Context Navigation

source: trunk/src/sh_prelude.c@ 39

Last change on this file since 39 was 37, checked in by rainer, 19 years ago
stat() -> lstat() in sh_prelude.c
File size: 32.3 KB

Rev	Line
[1]	1	/*
	2	*
	3	* Copyright (C) 2005 Yoann Vandoorselaere, Prelude IDS Technologies
	4	* Rainer Wichmann
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License as published by
	8	* the Free Software Foundation; either version 2, or (at your option)
	9	* any later version.
	10	*
	11	* This program is distributed in the hope that it will be useful,
	12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	14	* GNU General Public License for more details.
	15	*
	16	* You should have received a copy of the GNU General Public License
	17	* along with this program; see the file COPYING. If not, write to
	18	* the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
	19	*
	20	*/
	21
	22	/*
	23	* 28/04/2005 : R.W.:
	24	* move libprelude 0.8 code to seperate file
	25	*
	26	* 23/04/2005 : R.W.:
	27	* include libprelude 0.9 code from Yoann Vandoorselaere
	28	*/
[36]	29
	30
	31	/*
	32	* for strptime()
	33	*/
	34	#define _GNU_SOURCE 1
	35
[1]	36	#include "config_xor.h"
	37
	38	#include <stdio.h>
	39	#include <string.h>
	40	#include <sys/types.h>
[36]	41	#include <sys/stat.h>
[1]	42
	43	#if TIME_WITH_SYS_TIME
	44
	45	# include <sys/time.h>
	46	# include <time.h>
	47
	48	#else
	49
	50	# if HAVE_SYS_TIME_H
	51	# include <sys/time.h>
	52	# else
	53	# include <time.h>
	54	# endif
	55
	56	#endif
	57
[36]	58	#ifdef MAJOR_IN_MKDEV
	59	# include <sys/mkdev.h>
	60	#else
	61	# ifdef MAJOR_IN_SYSMACROS
	62	# include <sys/sysmacros.h>
	63	# endif
	64	#endif
	65
[1]	66	#include <unistd.h>
	67	#include <syslog.h>
	68	#include <pwd.h>
	69	#include <grp.h>
	70
[20]	71	int sh_argc_store;
	72	char ** sh_argv_store;
	73
[1]	74	#if defined(HAVE_LIBPRELUDE) && defined(HAVE_LIBPRELUDE_9)
	75
	76
	77	/*
	78	* _() macros are samhain specific; they are used to replace string
	79	* constants at runtime. This is part of the samhain stealth mode
	80	* (fill string constants with encoded strings, decode at runtime).
	81	*/
	82	#define FIL__ _("sh_prelude.c")
	83
	84
	85	#include <libprelude/idmef.h>
	86	#include <libprelude/prelude.h>
	87
	88	/*
	89	* includes for samhain-specific functions (sl_strstr, sh_error_handle)
	90	*/
	91	#include "slib.h"
	92	#include "sh_cat.h"
	93	#include "sh_error_min.h"
	94	#include "sh_prelude.h"
	95
	96	/*
	97	* When SH_USE_XML is set, value are formated using name="value".
	98	* Otherwise, value is formatted using the format name=<value>.
	99	*/
	100	#ifdef SH_USE_XML
	101	# define VALUE_DELIM_START '"'
	102	# define VALUE_DELIM_END '"'
	103	#else
	104	# define VALUE_DELIM_START '<'
	105	# define VALUE_DELIM_END '>'
	106	#endif
	107
	108	#define IDMEF_ANALYZER_MODEL _("Samhain")
	109	#define IDMEF_ANALYZER_CLASS _("Integrity Checker")
	110	#define IDMEF_ANALYZER_VERSION VERSION
	111	#define IDMEF_ANALYZER_MANUFACTURER _("Samhain by Rainer Wichmann")
	112
	113	#define CLASSIFICATION_URL _("http://www.la-samhna.de/samhain/")
	114
	115
	116
	117	/*
	118	* 0 = not initialized; -1 = failed; 1 = initialized
	119	*/
	120	static int initialized = 0;
	121	static int ready_for_init = 0;
	122
	123	static char *profile = NULL;
	124	static prelude_client_t *client = NULL;
	125
	126	static int severity_map[1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH] = {
	127	/* 0: unused (?) */ 0,
	128	/* 1: INFO */ 0,
	129	/* 2: LOW */ SH_ERR_ALL\|SH_ERR_INFO,
	130	/* 3: MEDIUM */ SH_ERR_NOTICE\|SH_ERR_WARN\|SH_ERR_STAMP\|SH_ERR_ERR,
	131	/* 4: HIGH */ SH_ERR_SEVERE\|SH_ERR_FATAL
	132	};
	133
	134	/* returns 0/tiger, 1/sha1, or 2/md5
	135	*/
	136	extern int sh_tiger_get_hashtype(void);
	137
	138	static void clear_and_set (int setpos, int flag)
	139	{
	140	unsigned int i;
	141	/* clear everywhere, and set at correct position */
	142	for (i = 1; i < (1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH); ++i)
	143	severity_map[i] &= ~flag;
	144	severity_map[setpos] \|= flag;
	145	return;
	146	}
	147
[22]	148	static int set_prelude_severity_int (const char * str, int prelude_sev)
[1]	149	{
[22]	150	char * p;
	151	char * dup = strdup (str);
[1]	152
[26]	153	if (!dup)
	154	return -1;
	155
[22]	156	p = strtok (dup, ", \t");
[1]	157	if (p) {
	158	do {
	159	if (0 == strcmp (p, _("alert")))
	160	clear_and_set (prelude_sev, SH_ERR_FATAL);
	161	else if (0 == strcmp (p, _("crit")))
	162	clear_and_set (prelude_sev, SH_ERR_SEVERE);
	163	else if (0 == strcmp (p, _("err")))
	164	clear_and_set (prelude_sev, SH_ERR_ERR);
	165	else if (0 == strcmp (p, _("mark")))
	166	clear_and_set (prelude_sev, SH_ERR_STAMP);
	167	else if (0 == strcmp (p, _("warn")))
	168	clear_and_set (prelude_sev, SH_ERR_WARN);
	169	else if (0 == strcmp (p, _("notice")))
	170	clear_and_set (prelude_sev, SH_ERR_NOTICE);
	171	else if (0 == strcmp (p, _("debug")))
	172	clear_and_set (prelude_sev, SH_ERR_ALL);
	173	else if (0 == strcmp (p, _("info")))
	174	clear_and_set (prelude_sev, SH_ERR_INFO);
[26]	175	else {
	176	free (dup);
[1]	177	return -1;
[26]	178	}
[1]	179	p = strtok (NULL, ", \t");
	180	} while (p);
	181	}
[22]	182	free(dup);
[1]	183	return 0;
	184	}
	185
[22]	186	int sh_prelude_map_info (const char * str)
[1]	187	{
	188	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_INFO));
	189	}
[22]	190	int sh_prelude_map_low (const char * str)
[1]	191	{
	192	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_LOW));
	193	}
[22]	194	int sh_prelude_map_medium (const char * str)
[1]	195	{
	196	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_MEDIUM));
	197	}
[22]	198	int sh_prelude_map_high (const char * str)
[1]	199	{
	200	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_HIGH));
	201	}
	202
	203	static idmef_impact_severity_t map_severity (int sam_sev)
	204	{
	205	int i;
	206	int max = 1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH;
	207	idmef_impact_severity_t retval = IDMEF_IMPACT_SEVERITY_MEDIUM;
	208
	209	for (i = 0; i < max; ++i) {
	210	if (severity_map[i] & sam_sev) {
	211	retval = (idmef_impact_severity_t) i;
	212	}
	213	}
	214	return retval;
	215	}
	216
	217	static char do_get_value(char ptr, char delim_start, char delim_end)
	218	{
	219	char *ret = NULL;
	220
	221	ptr = strchr(ptr, delim_start);
	222	if ( ! ptr )
	223	return NULL;
	224
	225	ret = ++ptr;
	226
	227	ptr = strchr(ptr, delim_end);
	228	if ( ! ptr )
	229	return NULL;
	230
	231	*ptr = '\0';
	232	ret = strdup(ret);
	233	*ptr = delim_end;
	234
	235	return ret;
	236	}
	237
	238
	239
	240	static char get_value(char msg, const char toktmp, const char toksuffix)
	241	{
	242	char *ptr, tok[128];
	243
	244	snprintf(tok, sizeof(tok), "%s%s=", toktmp, (toksuffix) ? toksuffix : "");
	245
	246	ptr = strstr(msg, tok);
	247	if ( ! ptr )
	248	return NULL;
	249
	250	return do_get_value(ptr, VALUE_DELIM_START, VALUE_DELIM_END);
	251	}
	252
	253
	254
	255	static char get_time_value(char msg, const char toktmp, const char toksuffix)
	256	{
	257
	258	char ret, ptr, tok[128];
	259
	260	snprintf(tok, sizeof(tok), "%s%s=", toktmp, (toksuffix) ? toksuffix : "");
	261
	262	ptr = strstr(msg, tok);
	263	if ( ! ptr )
	264	return NULL;
	265
	266	#ifndef SH_USE_XML
	267	ret = do_get_value(ptr, '[', ']');
	268	#else
	269	ret = do_get_value(ptr, VALUE_DELIM_START, VALUE_DELIM_END);
	270	#endif
	271
	272	return ret;
	273	}
	274
	275
	276
	277
	278	#if 0
	279	void debug_print_message(idmef_message_t *msg)
	280	{
	281	int ret;
	282	prelude_io_t *fd;
	283
	284	ret = prelude_io_new(&fd);
	285	if ( ret < 0 )
	286	return;
	287
	288	prelude_io_set_file_io(fd, stderr);
	289	idmef_message_print(idmef, fd);
	290
	291	prelude_io_destroy(fd);
	292	}
	293	#endif
	294
	295
	296
	297	static int idmef_time_from_samhain(idmef_time_t *time, const char str)
	298	{
	299	int ret;
	300	char *ptr;
	301	time_t utc;
	302	struct tm lt;
	303
	304	/*
	305	* Samhain stamp are encoded in UTC.
	306	*/
	307	ptr = strptime(str, _("%Y-%m-%dT%H:%M:%S"), &lt);
	308	if ( ! ptr ) {
	309	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
	310	_("could not format Samhain time"), _("idmef_time_from_samhain"));
	311	return -1;
	312	}
	313
	314	utc = prelude_timegm(&lt);
	315
	316	ret = idmef_time_new_from_time(time, &utc);
	317	if ( ret < 0 )
	318	return ret;
	319
	320	return 0;
	321	}
	322
[22]	323	/* flawfinder: ignore // is part of name, not access() */
[1]	324	static void get_access_info(idmef_file_access_t access, char mode, int pos, int mpos)
	325	{
	326	int got = 0;
	327	int ret;
	328	prelude_string_t *str;
	329
	330	do {
	331	if ( mode[pos] == 'r' ) {
[22]	332	/* flawfinder: ignore // is part of name, not access() */
[26]	333	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
[1]	334	if ( ret < 0 )
	335	return;
	336	prelude_string_set_dup(str, _("read"));
	337	++got;
	338	}
	339	else if ( mode[pos] == 'w' ) {
[22]	340	/* flawfinder: ignore // is part of name, not access() */
[26]	341	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
[1]	342	if ( ret < 0 )
	343	return;
	344	prelude_string_set_dup(str, _("write"));
	345	++got;
	346	}
	347	else if ( mode[pos] == 'x' \|\| mode[pos] == 's' \|\| mode[pos] == 't') {
[22]	348	/* flawfinder: ignore // is part of name, not access() */
[26]	349	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
[1]	350	if ( ret < 0 )
	351	return;
	352
	353	if ( mode[pos] == 'x' && mode[0] == 'd' )
	354	prelude_string_set_dup(str, _("search"));
	355
	356	else if ( mode[pos] == 'x' \|\| mode[pos] == 't' )
	357	prelude_string_set_dup(str, _("execute"));
	358
	359	else /* 's' */
	360	prelude_string_set_dup(str, _("executeAs"));
	361	++got;
	362	}
	363	++pos;
	364	} while (pos <= mpos);
	365
	366	if ( got == 0 ) {
[22]	367	/* flawfinder: ignore // is part of name, not access() */
[26]	368	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
[1]	369	if ( ret < 0 )
	370	return;
	371	prelude_string_set_dup(str, _("noAccess"));
	372	}
	373	return;
	374	}
	375
	376
	377	static void get_file_infos(idmef_target_t target, char msg,
	378	idmef_file_category_t category)
	379	{
	380	int ret;
	381	int hashtype = 0;
	382	char *ptr;
	383	idmef_time_t *time;
	384	idmef_file_t *file;
	385	idmef_inode_t *inode;
	386	prelude_string_t *str;
	387	idmef_checksum_t *checksum;
[22]	388	idmef_file_access_t access; / flawfinder: ignore */
[1]	389	idmef_user_id_t *userid;
	390	const char *suffix = (category == IDMEF_FILE_CATEGORY_CURRENT) ? "_new" : "_old";
	391	char *mode = NULL;
	392
[26]	393	ret = idmef_target_new_file(target, &file, IDMEF_LIST_APPEND);
[1]	394	if ( ret < 0 )
	395	return;
	396	idmef_file_set_category(file, category);
	397
	398	ptr = get_value(msg, _("path"), NULL);
	399	if ( ptr ) {
	400	/*
	401	* In term of IDMEF, this is the full path,
	402	* including the name.
	403	*/
	404	ret = idmef_file_new_path(file, &str);
[36]	405	if ( ret < 0 ) {
	406	free(ptr);
[1]	407	return;
[36]	408	}
[1]	409	prelude_string_set_nodup(str, ptr);
	410
	411	ptr = strrchr(ptr, '/');
	412	if ( ptr ) {
	413	ret = idmef_file_new_name(file, &str);
	414	if ( ret < 0 )
	415	return;
	416
	417	prelude_string_set_dup(str, ptr + 1);
	418	}
	419	}
	420
	421	ptr = get_value(msg, _("size"), suffix);
	422	if ( ptr ) {
	423	idmef_file_set_data_size(file, strtoul(ptr, NULL, 10));
	424	free(ptr);
	425	}
	426
	427	ptr = get_time_value(msg, _("mtime"), suffix);
	428	if ( ptr ) {
	429	ret = idmef_time_from_samhain(&time, ptr);
[36]	430	if ( ret < 0 ) {
	431	free(ptr);
[1]	432	return;
[36]	433	}
[1]	434
	435	idmef_file_set_modify_time(file, time);
	436	free(ptr);
	437	}
	438
	439	ptr = get_time_value(msg, _("ctime"), suffix);
	440	if ( ptr ) {
	441	ret = idmef_time_from_samhain(&time, ptr);
[36]	442	if ( ret < 0 ) {
	443	free(ptr);
[1]	444	return;
[36]	445	}
	446
[1]	447	idmef_file_set_create_time(file, time);
	448	free(ptr);
	449	}
	450
	451	ptr = get_value(msg, _("inode"), suffix);
	452	if ( ptr ) {
[36]	453	struct stat st;
	454
[37]	455	ret = lstat(prelude_string_get_string(idmef_file_get_path(file)), &st);
[36]	456	if ( ret < 0 ) {
	457	free(ptr);
	458	return;
	459	}
	460
[1]	461	ret = idmef_file_new_inode(file, &inode);
[36]	462	if ( ret < 0 ) {
	463	free(ptr);
[1]	464	return;
[36]	465	}
[1]	466
[36]	467	idmef_inode_set_major_device(inode, major(st.st_dev));
	468	idmef_inode_set_minor_device(inode, minor(st.st_dev));
[1]	469	idmef_inode_set_number(inode, strtoul(ptr, NULL, 10));
	470	free(ptr);
	471	}
	472
	473	ptr = get_value(msg, _("chksum"), suffix);
	474	if ( ptr ) {
[26]	475	ret = idmef_file_new_checksum(file, &checksum, IDMEF_LIST_APPEND);
[36]	476	if ( ret < 0 ) {
	477	free(ptr);
[1]	478	return;
[36]	479	}
[1]	480
	481	hashtype = sh_tiger_get_hashtype();
	482
	483	if (hashtype == 0)
	484	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
	485
	486	else if (hashtype == 1)
	487	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_SHA1);
	488
	489	else if (hashtype == 2)
	490	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_MD5);
	491
	492	else
	493	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
	494
	495
	496	ret = idmef_checksum_new_value(checksum, &str);
[36]	497	if ( ret < 0 ) {
	498	free(ptr);
[1]	499	return;
[36]	500	}
[1]	501
	502	/* will be freed on destroy()
	503	*/
	504	prelude_string_set_nodup(str, ptr);
	505	}
	506
	507	mode = get_value(msg, _("mode"), suffix);
	508	if ( mode ) {
[22]	509	/* flawfinder: ignore // is part of name, not access() */
[26]	510	ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
[1]	511	if ( ret < 0 )
[36]	512	goto mode_free;
[1]	513
[22]	514	/* flawfinder: ignore // is part of name, not access() */
[1]	515	ret = idmef_file_access_new_user_id(access, &userid);
	516	if ( ret < 0 )
[36]	517	goto mode_free;
[1]	518	idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_OTHER_PRIVS);
	519
[22]	520	/* flawfinder: ignore // is part of name, not access() */
[1]	521	get_access_info ( access, mode, 7, 9 );
	522	}
	523
	524	ptr = get_value(msg, _("owner"), suffix);
	525	if ( ptr ) {
	526	struct passwd *pw;
	527
[22]	528	/* flawfinder: ignore // is part of name, not access() */
[26]	529	ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
[36]	530	if ( ret < 0 ) {
	531	free(ptr);
	532	goto mode_free;
	533	}
[1]	534
[22]	535	/* flawfinder: ignore // is part of name, not access() */
[1]	536	ret = idmef_file_access_new_user_id(access, &userid);
[36]	537	if ( ret < 0 ) {
	538	free(ptr);
	539	goto mode_free;
	540	}
[1]	541	idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_USER_PRIVS);
	542
	543	ret = idmef_user_id_new_name(userid, &str);
[36]	544	if ( ret < 0 ) {
	545	free(ptr);
	546	goto mode_free;
	547	}
[1]	548	prelude_string_set_nodup(str, ptr);
	549
	550	pw = getpwnam(ptr);
	551	if ( ! pw )
[36]	552	goto mode_free;
[1]	553
	554	idmef_user_id_set_number(userid, pw->pw_uid);
	555
	556	if ( mode ) {
[22]	557	/* flawfinder: ignore // is part of name, not access() */
[1]	558	get_access_info ( access, mode, 1, 3 );
	559	}
	560	}
	561
	562	ptr = get_value(msg, _("group"), suffix);
	563	if ( ptr ) {
	564	struct group *gr;
	565
[22]	566	/* flawfinder: ignore // is part of name, not access() */
[26]	567	ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
[36]	568	if ( ret < 0 ) {
	569	free(ptr);
	570	goto mode_free;
	571	}
[1]	572
[36]	573	ret = idmef_file_access_new_user_id(access, &userid);/* flawfinder: ignore // is part of name, not access() */
	574	if ( ret < 0 ) {
	575	free(ptr);
	576	goto mode_free;
	577	}
	578
[1]	579	idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_GROUP_PRIVS);
	580
	581	ret = idmef_user_id_new_name(userid, &str);
[36]	582	if ( ret < 0 ) {
	583	free(ptr);
	584	goto mode_free;
	585	}
[1]	586
	587	prelude_string_set_nodup(str, ptr);
	588
	589	gr = getgrnam(ptr);
	590	if ( ! gr )
[36]	591	goto mode_free;
[1]	592
	593	idmef_user_id_set_number(userid, gr->gr_gid);
	594
	595	if ( mode ) {
[22]	596	get_access_info ( access, mode, 4, 6 ); /* flawfinder: ignore */
[1]	597	}
	598	}
	599
[36]	600	mode_free:
	601
[1]	602	if ( mode ) {
	603	free ( mode );
	604	}
[36]	605
	606	return;
[1]	607	}
	608
	609
	610
	611	static int map_policy_to_class(char msg, unsigned long msgid, idmef_impact_t impact, prelude_string_t *out)
	612	{
	613	char *ptr;
	614	int ret, i;
	615	struct tbl {
	616	unsigned int msgid;
	617	const char *name;
	618	idmef_impact_type_t type;
	619	} tbl[] = {
	620
	621	#ifdef SH_USE_UTMP
	622	{ MSG_UT_LG1X, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
	623	{ MSG_UT_LG1A, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
	624	{ MSG_UT_LG1B, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
	625	{ MSG_UT_LG2X, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
	626	{ MSG_UT_LG2A, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
	627	{ MSG_UT_LG2B, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
	628	{ MSG_UT_LG3X, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
	629	{ MSG_UT_LG3A, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
	630	{ MSG_UT_LG3B, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
	631	{ MSG_UT_LG3C, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
	632	#endif
	633
	634	#if defined(SH_WITH_CLIENT) \|\| defined(SH_STANDALONE)
	635	{ MSG_FI_MISS, N_("File Missing"), IDMEF_IMPACT_TYPE_FILE },
	636	{ MSG_FI_MISS2, N_("File Missing"), IDMEF_IMPACT_TYPE_FILE },
	637	{ MSG_FI_ADD, N_("File Added"), IDMEF_IMPACT_TYPE_FILE },
	638	{ MSG_FI_ADD2, N_("File Added"), IDMEF_IMPACT_TYPE_FILE },
	639	{ MSG_FI_CHAN, N_("File Modified"), IDMEF_IMPACT_TYPE_FILE },
	640	{ MSG_FI_NODIR, N_("File found where directory was expected"), IDMEF_IMPACT_TYPE_FILE },
	641	#endif
	642
	643	#ifdef SH_USE_KERN
	644	{ MSG_KERN_POLICY, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
	645	{ MSG_KERN_POL_CO, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
	646	{ MSG_KERN_PROC, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
	647	{ MSG_KERN_GATE, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
	648	{ MSG_KERN_IDT, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
	649	{ MSG_KERN_SYSCALL, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
	650	#endif
	651
	652	#ifdef SH_USE_SUIDCHK
	653	{ MSG_SUID_POLICY, N_("SUID/SGID File Detected"), IDMEF_IMPACT_TYPE_FILE },
	654	#endif
	655	/*
	656	* This must be the last table entry
	657	*/
	658	{ 0, NULL, IDMEF_IMPACT_TYPE_OTHER },
	659	};
	660
	661	for ( i = 0; tbl[i].name != NULL; i++ ) {
	662	if ( tbl[i].msgid != msgid )
	663	continue;
	664
	665	idmef_impact_set_type(impact, tbl[i].type);
	666	return prelude_string_cat(out, _(tbl[i].name));
	667	}
	668
	669	/* some other message
	670	*/
	671	ptr = get_value(msg, _("msg"), NULL);
	672	if ( ! ptr ) {
	673	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
	674	_("could not format Samhain message"), _("map_policy_to_class"));
	675	return -1;
	676	}
	677
	678	ret = prelude_string_cat(out, ptr);
	679	free(ptr);
	680
	681	return ret;
	682	}
	683
	684
	685
	686	static int get_login_info(char msg, idmef_alert_t alert)
	687	{
	688	int ret;
	689	char ptr, ip;
	690	idmef_user_t *user;
	691	idmef_node_t *node;
	692	struct passwd *pw;
	693	prelude_string_t *str;
	694	idmef_user_id_t *user_id;
	695	idmef_address_t *address;
	696	idmef_target_t *target = idmef_alert_get_next_target(alert, NULL);
	697	idmef_source_t *source = idmef_alert_get_next_source(alert, NULL);
	698
	699	ip = ptr = get_value(msg, _("ip"), NULL);
	700	if ( ptr ) {
	701	if ( ! source ) {
[26]	702	ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
[1]	703	if ( ret < 0 ) {
	704	free(ptr);
	705	return ret;
	706	}
	707	}
	708
	709	ret = idmef_source_new_node(source, &node);
	710	if ( ret < 0 ) {
	711	free(ptr);
	712	return ret;
	713	}
	714
[26]	715	ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
[1]	716	if ( ret < 0 ) {
	717	free(ptr);
	718	return ret;
	719	}
	720
	721	ret = idmef_address_new_address(address, &str);
	722	if ( ret < 0 ) {
	723	free(ptr);
	724	return ret;
	725	}
	726
	727	prelude_string_set_nodup(str, ptr);
	728	}
	729
	730	ptr = get_value(msg, _("host"), NULL);
	731	if ( ptr ) {
	732	if ( ip && strcmp(ptr, ip) == 0 )
	733	free(ptr);
	734	else {
	735	if ( ! source ) {
[26]	736	ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
[1]	737	if ( ret < 0 ) {
	738	free(ptr);
	739	return ret;
	740	}
	741	}
	742
	743	ret = idmef_source_new_node(source, &node);
	744	if ( ret < 0 ) {
	745	free(ptr);
	746	return ret;
	747	}
	748
	749	ret = idmef_node_new_name(node, &str);
	750	if ( ret < 0 ) {
	751	free(ptr);
	752	return ret;
	753	}
	754
	755	prelude_string_set_nodup(str, ptr);
	756	}
	757	}
	758
	759	ptr = get_value(msg, _("name"), NULL);
	760	if ( ptr ) {
	761	ret = idmef_target_new_user(target, &user);
	762	if ( ret < 0 ) {
	763	free(ptr);
	764	return ret;
	765	}
	766
	767	idmef_user_set_category(user, IDMEF_USER_CATEGORY_OS_DEVICE);
	768
[26]	769	ret = idmef_user_new_user_id(user, &user_id, IDMEF_LIST_APPEND);
[1]	770	if ( ret < 0 ) {
	771	free(ptr);
	772	return ret;
	773	}
	774
	775	idmef_user_id_set_type(user_id, IDMEF_USER_ID_TYPE_TARGET_USER);
	776
	777	pw = getpwnam(ptr);
	778	if ( pw )
	779	idmef_user_id_set_number(user_id, pw->pw_uid);
	780
	781	ret = idmef_user_id_new_name(user_id, &str);
	782	if ( ret < 0 ) {
	783	free(ptr);
	784	return ret;
	785	}
	786	prelude_string_set_nodup(str, ptr);
	787
	788	ptr = get_value(msg, _("tty"), NULL);
	789	if ( ptr ) {
	790	ret = idmef_user_id_new_tty(user_id, &str);
	791	if ( ret < 0 ) {
	792	free(ptr);
	793	return ret;
	794	}
	795
	796	prelude_string_set_nodup(str, ptr);
	797	}
	798	}
	799
	800	ptr = get_time_value(msg, _("time"), NULL);
	801	if ( ptr ) {
	802	idmef_time_t *time;
	803
	804	ret = idmef_time_from_samhain(&time, ptr);
	805	free(ptr);
	806
	807	if ( ret < 0 )
	808	return ret;
	809
	810	idmef_alert_set_detect_time(alert, time);
	811	}
	812
	813	return 0;
	814	}
	815
	816
	817	static int samhain_alert_prelude(int priority, int sh_class,
	818	char *message, unsigned long msgid)
	819	{
	820	int ret;
	821	idmef_time_t *time;
	822	idmef_alert_t *alert;
	823	idmef_message_t *idmef;
	824	idmef_classification_t *classification;
	825	idmef_assessment_t *assessment;
	826	idmef_additional_data_t *data;
	827	idmef_impact_t *impact;
	828	idmef_target_t *target;
	829	idmef_confidence_t *confidence;
	830	prelude_string_t *str;
	831
[15]	832	if ( !client \|\| sh_class == STAMP)
[1]	833	return 0;
	834
	835	ret = idmef_message_new(&idmef);
	836	if ( ret < 0 )
	837	goto err;
	838
	839	ret = idmef_message_new_alert(idmef, &alert);
	840	if ( ret < 0 )
	841	goto err;
	842
[26]	843	idmef_alert_set_analyzer(alert, idmef_analyzer_ref(prelude_client_get_analyzer(client)), IDMEF_LIST_PREPEND);
[1]	844
	845	ret = idmef_time_new_from_gettimeofday(&time);
	846	if ( ret < 0 )
	847	goto err;
	848	idmef_alert_set_detect_time(alert, time);
	849
	850	ret = idmef_time_new_from_gettimeofday(&time);
	851	if ( ret < 0 )
	852	goto err;
	853	idmef_alert_set_create_time(alert, time);
	854
	855	ret = idmef_alert_new_classification(alert, &classification);
	856	if ( ret < 0 )
	857	goto err;
	858
[26]	859	ret = idmef_alert_new_target(alert, &target, IDMEF_LIST_APPEND);
[1]	860	if ( ret < 0 )
	861	goto err;
	862
	863	idmef_target_set_decoy(target, IDMEF_TARGET_DECOY_NO);
	864
	865	if ( idmef_analyzer_get_node(prelude_client_get_analyzer(client)) ) {
	866	idmef_node_ref(idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
	867	idmef_target_set_node(target, idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
	868	}
	869
	870	if ( strstr(message, _("path=")) ) {
[2]	871	#if defined(SH_WITH_CLIENT) \|\| defined(SH_STANDALONE)
[1]	872	if ( msgid != MSG_FI_ADD && msgid != MSG_FI_ADD2 )
	873	get_file_infos(target, message, IDMEF_FILE_CATEGORY_ORIGINAL);
[2]	874	#endif
[1]	875
	876	get_file_infos(target, message, IDMEF_FILE_CATEGORY_CURRENT);
	877	}
	878
	879	ret = idmef_alert_new_assessment(alert, &assessment);
	880	if ( ret < 0 )
	881	goto err;
	882
	883	ret = idmef_assessment_new_impact(assessment, &impact);
	884	if ( ret < 0 )
	885	goto err;
	886
	887	ret = idmef_classification_new_text(classification, &str);
	888	if ( ret < 0 )
	889	goto err;
	890
	891	ret = get_login_info(message, alert);
	892	if ( ret < 0 )
	893	goto err;
	894
	895	map_policy_to_class(message, msgid, impact, str);
	896
	897	#if 0
	898	if ( priority == SH_ERR_SEVERE \|\| priority == SH_ERR_FATAL )
	899	idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_HIGH);
	900
	901	else if ( priority == SH_ERR_ALL \|\| priority == SH_ERR_INFO \|\| priority == SH_ERR_NOTICE )
	902	idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_LOW);
	903
	904	else
	905	idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_MEDIUM);
	906	#endif
	907	idmef_impact_set_severity(impact, map_severity(priority));
	908
	909	idmef_impact_set_completion(impact, IDMEF_IMPACT_COMPLETION_SUCCEEDED);
	910
	911	ret = idmef_assessment_new_confidence(assessment, &confidence);
	912	if ( ret < 0 )
	913	goto err;
	914
	915	idmef_confidence_set_rating(confidence, IDMEF_CONFIDENCE_RATING_HIGH);
	916
[26]	917	ret = idmef_alert_new_additional_data(alert, &data, IDMEF_LIST_APPEND);
[1]	918	if ( ret < 0 )
	919	goto err;
	920
	921	ret = idmef_additional_data_new_meaning(data, &str);
	922	if ( ret < 0 )
	923	goto err;
	924
	925	prelude_string_set_dup(str, _("Message generated by Samhain"));
	926	idmef_additional_data_set_type(data, IDMEF_ADDITIONAL_DATA_TYPE_STRING);
	927	idmef_additional_data_set_string_ref(data, message);
	928
	929	/* debug_print_message(idmef); */
	930
	931	prelude_client_send_idmef(client, idmef);
	932	idmef_message_destroy(idmef);
	933
	934	return 0;
	935
	936	err:
	937	idmef_message_destroy(idmef);
	938	return -1;
	939	}
	940
	941
	942	int sh_prelude_alert(int priority, int sh_class, char *message, long msgflags, unsigned long msgid)
	943	{
	944	int ret;
	945
	946	(void) msgflags; /* fix compiler warning */
	947
[15]	948	if ( initialized < 1 )
[1]	949	return -1;
	950
	951	ret = samhain_alert_prelude(priority, sh_class, message, msgid);
	952	if ( ret < 0 ) {
	953	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
	954	_("Problem with IDMEF for prelude-ids support: alert lost"),
	955	_("sh_prelude_alert"));
	956	}
	957
	958	return ret;
	959	}
	960
	961
	962
[22]	963	int sh_prelude_set_profile(const char *arg)
[1]	964	{
	965	if ( profile ) {
	966	free(profile);
	967	profile = NULL;
	968	}
	969
	970	if ( arg ) {
	971	profile = strdup(arg);
	972	if ( ! profile )
	973	return -1;
	974	}
	975
	976	return 0;
	977	}
	978
	979
	980	void sh_prelude_reset(void)
	981	{
	982	extern void sh_error_init_prelude();
	983
	984	ready_for_init = 1;
	985	sh_error_init_prelude();
	986	return;
	987	}
	988
	989
	990
	991	void sh_prelude_stop(void)
	992	{
	993	if (initialized < 1)
	994	return;
	995	prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
[15]	996	client = NULL;
[1]	997	initialized = 0;
	998	return;
	999	}
	1000
	1001
	1002
	1003	int sh_prelude_init(void)
	1004	{
	1005	int ret;
	1006	prelude_string_t *str;
	1007	idmef_analyzer_t *analyzer;
	1008	prelude_client_flags_t flags;
[20]	1009	#ifdef SH_NOFAILOVER
	1010	prelude_connection_pool_t *pool;
	1011	prelude_connection_pool_flags_t conn_flags;
	1012	#endif
[1]	1013
	1014	if (ready_for_init == 0)
	1015	return initialized;
	1016
	1017	if (initialized > 0)
	1018	return initialized;
	1019
	1020	prelude_thread_init(NULL);
[20]	1021	prelude_init(&sh_argc_store, sh_argv_store);
[1]	1022
	1023	ret = prelude_client_new(&client, profile ? profile : _("samhain"));
	1024	if ( ret < 0 ) {
	1025	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
	1026	_("Failed to initialize Prelude"), _("sh_prelude_init"));
	1027	initialized = -1;
	1028	return -1;
	1029	}
	1030
	1031	/*
	1032	* Enable automatic heartbeat sending.
	1033	*/
	1034	flags = prelude_client_get_flags(client);
	1035	ret = prelude_client_set_flags(client, flags \| PRELUDE_CLIENT_FLAGS_ASYNC_TIMER);
	1036
	1037	analyzer = prelude_client_get_analyzer(client);
	1038
	1039	ret = idmef_analyzer_new_model(analyzer, &str);
	1040	prelude_string_set_dup(str, IDMEF_ANALYZER_MODEL);
	1041
	1042	ret = idmef_analyzer_new_class(analyzer, &str);
	1043	prelude_string_set_dup(str, IDMEF_ANALYZER_CLASS);
	1044
	1045	ret = idmef_analyzer_new_version(analyzer, &str);
	1046	prelude_string_set_dup(str, IDMEF_ANALYZER_VERSION);
	1047
[20]	1048	#ifdef SH_NOFAILOVER
	1049	pool = prelude_client_get_connection_pool(client);
	1050	conn_flags = prelude_connection_pool_get_flags(pool);
	1051
	1052	conn_flags &= ~PRELUDE_CONNECTION_POOL_FLAGS_FAILOVER;
	1053	prelude_connection_pool_set_flags(pool, conn_flags);
	1054	#endif
	1055
[1]	1056	ret = prelude_client_start(client);
	1057	if ( ret < 0 ) {
	1058	prelude_perror(ret, _("error starting prelude client"));
	1059
	1060	if ( prelude_client_is_setup_needed(ret) )
	1061	prelude_client_print_setup_error(client);
	1062
	1063	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
	1064	_("Failed to start Prelude"), _("sh_prelude_init"));
	1065	initialized = -1;
	1066	return -1;
	1067	}
	1068
	1069	initialized = 1;
	1070	return 1;
	1071	}
	1072
	1073	/* HAVE_LIBPRELUDE_9 */
	1074	#endif
	1075

Note: See TracBrowser for help on using the repository browser.

Download in other formats: