You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549
  1. // snfCFGmgr.hpp
  2. // Copyright (C) 2006 - 2020 Arm Research Labs, LLC
  3. // See www.armresearch.com for the copyright terms.
  4. //
  5. // SNF Configuration manager.
  6. //// Begin include only once
  7. #pragma once
  8. #include "GBUdb.hpp"
  9. #include "snf_HeaderFinder.hpp"
  10. #include "../CodeDweller/configuration.hpp"
  11. #include "../CodeDweller/threading.hpp"
  12. #include <string>
  13. #include <set>
  14. namespace cd = codedweller;
  15. const unsigned long int HeaderDirectiveBypass = 0x00000001; // Bypass hd rule flag.
  16. const unsigned long int HeaderDirectiveWhite = 0x00000002; // White hd rule flag.
  17. const unsigned long int HeaderDirectiveDrillDown = 0x00000004; // DrillDown rule flag.
  18. const unsigned long int HeaderDirectiveSource = 0x00000008; // Source rule flag.
  19. const unsigned long int HeaderDirectiveContext = 0x80000000; // Context activation flag.
  20. class HeaderDirectiveHandler : public cd::Configurator { // Handle inputs to header directives.
  21. public:
  22. HeaderDirectiveSet HeaderDirectives; // Managed set of Header Directives.
  23. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The configurator call adds the Input.
  24. if(HeaderDirectiveContext == ContextInput.Directive) { // If a context has been established
  25. ContextInput.Context = HeaderDirectives.size() + 1; // then setup the context ID and
  26. DirectiveInput.Context = ContextInput.Context; // share it with the input.
  27. HeaderDirectives.insert(ContextInput); // Insert the context tester and
  28. ContextInput.clear(); // then clear it for future use.
  29. }
  30. HeaderDirectives.insert(DirectiveInput); // Insert the directive and then
  31. DirectiveInput.clear(); // clear the input for future use.
  32. }
  33. HeaderFinderPattern ContextInput; // The context can be set externally.
  34. HeaderFinderPattern DirectiveInput; // The Input can be set externally.
  35. void reset() { // Reset the handler like this:
  36. HeaderDirectives.clear(); // Clear the header directives.
  37. ContextInput.clear(); // Clear the Context Input.
  38. DirectiveInput.clear(); // Clear the Directive Input.
  39. }
  40. };
  41. class HeaderDirectiveInitializer : public cd::Configurator { // Initializes Header Directives.
  42. private:
  43. HeaderDirectiveHandler* MyTarget; // Needs to know it's target.
  44. public:
  45. HeaderDirectiveInitializer() : MyTarget(NULL) {} // Constructor doesn't know it's target yet.
  46. void setTarget(HeaderDirectiveHandler& H) { MyTarget = &H; } // We have a way to set the target though ;-)
  47. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The configurator() function goes to the
  48. if(NULL!=MyTarget) { // target (if it's set) and pushes the
  49. MyTarget->reset(); // reset button (empties the set).
  50. }
  51. }
  52. };
  53. class HeaderDirectiveWhiteHeaderInitializer : public cd::Configurator { // Initializes White Header Directives.
  54. private:
  55. HeaderDirectiveHandler* MyTarget; // Needs to know it's target.
  56. public:
  57. HeaderDirectiveWhiteHeaderInitializer() : MyTarget(NULL) {} // Constructor doesn't know it's target yet.
  58. void setTarget(HeaderDirectiveHandler& H) { MyTarget = &H; } // We have a way to set the target though ;-)
  59. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The configurator() function goes to the
  60. if(NULL!=MyTarget) { // target (if it's set) and sets it up
  61. MyTarget->ContextInput.clear(); // for a white header directive.
  62. MyTarget->DirectiveInput.clear();
  63. MyTarget->DirectiveInput.Directive = HeaderDirectiveWhite;
  64. }
  65. }
  66. };
  67. class HeaderDirectiveBypassHeaderInitializer : public cd::Configurator { // Initializes Bypass Header Directives.
  68. private:
  69. HeaderDirectiveHandler* MyTarget; // Needs to know it's target.
  70. public:
  71. HeaderDirectiveBypassHeaderInitializer() : MyTarget(NULL) {} // Constructor doesn't know it's target yet.
  72. void setTarget(HeaderDirectiveHandler& H) { MyTarget = &H; } // We have a way to set the target though ;-)
  73. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The configurator() function goes to the
  74. if(NULL!=MyTarget) { // target (if it's set) and sets it up
  75. MyTarget->ContextInput.clear(); // for a bypass header directive.
  76. MyTarget->DirectiveInput.clear();
  77. MyTarget->DirectiveInput.Directive = HeaderDirectiveBypass;
  78. }
  79. }
  80. };
  81. class HeaderDirectiveDrilldownInitializer : public cd::Configurator { // Initializes Drilldown Header Directives.
  82. private:
  83. HeaderDirectiveHandler* MyTarget; // Needs to know it's target.
  84. public:
  85. HeaderDirectiveDrilldownInitializer() : MyTarget(NULL) {} // Constructor doesn't know it's target yet.
  86. void setTarget(HeaderDirectiveHandler& H) { MyTarget = &H; } // We have a way to set the target though ;-)
  87. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The configurator() function goes to the
  88. if(NULL!=MyTarget) { // target (if it's set) and sets it up for
  89. MyTarget->ContextInput.clear(); // a drilldown header directive.
  90. MyTarget->DirectiveInput.clear();
  91. MyTarget->DirectiveInput.Directive = HeaderDirectiveDrillDown;
  92. MyTarget->DirectiveInput.Header = "Received:";
  93. }
  94. }
  95. };
  96. class HeaderDirectiveSourceHeaderInitializer : public cd::Configurator { // Initializes Source Header Directives.
  97. private:
  98. HeaderDirectiveHandler* MyTarget; // Needs to know it's target.
  99. public:
  100. HeaderDirectiveSourceHeaderInitializer() : MyTarget(NULL) {} // Constructor doesn't know it's target yet.
  101. void setTarget(HeaderDirectiveHandler& H) { MyTarget = &H; } // We have a way to set the target though ;-)
  102. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The configurator() function goes to the
  103. if(NULL!=MyTarget) { // target (if it's set) and sets it up
  104. MyTarget->ContextInput.clear(); // for a context sensitive source header
  105. MyTarget->DirectiveInput.clear(); // directive. Activation context as well
  106. MyTarget->ContextInput.Directive = HeaderDirectiveContext; // as source header data.
  107. MyTarget->ContextInput.Header = "Received:";
  108. MyTarget->DirectiveInput.Directive = HeaderDirectiveSource;
  109. }
  110. }
  111. };
  112. class RangePoint { // Range point x:Probability, y:Confidence
  113. public:
  114. RangePoint() : // The simple constructor sets all to zero.
  115. Probability(0.0),
  116. Confidence(0.0) {}
  117. RangePoint(double C, double P) : // This constructor sets the values.
  118. Probability(P),
  119. Confidence(C) {}
  120. double Probability; // Probability and Confidence are
  121. double Confidence; // freely accessible.
  122. bool operator<(const RangePoint& right) const { // Comparison of RangePoint objects depends
  123. return (Confidence < right.Confidence); // on the Confidence value. This is because
  124. } // Confidence is used as a "key" in the set.
  125. bool operator>(const RangePoint& right) const {
  126. return (Confidence > right.Confidence);
  127. }
  128. bool operator==(const RangePoint& right) const {
  129. return (Confidence == right.Confidence);
  130. }
  131. bool operator<=(const RangePoint& right) const {
  132. return (Confidence <= right.Confidence);
  133. }
  134. bool operator>=(const RangePoint& right) const {
  135. return (Confidence >= right.Confidence);
  136. }
  137. };
  138. class RangeHandler : public cd::Configurator { // The handler adds edgepoints and holds and
  139. public: // tests the set that defines the region.
  140. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The () operator adds EdgeInput to the list.
  141. EdgeMap.insert(EdgeInput);
  142. }
  143. bool On_Off; // Ranges can be turned on and off.
  144. int Symbol; // They have a symbol assigned to them.
  145. int Priority; // They have an evaluation priority.
  146. RangePoint EdgeInput; // This EdgePoint is set, and added using ().
  147. std::set<RangePoint> EdgeMap; // This contains the set of EdgePoints.
  148. bool isInWhite(RangePoint& x); // True if x is inside the -P of the EdgeMap.
  149. bool isInBlack(RangePoint& x); // True if x is inside the +P of the EdgeMap.
  150. void reset() { EdgeMap.clear(); } // When we reset - we empty the EdgeMap.
  151. };
  152. class RangeInitializer : public cd::Configurator { // The RangeInitializer Configurator.
  153. private:
  154. RangeHandler* MyTarget; // Needs to know it's target.
  155. public:
  156. RangeInitializer() : MyTarget(NULL) {} // Constructor doesn't know it's target yet.
  157. void setTarget(RangeHandler& H) { MyTarget = &H; } // We have a way to set the target though ;-)
  158. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The configurator() function goes to the
  159. if(NULL!=MyTarget) { // target (if it's set) and pushes the
  160. MyTarget->reset(); // reset button.
  161. }
  162. }
  163. };
  164. class IntegerSetHandler : public cd::Configurator { // Integer set handler for rule panics.
  165. public:
  166. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The operator() inserts IntegerInput
  167. IntegerSet.insert(IntegerInput); // if it's not already a member.
  168. }
  169. int IntegerInput; // The input port.
  170. std::set<int> IntegerSet; // The set itself.
  171. bool isListed(int x); // How to check if an int is listed.
  172. void reset() { IntegerSet.clear(); } // How to reset (clear) the list.
  173. };
  174. class IntegerSetInitializer : public cd::Configurator { // The initializer resets the set.
  175. private:
  176. IntegerSetHandler* MyTarget; // It needs to know which set to init.
  177. public:
  178. IntegerSetInitializer() : MyTarget(NULL) {} // Start off not knowing where to go.
  179. void setTarget(IntegerSetHandler& H) { MyTarget = &H; } // Set a pointer to the handler.
  180. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The operator() does the trick.
  181. if(NULL!=MyTarget) {
  182. MyTarget->reset();
  183. }
  184. }
  185. };
  186. class XHDRSymbol { // XHeader associated with a Symbol
  187. public:
  188. int Symbol; // The integer symbol.
  189. std::string Header; // The header to associate.
  190. XHDRSymbol(int FreshSymbol, std::string FreshHeader) : // Creating the object requires both.
  191. Symbol(FreshSymbol),
  192. Header(FreshHeader) {}
  193. bool operator<(const XHDRSymbol& right) const { // To live in a set we must have a <
  194. return (Symbol < right.Symbol); // operator. Only the symbol matters
  195. } // in this case.
  196. };
  197. class XHDRSymbolsHandler : public cd::Configurator { // XHDRSymbol hander.
  198. public:
  199. std::set<XHDRSymbol> SymbolHeaders; // Carries a set of Symbol Headers.
  200. void reset() { SymbolHeaders.clear(); } // Is reset by clearing the set.
  201. std::string HeaderForSymbol(int S) { // Can return a Header for symbol.
  202. std::string MatchingHeader = ""; // Starting with an empty string,
  203. std::set<XHDRSymbol>::iterator iS = SymbolHeaders.find(XHDRSymbol(S,"")); // we look up the symbol and
  204. if(SymbolHeaders.end() != iS) { // if we find it then we will
  205. MatchingHeader = (*iS).Header; // return the matching header
  206. } // string. If not then we return
  207. return MatchingHeader; // the empty string.
  208. } // Coded in-line on purpose.
  209. bool OnOff; // Input OnOff value.
  210. int Symbol; // Input Symbol value.
  211. std::string Header; // Input Header value.
  212. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The operator() inserts an XHDRSymbol
  213. if(OnOff) { // if the header entry is turned on and
  214. SymbolHeaders.insert(XHDRSymbol(Symbol, Header)); // if it's not already a member.
  215. }
  216. }
  217. };
  218. class XHDRSymbolsInitializer : public cd::Configurator { // The XHDRSymbols initializer.
  219. private:
  220. XHDRSymbolsHandler* MyTarget; // It needs to know which set to init.
  221. public:
  222. XHDRSymbolsInitializer() : MyTarget(NULL) {} // Start off not knowing where to go.
  223. void setTarget(XHDRSymbolsHandler& H) { MyTarget = &H; } // Set a pointer to the handler.
  224. void operator()(cd::ConfigurationElement& E, cd::ConfigurationData& D) { // The operator() does the trick.
  225. if(NULL!=MyTarget) {
  226. MyTarget->reset();
  227. }
  228. }
  229. };
  230. enum class snfIPRange { // IP action ranges
  231. Unknown, // Unknown - not defined.
  232. White, // This is a good guy.
  233. Normal, // Benefit of the doubt.
  234. New, // It is new to us.
  235. Caution, // This is suspicious.
  236. Black, // This is bad.
  237. Truncate // Don't even bother looking.
  238. };
  239. const int ScanLogMatches_All = 2; // Include all matches.
  240. const int ScanLogMatches_Unique = 1; // Include 1 match of each rule.
  241. const int ScanLogMatches_None = 0; // Include only the final result.
  242. const int LogOutputMode_None = 0; // No output (don't process).
  243. const int LogOutputMode_API = 1; // Make available to API.
  244. const int LogOutputMode_File = 2; // Output to msgfile.xhdr.
  245. const int LogOutputMode_Inject = 3; // Inject into msgfile.
  246. class snfCFGData { // Object that stores our config data.
  247. private:
  248. cd::ConfigurationElement MyCFGReader; // This is how we read our cfg data.
  249. public:
  250. snfCFGData(); // Constructor handled in .cpp
  251. void initializeFromFile(const char* FileName); // Initialize from the provided file.
  252. int Generation; // Generation tag.
  253. // Here are the derived data elements...
  254. std::string ConfigFilePath; // Configuration file path
  255. std::string RuleFilePath; // Rulebase file path
  256. std::string SecurityKey; // Security key for rulebase
  257. // Here are the basic data elements...
  258. std::string node_identity;
  259. std::string node_licenseid;
  260. std::string node_authentication;
  261. //// paths
  262. std::string paths_workspace_path;
  263. std::string paths_rulebase_path;
  264. std::string paths_log_path;
  265. //// logging
  266. bool Logs_Rotation_LocalTime_OnOff;
  267. bool Status_SecondReport_Log_OnOff;
  268. bool Status_SecondReport_Append_OnOff;
  269. bool Status_MinuteReport_Log_OnOff;
  270. bool Status_MinuteReport_Append_OnOff;
  271. bool Status_HourReport_Log_OnOff;
  272. bool Status_HourReport_Append_OnOff;
  273. bool Scan_Identifier_Force_Message_Id;
  274. int Scan_Classic_Mode;
  275. bool Scan_Classic_Rotate;
  276. int Scan_Classic_Matches;
  277. int Scan_XML_Mode;
  278. bool Scan_XML_Rotate;
  279. int Scan_XML_Matches;
  280. bool Scan_XML_Performance;
  281. bool Scan_XML_GBUdb;
  282. //// xheaders
  283. int XHDROutput_Mode;
  284. bool XHDRVersion_OnOff;
  285. std::string XHDRVersion_Header;
  286. bool XHDRLicense_OnOff;
  287. std::string XHDRLicense_Header;
  288. bool XHDRRulebase_OnOff;
  289. std::string XHDRRulebase_Header;
  290. bool XHDRIdentifier_OnOff;
  291. std::string XHDRIdentifier_Header;
  292. bool XHDRGBUdb_OnOff;
  293. std::string XHDRGBUdb_Header;
  294. bool XHDRResult_OnOff;
  295. std::string XHDRResult_Header;
  296. bool XHDRMatches_OnOff;
  297. std::string XHDRMatches_Header;
  298. bool XHDRBlack_OnOff;
  299. std::string XHDRBlack_Header;
  300. bool XHDRWhite_OnOff;
  301. std::string XHDRWhite_Header;
  302. bool XHDRClean_OnOff;
  303. std::string XHDRClean_Header;
  304. XHDRSymbolsHandler XHDRSymbolHeaders;
  305. XHDRSymbolsInitializer XHDRSymbolHeadersInitializer;
  306. //// platform
  307. std::string PlatformElementContents;
  308. //// network
  309. int network_sync_secs;
  310. std::string network_sync_host;
  311. int network_sync_port;
  312. bool update_script_on_off;
  313. std::string update_script_call;
  314. int update_script_guard_time;
  315. //// gbudb
  316. int gbudb_database_condense_minimum_seconds_between;
  317. bool gbudb_database_condense_time_trigger_on_off;
  318. int gbudb_database_condense_time_trigger_seconds;
  319. bool gbudb_database_condense_posts_trigger_on_off;
  320. int gbudb_database_condense_posts_trigger_posts;
  321. bool gbudb_database_condense_records_trigger_on_off;
  322. int gbudb_database_condense_records_trigger_records;
  323. bool gbudb_database_condense_size_trigger_on_off;
  324. int gbudb_database_condense_size_trigger_megabytes;
  325. bool gbudb_database_checkpoint_on_off;
  326. int gbudb_database_checkpoint_secs;
  327. RangeHandler WhiteRangeHandler;
  328. RangeInitializer WhiteRangeInitializer;
  329. bool gbudb_regions_white_panic_on_off;
  330. int gbudb_regions_white_panic_rule_range;
  331. RangeHandler BlackRangeHandler;
  332. RangeInitializer BlackRangeInitializer;
  333. bool gbudb_regions_black_sample_on_off;
  334. double gbudb_regions_black_sample_probability;
  335. int gbudb_regions_black_sample_grab_one_in;
  336. bool gbudb_regions_black_sample_passthrough;
  337. int gbudb_regions_black_sample_passthrough_symbol;
  338. int gbudb_regions_black_truncate_symbol;
  339. bool gbudb_regions_black_truncate_on_off;
  340. double gbudb_regions_black_truncate_probability;
  341. int gbudb_regions_black_truncate_peek_one_in;
  342. RangeHandler CautionRangeHandler;
  343. RangeInitializer CautionRangeInitializer;
  344. snfIPRange RangeEvaluation(GBUdbRecord& R); // Returns the range for a GBUdbRecord.
  345. snfIPRange RangeEvaluation(RangePoint& p); // Returns the range for a RangePoint.
  346. HeaderDirectiveHandler HeaderDirectivesHandler; //** Handles header directives.
  347. HeaderDirectiveInitializer HeaderDirectivesInitializer; //** Initializes header directives set.
  348. HeaderDirectiveSourceHeaderInitializer HDSourceHeaderInitializer; //**** For source header directives.
  349. HeaderDirectiveDrilldownInitializer HDDrilldownInitializer; //**** For drilldown header directives.
  350. HeaderDirectiveBypassHeaderInitializer HDBypassHeaderInitializer; //**** For bypass header directives.
  351. HeaderDirectiveWhiteHeaderInitializer HDWhiteHeaderInitializer; //**** For white header directives.
  352. IntegerSetHandler TrainingBypassRuleHandler; // Rules to NOT train GBUdb with source.
  353. IntegerSetInitializer TrainingBypassRuleInitializer;
  354. IntegerSetHandler TrainingWhiteRuleHandler; // Rules to train GBUdb as white source.
  355. IntegerSetInitializer TrainingWhiteRuleInitializer;
  356. bool GBUdbTrainingOn_Off; // True when GBUdb training is allowed.
  357. IntegerSetHandler RulePanicHandler;
  358. IntegerSetInitializer RulePanicInitializer;
  359. bool XCI_OnOff; // XML Command Interface ON or OFF.
  360. int XCI_Port; // XML Command Interface Port number.
  361. bool MessageFileTypeCGP_on_off; // True for scanning communigate msgs.
  362. };
  363. class snfCFGmgr { // Object that manages our config data.
  364. private:
  365. cd::Mutex myMutex; // Serialize control during updates.
  366. snfCFGData A; // This is where we store one copy.
  367. snfCFGData B; // This is where we store the other.
  368. volatile bool AisActive; // This tells us which is active.
  369. void swapCFGData(); // This swaps the active dataset.
  370. snfCFGData& ActiveData(); // This returns the active dataset.
  371. snfCFGData& InactiveData(); // This returns the inactive dataset.
  372. std::string InitFileName; // Initilization parameters are reused
  373. std::string InitLicenseId; // any time load() is called.
  374. std::string InitAuthentication;
  375. std::string ConfigurationPath; // Path to active configuration file.
  376. public:
  377. snfCFGmgr(); // Constructor - to get things right
  378. void initialize( // In order to initialize we need to
  379. const char* FileName, // collect a path to our config or .snf
  380. const char* LicenseId, // our license id and our
  381. const char* Authentication // authentication.
  382. );
  383. class LoadFailure {}; // What we throw if load fails.
  384. void load(); // Load the configuration data.
  385. //// Access methods for config data...
  386. std::string RuleFilePath(); // Rulebase file path
  387. std::string SecurityKey(); // Security key for rulebase
  388. snfCFGData* ActiveConfiguration(); // Pointer to active configuration
  389. };