From e7d4ec890b42ceb0ab9bb4ee5ecc9a9e489c7388 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Wed, 11 Aug 2010 14:38:21 +0200 Subject: imptcp: added $InputPTCPServerNotifyOnConnectionClose directive plus some minor cleanup --- doc/imptcp.html | 3 --- plugins/imptcp/imptcp.c | 13 ++++++++----- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/doc/imptcp.html b/doc/imptcp.html index 913563a5..c63ddc34 100644 --- a/doc/imptcp.html +++ b/doc/imptcp.html @@ -45,10 +45,7 @@ That would require much more code changes, which I was unable to do so far. Full can be found at the Cisco tcp syslog anomaly page.
  • $InputPTCPServerNotifyOnConnectionClose [on/off]
    -CURRENTLY DISABLED
    instructs imptcp to emit a message if the remote peer closes a connection.
    -Important: This directive is global to all listeners and must be given right -after loading imptcp, otherwise it may have no effect.
  • $InputPTCPServerRun <port>
    Starts a TCP server on selected port
  • $InputPTCPServerInputName <name>
    diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c index 732590a9..2bceffad 100644 --- a/plugins/imptcp/imptcp.c +++ b/plugins/imptcp/imptcp.c @@ -60,7 +60,6 @@ #include "ruleset.h" #include "msg.h" #include "net.h" /* for permittedPeers, may be removed when this is removed */ -//#include "tcpsrv.h" /* NOTE: we use some defines from this module -- TODO: re-think! */ MODULE_TYPE_INPUT @@ -873,6 +872,7 @@ static rsRetVal addTCPListener(void __attribute__((unused)) *pVal, uchar *pNewVa pSrv->pSess = NULL; pSrv->pLstn = NULL; pSrv->bEmitMsgOnClose = cs.bEmitMsgOnClose; +dbgprintf("imptcp: add srv emitMsgOnClose: %d\n", pSrv->bEmitMsgOnClose); pSrv->port = pNewVal; //pSrv->iAddtlFrameDelim = cs.iAddtlFrameDelim; cs.pszInputName = NULL; /* moved over to pSrv, we do not own */ @@ -931,13 +931,11 @@ lstnActivity(ptcplstn_t *pLstn) prop_t *peerName; prop_t *peerIP; rsRetVal localRet; -int iac = 0; DEFiRet; DBGPRINTF("imptcp: new connection on listen socket %d\n", pLstn->sock); while(1) { localRet = AcceptConnReq(pLstn->sock, &newSock, &peerName, &peerIP); -//if(iac++ > 0) fprintf(stderr, "%d accepts in a row!\n", iac); if(localRet == RS_RET_NO_MORE_DATA) break; CHKiRet(localRet); @@ -958,14 +956,12 @@ sessActivity(ptcpsess_t *pSess) int lenRcv; int lenBuf; DEFiRet; -int iac = 0; DBGPRINTF("imptcp: new activity on session socket %d\n", pSess->sock); while(1) { lenBuf = sizeof(rcvBuf); lenRcv = recv(pSess->sock, rcvBuf, lenBuf, 0); -//if(iac++ > 1) fprintf(stderr, "\n%d recv in a row!\n", iac-1); if(lenRcv > 0) { /* have data, process it */ @@ -973,6 +969,13 @@ int iac = 0; CHKiRet(DataRcvd(pSess, rcvBuf, lenRcv)); } else if (lenRcv == 0) { /* session was closed, do clean-up */ + if(pSess->pSrv->bEmitMsgOnClose) { + uchar *peerName; + int lenPeer; + prop.GetString(pSess->peerName, &peerName, &lenPeer); + errmsg.LogError(0, RS_RET_PEER_CLOSED_CONN, "imptcp session %d closed by remote peer %s.\n", + pSess->sock, peerName); + } CHKiRet(closeSess(pSess)); break; } else { -- cgit