[PATCH] http: add ignore mechanism that can test multiple fields

This adds a configuration option HTTP_IGNORE_EVAL for the http service
which you can be set to arbitrary code to eval to do arbitrary tests
against multiple log file fields. Useful if you want to define narrower
ignore rules than you can get with previous ignore mechanisms that each
only test a single field.

Unless you override the new option, everything behaves like it used to,
including older ignore mechanisms.
---
 conf/services/http.conf |  8 ++++++++
 scripts/services/http   | 19 +++++++++++++------
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/conf/services/http.conf b/conf/services/http.conf
index ec34c17..ce1b433 100644
--- a/conf/services/http.conf
+++ b/conf/services/http.conf
@@ -60,6 +60,14 @@ $HTTP_IGNORE_ERROR_HACKS = 0
 #   $HTTP_IGNORE_IPS = ^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\.
 #
 
+# For more sophisticated ignore rules, you can define HTTP_IGNORE_EVAL
+# to an arbitrary chunk of code.
+# The default is not to filter anything:
+$HTTP_IGNORE_EVAL = 0
+# Example:
+# $HTTP_IGNORE_EVAL = "($field{http_rc} == 401) && ($field{client_ip}=~/^192\.168\./) && ($field{url}=~m%^/protected1/%)"
+# See the "scripts/services/http" script for other variables that can be tested.
+
 # The variable $HTTP_USER_DISPLAY defines which user accesses are displayed.
 # The default is not to display user accesses:
 $HTTP_USER_DISPLAY = 0
diff --git a/scripts/services/http b/scripts/services/http
index a80f5d1..fbaa726 100755
--- a/scripts/services/http
+++ b/scripts/services/http
@@ -134,6 +134,7 @@ use Logwatch ':sort';
 my $detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
 my $ignoreURLs = $ENV{'http_ignore_urls'};
 my $ignoreIPs = $ENV{'http_ignore_ips'};
+my $ignoreEval = $ENV{'http_ignore_eval'};
 my $ignore_error_hacks = $ENV{'http_ignore_error_hacks'} || 0;
 my $user_display = $ENV{'http_user_display'};
 my $logformat = "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"|%h %l %u %t \"%r\" %>s %b|%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b";
@@ -573,9 +574,7 @@ while (my $line = <STDIN>) {
       $other_count += 1;
       $other_bytes += $field{bytes_transfered};
    }
-   if ( ($field{http_rc} >= 400) &&
-         !((defined $ignoreURLs) && ($field{url} =~ /$ignoreURLs/)) &&
-         !((defined $ignoreIPs) && ($field{client_ip} =~ /$ignoreIPs/)) ) {
+   if ( ($field{http_rc} >= 400) && !shouldIgnore("needs_exam") ) {
       my $fmt_url = $field{url};
       if (length($field{url}) > 60) {
          $fmt_url = substr($field{url},0,42) . " ... " .
@@ -584,9 +583,7 @@ while (my $line = <STDIN>) {
       $needs_exam{$field{http_rc}}{$fmt_url}++;
    }
    if (defined $field{userid} && $field{userid} ne "-" &&
-         (eval $user_display) &&
-         !((defined $ignoreURLs) && ($field{url} =~ /$ignoreURLs/)) &&
-         !((defined $ignoreIPs) && ($field{client_ip} =~ /$ignoreIPs/)) ) {
+         (eval $user_display) && !shouldIgnore("users_logged") ) {
        $users_logged{$field{userid}}{$field{client_ip}}++;
    }
 
@@ -791,6 +788,16 @@ if ($notparsed) {
 
 exit (0);
 
+sub shouldIgnore {
+   my($context)=@_;
+
+   if( ((defined $ignoreURLs) && ($field{url} =~ /$ignoreURLs/)) ||
+       ((defined $ignoreIPs) && ($field{client_ip} =~ /$ignoreIPs/)) ) {
+      return 1;
+   }
+   return (eval $ignoreEval);
+}
+
 # vi: shiftwidth=3 tabstop=3 syntax=perl et
 # Local Variables:
 # mode: perl
-- 
1.7.10.2.484.gcd07cc5


------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/