82 lines
2.0 KiB
Perl
82 lines
2.0 KiB
Perl
package My::parser::apache_parser;
|
|
use strict;
|
|
use warnings;
|
|
|
|
sub new {
|
|
my $class = shift;
|
|
my $self = {};
|
|
bless ($self, $class);
|
|
return $self;
|
|
}
|
|
|
|
sub parser {
|
|
my $self = shift;
|
|
my $string = shift;
|
|
my ($reply,$hostile,$host) = ("No match for $string",0,'');
|
|
my $re_host = qr/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/;
|
|
if($string =~ m/proxy_fcgi:error.*Got error 'Primary script unknown'/) {
|
|
$_ = $string;
|
|
$reply = 'Request for unknown fcgi-script';
|
|
$hostile = 1;
|
|
PARSE:
|
|
m/(\[client\ ($re_host)\:0\])/gcix && do {
|
|
$host = $2;
|
|
};
|
|
} elsif($string =~ m/script not found or unable to stat/) {
|
|
$_ = $string;
|
|
$reply = 'Script not found';
|
|
$hostile = 1;
|
|
PARSE:
|
|
m/(\[client\ ($re_host)\:0\])/gcix && do {
|
|
$host = $2;
|
|
};
|
|
} elsif($string =~ m/ap_pass_brigade failed in handle_request_ipc function/) {
|
|
$_ = $string;
|
|
$hostile = 1;
|
|
$reply = 'Connection closed early';
|
|
PARSE:
|
|
m/(\[client\ ($re_host)\:0\])/gcix && do {
|
|
$host = $2;
|
|
};
|
|
} elsif($string =~ m/Invalid URI in request/) {
|
|
$_ = $string;
|
|
$hostile = 1;
|
|
$reply = 'Invalid URI';
|
|
PARSE:
|
|
m/(\[client\ ($re_host)\:0\])/gcix && do {
|
|
$host = $2;
|
|
};
|
|
} elsif($string =~ m/invalid URI path /) {
|
|
$_ = $string;
|
|
$hostile = 1;
|
|
$reply = 'Invalid URI';
|
|
PARSE:
|
|
m/(\[client\ ($re_host)\:0\])/gcix && do {
|
|
$host = $2;
|
|
};
|
|
} elsif($string =~ m/\(63\)File name too long: /) {
|
|
$_ = $string;
|
|
$hostile = 1;
|
|
$reply = 'File name too long';
|
|
PARSE:
|
|
m/(\[client\ ($re_host)\:0\])/gcix && do {
|
|
$host = $2;
|
|
};
|
|
} elsif($string =~ m/ AH00135: Invalid method in request /) {
|
|
$_ = $string;
|
|
$hostile = 1;
|
|
$reply = 'Invalid request method';
|
|
PARSE:
|
|
m/(\[client\ ($re_host)\:0\])/gcix && do {
|
|
$host = $2;
|
|
};
|
|
} elsif($string =~ m/mod_fcgid: cleanup zombie process/) {
|
|
$reply = 'fcgi process killed';
|
|
} elsif($string =~ m/scoreboard already in used/) {
|
|
$reply = 'Scoreboard already in use';
|
|
}
|
|
return { retval => 1, retmsg => $reply, hostile => $hostile, host => $host, string => $string };
|
|
}
|
|
|
|
return 1;
|