« back to all changes in this revision
Viewing changes to src/parser/attack_parser.c
- browse files at revision 6
- compare with another revision
- download diff
- download tarball
- view history from revision 6
- Committer: Bazaar Package Importer
- Author(s): Julián Moreno Patiño
- Date: 2011-02-13 17:24:58 UTC
- mfrom: (1.2.1 upstream) (5.1.1 experimental)
- Revision ID: james.westby@ubuntu.com-20110213172458-0pr057n7ja5gfvz9
Tags: 1.5-1
* New upstream release
+ Removed README.source, it's not used.
+ Moved svn to git
+ Added support for whitelisting
+ Released to unstable, it's a stable release.
+ Removed README.source, it's not used.
+ Moved svn to git
+ Added support for whitelisting
+ Released to unstable, it's a stable release.
- files added:
- .pc
- .pc/01_sshguard_manpage.diff
- .pc/01_sshguard_manpage.diff/man
- .pc/02_avoid_ftbfs_kfreebsd.diff
- .pc/02_avoid_ftbfs_kfreebsd.diff/src
- debian/source
- files removed:
- debian/README.source
- files modified:
- Changes
added
removed
src/parser/attack_parser.c
72
72
WORD = 261,
73
73
INTEGER = 262,
74
74
SYSLOG_BANNER_PID = 263,
75
SYSLOG_BANNER = 264,
76
TIMESTAMP_SYSLOG = 265,
77
TIMESTAMP_TAI64 = 266,
78
METALOG_BANNER = 267,
79
SSH_INVALUSERPREF = 268,
80
SSH_NOTALLOWEDPREF = 269,
81
SSH_NOTALLOWEDSUFF = 270,
82
SSH_LOGINERR_PREF = 271,
83
SSH_LOGINERR_SUFF = 272,
84
SSH_LOGINERR_PAM = 273,
85
SSH_REVERSEMAP_PREF = 274,
86
SSH_REVERSEMAP_SUFF = 275,
87
SSH_NOIDENTIFSTR = 276,
88
SSH_BADPROTOCOLIDENTIF = 277,
89
DOVECOT_IMAP_LOGINERR_PREF = 278,
90
DOVECOT_IMAP_LOGINERR_SUFF = 279,
91
UWIMAP_LOGINERR = 280,
92
CYRUSIMAP_SASL_LOGINERR_PREF = 281,
93
CYRUSIMAP_SASL_LOGINERR_SUFF = 282,
94
FREEBSDFTPD_LOGINERR_PREF = 283,
95
FREEBSDFTPD_LOGINERR_SUFF = 284,
96
PROFTPD_LOGINERR_PREF = 285,
97
PROFTPD_LOGINERR_SUFF = 286,
98
PUREFTPD_LOGINERR_PREF = 287,
99
PUREFTPD_LOGINERR_SUFF = 288
75
LAST_LINE_REPEATED_N_TIMES = 264,
76
SYSLOG_BANNER = 265,
77
TIMESTAMP_SYSLOG = 266,
78
TIMESTAMP_TAI64 = 267,
79
AT_TIMESTAMP_TAI64 = 268,
80
METALOG_BANNER = 269,
81
SSH_INVALUSERPREF = 270,
82
SSH_NOTALLOWEDPREF = 271,
83
SSH_NOTALLOWEDSUFF = 272,
84
SSH_LOGINERR_PREF = 273,
85
SSH_LOGINERR_SUFF = 274,
86
SSH_LOGINERR_PAM = 275,
87
SSH_REVERSEMAP_PREF = 276,
88
SSH_REVERSEMAP_SUFF = 277,
89
SSH_NOIDENTIFSTR = 278,
90
SSH_BADPROTOCOLIDENTIF = 279,
91
DOVECOT_IMAP_LOGINERR_PREF = 280,
92
DOVECOT_IMAP_LOGINERR_SUFF = 281,
93
UWIMAP_LOGINERR = 282,
94
CYRUSIMAP_SASL_LOGINERR_PREF = 283,
95
CYRUSIMAP_SASL_LOGINERR_SUFF = 284,
96
CUCIPOP_AUTHFAIL = 285,
97
EXIM_ESMTP_AUTHFAIL_PREF = 286,
98
EXIM_ESMTP_AUTHFAIL_SUFF = 287,
99
SENDMAIL_RELAYDENIED_PREF = 288,
100
SENDMAIL_RELAYDENIED_SUFF = 289,
101
FREEBSDFTPD_LOGINERR_PREF = 290,
102
FREEBSDFTPD_LOGINERR_SUFF = 291,
103
PROFTPD_LOGINERR_PREF = 292,
104
PROFTPD_LOGINERR_SUFF = 293,
105
PUREFTPD_LOGINERR_PREF = 294,
106
PUREFTPD_LOGINERR_SUFF = 295,
107
VSFTPD_LOGINERR_PREF = 296,
108
VSFTPD_LOGINERR_SUFF = 297
100
109
};
101
110
#endif
102
111
/* Tokens. */
106
115
#define WORD 261
107
116
#define INTEGER 262
108
117
#define SYSLOG_BANNER_PID 263
109
#define SYSLOG_BANNER 264
110
#define TIMESTAMP_SYSLOG 265
111
#define TIMESTAMP_TAI64 266
112
#define METALOG_BANNER 267
113
#define SSH_INVALUSERPREF 268
114
#define SSH_NOTALLOWEDPREF 269
115
#define SSH_NOTALLOWEDSUFF 270
116
#define SSH_LOGINERR_PREF 271
117
#define SSH_LOGINERR_SUFF 272
118
#define SSH_LOGINERR_PAM 273
119
#define SSH_REVERSEMAP_PREF 274
120
#define SSH_REVERSEMAP_SUFF 275
121
#define SSH_NOIDENTIFSTR 276
122
#define SSH_BADPROTOCOLIDENTIF 277
123
#define DOVECOT_IMAP_LOGINERR_PREF 278
124
#define DOVECOT_IMAP_LOGINERR_SUFF 279
125
#define UWIMAP_LOGINERR 280
126
#define CYRUSIMAP_SASL_LOGINERR_PREF 281
127
#define CYRUSIMAP_SASL_LOGINERR_SUFF 282
128
#define FREEBSDFTPD_LOGINERR_PREF 283
129
#define FREEBSDFTPD_LOGINERR_SUFF 284
130
#define PROFTPD_LOGINERR_PREF 285
131
#define PROFTPD_LOGINERR_SUFF 286
132
#define PUREFTPD_LOGINERR_PREF 287
133
#define PUREFTPD_LOGINERR_SUFF 288
118
#define LAST_LINE_REPEATED_N_TIMES 264
119
#define SYSLOG_BANNER 265
120
#define TIMESTAMP_SYSLOG 266
121
#define TIMESTAMP_TAI64 267
122
#define AT_TIMESTAMP_TAI64 268
123
#define METALOG_BANNER 269
124
#define SSH_INVALUSERPREF 270
125
#define SSH_NOTALLOWEDPREF 271
126
#define SSH_NOTALLOWEDSUFF 272
127
#define SSH_LOGINERR_PREF 273
128
#define SSH_LOGINERR_SUFF 274
129
#define SSH_LOGINERR_PAM 275
130
#define SSH_REVERSEMAP_PREF 276
131
#define SSH_REVERSEMAP_SUFF 277
132
#define SSH_NOIDENTIFSTR 278
133
#define SSH_BADPROTOCOLIDENTIF 279
134
#define DOVECOT_IMAP_LOGINERR_PREF 280
135
#define DOVECOT_IMAP_LOGINERR_SUFF 281
136
#define UWIMAP_LOGINERR 282
137
#define CYRUSIMAP_SASL_LOGINERR_PREF 283
138
#define CYRUSIMAP_SASL_LOGINERR_SUFF 284
139
#define CUCIPOP_AUTHFAIL 285
140
#define EXIM_ESMTP_AUTHFAIL_PREF 286
141
#define EXIM_ESMTP_AUTHFAIL_SUFF 287
142
#define SENDMAIL_RELAYDENIED_PREF 288
143
#define SENDMAIL_RELAYDENIED_SUFF 289
144
#define FREEBSDFTPD_LOGINERR_PREF 290
145
#define FREEBSDFTPD_LOGINERR_SUFF 291
146
#define PROFTPD_LOGINERR_PREF 292
147
#define PROFTPD_LOGINERR_SUFF 293
148
#define PUREFTPD_LOGINERR_PREF 294
149
#define PUREFTPD_LOGINERR_SUFF 295
150
#define VSFTPD_LOGINERR_PREF 296
151
#define VSFTPD_LOGINERR_SUFF 297
134
152
135
153
136
154
138
156
/* Copy the first part of user declarations. */
139
157
#line 1 "attack_parser.y"
140
158
159
160
/*
161
* Copyright (c) 2007,2008,2009,2010 Mij <mij@sshguard.net>
162
*
163
* Permission to use, copy, modify, and distribute this software for any
164
* purpose with or without fee is hereby granted, provided that the above
165
* copyright notice and this permission notice appear in all copies.
166
*
167
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
168
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
169
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
170
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
171
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
172
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
173
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
174
*/
175
176
/*
177
* SSHGuard. See http://www.sshguard.net
178
*/
179
180
141
181
#include <stdio.h>
142
182
#include <string.h>
143
183
#include <stdlib.h>
148
188
#include <netinet/in.h>
149
189
#include <arpa/inet.h>
150
190
#include <errno.h>
191
#include <assert.h>
151
192
152
193
153
194
#include "../sshguard_log.h"
154
195
#include "../sshguard_procauth.h"
196
#include "../sshguard_logsuck.h"
197
198
/* get to know MAX_FILES_POLLED */
199
#include "../sshguard.h"
155
200
156
201
#include "../parser.h"
157
202
158
void yyerror(char *msg);
203
/* stuff exported by the scanner */
204
extern void scanner_init();
205
extern void scanner_fin();
159
206
extern int yylex();
160
207
208
/* my function for reporting parse errors */
209
static void yyerror(int source_id, const char *msg);
210
211
/* Metadata used by the parser */
212
/* per-source metadata */
213
typedef struct {
214
sourceid_t id;
215
int last_was_recognized;
216
attack_t last_attack;
217
unsigned int last_multiplicity;
218
} source_metadata_t;
219
220
/* parser metadata */
221
static struct {
222
unsigned int num_sources;
223
int current_source_index;
224
source_metadata_t sources[MAX_FILES_POLLED];
225
} parser_metadata = { 0, -1 };
226
161
227
162
228
163
229
/* Enabling traces. */
180
246
181
247
#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
182
248
typedef union YYSTYPE
183
#line 27 "attack_parser.y"
249
#line 78 "attack_parser.y"
184
250
{
185
251
char *str;
186
252
int num;
187
253
}
188
/* Line 187 of yacc.c. */
189
#line 190 "attack_parser.c"
254
/* Line 193 of yacc.c. */
255
#line 256 "attack_parser.c"
190
256
YYSTYPE;
191
257
# define yystype YYSTYPE /* obsolescent; will be withdrawn */
192
258
# define YYSTYPE_IS_DECLARED 1
199
265
200
266
201
267
/* Line 216 of yacc.c. */
202
#line 203 "attack_parser.c"
268
#line 269 "attack_parser.c"
203
269
204
270
#ifdef short
205
271
# undef short
249
315
#define YYSIZE_MAXIMUM ((YYSIZE_T) -1)
250
316
251
317
#ifndef YY_
252
# if YYENABLE_NLS
318
# if defined YYENABLE_NLS && YYENABLE_NLS
253
319
# if ENABLE_NLS
254
320
# include <libintl.h> /* INFRINGES ON USER NAME SPACE */
255
321
# define YY_(msgid) dgettext ("bison-runtime", msgid)
412
478
#endif
413
479
414
480
/* YYFINAL -- State number of the termination state. */
415
#define YYFINAL 55
481
#define YYFINAL 70
416
482
/* YYLAST -- Last index in YYTABLE. */
417
#define YYLAST 68
483
#define YYLAST 82
418
484
419
485
/* YYNTOKENS -- Number of terminals. */
420
#define YYNTOKENS 37
486
#define YYNTOKENS 45
421
487
/* YYNNTS -- Number of nonterminals. */
422
#define YYNNTS 19
488
#define YYNNTS 25
423
489
/* YYNRULES -- Number of rules. */
424
#define YYNRULES 37
490
#define YYNRULES 48
425
491
/* YYNRULES -- Number of states. */
426
#define YYNSTATES 67
492
#define YYNSTATES 84
427
493
428
494
/* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX. */
429
495
#define YYUNDEFTOK 2
430
#define YYMAXUTOK 288
496
#define YYMAXUTOK 297
431
497
432
498
#define YYTRANSLATE(YYX) \
433
499
((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
441
507
2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
442
508
2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
443
509
2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
444
2, 2, 2, 2, 34, 2, 2, 2, 2, 2,
445
2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
446
2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
447
2, 35, 2, 36, 2, 2, 2, 2, 2, 2,
510
2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
511
2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
512
2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
513
2, 43, 2, 44, 2, 2, 2, 2, 2, 2,
448
514
2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
449
515
2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
450
516
2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
463
529
2, 2, 2, 2, 2, 2, 1, 2, 3, 4,
464
530
5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
465
531
15, 16, 17, 18, 19, 20, 21, 22, 23, 24,
466
25, 26, 27, 28, 29, 30, 31, 32, 33
532
25, 26, 27, 28, 29, 30, 31, 32, 33, 34,
533
35, 36, 37, 38, 39, 40, 41, 42
467
534
};
468
535
469
536
#if YYDEBUG
471
538
YYRHS. */
472
539
static const yytype_uint8 yyprhs[] =
473
540
{
474
0, 0, 3, 5, 7, 9, 11, 14, 17, 21,
475
24, 26, 28, 30, 32, 34, 36, 38, 40, 42,
476
44, 46, 48, 50, 52, 54, 57, 61, 65, 68,
477
72, 75, 78, 82, 87, 91, 95, 99
541
0, 0, 3, 5, 7, 9, 11, 14, 17, 20,
542
23, 25, 27, 29, 31, 33, 35, 37, 39, 41,
543
43, 45, 47, 49, 51, 53, 55, 57, 59, 61,
544
63, 65, 67, 70, 74, 78, 81, 85, 88, 91,
545
95, 100, 104, 107, 111, 115, 119, 123, 127
478
546
};
479
547
480
548
/* YYRHS -- A `-1'-separated list of the rules' RHS. */
481
549
static const yytype_int8 yyrhs[] =
482
550
{
483
38, 0, -1, 39, -1, 40, -1, 41, -1, 42,
484
-1, 8, 42, -1, 9, 42, -1, 34, 11, 42,
485
-1, 12, 42, -1, 44, -1, 50, -1, 51, -1,
486
52, -1, 53, -1, 54, -1, 55, -1, 3, -1,
487
4, -1, 5, -1, 45, -1, 46, -1, 47, -1,
488
48, -1, 49, -1, 13, 43, -1, 14, 43, 15,
489
-1, 16, 43, 17, -1, 18, 43, -1, 19, 43,
490
20, -1, 21, 43, -1, 22, 43, -1, 23, 43,
491
24, -1, 25, 35, 43, 36, -1, 26, 43, 27,
492
-1, 28, 43, 29, -1, 30, 43, 31, -1, 32,
493
43, 33, -1
551
46, 0, -1, 47, -1, 48, -1, 49, -1, 50,
552
-1, 8, 50, -1, 10, 50, -1, 13, 50, -1,
553
14, 50, -1, 51, -1, 52, -1, 54, -1, 60,
554
-1, 61, -1, 62, -1, 63, -1, 64, -1, 65,
555
-1, 66, -1, 67, -1, 68, -1, 69, -1, 9,
556
-1, 3, -1, 4, -1, 5, -1, 55, -1, 56,
557
-1, 57, -1, 58, -1, 59, -1, 15, 53, -1,
558
16, 53, 17, -1, 18, 53, 19, -1, 20, 53,
559
-1, 21, 53, 22, -1, 23, 53, -1, 24, 53,
560
-1, 25, 53, 26, -1, 27, 43, 53, 44, -1,
561
28, 53, 29, -1, 30, 53, -1, 31, 53, 32,
562
-1, 33, 53, 34, -1, 35, 53, 36, -1, 37,
563
53, 38, -1, 39, 53, 40, -1, 41, 53, 42,
564
-1
494
565
};
495
566
496
567
/* YYRLINE[YYN] -- source line where rule number YYN was defined. */
497
static const yytype_uint8 yyrline[] =
568
static const yytype_uint16 yyrline[] =
498
569
{
499
0, 60, 60, 61, 62, 63, 76, 85, 90, 94,
500
99, 100, 101, 102, 103, 104, 105, 110, 114, 118,
501
170, 172, 173, 174, 175, 180, 182, 186, 187, 191,
502
195, 199, 204, 209, 213, 218, 223, 228
570
0, 122, 122, 123, 124, 125, 138, 148, 153, 157,
571
163, 165, 169, 170, 171, 172, 173, 174, 175, 176,
572
177, 178, 179, 184, 203, 207, 211, 262, 264, 265,
573
266, 267, 272, 274, 278, 279, 283, 287, 291, 296,
574
301, 305, 310, 315, 319, 324, 329, 334, 339
503
575
};
504
576
#endif
505
577
509
581
static const char *const yytname[] =
510
582
{
511
583
"$end", "error", "$undefined", "IPv4", "IPv6", "HOSTADDR", "WORD",
512
"INTEGER", "SYSLOG_BANNER_PID", "SYSLOG_BANNER", "TIMESTAMP_SYSLOG",
513
"TIMESTAMP_TAI64", "METALOG_BANNER", "SSH_INVALUSERPREF",
584
"INTEGER", "SYSLOG_BANNER_PID", "LAST_LINE_REPEATED_N_TIMES",
585
"SYSLOG_BANNER", "TIMESTAMP_SYSLOG", "TIMESTAMP_TAI64",
586
"AT_TIMESTAMP_TAI64", "METALOG_BANNER", "SSH_INVALUSERPREF",
514
587
"SSH_NOTALLOWEDPREF", "SSH_NOTALLOWEDSUFF", "SSH_LOGINERR_PREF",
515
588
"SSH_LOGINERR_SUFF", "SSH_LOGINERR_PAM", "SSH_REVERSEMAP_PREF",
516
589
"SSH_REVERSEMAP_SUFF", "SSH_NOIDENTIFSTR", "SSH_BADPROTOCOLIDENTIF",
517
590
"DOVECOT_IMAP_LOGINERR_PREF", "DOVECOT_IMAP_LOGINERR_SUFF",
518
591
"UWIMAP_LOGINERR", "CYRUSIMAP_SASL_LOGINERR_PREF",
519
"CYRUSIMAP_SASL_LOGINERR_SUFF", "FREEBSDFTPD_LOGINERR_PREF",
520
"FREEBSDFTPD_LOGINERR_SUFF", "PROFTPD_LOGINERR_PREF",
521
"PROFTPD_LOGINERR_SUFF", "PUREFTPD_LOGINERR_PREF",
522
"PUREFTPD_LOGINERR_SUFF", "'@'", "'['", "']'", "$accept", "text",
523
"syslogent", "multilogent", "metalogent", "logmsg", "addr", "sshmsg",
524
"ssh_illegaluser", "ssh_authfail", "ssh_reversemapping",
525
"ssh_noidentifstring", "ssh_badprotocol", "dovecotmsg", "uwimapmsg",
526
"cyrusimapmsg", "freebsdftpdmsg", "proftpdmsg", "pureftpdmsg", 0
592
"CYRUSIMAP_SASL_LOGINERR_SUFF", "CUCIPOP_AUTHFAIL",
593
"EXIM_ESMTP_AUTHFAIL_PREF", "EXIM_ESMTP_AUTHFAIL_SUFF",
594
"SENDMAIL_RELAYDENIED_PREF", "SENDMAIL_RELAYDENIED_SUFF",
595
"FREEBSDFTPD_LOGINERR_PREF", "FREEBSDFTPD_LOGINERR_SUFF",
596
"PROFTPD_LOGINERR_PREF", "PROFTPD_LOGINERR_SUFF",
597
"PUREFTPD_LOGINERR_PREF", "PUREFTPD_LOGINERR_SUFF",
598
"VSFTPD_LOGINERR_PREF", "VSFTPD_LOGINERR_SUFF", "'['", "']'", "$accept",
599
"text", "syslogent", "multilogent", "metalogent", "logmsg", "msg_single",
600
"msg_multiple", "addr", "sshmsg", "ssh_illegaluser", "ssh_authfail",
601
"ssh_reversemapping", "ssh_noidentifstring", "ssh_badprotocol",
602
"dovecotmsg", "uwimapmsg", "cyrusimapmsg", "cucipopmsg", "eximmsg",
603
"sendmailmsg", "freebsdftpdmsg", "proftpdmsg", "pureftpdmsg",
604
"vsftpdmsg", 0
527
605
};
528
606
#endif
529
607
535
613
0, 256, 257, 258, 259, 260, 261, 262, 263, 264,
536
614
265, 266, 267, 268, 269, 270, 271, 272, 273, 274,
537
615
275, 276, 277, 278, 279, 280, 281, 282, 283, 284,
538
285, 286, 287, 288, 64, 91, 93
616
285, 286, 287, 288, 289, 290, 291, 292, 293, 294,
617
295, 296, 297, 91, 93
539
618
};
540
619
# endif
541
620
542
621
/* YYR1[YYN] -- Symbol number of symbol that rule YYN derives. */
543
622
static const yytype_uint8 yyr1[] =
544
623
{
545
0, 37, 38, 38, 38, 38, 39, 39, 40, 41,
546
42, 42, 42, 42, 42, 42, 42, 43, 43, 43,
547
44, 44, 44, 44, 44, 45, 45, 46, 46, 47,
548
48, 49, 50, 51, 52, 53, 54, 55
624
0, 45, 46, 46, 46, 46, 47, 47, 48, 49,
625
50, 50, 51, 51, 51, 51, 51, 51, 51, 51,
626
51, 51, 51, 52, 53, 53, 53, 54, 54, 54,
627
54, 54, 55, 55, 56, 56, 57, 58, 59, 60,
628
61, 62, 63, 64, 65, 66, 67, 68, 69
549
629
};
550
630
551
631
/* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN. */
552
632
static const yytype_uint8 yyr2[] =
553
633
{
554
0, 2, 1, 1, 1, 1, 2, 2, 3, 2,
555
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
556
1, 1, 1, 1, 1, 2, 3, 3, 2, 3,
557
2, 2, 3, 4, 3, 3, 3, 3
634
0, 2, 1, 1, 1, 1, 2, 2, 2, 2,
635
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
636
1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
637
1, 1, 2, 3, 3, 2, 3, 2, 2, 3,
638
4, 3, 2, 3, 3, 3, 3, 3, 3
558
639
};
559
640
560
641
/* YYDEFACT[STATE-NAME] -- Default rule to reduce with in state
562
643
means the default is an error. */
563
644
static const yytype_uint8 yydefact[] =
564
645
{
646
0, 0, 23, 0, 0, 0, 0, 0, 0, 0,
565
647
0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
566
0, 0, 0, 0, 0, 0, 0, 0, 0, 2,
567
3, 4, 5, 10, 20, 21, 22, 23, 24, 11,
568
12, 13, 14, 15, 16, 6, 7, 9, 17, 18,
569
19, 25, 0, 0, 28, 0, 30, 31, 0, 0,
570
0, 0, 0, 0, 0, 1, 26, 27, 29, 32,
571
0, 34, 35, 36, 37, 8, 33
648
0, 0, 0, 0, 2, 3, 4, 5, 10, 11,
649
12, 27, 28, 29, 30, 31, 13, 14, 15, 16,
650
17, 18, 19, 20, 21, 22, 6, 7, 8, 9,
651
24, 25, 26, 32, 0, 0, 35, 0, 37, 38,
652
0, 0, 0, 42, 0, 0, 0, 0, 0, 0,
653
1, 33, 34, 36, 39, 0, 41, 43, 44, 45,
654
46, 47, 48, 40
572
655
};
573
656
574
657
/* YYDEFGOTO[NTERM-NUM]. */
575
658
static const yytype_int8 yydefgoto[] =
576
659
{
577
-1, 18, 19, 20, 21, 22, 41, 23, 24, 25,
578
26, 27, 28, 29, 30, 31, 32, 33, 34
660
-1, 23, 24, 25, 26, 27, 28, 29, 53, 30,
661
31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
662
41, 42, 43, 44, 45
579
663
};
580
664
581
665
/* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
582
666
STATE-NUM. */
583
#define YYPACT_NINF -26
667
#define YYPACT_NINF -37
584
668
static const yytype_int8 yypact[] =
585
669
{
586
7, 36, 36, 36, 39, 39, 39, 39, 39, 39,
587
39, 39, -25, 39, 39, 39, 39, 6, 18, -26,
588
-26, -26, -26, -26, -26, -26, -26, -26, -26, -26,
589
-26, -26, -26, -26, -26, -26, -26, -26, -26, -26,
590
-26, -26, 9, 5, -26, 11, -26, -26, 3, 39,
591
13, 16, 15, 1, 36, -26, -26, -26, -26, -26,
592
0, -26, -26, -26, -26, -26, -26
670
8, 35, -37, 35, 35, 35, 77, 77, 77, 77,
671
77, 77, 77, 77, -36, 77, 77, 77, 77, 77,
672
77, 77, 77, 19, -37, -37, -37, -37, -37, -37,
673
-37, -37, -37, -37, -37, -37, -37, -37, -37, -37,
674
-37, -37, -37, -37, -37, -37, -37, -37, -37, -37,
675
-37, -37, -37, -37, 3, 6, -37, 5, -37, -37,
676
4, 77, 11, -37, 2, 12, 1, 10, 17, 0,
677
-37, -37, -37, -37, -37, 20, -37, -37, -37, -37,
678
-37, -37, -37, -37
593
679
};
594
680
595
681
/* YYPGOTO[NTERM-NUM]. */
596
682
static const yytype_int8 yypgoto[] =
597
683
{
598
-26, -26, -26, -26, -26, -1, -2, -26, -26, -26,
599
-26, -26, -26, -26, -26, -26, -26, -26, -26
684
-37, -37, -37, -37, -37, 74, -37, -37, -7, -37,
685
-37, -37, -37, -37, -37, -37, -37, -37, -37, -37,
686
-37, -37, -37, -37, -37
600
687
};
601
688
602
689
/* YYTABLE[YYPACT[STATE-NUM]]. What to do in state STATE-NUM. If
606
693
#define YYTABLE_NINF -1
607
694
static const yytype_uint8 yytable[] =
608
695
{
609
35, 36, 37, 42, 43, 44, 45, 46, 47, 48,
610
49, 50, 51, 52, 53, 1, 2, 54, 55, 3,
611
4, 5, 57, 6, 56, 7, 8, 59, 9, 10,
612
11, 58, 12, 13, 64, 14, 66, 15, 0, 16,
613
61, 17, 38, 39, 40, 62, 63, 60, 0, 4,
614
5, 0, 6, 65, 7, 8, 0, 9, 10, 11,
615
0, 12, 13, 0, 14, 0, 15, 0, 16
696
54, 55, 56, 57, 58, 59, 60, 61, 62, 63,
697
64, 65, 66, 67, 68, 69, 1, 2, 3, 70,
698
71, 4, 5, 6, 7, 72, 8, 73, 9, 10,
699
74, 11, 12, 13, 77, 14, 15, 79, 16, 17,
700
76, 18, 82, 19, 2, 20, 78, 21, 80, 22,
701
6, 7, 0, 8, 75, 9, 10, 81, 11, 12,
702
13, 0, 14, 15, 83, 16, 17, 0, 18, 0,
703
19, 0, 20, 0, 21, 46, 22, 47, 48, 49,
704
50, 51, 52
616
705
};
617
706
618
707
static const yytype_int8 yycheck[] =
619
708
{
620
1, 2, 3, 5, 6, 7, 8, 9, 10, 11,
621
35, 13, 14, 15, 16, 8, 9, 11, 0, 12,
622
13, 14, 17, 16, 15, 18, 19, 24, 21, 22,
623
23, 20, 25, 26, 33, 28, 36, 30, -1, 32,
624
27, 34, 3, 4, 5, 29, 31, 49, -1, 13,
625
14, -1, 16, 54, 18, 19, -1, 21, 22, 23,
626
-1, 25, 26, -1, 28, -1, 30, -1, 32
709
7, 8, 9, 10, 11, 12, 13, 43, 15, 16,
710
17, 18, 19, 20, 21, 22, 8, 9, 10, 0,
711
17, 13, 14, 15, 16, 19, 18, 22, 20, 21,
712
26, 23, 24, 25, 32, 27, 28, 36, 30, 31,
713
29, 33, 42, 35, 9, 37, 34, 39, 38, 41,
714
15, 16, -1, 18, 61, 20, 21, 40, 23, 24,
715
25, -1, 27, 28, 44, 30, 31, -1, 33, -1,
716
35, -1, 37, -1, 39, 1, 41, 3, 4, 5,
717
3, 4, 5
627
718
};
628
719
629
720
/* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
630
721
symbol of state STATE-NUM. */
631
722
static const yytype_uint8 yystos[] =
632
723
{
633
0, 8, 9, 12, 13, 14, 16, 18, 19, 21,
634
22, 23, 25, 26, 28, 30, 32, 34, 38, 39,
635
40, 41, 42, 44, 45, 46, 47, 48, 49, 50,
636
51, 52, 53, 54, 55, 42, 42, 42, 3, 4,
637
5, 43, 43, 43, 43, 43, 43, 43, 43, 35,
638
43, 43, 43, 43, 11, 0, 15, 17, 20, 24,
639
43, 27, 29, 31, 33, 42, 36
724
0, 8, 9, 10, 13, 14, 15, 16, 18, 20,
725
21, 23, 24, 25, 27, 28, 30, 31, 33, 35,
726
37, 39, 41, 46, 47, 48, 49, 50, 51, 52,
727
54, 55, 56, 57, 58, 59, 60, 61, 62, 63,
728
64, 65, 66, 67, 68, 69, 50, 50, 50, 50,
729
3, 4, 5, 53, 53, 53, 53, 53, 53, 53,
730
53, 43, 53, 53, 53, 53, 53, 53, 53, 53,
731
0, 17, 19, 22, 26, 53, 29, 32, 34, 36,
732
38, 40, 42, 44
640
733
};
641
734
642
735
#define yyerrok (yyerrstatus = 0)
669
762
} \
670
763
else \
671
764
{ \
672
yyerror (YY_("syntax error: cannot back up")); \
765
yyerror (source_id, YY_("syntax error: cannot back up")); \
673
766
YYERROR; \
674
767
} \
675
768
while (YYID (0))
710
803
we won't break user code: when these are the locations we know. */
711
804
712
805
#ifndef YY_LOCATION_PRINT
713
# if YYLTYPE_IS_TRIVIAL
806
# if defined YYLTYPE_IS_TRIVIAL && YYLTYPE_IS_TRIVIAL
714
807
# define YY_LOCATION_PRINT(File, Loc) \
715
808
fprintf (File, "%d.%d-%d.%d", \
716
809
(Loc).first_line, (Loc).first_column, \
749
842
{ \
750
843
YYFPRINTF (stderr, "%s ", Title); \
751
844
yy_symbol_print (stderr, \
752
Type, Value); \
845
Type, Value, source_id); \
753
846
YYFPRINTF (stderr, "\n"); \
754
847
} \
755
848
} while (YYID (0))
763
856
#if (defined __STDC__ || defined __C99__FUNC__ \
764
857
|| defined __cplusplus || defined _MSC_VER)
765
858
static void
766
yy_symbol_value_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep)
859
yy_symbol_value_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep, const int source_id)
767
860
#else
768
861
static void
769
yy_symbol_value_print (yyoutput, yytype, yyvaluep)
862
yy_symbol_value_print (yyoutput, yytype, yyvaluep, source_id)
770
863
FILE *yyoutput;
771
864
int yytype;
772
865
YYSTYPE const * const yyvaluep;
866
const int source_id;
773
867
#endif
774
868
{
775
869
if (!yyvaluep)
776
870
return;
871
YYUSE (source_id);
777
872
# ifdef YYPRINT
778
873
if (yytype < YYNTOKENS)
779
874
YYPRINT (yyoutput, yytoknum[yytype], *yyvaluep);
795
890
#if (defined __STDC__ || defined __C99__FUNC__ \
796
891
|| defined __cplusplus || defined _MSC_VER)
797
892
static void
798
yy_symbol_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep)
893
yy_symbol_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep, const int source_id)
799
894
#else
800
895
static void
801
yy_symbol_print (yyoutput, yytype, yyvaluep)
896
yy_symbol_print (yyoutput, yytype, yyvaluep, source_id)
802
897
FILE *yyoutput;
803
898
int yytype;
804
899
YYSTYPE const * const yyvaluep;
900
const int source_id;
805
901
#endif
806
902
{
807
903
if (yytype < YYNTOKENS)
809
905
else
810
906
YYFPRINTF (yyoutput, "nterm %s (", yytname[yytype]);
811
907
812
yy_symbol_value_print (yyoutput, yytype, yyvaluep);
908
yy_symbol_value_print (yyoutput, yytype, yyvaluep, source_id);
813
909
YYFPRINTF (yyoutput, ")");
814
910
}
815
911
849
945
#if (defined __STDC__ || defined __C99__FUNC__ \
850
946
|| defined __cplusplus || defined _MSC_VER)
851
947
static void
852
yy_reduce_print (YYSTYPE *yyvsp, int yyrule)
948
yy_reduce_print (YYSTYPE *yyvsp, int yyrule, const int source_id)
853
949
#else
854
950
static void
855
yy_reduce_print (yyvsp, yyrule)
951
yy_reduce_print (yyvsp, yyrule, source_id)
856
952
YYSTYPE *yyvsp;
857
953
int yyrule;
954
const int source_id;
858
955
#endif
859
956
{
860
957
int yynrhs = yyr2[yyrule];
868
965
fprintf (stderr, " $%d = ", yyi + 1);
869
966
yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi],
870
967
&(yyvsp[(yyi + 1) - (yynrhs)])
871
);
968
, source_id);
872
969
fprintf (stderr, "\n");
873
970
}
874
971
}
876
973
# define YY_REDUCE_PRINT(Rule) \
877
974
do { \
878
975
if (yydebug) \
879
yy_reduce_print (yyvsp, Rule); \
976
yy_reduce_print (yyvsp, Rule, source_id); \
880
977
} while (YYID (0))
881
978
882
979
/* Nonzero means print parse trace. It is left uninitialized so that
1127
1224
#if (defined __STDC__ || defined __C99__FUNC__ \
1128
1225
|| defined __cplusplus || defined _MSC_VER)
1129
1226
static void
1130
yydestruct (const char *yymsg, int yytype, YYSTYPE *yyvaluep)
1227
yydestruct (const char *yymsg, int yytype, YYSTYPE *yyvaluep, const int source_id)
1131
1228
#else
1132
1229
static void
1133
yydestruct (yymsg, yytype, yyvaluep)
1230
yydestruct (yymsg, yytype, yyvaluep, source_id)
1134
1231
const char *yymsg;
1135
1232
int yytype;
1136
1233
YYSTYPE *yyvaluep;
1234
const int source_id;
1137
1235
#endif
1138
1236
{
1139
1237
YYUSE (yyvaluep);
1238
YYUSE (source_id);
1140
1239
1141
1240
if (!yymsg)
1142
1241
yymsg = "Deleting";
1161
1260
#endif
1162
1261
#else /* ! YYPARSE_PARAM */
1163
1262
#if defined __STDC__ || defined __cplusplus
1164
int yyparse (void);
1263
int yyparse (const int source_id);
1165
1264
#else
1166
1265
int yyparse ();
1167
1266
#endif
1198
1297
#if (defined __STDC__ || defined __C99__FUNC__ \
1199
1298
|| defined __cplusplus || defined _MSC_VER)
1200
1299
int
1201
yyparse (void)
1300
yyparse (const int source_id)
1202
1301
#else
1203
1302
int
1204
yyparse ()
1205
1303
yyparse (source_id)
1304
const int source_id;
1206
1305
#endif
1207
1306
#endif
1208
1307
{
1451
1550
switch (yyn)
1452
1551
{
1453
1552
case 6:
1454
#line 76 "attack_parser.y"
1553
#line 138 "attack_parser.y"
1455
1554
{
1456
1555
/* reject to accept if the pid has been forged */
1457
1556
if (procauth_isauthoritative(parsed_attack.service, (yyvsp[(1) - (2)].num)) == -1) {
1463
1562
break;
1464
1563
1465
1564
case 10:
1466
#line 99 "attack_parser.y"
1565
#line 163 "attack_parser.y"
1566
{ parser_metadata.sources[parser_metadata.current_source_index].last_multiplicity = 1; }
1567
break;
1568
1569
case 11:
1570
#line 165 "attack_parser.y"
1571
{ parser_metadata.sources[parser_metadata.current_source_index].last_multiplicity = (yyvsp[(1) - (1)].num); }
1572
break;
1573
1574
case 12:
1575
#line 169 "attack_parser.y"
1467
1576
{ parsed_attack.service = SERVICES_SSH; }
1468
1577
break;
1469
1578
1470
case 11:
1471
#line 100 "attack_parser.y"
1579
case 13:
1580
#line 170 "attack_parser.y"
1472
1581
{ parsed_attack.service = SERVICES_DOVECOT; }
1473
1582
break;
1474
1583
1475
case 12:
1476
#line 101 "attack_parser.y"
1584
case 14:
1585
#line 171 "attack_parser.y"
1477
1586
{ parsed_attack.service = SERVICES_UWIMAP; }
1478
1587
break;
1479
1588
1480
case 13:
1481
#line 102 "attack_parser.y"
1589
case 15:
1590
#line 172 "attack_parser.y"
1482
1591
{ parsed_attack.service = SERVICES_CYRUSIMAP; }
1483
1592
break;
1484
1593
1485
case 14:
1486
#line 103 "attack_parser.y"
1594
case 16:
1595
#line 173 "attack_parser.y"
1596
{ parsed_attack.service = SERVICES_CUCIPOP; }
1597
break;
1598
1599
case 17:
1600
#line 174 "attack_parser.y"
1601
{ parsed_attack.service = SERVICES_EXIM; }
1602
break;
1603
1604
case 18:
1605
#line 175 "attack_parser.y"
1606
{ parsed_attack.service = SERVICES_SENDMAIL; }
1607
break;
1608
1609
case 19:
1610
#line 176 "attack_parser.y"
1487
1611
{ parsed_attack.service = SERVICES_FREEBSDFTPD; }
1488
1612
break;
1489
1613
1490
case 15:
1491
#line 104 "attack_parser.y"
1614
case 20:
1615
#line 177 "attack_parser.y"
1492
1616
{ parsed_attack.service = SERVICES_PROFTPD; }
1493
1617
break;
1494
1618
1495
case 16:
1496
#line 105 "attack_parser.y"
1619
case 21:
1620
#line 178 "attack_parser.y"
1497
1621
{ parsed_attack.service = SERVICES_PUREFTPD; }
1498
1622
break;
1499
1623
1500
case 17:
1501
#line 110 "attack_parser.y"
1624
case 22:
1625
#line 179 "attack_parser.y"
1626
{ parsed_attack.service = SERVICES_VSFTPD; }
1627
break;
1628
1629
case 23:
1630
#line 184 "attack_parser.y"
1631
{
1632
/* the message repeated, was it an attack? */
1633
if (! parser_metadata.sources[parser_metadata.current_source_index].last_was_recognized) {
1634
/* make sure this doesn't get recognized as an attack */
1635
YYABORT;
1636
}
1637
1638
/* got a repeated attack */
1639
parsed_attack = parser_metadata.sources[parser_metadata.current_source_index].last_attack;
1640
/* restore previous "genuine" dangerousness, and build new one */
1641
parsed_attack.dangerousness = (yyvsp[(1) - (1)].num) * (parsed_attack.dangerousness / parser_metadata.sources[parser_metadata.current_source_index].last_multiplicity);
1642
1643
/* pass up the multiplicity of this attack */
1644
(yyval.num) = (yyvsp[(1) - (1)].num);
1645
}
1646
break;
1647
1648
case 24:
1649
#line 203 "attack_parser.y"
1502
1650
{
1503
1651
parsed_attack.address.kind = ADDRKIND_IPv4;
1504
1652
strcpy(parsed_attack.address.value, (yyvsp[(1) - (1)].str));
1505
1653
}
1506
1654
break;
1507
1655
1508
case 18:
1509
#line 114 "attack_parser.y"
1656
case 25:
1657
#line 207 "attack_parser.y"
1510
1658
{
1511
1659
parsed_attack.address.kind = ADDRKIND_IPv6;
1512
1660
strcpy(parsed_attack.address.value, (yyvsp[(1) - (1)].str));
1513
1661
}
1514
1662
break;
1515
1663
1516
case 19:
1517
#line 118 "attack_parser.y"
1664
case 26:
1665
#line 211 "attack_parser.y"
1518
1666
{
1519
1667
struct addrinfo addrinfo_hints;
1520
1668
struct addrinfo *addrinfo_result;
1551
1699
}
1552
1700
} else {
1553
1701
sshguard_log(LOG_ERR, "Could not resolv '%s' in neither of IPv{4,6}. Giving up entry.", (yyvsp[(1) - (1)].str));
1554
freeaddrinfo(addrinfo_result);
1555
1702
YYABORT;
1556
1703
}
1557
1704
}
1564
1711
1565
1712
1566
1713
/* Line 1267 of yacc.c. */
1567
#line 1568 "attack_parser.c"
1714
#line 1715 "attack_parser.c"
1568
1715
default: break;
1569
1716
}
1570
1717
YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
1600
1747
{
1601
1748
++yynerrs;
1602
1749
#if ! YYERROR_VERBOSE
1603
yyerror (YY_("syntax error"));
1750
yyerror (source_id, YY_("syntax error"));
1604
1751
#else
1605
1752
{
1606
1753
YYSIZE_T yysize = yysyntax_error (0, yystate, yychar);
1624
1771
if (0 < yysize && yysize <= yymsg_alloc)
1625
1772
{
1626
1773
(void) yysyntax_error (yymsg, yystate, yychar);
1627
yyerror (yymsg);
1774
yyerror (source_id, yymsg);
1628
1775
}
1629
1776
else
1630
1777
{
1631
yyerror (YY_("syntax error"));
1778
yyerror (source_id, YY_("syntax error"));
1632
1779
if (yysize != 0)
1633
1780
goto yyexhaustedlab;
1634
1781
}
1652
1799
else
1653
1800
{
1654
1801
yydestruct ("Error: discarding",
1655
yytoken, &yylval);
1802
yytoken, &yylval, source_id);
1656
1803
yychar = YYEMPTY;
1657
1804
}
1658
1805
}
1708
1855
1709
1856
1710
1857
yydestruct ("Error: popping",
1711
yystos[yystate], yyvsp);
1858
yystos[yystate], yyvsp, source_id);
1712
1859
YYPOPSTACK (1);
1713
1860
yystate = *yyssp;
1714
1861
YY_STACK_PRINT (yyss, yyssp);
1746
1893
| yyexhaustedlab -- memory exhaustion comes here. |
1747
1894
`-------------------------------------------------*/
1748
1895
yyexhaustedlab:
1749
yyerror (YY_("memory exhausted"));
1896
yyerror (source_id, YY_("memory exhausted"));
1750
1897
yyresult = 2;
1751
1898
/* Fall through. */
1752
1899
#endif
1754
1901
yyreturn:
1755
1902
if (yychar != YYEOF && yychar != YYEMPTY)
1756
1903
yydestruct ("Cleanup: discarding lookahead",
1757
yytoken, &yylval);
1904
yytoken, &yylval, source_id);
1758
1905
/* Do not reclaim the symbols of the rule which action triggered
1759
1906
this YYABORT or YYACCEPT. */
1760
1907
YYPOPSTACK (yylen);
1762
1909
while (yyssp != yyss)
1763
1910
{
1764
1911
yydestruct ("Cleanup: popping",
1765
yystos[*yyssp], yyvsp);
1912
yystos[*yyssp], yyvsp, source_id);
1766
1913
YYPOPSTACK (1);
1767
1914
}
1768
1915
#ifndef yyoverflow
1778
1925
}
1779
1926
1780
1927
1781
#line 231 "attack_parser.y"
1782
1783
1784
void yyerror(char *msg) { /* do nothing */ }
1928
#line 342 "attack_parser.y"
1929
1930
1931
static void yyerror(int source_id, const char *msg) { /* do nothing */ }
1932
1933
static void init_structures(int source_id) {
1934
int cnt;
1935
1936
/* add metadata for this source, if new */
1937
for (cnt = 0; cnt < parser_metadata.num_sources; ++cnt) {
1938
if (parser_metadata.sources[cnt].id == source_id) break;
1939
}
1940
if (cnt == parser_metadata.num_sources) {
1941
/* new source! */
1942
assert(cnt < MAX_FILES_POLLED);
1943
parser_metadata.sources[cnt].id = source_id;
1944
parser_metadata.sources[cnt].last_was_recognized = 0;
1945
parser_metadata.sources[cnt].last_multiplicity = 1;
1946
1947
parser_metadata.num_sources++;
1948
}
1949
1950
/* initialize the attack structure */
1951
parsed_attack.dangerousness = DEFAULT_ATTACKS_DANGEROUSNESS;
1952
1953
/* set current source index */
1954
parser_metadata.current_source_index = cnt;
1955
}
1956
1957
int parse_line(int source_id, char *str) {
1958
int ret;
1959
1960
/* initialize parser structures */
1961
init_structures(source_id);
1962
1963
/* initialize scanner, do parse, finalize scanner */
1964
scanner_init(str);
1965
ret = yyparse(source_id);
1966
scanner_fin();
1967
1968
/* do post-parsing oeprations */
1969
if (ret == 0) {
1970
/* message recognized */
1971
/* update metadata on this source */
1972
parser_metadata.sources[parser_metadata.current_source_index].last_was_recognized = 1;
1973
parser_metadata.sources[parser_metadata.current_source_index].last_attack = parsed_attack;
1974
} else {
1975
/* message not recognized */
1976
parser_metadata.sources[parser_metadata.current_source_index].last_was_recognized = 0;
1977
}
1978
1979
return ret;
1980
}
1785
1981
1786
1982
1787
1983
Loggerhead is a web-based interface for Breezy
Version: 2.0.1