tyler.durden/loganalyzer
1
0
Fork 0
mirror of https://github.com/rsyslog/loganalyzer.git synced 2025-09-26 11:19:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Made some adjustments on the IP resolving, we skip the resolving if the IP is surrounded by brackets

Browse Source 
The reason for this is, because the IP is prepended with the DNS name in this case most likely.
So it wouldn't make sense to resolve the name again.
This commit is contained in:
Andre Lorbach 2008-06-06 16:46:46 +02:00
parent c49fbd56a4
commit 5e124a8524
1 changed files with 1067 additions and 1069 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/include/functions_common.php
View File

@ -863,7 +863,7 @@ function AddContextLinks(&$sourceTxt)
if ( !isset($CFG['EnableIPAddressResolve']) || $CFG['EnableIPAddressResolve'] == 1 ) if ( !isset($CFG['EnableIPAddressResolve']) || $CFG['EnableIPAddressResolve'] == 1 )
{ {
// Search for IP's and Add Reverse Lookup first! // Search for IP's and Add Reverse Lookup first!
$sourceTxt = preg_replace( '/\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b/e', "'\\1.\\2.\\3.\\4' . ReverseResolveIP('\\1.\\2.\\3.\\4', '<font class=\"highlighted\"> {', '} </font>')", $sourceTxt ); $sourceTxt = preg_replace( '/([^\[])\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b/e', "'\\1\\2.\\3.\\4.\\5' . ReverseResolveIP('\\2.\\3.\\4.\\5', '<font class=\"highlighted\"> {', '} </font>')", $sourceTxt );
} }
// Create if not set! // Create if not set!
@ -873,9 +873,9 @@ function AddContextLinks(&$sourceTxt)
// Create Search Array // Create Search Array
$search = array $search = array
( (
'/\.([\w\d\_]+)\.(' . $szTLDDomains . ')([^a-zA-Z0-9])/x', '/\.([\w\d\_\-]+)\.(' . $szTLDDomains . ')([^a-zA-Z0-9\.])/x',
// '|([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})|', // '|([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})|',
'/\b(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b/x', '/(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)/x',
); );
// Create Replace Array // Create Replace Array
@ -902,13 +902,10 @@ function ReverseResolveIP( $szIP, $prepend, $append )
// Substract 5 savety seconds! // Substract 5 savety seconds!
$scriptruntime = intval(microtime_float() - $gl_starttime); $scriptruntime = intval(microtime_float() - $gl_starttime);
if ( $scriptruntime > ($MaxExecutionTime-5) ) if ( $scriptruntime > ($MaxExecutionTime-5) )
{
echo "WTF $scriptruntime - $MaxExecutionTime";
return ""; return "";
}
// Abort if these IP's are postet // Abort if these IP's are postet
if ( strpos("0.0.0.0", $szIP) !== false | strpos("127.", $szIP) !== false | strpos("255.255.255.255", $szIP) !== false ) if ( strpos($szIP, "0.0.0.0") !== false | strpos($szIP, "127.") !== false | strpos($szIP, "255.255.255.255") !== false )
return ""; return "";
else else
{ {
@ -917,7 +914,7 @@ echo "WTF $scriptruntime - $MaxExecutionTime";
$_SESSION['dns_cache'][$szIP] = gethostbyaddr($szIP); $_SESSION['dns_cache'][$szIP] = gethostbyaddr($szIP);
// Abort if IP and RESOLVED name are the same ^^! // Abort if IP and RESOLVED name are the same ^^!
if ( $_SESSION['dns_cache'][$szIP] == $szIP ) if ( $_SESSION['dns_cache'][$szIP] == $szIP || strlen($_SESSION['dns_cache'][$szIP]) <= 0 )
return; return;
// Create string // Create string
@ -937,7 +934,8 @@ function CreateTopLevelDomainSearch()
{ {
// Current list taken from http://en.wikipedia.org/wiki/List_of_Internet_top-level_domains! // Current list taken from http://en.wikipedia.org/wiki/List_of_Internet_top-level_domains!
global $szTLDDomains; global $szTLDDomains;
$szTLDDomains = "aero|asia|biz|cat|com|coop|edu|gov|info|int|jobs|mil|mobi|museum|name|net|org|pro|tel|travel|cTLD|ac|ad|ae|af|ag|ai|al|am|an|ao|aq|ar|as|at|au|aw|ax|az|ba|bb|bd|be|bf|bg|bh|bi|bj|bm|bn|bo|br|bs|bt|bv|bw|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|cr|cu|cv|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|er|es|et|eu|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|hr|ht|hu|id|ie|il|im|in|io|iq|ir|is|it|je|jm|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mg|mh|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|mz|na|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa|re|ro|rs|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|st|su|sv|sy|sz|tc|td|tf|tg|th|tj|tk|tl|tm|tn|to|tp|tr|tt|tv|tw|tz|ua|ug|uk|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|yu|za|zm|zw"; $szTLDDomains = "co.th|com.au|co.uk|co.jp";
$szTLDDomains .= "aero|asia|biz|cat|com|coop|edu|gov|info|int|jobs|mil|mobi|museum|name|net|org|pro|tel|travel|cTLD|ac|ad|ae|af|ag|ai|al|am|an|ao|aq|ar|as|at|au|aw|ax|az|ba|bb|bd|be|bf|bg|bh|bi|bj|bm|bn|bo|br|bs|bt|bv|bw|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|cr|cu|cv|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|er|es|et|eu|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|hr|ht|hu|id|ie|il|im|in|io|iq|ir|is|it|je|jm|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mg|mh|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|mz|na|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa|re|ro|rs|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|st|su|sv|sy|sz|tc|td|tf|tg|th|tj|tk|tl|tm|tn|to|tp|tr|tt|tv|tw|tz|ua|ug|uk|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|yu|za|zm|zw";
} }
// --- BEGIN Usermanagement Function --- // --- BEGIN Usermanagement Function ---