private bool ParseRegex(Regex regex, string line, bool notifyOnly) { if (regex != null) { IPAddressLogEvent info = IPBanService.GetIPAddressInfoFromRegex(dns, regex, line); if (info.FoundMatch) { info.Type = (notifyOnly ? IPAddressEventType.SuccessfulLogin : IPAddressEventType.FailedLogin); info.Source = info.Source ?? Source; IPBanLog.Debug("Log file found match, ip: {0}, user: {1}, source: {2}, count: {3}, type: {4}", info.IPAddress, info.UserName, info.Source, info.Count, info.Type); loginHandler.AddIPAddressLogEvents(new IPAddressLogEvent[] { info }); return(true); } } return(false); }
private IPAddressLogEvent ExtractEventViewerXml(XmlDocument doc) { XmlNode keywordsNode = doc.SelectSingleNode("//Keywords"); string keywordsText = keywordsNode.InnerText; if (keywordsText.StartsWith("0x")) { keywordsText = keywordsText.Substring(2); } ulong keywordsULONG = ulong.Parse(keywordsText, NumberStyles.AllowHexSpecifier, CultureInfo.InvariantCulture); IPAddressLogEvent info = null; bool foundNotifyOnly = false; if (keywordsNode != null) { // we must match on keywords foreach (EventViewerExpressionGroup group in service.Config.WindowsEventViewerGetGroupsMatchingKeywords(keywordsULONG)) { string userName = null; string source = null; foreach (EventViewerExpression expression in group.Expressions) { // find all the nodes, try and get an ip from any of them, all must match XmlNodeList nodes = doc.SelectNodes(expression.XPath); if (nodes.Count == 0) { Logger.Debug("No nodes found for xpath {0}", expression.XPath); info = null; break; } // if there is a regex, it must match if (string.IsNullOrWhiteSpace(expression.Regex)) { // count as a match, do not modify the ip address if it was already set Logger.Debug("No regex, so counting as a match"); } else { info = null; // try and find an ip from any of the nodes foreach (XmlNode node in nodes) { // if we get a match, stop checking nodes info = IPBanService.GetIPAddressInfoFromRegex(service.DnsLookup, expression.RegexObject, node.InnerText); if (info.FoundMatch) { if (group.NotifyOnly) { foundNotifyOnly = true; } else if (foundNotifyOnly) { throw new InvalidDataException("Conflicting expressions in event viewer, both failed and success logins matched keywords " + group.Keywords); } userName = (userName ?? info.UserName); source = (source ?? info.Source); break; } } if (info != null && !info.FoundMatch) { // match fail, null out ip, we have to match ALL the nodes or we get null ip and do not ban Logger.Debug("Regex {0} did not match any nodes with xpath {1}", expression.Regex, expression.XPath); info = null; foundNotifyOnly = false; break; } } } if (info != null && info.FoundMatch && info.IPAddress != null) { info.UserName = (info.UserName ?? userName); info.Source = info.Source ?? source ?? group.Source; break; } info = null; // set null for next attempt } } if (info != null) { info.Type = (foundNotifyOnly ? IPAddressEventType.SuccessfulLogin : IPAddressEventType.FailedLogin); } return(info); }