributes.seq_no $seq_no");
    push(@data, "packet.attributes.machine_name $fqdn");
    push(@data, "packet.attributes.date $date");
    push(@data, "packet.attributes.type data");
    push(@data, "packet.attributes.ip $ip");
    push(@data, "packet.attributes.key $key");
    
    # sort the data
    @data = sort(grep(!/^$/, grep(/^packet\./, @data)));

    # turn the array into some nice XML
    my($xml) = &make_xml("", "");

    my($sock) = new IO::Socket::INET (
                                      PeerPort => $udp_port,
                                      PeerAddr => $filter_addr,
                                      Proto => 'udp'
                                     ) or die "Could not send UDP: $!\n";
    
    print $sock $xml or die "Could not send UDP packet: $!\n";
    close($sock);
    $seq_no++;
    print "-";
    
    return;
}


#-----------------------------------------------------------------------
# send_tcp_heartbeat
# Establishes a TCP connection to an i-scream filter.
# The heartbeat is used as a guaranteed "I'm alive" delivery mechanism.
# If we need to reconfigure, then we complete the heartbeat before
# doing so.
#-----------------------------------------------------------------------
sub send_tcp_heartbeat() {

    my ($doReconfigure) = 0;

    my($sock) = new IO::Socket::INET(
                                     PeerAddr => $filter_addr,
                                     PeerPort => $tcp_port,
                                     Proto => 'tcp'
                                    ) or return;
    if (!defined $sock) {
        print "IHOST WARNING: Failed to deliver a heartbeat to the i-scream filter.\n";
        &tcp_configure();
        return;
    }

    # Now run through the configuration process.
    my($response);

    print $sock "HEARTBEAT\n";
    $response = <$sock>;
    if (!$response eq "OK\n") {
        close($sock);
        print "Server gave wrong response to HEARTBEAT: $response\n";
        &tcp_configure();
        return;
    }
    
    print $sock "CONFIG\n";
    $response = <$sock>;
    if (!$response eq "OK\n") {
        close($sock);
        print "Server gave wrong response to CONFIG: $response\n";
        &tcp_configure();
        return;
    }

    print $sock "$file_list\n";
    $response = <$sock>;
    if (!$response eq "OK\n") {
        close($sock);
        print "Server gave wrong response to file list: $response\n";
        &tcp_configure();
        return;
    }
    
    print $sock "$last_modified\n";
    $response = <$sock>;
    if ($response eq "ERROR\n") {
        close($sock);
        print "Server configuration changed.  Reconfiguring with filter manager.\n";
        $doReconfigure = 1;
    }
    if (!$response eq "OK\n") {
        close($sock);
        print "Server gave wrong response to HEARTBEAT: $response\n";
        &tcp_configure();
        return;
    }
    
    print $sock "KEY\n";
    $key = <$sock>;
    
    print $sock "ENDHEARTBEAT\n";
    $response = <$sock>;
    if (!$response eq "OK\n") {
        close($sock);
        print "Server gave wrong response to ENDHEARTBEAT: $response\n";
        &tcp_configure();
        return;
    }
    
    close($sock);
    print "^";
    
    &tcp_configure() if $doReconfigure;
    
    return;
}


#-----------------------------------------------------------------------
# write_pid
# Writes the PID (process ID) of this instance to $pidfile.
# This is then used by a seperate script to check (and restart) ihost.
#-----------------------------------------------------------------------
sub write_pid() {
    open PID, ">$pidfile";
    print PID $$;
    close PID;
    
    return;
}

#-----------------------------------------------------------------------
# make_xml
# Turns an array of plugins data into an XML string.
#-----------------------------------------------------------------------
sub make_xml() {
    my($curlevel, $curline) = @_;
    my($xmltemp) = ""; my($curtag) = ""; my($attributes) = "";
    while(1) {
        $curline = shift(@data) if $curline eq "";
        return $xmltemp if not defined $curline;
        chomp $curline;
        # dealing with nest (or attributes)
        if($curline =~ /^$curlevel([^\.\s]+\.)/) {
            $curtag=$1;
            if($curline =~ /^$curlevel$curtag([^\.\s]+)\s+(.*)$/) {
                $xmltemp .= &make_xml("$curlevel$curtag", $curline);
            }
            elsif($curline =~ /^$curlevel$curtag(attributes)\.([^\.\s]+)\s+(.*)$/) {
                $attributes .= " $2=\"$3\"";
            }
            else {
                $xmltemp .= &make_xml("$curlevel$curtag", $curline);
            }
            my($nextline) = $data[0]; chomp $nextline if defined $nextline;
            $curtag =~ s/(.*)\./$1/;
            if((defined $nextline) && ($nextline =~ /^$curlevel$curtag\./)) {
                $curline = ""; 
            }
            else {
                $xmltemp = "<$curtag$attributes>$xmltemp</$curtag>" unless $curtag eq "";
                return $xmltemp;
            }
        }
        # dealing with value
        elsif($curline =~ /^$curlevel([^\.\s]+)\s+(.*)$/) {
            $curtag=$1;
            $xmltemp=$2;           
            my($nextline) = $data[0]; chomp $nextline if defined $nextline;
            if(defined $nextline && ($nextline =~ /^$curlevel$curtag\./ || $nextline =~ /^$curlevel$curtag\s+/)) {
                $curline = ""; 
            }
            else {
                $xmltemp = "<$curtag$attributes>$xmltemp</$curtag>" unless $curtag eq "";
                return $xmltemp;
            }
        }
        # dealing with a null value
        elsif($curline =~ /^$curlevel([^\.\s]+)$/) {
            # simply adding a space makes the above elsif deal with it :)
            # just level with an empty tag in the XML
            $curline .= " ";
        }
        # failing all that, skip the line
        else {
            $curline = "";
        }
    }
}
Revision:	1.49
Committed:	Sat May 18 18:15:56 2002 UTC (22 years, 4 months ago) by tdb
Content type:	text/plain
Branch:	MAIN
Changes since 1.48:	+20 -1 lines
Log Message:	i-scream is now licensed under the GPL. I've added the GPL headers to every source file, and put a full copy of the license in the appropriate places. I think I've covered everything. This is going to be a mad commit ;)
#	User	Rev	Content
1	pjm2	1.6	#!/usr/bin/perl -w
2	pjm2	1.1
3	tdb	1.49	#
4			# i-scream central monitoring system
5			# Copyright (C) 2000-2002 i-scream
6			#
7			# This program is free software; you can redistribute it and/or
8			# modify it under the terms of the GNU General Public License
9			# as published by the Free Software Foundation; either version 2
10			# of the License, or (at your option) any later version.
11			#
12			# This program is distributed in the hope that it will be useful,
13			# but WITHOUT ANY WARRANTY; without even the implied warranty of
14			# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15			# GNU General Public License for more details.
16			#
17			# You should have received a copy of the GNU General Public License
18			# along with this program; if not, write to the Free Software
19			# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
20			#
21
22	pjm2	1.1	# -----------------------------------------------------------
23			# Perl i-scream Host.
24	pjm2	1.12	# http://www.i-scream.org.uk
25	pjm2	1.1	#
26			# An all-in-one script to act as an i-scream host on
27	tdb	1.36	# a typical Unix/Linux box.
28	pjm2	1.1	#
29	tdb	1.44	# $Author: tdb $
30	tdb	1.49	# $Id: ihost.pl,v 1.48 2002/05/11 17:20:07 tdb Exp $
31	pjm2	1.1	#------------------------------------------------------------
32
33			$\| = 1;
34
35			use strict;
36			use IO::Socket;
37			use Sys::Hostname;
38
39			use vars qw (
40			$filter_manager_addr
41			$filter_manager_port
42			$seq_no
43			$udp_update_time
44			$tcp_update_time
45			$last_udp_time
46			$last_tcp_time
47			$last_modified
48			$udp_port
49			$tcp_port
50			$filter_addr
51			$file_list
52	pjm2	1.17	$fqdn
53	tdb	1.25	$pidfile
54	pjm2	1.28	$retry_wait
55	tdb	1.44	$ostype
56	tdb	1.47	$key
57	tdb	1.37	@data
58	pjm2	1.1	);
59
60			if (@ARGV != 2) {
61			die "Usage: ihost.pl [i-scream filter manager] [TCP port]\n";
62			}
63
64			$filter_manager_addr = $ARGV[0];
65			$filter_manager_port = $ARGV[1];
66
67			$seq_no = 1;
68	pjm2	1.33	$retry_wait = 60;
69	pjm2	1.1
70	tdb	1.44	# work out our platform, if we can.
71			$ostype = `uname -s`;
72			chomp $ostype;
73			$ostype = "unknown" if not defined $ostype;
74
75	tdb	1.25	# write our PID to a file
76	tdb	1.41	# use home dir by default
77	tdb	1.42	#$pidfile = $ENV{"HOME"};
78	tdb	1.41	# or drop it in /var/tmp if we can't find HOME
79			$pidfile = "/var/tmp" if not defined $pidfile;
80			$pidfile .= "/.ihost.pid";
81	tdb	1.25	&write_pid();
82
83	pjm2	1.1	&tcp_configure();
84	tdb	1.47	&send_tcp_heartbeat();
85	pjm2	1.1	&send_udp_packet();
86
87			$last_udp_time = time;
88			$last_tcp_time = time;
89			while (1) {
90	pjm2	1.9	my($time) = time;
91			if ($time >= $last_udp_time + $udp_update_time) {
92	pjm2	1.1	&send_udp_packet();
93	pjm2	1.9	$last_udp_time = $time;
94	pjm2	1.1	}
95	pjm2	1.9	if ($time >= $last_tcp_time + $tcp_update_time) {
96	pjm2	1.1	&send_tcp_heartbeat();
97	pjm2	1.9	$last_tcp_time = $time;
98	pjm2	1.1	}
99	pjm2	1.9	my($next_udp) = $udp_update_time - $time + $last_udp_time;
100			my($next_tcp) = $tcp_update_time - $time + $last_tcp_time;
101			my($delay);
102			if ($next_udp < $next_tcp) {
103			$delay = $next_udp
104			}
105			else {
106			$delay = $next_tcp;
107			}
108	tdb	1.35	sleep $delay;
109	pjm2	1.1	}
110
111	tdb	1.25	# we'll probably never get here...
112			`rm -f $pidfile`;
113	pjm2	1.1	exit(0);
114
115	pjm2	1.12
116			#-----------------------------------------------------------------------
117	pjm2	1.28	# wait_then_retry
118			# Waits for the period of time specified in $retry_wait, then attempts
119			# to reconfigure with the server.
120			#-----------------------------------------------------------------------
121			sub wait_then_retry() {
122			print "Will retry configuration with filter manager in $retry_wait seconds.\n";
123	tdb	1.35	sleep $retry_wait;
124	pjm2	1.28	}
125
126
127			#-----------------------------------------------------------------------
128	pjm2	1.12	# tcp_configure
129			# Establishes a TCP connection to the specified i-scream filter manager.
130			# The host then requests details from the server, such as the intervals
131			# at which to send UDP packets.
132			#-----------------------------------------------------------------------
133	pjm2	1.1	sub tcp_configure() {
134
135	pjm2	1.31	while (1) {
136	pjm2	1.28	my($sock) = new IO::Socket::INET(
137			PeerAddr => $filter_manager_addr,
138			PeerPort => $filter_manager_port,
139			Proto => 'tcp'
140			) or die "Cannot connect!";
141			if (!defined $sock) {
142			print "IHOST ERROR: Could not connect to $filter_manager_addr:$filter_manager_port.\n";
143			print "Please check that there is an i-scream server at this address.\n";
144			wait_then_retry();
145			next;
146			}
147
148			# Now run through the configuration process...
149			my($response);
150
151			print $sock "STARTCONFIG\n";
152			$response = <$sock>;
153	pjm2	1.32	if ($response && !($response eq "OK\n")) {
154			print "The i-scream server rejected the STARTCONFIG command.\n";
155	pjm2	1.28	close($sock);
156			wait_then_retry();
157			next;
158			}
159
160			print "Config started okay.\n";
161
162			print $sock "LASTMODIFIED\n";
163			$response = <$sock>;
164	tdb	1.48	if (!$response \|\| $response eq "ERROR\n") {
165			print "The i-scream server did not provide the LASTMODIFIED value.\n";
166	pjm2	1.32	close($sock);
167			wait_then_retry();
168			next;
169			}
170	tdb	1.48	chomp $response;
171	pjm2	1.28	$last_modified = $response;
172
173			print "Config last modified: ". (scalar localtime $last_modified/1000) . "\n";
174
175			print $sock "FILELIST\n";
176			$response = <$sock>;
177	tdb	1.48	if (!$response \|\| $response eq "ERROR\n") {
178	pjm2	1.32	print "The i-scream server did not provide a configuration file list.\n";
179			close($sock);
180			wait_then_retry();
181			next;
182			}
183	tdb	1.48	chomp $response;
184	pjm2	1.28	$file_list = $response;
185
186			print "File list obtained: $file_list\n";
187
188			print $sock "FQDN\n";
189			$response = <$sock>;
190	tdb	1.48	if (!$response \|\| $response eq "ERROR\n") {
191	pjm2	1.32	print "The i-scream server did not tell us our FQDN.\n";
192			close($sock);
193			wait_then_retry();
194			next;
195			}
196	tdb	1.48	chomp $response;
197	pjm2	1.28	$fqdn = $response;
198
199			print "FQDN returned: $fqdn\n";
200
201			print $sock "UDPUpdateTime\n";
202			$response = <$sock>;
203	tdb	1.48	if (!$response \|\| $response eq "ERROR\n") {
204	pjm2	1.32	print "The i-scream server did not give us a UDPUpdateTime.\n";
205			close($sock);
206			wait_then_retry();
207			next;
208			}
209	tdb	1.48	chomp $response;
210	pjm2	1.28	$udp_update_time = $response;
211
212			print $sock "TCPUpdateTime\n";
213			$response = <$sock>;
214	tdb	1.48	if (!$response \|\| $response eq "ERROR\n") {
215	pjm2	1.32	print "The i-scream server did not give us a TCPUpdateTime.\n";
216			close($sock);
217			wait_then_retry();
218			next;
219			}
220	tdb	1.48	chomp $response;
221	pjm2	1.28	$tcp_update_time = $response;
222
223			print "UDP packet period: $udp_update_time seconds.\nTCP heartbeat period: $tcp_update_time seconds.\n";
224
225			print $sock "ENDCONFIG\n";
226			$response = <$sock>;
227	pjm2	1.32	if ($response && !($response eq "OK\n")) {
228	pjm2	1.28	print "ENDCONFIG command to server failed. Terminated.\n";
229			close($sock);
230			wait_then_retry();
231			next;
232			}
233
234			print "Config ended.\n";
235
236			print $sock "FILTER\n";
237			$response = <$sock>;
238	pjm2	1.32	if (!$response) {
239	pjm2	1.28	print "Failed: Could not get a filter address from the filter manager.\n";
240			close($sock);
241			wait_then_retry();
242			next;
243			}
244	tdb	1.48	chomp $response;
245	pjm2	1.28	if ($response eq "ERROR") {
246			print "There are no active configured filters for your host.\n";
247			close($sock);
248			wait_then_retry();
249			next;
250			}
251	tdb	1.48	$response =~ /^(.);(.);(.*)/;
252	pjm2	1.28	($filter_addr, $udp_port, $tcp_port) = ($1, $2, $3);
253			unless (defined($filter_addr) && defined($udp_port) && defined($tcp_port)) {
254			print "Failed: Filter address response from server did not make sense: $response\n";
255			close($sock);
256			wait_then_retry();
257			next;
258			}
259
260			print "Got filter data ($filter_addr, $udp_port, $tcp_port)\n";
261
262			print $sock "END\n";
263			$response = <$sock>;
264	pjm2	1.32	if ($response && ($response eq "OK\n")) {
265	pjm2	1.28	print "Host successfully configured via TCP.\n"
266			}
267			else {
268	pjm2	1.32	print "The server failed the host configuration on the END command.\n";
269	pjm2	1.28	close($sock);
270			wait_then_retry();
271			next;
272			}
273	pjm2	1.1
274	pjm2	1.28	close($sock);
275	pjm2	1.1
276	pjm2	1.28	print "Configuration finished sucessfully!\n";
277			last;
278	pjm2	1.1	}
279	pjm2	1.12	return;
280	pjm2	1.1	}
281
282	pjm2	1.12
283			#-----------------------------------------------------------------------
284			# send_udp_packet
285			# Sends a UDP packet to an i-scream filter.
286			# The packet contains XML markup describing some of the machine's state.
287			# Receipt of UDP packets is not guaranteed.
288			#-----------------------------------------------------------------------
289	pjm2	1.1	sub send_udp_packet() {
290
291	tdb	1.37	my($plugins_dir) = "plugins";
292
293			opendir PLUGINS, $plugins_dir;
294			my(@plugins) = readdir PLUGINS;
295			foreach my $plugin (@plugins) {
296	tdb	1.44	push @data, `$plugins_dir/$plugin $ostype` if -x "$plugins_dir/$plugin" && -f "$plugins_dir/$plugin";
297	tdb	1.37	}
298	pjm2	1.1
299	tdb	1.36	# get some extra data
300	pjm2	1.1	my($date) = time;
301	pjm2	1.33	my($ip);
302			$ip = inet_ntoa(scalar(gethostbyname(hostname())) \|\| 'localhost') or $ip = 'localhost';
303	tdb	1.36
304			# add some extra data to the array
305	tdb	1.43	push(@data, "packet.attributes.seq_no $seq_no");
306			push(@data, "packet.attributes.machine_name $fqdn");
307			push(@data, "packet.attributes.date $date");
308			push(@data, "packet.attributes.type data");
309			push(@data, "packet.attributes.ip $ip");
310	tdb	1.47	push(@data, "packet.attributes.key $key");
311	tdb	1.39
312			# sort the data
313	tdb	1.43	@data = sort(grep(!/^$/, grep(/^packet\./, @data)));
314
315	tdb	1.36	# turn the array into some nice XML
316			my($xml) = &make_xml("", "");
317	tdb	1.43
318	pjm2	1.1	my($sock) = new IO::Socket::INET (
319			PeerPort => $udp_port,
320			PeerAddr => $filter_addr,
321			Proto => 'udp'
322	pjm2	1.21	) or die "Could not send UDP: $!\n";
323	tdb	1.36
324	pjm2	1.1	print $sock $xml or die "Could not send UDP packet: $!\n";
325			close($sock);
326			$seq_no++;
327	tdb	1.38	print "-";
328	pjm2	1.12
329			return;
330	pjm2	1.1	}
331
332	pjm2	1.12
333			#-----------------------------------------------------------------------
334			# send_tcp_heartbeat
335			# Establishes a TCP connection to an i-scream filter.
336			# The heartbeat is used as a guaranteed "I'm alive" delivery mechanism.
337	pjm2	1.34	# If we need to reconfigure, then we complete the heartbeat before
338			# doing so.
339	pjm2	1.12	#-----------------------------------------------------------------------
340	pjm2	1.1	sub send_tcp_heartbeat() {
341
342	pjm2	1.34	my ($doReconfigure) = 0;
343
344	pjm2	1.1	my($sock) = new IO::Socket::INET(
345			PeerAddr => $filter_addr,
346			PeerPort => $tcp_port,
347			Proto => 'tcp'
348	pjm2	1.21	) or return;
349	pjm2	1.11	if (!defined $sock) {
350			print "IHOST WARNING: Failed to deliver a heartbeat to the i-scream filter.\n";
351	pjm2	1.27	&tcp_configure();
352	pjm2	1.11	return;
353			}
354	pjm2	1.1
355			# Now run through the configuration process.
356			my($response);
357
358			print $sock "HEARTBEAT\n";
359			$response = <$sock>;
360	pjm2	1.32	if (!$response eq "OK\n") {
361	pjm2	1.1	close($sock);
362			print "Server gave wrong response to HEARTBEAT: $response\n";
363	pjm2	1.27	&tcp_configure();
364	pjm2	1.1	return;
365			}
366
367			print $sock "CONFIG\n";
368			$response = <$sock>;
369	pjm2	1.32	if (!$response eq "OK\n") {
370	pjm2	1.1	close($sock);
371			print "Server gave wrong response to CONFIG: $response\n";
372	pjm2	1.27	&tcp_configure();
373	pjm2	1.1	return;
374			}
375
376			print $sock "$file_list\n";
377			$response = <$sock>;
378	pjm2	1.32	if (!$response eq "OK\n") {
379	pjm2	1.1	close($sock);
380			print "Server gave wrong response to file list: $response\n";
381	pjm2	1.27	&tcp_configure();
382	pjm2	1.1	return;
383			}
384
385			print $sock "$last_modified\n";
386			$response = <$sock>;
387	pjm2	1.32	if ($response eq "ERROR\n") {
388	pjm2	1.1	close($sock);
389	pjm2	1.27	print "Server configuration changed. Reconfiguring with filter manager.\n";
390	pjm2	1.34	$doReconfigure = 1;
391	pjm2	1.1	}
392	pjm2	1.32	if (!$response eq "OK\n") {
393	pjm2	1.1	close($sock);
394			print "Server gave wrong response to HEARTBEAT: $response\n";
395	pjm2	1.27	&tcp_configure();
396	pjm2	1.1	return;
397			}
398	tdb	1.47
399			print $sock "KEY\n";
400			$key = <$sock>;
401	pjm2	1.1
402			print $sock "ENDHEARTBEAT\n";
403	pjm2	1.23	$response = <$sock>;
404	pjm2	1.32	if (!$response eq "OK\n") {
405	pjm2	1.1	close($sock);
406			print "Server gave wrong response to ENDHEARTBEAT: $response\n";
407	pjm2	1.27	&tcp_configure();
408	pjm2	1.1	return;
409			}
410
411			close($sock);
412			print "^";
413	pjm2	1.34
414			&tcp_configure() if $doReconfigure;
415	tdb	1.25
416			return;
417			}
418
419	tdb	1.36
420	tdb	1.25	#-----------------------------------------------------------------------
421			# write_pid
422			# Writes the PID (process ID) of this instance to $pidfile.
423			# This is then used by a seperate script to check (and restart) ihost.
424			#-----------------------------------------------------------------------
425			sub write_pid() {
426			open PID, ">$pidfile";
427			print PID $$;
428			close PID;
429	pjm2	1.12
430			return;
431	tdb	1.36	}
432
433			#-----------------------------------------------------------------------
434			# make_xml
435	tdb	1.37	# Turns an array of plugins data into an XML string.
436	tdb	1.36	#-----------------------------------------------------------------------
437			sub make_xml() {
438			my($curlevel, $curline) = @_;
439			my($xmltemp) = ""; my($curtag) = ""; my($attributes) = "";
440	tdb	1.40	while(1) {
441	tdb	1.43	$curline = shift(@data) if $curline eq "";
442			return $xmltemp if not defined $curline;
443			chomp $curline;
444			# dealing with nest (or attributes)
445	tdb	1.36	if($curline =~ /^$curlevel([^\.\s]+\.)/) {
446			$curtag=$1;
447	tdb	1.43	if($curline =~ /^$curlevel$curtag([^\.\s]+)\s+(.*)$/) {
448			$xmltemp .= &make_xml("$curlevel$curtag", $curline);
449			}
450			elsif($curline =~ /^$curlevel$curtag(attributes)\.([^\.\s]+)\s+(.*)$/) {
451			$attributes .= " $2=\"$3\"";
452			}
453			else {
454			$xmltemp .= &make_xml("$curlevel$curtag", $curline);
455			}
456			my($nextline) = $data[0]; chomp $nextline if defined $nextline;
457	tdb	1.45	$curtag =~ s/(.*)\./$1/;
458			if((defined $nextline) && ($nextline =~ /^$curlevel$curtag\./)) {
459	tdb	1.43	$curline = "";
460			}
461			else {
462			$xmltemp = "<$curtag$attributes>$xmltemp</$curtag>" unless $curtag eq "";
463			return $xmltemp;
464			}
465	tdb	1.36	}
466	tdb	1.43	# dealing with value
467			elsif($curline =~ /^$curlevel([^\.\s]+)\s+(.*)$/) {
468			$curtag=$1;
469			$xmltemp=$2;
470			my($nextline) = $data[0]; chomp $nextline if defined $nextline;
471			if(defined $nextline && ($nextline =~ /^$curlevel$curtag\./ \|\| $nextline =~ /^$curlevel$curtag\s+/)) {
472			$curline = "";
473			}
474			else {
475			$xmltemp = "<$curtag$attributes>$xmltemp</$curtag>" unless $curtag eq "";
476			return $xmltemp;
477			}
478	tdb	1.36	}
479	tdb	1.46	# dealing with a null value
480			elsif($curline =~ /^$curlevel([^\.\s]+)$/) {
481			# simply adding a space makes the above elsif deal with it :)
482			# just level with an empty tag in the XML
483			$curline .= " ";
484			}
485			# failing all that, skip the line
486			else {
487			$curline = "";
488			}
489	tdb	1.36	}
490	pjm2	1.1	}