Skip to content

Improved MariaDB PCRE support #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 26, 2016
Merged

Improved MariaDB PCRE support #38

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 28 additions & 18 deletions schema/echofish-procedures.mariadb10.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,13 +47,14 @@ END;
DROP PROCEDURE IF EXISTS extract_ipaddr//
CREATE PROCEDURE extract_ipaddr(IN msg VARCHAR(5000))
BEGIN
DECLARE matching INT default 1;
DECLARE ipaddr VARCHAR(255);
SET ipaddr=(SELECT REGEXP_SUBSTR(msg, '/(([0-9]+)(?:\.[0-9]+){3})/'));
tfer_loop:WHILE (ipaddr IS NOT NULL and length(ipaddr)>0 ) DO
SELECT ipaddr;
set matching=matching+1;
SET ipaddr=(SELECT REGEXP_SUBSTR(msg, '/(([0-9]+)(?:\.[0-9]+){3})/'));
DECLARE matching INT default 1;
DECLARE ipaddr VARCHAR(255);
SET ipaddr=(SELECT REGEXP_SUBSTR(msg, '\\d{1,3}(?:\.\\d{1,3}){3}'));
tfer_loop:WHILE ( ipaddr IS NOT NULL and length(ipaddr)>0 ) DO
SELECT ipaddr;
SET matching=matching+1;
SET msg=(SELECT REPLACE( msg, @ipaddr, '' ));
SET ipaddr=(SELECT REGEXP_SUBSTR(msg, '?:\\d{1,3}(?:\.\\d{1,3}){3})'));
END WHILE tfer_loop;
END;
//
Expand Down Expand Up @@ -139,23 +140,32 @@ END;
DROP PROCEDURE IF EXISTS abuser_parser//
CREATE PROCEDURE abuser_parser(IN aid BIGINT UNSIGNED,IN ahost BIGINT UNSIGNED,IN aprogram VARCHAR(255),IN afacility INT,in alevel INT,IN apid BIGINT,in amsg TEXT,in areceived_ts TIMESTAMP)
BEGIN
DECLARE done,mts,Ccapture INT DEFAULT 0;
DECLARE CONTINUE HANDLER FOR NOT FOUND SET done = -1;
DECLARE done,mts,Ccapture INT DEFAULT 0;
DECLARE CONTINUE HANDLER FOR NOT FOUND SET done = -1;

SELECT id,pattern,grouping,capture INTO mts,@pattern,@grouping,Ccapture FROM abuser_trigger WHERE
SELECT id,pattern,grouping,capture INTO mts,@pattern,@grouping,Ccapture FROM abuser_trigger WHERE
amsg LIKE msg AND
aprogram LIKE if(program='' or program is null,'%',program) AND
afacility like if(facility<0,'%',facility) AND
alevel like if(`severity`<0,'%',`severity`) and active=1
LIMIT 1;
IF mts>0 AND Ccapture IS NOT NULL AND INET_ATON(REGEXP_REPLACE(amsg,@pattern,CONCAT('\\' COLLATE utf8_general_ci,@grouping))) IS NOT NULL THEN
INSERT INTO abuser_incident (ip,trigger_id,counter,first_occurrence,last_occurrence)
VALUES (INET_ATON(REGEXP_REPLACE(amsg,@pattern,CONCAT('\\' COLLATE utf8_general_ci,@grouping))),
mts,1,areceived_ts,areceived_ts)
ON DUPLICATE KEY UPDATE counter=counter+1,last_occurrence=areceived_ts;
SELECT id INTO @incident_id FROM abuser_incident WHERE ip=INET_ATON(REGEXP_REPLACE(amsg,@pattern,CONCAT('\\' COLLATE utf8_general_ci,@grouping))) AND trigger_id=mts;
CALL abuser_log_evidence(@incident_id,aid);
END IF;

SET @grouping = (CONVERT(CONCAT('\\',@grouping) USING utf8) COLLATE utf8_unicode_ci);
IF @pattern REGEXP '^\\^' != '1' THEN
SET @pattern = (CONCAT('^.*',@pattern));
END IF;
if @pattern REGEXP '\\$$' != '1' THEN
SET @pattern = (CONCAT(@pattern,'.*$'));
END IF;

IF mts>0 AND Ccapture IS NOT NULL AND INET_ATON(REGEXP_REPLACE(amsg,@pattern,@grouping)) IS NOT NULL THEN
INSERT INTO abuser_incident (ip,trigger_id,counter,first_occurrence,last_occurrence)
VALUES (INET_ATON(REGEXP_REPLACE(amsg,@pattern,@grouping)),
mts,1,areceived_ts,areceived_ts)
ON DUPLICATE KEY UPDATE counter=counter+1,last_occurrence=areceived_ts;
SELECT id INTO @incident_id FROM abuser_incident WHERE ip=INET_ATON(REGEXP_REPLACE(amsg,@pattern,@grouping)) AND trigger_id=mts;
CALL abuser_log_evidence(@incident_id,aid);
END IF;
END;//


Expand Down