source: trunk/src/sh_prelude.c@ 162

Last change on this file since 162 was 131, checked in by rainer, 17 years ago

Use thread-safe libc functions.

File size: 32.7 KB
Line 
1/*
2 *
3 * Copyright (C) 2005 Yoann Vandoorselaere, Prelude IDS Technologies
4 * Rainer Wichmann
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2, or (at your option)
9 * any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; see the file COPYING. If not, write to
18 * the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
19 *
20 */
21
22/*
23 * 28/04/2005 : R.W.:
24 * move libprelude 0.8 code to seperate file
25 *
26 * 23/04/2005 : R.W.:
27 * include libprelude 0.9 code from Yoann Vandoorselaere
28 */
29
30
31/*
32 * for strptime()
33 */
34#define _GNU_SOURCE 1
35
36#include "config_xor.h"
37
38#include <stdio.h>
39#include <string.h>
40#include <sys/types.h>
41
42#if TIME_WITH_SYS_TIME
43
44# include <sys/time.h>
45# include <time.h>
46
47#else
48
49# if HAVE_SYS_TIME_H
50# include <sys/time.h>
51# else
52# include <time.h>
53# endif
54
55#endif
56
57#include <unistd.h>
58#include <syslog.h>
59#include <pwd.h>
60
61int sh_argc_store;
62char ** sh_argv_store;
63
64#if defined(HAVE_LIBPRELUDE) && defined(HAVE_LIBPRELUDE_9)
65
66
67/*
68 * _() macros are samhain specific; they are used to replace string
69 * constants at runtime. This is part of the samhain stealth mode
70 * (fill string constants with encoded strings, decode at runtime).
71 */
72#define FIL__ _("sh_prelude.c")
73
74
75#include <libprelude/idmef.h>
76#include <libprelude/prelude.h>
77
78/*
79 * includes for samhain-specific functions (sl_strstr, sh_error_handle)
80 */
81#include "samhain.h"
82#include "sh_cat.h"
83#include "sh_error_min.h"
84#include "sh_prelude.h"
85#define SH_NEED_PWD_GRP 1
86#include "sh_static.h"
87
88/*
89 * When SH_USE_XML is set, value are formated using name="value".
90 * Otherwise, value is formatted using the format name=<value>.
91 */
92#ifdef SH_USE_XML
93# define VALUE_DELIM_START '"'
94# define VALUE_DELIM_END '"'
95#else
96# define VALUE_DELIM_START '<'
97# define VALUE_DELIM_END '>'
98#endif
99
100#define IDMEF_ANALYZER_MODEL _("Samhain")
101#define IDMEF_ANALYZER_CLASS _("Integrity Checker")
102#define IDMEF_ANALYZER_VERSION VERSION
103#define IDMEF_ANALYZER_MANUFACTURER _("http://www.la-samhna.de/samhain/")
104
105
106
107/*
108 * 0 = not initialized; -1 = failed; 1 = initialized
109 */
110static int initialized = 0;
111static int ready_for_init = 0;
112
113static char *profile = NULL;
114static prelude_client_t *client = NULL;
115
116static int severity_map[1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH] = {
117 /* 0: unused (?) */ 0,
118 /* 1: INFO */ 0,
119 /* 2: LOW */ SH_ERR_ALL|SH_ERR_INFO,
120 /* 3: MEDIUM */ SH_ERR_NOTICE|SH_ERR_WARN|SH_ERR_STAMP|SH_ERR_ERR,
121 /* 4: HIGH */ SH_ERR_SEVERE|SH_ERR_FATAL
122};
123
124/* returns 0/tiger, 1/sha1, or 2/md5
125 */
126extern int sh_tiger_get_hashtype(void);
127
128static void clear_and_set (int setpos, int flag)
129{
130 unsigned int i;
131 /* clear everywhere, and set at correct position */
132 for (i = 1; i < (1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH); ++i)
133 severity_map[i] &= ~flag;
134 severity_map[setpos] |= flag;
135 return;
136}
137
138static int set_prelude_severity_int (const char * str, int prelude_sev)
139{
140 char * p;
141 char * dup = strdup (str);
142#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
143 char * saveptr;
144#endif
145
146 if (!dup)
147 return -1;
148
149#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
150 p = strtok_r (dup, ", \t", &saveptr);
151#else
152 p = strtok (dup, ", \t");
153#endif
154 if (p) {
155 do {
156 if (0 == strcmp (p, _("alert")))
157 clear_and_set (prelude_sev, SH_ERR_FATAL);
158 else if (0 == strcmp (p, _("crit")))
159 clear_and_set (prelude_sev, SH_ERR_SEVERE);
160 else if (0 == strcmp (p, _("err")))
161 clear_and_set (prelude_sev, SH_ERR_ERR);
162 else if (0 == strcmp (p, _("mark")))
163 clear_and_set (prelude_sev, SH_ERR_STAMP);
164 else if (0 == strcmp (p, _("warn")))
165 clear_and_set (prelude_sev, SH_ERR_WARN);
166 else if (0 == strcmp (p, _("notice")))
167 clear_and_set (prelude_sev, SH_ERR_NOTICE);
168 else if (0 == strcmp (p, _("debug")))
169 clear_and_set (prelude_sev, SH_ERR_ALL);
170 else if (0 == strcmp (p, _("info")))
171 clear_and_set (prelude_sev, SH_ERR_INFO);
172 else {
173 free (dup);
174 return -1;
175 }
176#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
177 p = strtok_r (NULL, ", \t", &saveptr);
178#else
179 p = strtok (NULL, ", \t");
180#endif
181 } while (p);
182 }
183 free(dup);
184 return 0;
185}
186
187int sh_prelude_map_info (const char * str)
188{
189 return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_INFO));
190}
191int sh_prelude_map_low (const char * str)
192{
193 return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_LOW));
194}
195int sh_prelude_map_medium (const char * str)
196{
197 return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_MEDIUM));
198}
199int sh_prelude_map_high (const char * str)
200{
201 return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_HIGH));
202}
203
204static idmef_impact_severity_t map_severity (int sam_sev)
205{
206 int i;
207 int max = 1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH;
208 idmef_impact_severity_t retval = IDMEF_IMPACT_SEVERITY_MEDIUM;
209
210 for (i = 0; i < max; ++i) {
211 if (severity_map[i] & sam_sev) {
212 retval = (idmef_impact_severity_t) i;
213 }
214 }
215 return retval;
216}
217
218static char *do_get_value(char *ptr, char delim_start, char delim_end)
219{
220 char *ret = NULL;
221
222 ptr = strchr(ptr, delim_start);
223 if ( ! ptr )
224 return NULL;
225
226 ret = ++ptr;
227
228 ptr = strchr(ptr, delim_end);
229 if ( ! ptr )
230 return NULL;
231
232 *ptr = '\0';
233 ret = strdup(ret);
234 *ptr = delim_end;
235
236 return ret;
237}
238
239
240
241static char *get_value(char *msg, const char *toktmp, const char *toksuffix)
242{
243 char *ptr, tok[128];
244
245 snprintf(tok, sizeof(tok), "%s%s=", toktmp, (toksuffix) ? toksuffix : "");
246
247 ptr = strstr(msg, tok);
248 if ( ! ptr )
249 return NULL;
250
251 return do_get_value(ptr, VALUE_DELIM_START, VALUE_DELIM_END);
252}
253
254
255
256static char *get_time_value(char *msg, const char *toktmp, const char *toksuffix)
257{
258
259 char *ret, *ptr, tok[128];
260
261 snprintf(tok, sizeof(tok), "%s%s=", toktmp, (toksuffix) ? toksuffix : "");
262
263 ptr = strstr(msg, tok);
264 if ( ! ptr )
265 return NULL;
266
267#ifndef SH_USE_XML
268 ret = do_get_value(ptr, '[', ']');
269#else
270 ret = do_get_value(ptr, VALUE_DELIM_START, VALUE_DELIM_END);
271#endif
272
273 return ret;
274}
275
276
277
278
279#if 0
280void debug_print_message(idmef_message_t *msg)
281{
282 int ret;
283 prelude_io_t *fd;
284
285 ret = prelude_io_new(&fd);
286 if ( ret < 0 )
287 return;
288
289 prelude_io_set_file_io(fd, stderr);
290 idmef_message_print(idmef, fd);
291
292 prelude_io_destroy(fd);
293}
294#endif
295
296
297
298static int idmef_time_from_samhain(idmef_time_t **time, const char *str)
299{
300 int ret;
301 char *ptr;
302 time_t utc;
303 struct tm lt;
304
305 /*
306 * Samhain stamp are encoded in UTC.
307 */
308 ptr = strptime(str, _("%Y-%m-%dT%H:%M:%S"), &lt);
309 if ( ! ptr ) {
310 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
311 _("could not format Samhain time"), _("idmef_time_from_samhain"));
312 return -1;
313 }
314
315 utc = prelude_timegm(&lt);
316
317 ret = idmef_time_new_from_time(time, &utc);
318 if ( ret < 0 )
319 return ret;
320
321 return 0;
322}
323
324/* flawfinder: ignore *//* is part of name, not access() */
325static void get_access_info(idmef_file_access_t *access, char * mode, int pos, int mpos)
326{
327 int got = 0;
328 int ret;
329 prelude_string_t *str;
330
331 do {
332 if ( mode[pos] == 'r' ) {
333 /* flawfinder: ignore *//* is part of name, not access() */
334 ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
335 if ( ret < 0 )
336 return;
337 prelude_string_set_dup(str, _("read"));
338 ++got;
339 }
340 else if ( mode[pos] == 'w' ) {
341 /* flawfinder: ignore *//* is part of name, not access() */
342 ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
343 if ( ret < 0 )
344 return;
345 prelude_string_set_dup(str, _("write"));
346 ++got;
347 }
348 else if ( mode[pos] == 'x' || mode[pos] == 's' || mode[pos] == 't') {
349 /* flawfinder: ignore *//* is part of name, not access() */
350 ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
351 if ( ret < 0 )
352 return;
353
354 if ( mode[pos] == 'x' && mode[0] == 'd' )
355 prelude_string_set_dup(str, _("search"));
356
357 else if ( mode[pos] == 'x' || mode[pos] == 't' )
358 prelude_string_set_dup(str, _("execute"));
359
360 else /* 's' */
361 prelude_string_set_dup(str, _("executeAs"));
362 ++got;
363 }
364 ++pos;
365 } while (pos <= mpos);
366
367 if ( got == 0 ) {
368 /* flawfinder: ignore *//* is part of name, not access() */
369 ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
370 if ( ret < 0 )
371 return;
372 prelude_string_set_dup(str, _("noAccess"));
373 }
374 return;
375}
376
377
378static void get_file_infos(idmef_target_t *target, char *msg,
379 idmef_file_category_t category)
380{
381 int ret;
382 int hashtype = 0;
383 char *ptr;
384 idmef_time_t *time;
385 idmef_file_t *file;
386 idmef_inode_t *inode;
387 prelude_string_t *str;
388 idmef_checksum_t *checksum;
389 idmef_file_access_t *access; /* flawfinder: ignore */
390 idmef_user_id_t *userid;
391 const char *suffix = (category == IDMEF_FILE_CATEGORY_CURRENT) ? "_new" : "_old";
392 char *mode = NULL;
393
394 ret = idmef_target_new_file(target, &file, IDMEF_LIST_APPEND);
395 if ( ret < 0 )
396 return;
397 idmef_file_set_category(file, category);
398
399 ptr = get_value(msg, _("path"), NULL);
400 if ( ptr ) {
401 /*
402 * In term of IDMEF, this is the full path,
403 * including the name.
404 */
405 ret = idmef_file_new_path(file, &str);
406 if ( ret < 0 ) {
407 free(ptr);
408 return;
409 }
410 prelude_string_set_nodup(str, ptr);
411
412 ptr = strrchr(ptr, '/');
413 if ( ptr ) {
414 ret = idmef_file_new_name(file, &str);
415 if ( ret == 0 ) {
416 prelude_string_set_dup(str, ptr + 1);
417 }
418 }
419 }
420
421 ptr = get_value(msg, _("size"), suffix);
422 if ( ptr ) {
423 idmef_file_set_data_size(file, strtoul(ptr, NULL, 10));
424 free(ptr);
425 }
426
427 ptr = get_time_value(msg, _("mtime"), suffix);
428 if ( ptr ) {
429 ret = idmef_time_from_samhain(&time, ptr);
430 if ( ret == 0 ) {
431 idmef_file_set_modify_time(file, time);
432 }
433 free(ptr);
434 }
435
436 ptr = get_time_value(msg, _("ctime"), suffix);
437 if ( ptr ) {
438 ret = idmef_time_from_samhain(&time, ptr);
439 if ( ret == 0 ) {
440 idmef_file_set_create_time(file, time);
441 }
442 free(ptr);
443 }
444
445 ptr = get_value(msg, _("inode"), suffix);
446 if ( ptr ) {
447 ret = idmef_file_new_inode(file, &inode);
448 if ( ret == 0 ) {
449 char * dev = get_value(msg, _("dev"), suffix);
450 if (dev) {
451 char * q = strchr(dev, ',');
452 if (*q) {
453 *q = '\0'; ++q;
454 idmef_inode_set_major_device(inode, strtoul(dev, NULL, 0));
455 idmef_inode_set_minor_device(inode, strtoul( q, NULL, 0));
456 }
457 free(dev);
458 }
459 idmef_inode_set_number(inode, strtoul(ptr, NULL, 10));
460 }
461 free(ptr);
462 }
463
464 ptr = get_value(msg, _("chksum"), suffix);
465 if ( ptr ) {
466 ret = idmef_file_new_checksum(file, &checksum, IDMEF_LIST_APPEND);
467 if ( ret < 0 ) {
468 free(ptr);
469 goto get_mode;
470 }
471
472 hashtype = sh_tiger_get_hashtype();
473
474 if (hashtype == 0)
475 idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
476
477 else if (hashtype == 1)
478 idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_SHA1);
479
480 else if (hashtype == 2)
481 idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_MD5);
482
483 else
484 idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
485
486
487 ret = idmef_checksum_new_value(checksum, &str);
488 if ( ret < 0 ) {
489 free(ptr);
490 goto get_mode;
491 }
492
493 /* will be freed on destroy()
494 */
495 prelude_string_set_nodup(str, ptr);
496 }
497
498 get_mode:
499
500 mode = get_value(msg, _("mode"), suffix);
501 if ( mode ) {
502 /* flawfinder: ignore *//* is part of name, not access() */
503 ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
504 if ( ret < 0 )
505 goto get_owner;
506
507 /* flawfinder: ignore *//* is part of name, not access() */
508 ret = idmef_file_access_new_user_id(access, &userid);
509 if ( ret < 0 )
510 goto get_owner;
511 idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_OTHER_PRIVS);
512
513 /* flawfinder: ignore *//* is part of name, not access() */
514 get_access_info ( access, mode, 7, 9 );
515 }
516
517 get_owner:
518
519 ptr = get_value(msg, _("owner"), suffix);
520 if ( ptr ) {
521 char * uid;
522
523 /* flawfinder: ignore *//* is part of name, not access() */
524 ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
525 if ( ret < 0 ) {
526 free(ptr);
527 goto get_group;
528 }
529
530 /* flawfinder: ignore *//* is part of name, not access() */
531 ret = idmef_file_access_new_user_id(access, &userid);
532 if ( ret < 0 ) {
533 free(ptr);
534 goto get_group;
535 }
536 idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_USER_PRIVS);
537
538 ret = idmef_user_id_new_name(userid, &str);
539 if ( ret < 0 ) {
540 free(ptr);
541 goto get_group;
542 }
543 prelude_string_set_nodup(str, ptr);
544
545 uid = get_value(msg, _("iowner"), suffix);
546 if ( ! uid )
547 goto get_group;
548
549 idmef_user_id_set_number(userid, strtoul(uid, NULL, 0));
550
551 if ( mode ) {
552 /* flawfinder: ignore *//* is part of name, not access() */
553 get_access_info ( access, mode, 1, 3 );
554 }
555
556 free(uid);
557 }
558
559 get_group:
560
561 ptr = get_value(msg, _("group"), suffix);
562 if ( ptr ) {
563 char *gid;
564
565 /* flawfinder: ignore *//* is part of name, not access() */
566 ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
567 if ( ret < 0 ) {
568 free(ptr);
569 goto mode_free;
570 }
571
572 ret = idmef_file_access_new_user_id(access, &userid);/* flawfinder: ignore *//* is part of name, not access() */
573 if ( ret < 0 ) {
574 free(ptr);
575 goto mode_free;
576 }
577
578 idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_GROUP_PRIVS);
579
580 ret = idmef_user_id_new_name(userid, &str);
581 if ( ret < 0 ) {
582 free(ptr);
583 goto mode_free;
584 }
585
586 prelude_string_set_nodup(str, ptr);
587
588 gid = get_value(msg, _("igroup"), suffix);
589 if ( ! gid )
590 goto mode_free;
591
592 idmef_user_id_set_number(userid, strtoul(gid, NULL, 0));
593
594 if ( mode ) {
595 get_access_info ( access, mode, 4, 6 ); /* flawfinder: ignore */
596 }
597
598 free(gid);
599 }
600
601 mode_free:
602
603 if ( mode ) {
604 free ( mode );
605 }
606
607 return;
608}
609
610
611
612static int map_policy_to_class(char *msg, unsigned long msgid, idmef_impact_t *impact, prelude_string_t *out)
613{
614 char *ptr;
615 int ret, i;
616 struct tbl {
617 unsigned int msgid;
618 const char *name;
619 idmef_impact_type_t type;
620 } tbl[] = {
621
622#ifdef SH_USE_UTMP
623 { MSG_UT_LG1X, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
624 { MSG_UT_LG1A, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
625 { MSG_UT_LG1B, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
626 { MSG_UT_LG2X, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
627 { MSG_UT_LG2A, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
628 { MSG_UT_LG2B, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
629 { MSG_UT_LG3X, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
630 { MSG_UT_LG3A, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
631 { MSG_UT_LG3B, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
632 { MSG_UT_LG3C, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
633#endif
634
635#if defined(SH_WITH_CLIENT) || defined(SH_STANDALONE)
636 { MSG_FI_MISS, N_("File Missing"), IDMEF_IMPACT_TYPE_FILE },
637 { MSG_FI_MISS2, N_("File Missing"), IDMEF_IMPACT_TYPE_FILE },
638 { MSG_FI_ADD, N_("File Added"), IDMEF_IMPACT_TYPE_FILE },
639 { MSG_FI_ADD2, N_("File Added"), IDMEF_IMPACT_TYPE_FILE },
640 { MSG_FI_CHAN, N_("File Modified"), IDMEF_IMPACT_TYPE_FILE },
641 { MSG_FI_NODIR, N_("File found where directory was expected"), IDMEF_IMPACT_TYPE_FILE },
642#endif
643
644#ifdef SH_USE_KERN
645 { MSG_KERN_POLICY, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
646 { MSG_KERN_POL_CO, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
647 { MSG_KERN_PROC, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
648 { MSG_KERN_GATE, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
649 { MSG_KERN_IDT, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
650 { MSG_KERN_SYSCALL, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
651#endif
652
653#ifdef SH_USE_SUIDCHK
654 { MSG_SUID_POLICY, N_("SUID/SGID File Detected"), IDMEF_IMPACT_TYPE_FILE },
655#endif
656 /*
657 * This must be the last table entry
658 */
659 { 0, NULL, IDMEF_IMPACT_TYPE_OTHER },
660 };
661
662 for ( i = 0; tbl[i].name != NULL; i++ ) {
663 if ( tbl[i].msgid != msgid )
664 continue;
665
666 idmef_impact_set_type(impact, tbl[i].type);
667 return prelude_string_cat(out, _(tbl[i].name));
668 }
669
670 /* some other message
671 */
672 ptr = get_value(msg, _("msg"), NULL);
673 if ( ! ptr ) {
674 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
675 _("could not format Samhain message"), _("map_policy_to_class"));
676 return -1;
677 }
678
679 ret = prelude_string_cat(out, ptr);
680 free(ptr);
681
682 return ret;
683}
684
685
686
687static int get_login_info(char *msg, idmef_alert_t *alert)
688{
689 int ret;
690 char *ptr, *ip;
691 idmef_user_t *user;
692 idmef_node_t *node;
693 struct passwd *pw;
694#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
695 struct passwd pwd;
696 char buffer[SH_PWBUF_SIZE];
697#endif
698 prelude_string_t *str;
699 idmef_user_id_t *user_id;
700 idmef_address_t *address;
701 idmef_target_t *target = idmef_alert_get_next_target(alert, NULL);
702 idmef_source_t *source = idmef_alert_get_next_source(alert, NULL);
703
704 ip = ptr = get_value(msg, _("ip"), NULL);
705 if ( ptr ) {
706 if ( ! source ) {
707 ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
708 if ( ret < 0 ) {
709 free(ptr);
710 return ret;
711 }
712 }
713
714 ret = idmef_source_new_node(source, &node);
715 if ( ret < 0 ) {
716 free(ptr);
717 return ret;
718 }
719
720 ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
721 if ( ret < 0 ) {
722 free(ptr);
723 return ret;
724 }
725
726 ret = idmef_address_new_address(address, &str);
727 if ( ret < 0 ) {
728 free(ptr);
729 return ret;
730 }
731
732 prelude_string_set_nodup(str, ptr);
733 }
734
735 ptr = get_value(msg, _("host"), NULL);
736 if ( ptr ) {
737 if ( ip && strcmp(ptr, ip) == 0 )
738 free(ptr);
739 else {
740 if ( ! source ) {
741 ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
742 if ( ret < 0 ) {
743 free(ptr);
744 return ret;
745 }
746 }
747
748 ret = idmef_source_new_node(source, &node);
749 if ( ret < 0 ) {
750 free(ptr);
751 return ret;
752 }
753
754 ret = idmef_node_new_name(node, &str);
755 if ( ret < 0 ) {
756 free(ptr);
757 return ret;
758 }
759
760 prelude_string_set_nodup(str, ptr);
761 }
762 }
763
764 ptr = get_value(msg, _("name"), NULL);
765 if ( ptr ) {
766 ret = idmef_target_new_user(target, &user);
767 if ( ret < 0 ) {
768 free(ptr);
769 return ret;
770 }
771
772 idmef_user_set_category(user, IDMEF_USER_CATEGORY_OS_DEVICE);
773
774 ret = idmef_user_new_user_id(user, &user_id, IDMEF_LIST_APPEND);
775 if ( ret < 0 ) {
776 free(ptr);
777 return ret;
778 }
779
780 idmef_user_id_set_type(user_id, IDMEF_USER_ID_TYPE_TARGET_USER);
781
782#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
783 sh_getpwnam_r(ptr, &pwd, buffer, sizeof(buffer), &pw);
784#else
785 pw = sh_getpwnam(ptr);
786#endif
787 if ( pw )
788 idmef_user_id_set_number(user_id, pw->pw_uid);
789
790 ret = idmef_user_id_new_name(user_id, &str);
791 if ( ret < 0 ) {
792 free(ptr);
793 return ret;
794 }
795 prelude_string_set_nodup(str, ptr);
796
797 ptr = get_value(msg, _("tty"), NULL);
798 if ( ptr ) {
799 ret = idmef_user_id_new_tty(user_id, &str);
800 if ( ret < 0 ) {
801 free(ptr);
802 return ret;
803 }
804
805 prelude_string_set_nodup(str, ptr);
806 }
807 }
808
809 ptr = get_time_value(msg, _("time"), NULL);
810 if ( ptr ) {
811 idmef_time_t *time;
812
813 ret = idmef_time_from_samhain(&time, ptr);
814 free(ptr);
815
816 if ( ret < 0 )
817 return ret;
818
819 idmef_alert_set_detect_time(alert, time);
820 }
821
822 return 0;
823}
824
825
826static int samhain_alert_prelude(int priority, int sh_class,
827 char *message, unsigned long msgid)
828{
829 int ret;
830 idmef_time_t *time;
831 idmef_alert_t *alert;
832 idmef_message_t *idmef;
833 idmef_classification_t *classification;
834 idmef_assessment_t *assessment;
835 idmef_additional_data_t *data;
836 idmef_impact_t *impact;
837 idmef_target_t *target;
838 idmef_confidence_t *confidence;
839 prelude_string_t *str;
840
841 if ( !client || sh_class == STAMP)
842 return 0;
843
844 ret = idmef_message_new(&idmef);
845 if ( ret < 0 )
846 goto err;
847
848 ret = idmef_message_new_alert(idmef, &alert);
849 if ( ret < 0 )
850 goto err;
851
852 idmef_alert_set_analyzer(alert, idmef_analyzer_ref(prelude_client_get_analyzer(client)), IDMEF_LIST_PREPEND);
853
854 ret = idmef_time_new_from_gettimeofday(&time);
855 if ( ret < 0 )
856 goto err;
857 idmef_alert_set_detect_time(alert, time);
858
859 ret = idmef_time_new_from_gettimeofday(&time);
860 if ( ret < 0 )
861 goto err;
862 idmef_alert_set_create_time(alert, time);
863
864 ret = idmef_alert_new_classification(alert, &classification);
865 if ( ret < 0 )
866 goto err;
867
868 ret = idmef_alert_new_target(alert, &target, IDMEF_LIST_APPEND);
869 if ( ret < 0 )
870 goto err;
871
872 idmef_target_set_decoy(target, IDMEF_TARGET_DECOY_NO);
873
874 if ( idmef_analyzer_get_node(prelude_client_get_analyzer(client)) ) {
875 idmef_node_ref(idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
876 idmef_target_set_node(target, idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
877 }
878
879 if ( strstr(message, _("path=")) ) {
880#if defined(SH_WITH_CLIENT) || defined(SH_STANDALONE)
881 if ( msgid != MSG_FI_ADD && msgid != MSG_FI_ADD2 )
882 get_file_infos(target, message, IDMEF_FILE_CATEGORY_ORIGINAL);
883#endif
884
885 get_file_infos(target, message, IDMEF_FILE_CATEGORY_CURRENT);
886 }
887
888 ret = idmef_alert_new_assessment(alert, &assessment);
889 if ( ret < 0 )
890 goto err;
891
892 ret = idmef_assessment_new_impact(assessment, &impact);
893 if ( ret < 0 )
894 goto err;
895
896 ret = idmef_classification_new_text(classification, &str);
897 if ( ret < 0 )
898 goto err;
899
900 ret = get_login_info(message, alert);
901 if ( ret < 0 )
902 goto err;
903
904 map_policy_to_class(message, msgid, impact, str);
905
906#if 0
907 if ( priority == SH_ERR_SEVERE || priority == SH_ERR_FATAL )
908 idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_HIGH);
909
910 else if ( priority == SH_ERR_ALL || priority == SH_ERR_INFO || priority == SH_ERR_NOTICE )
911 idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_LOW);
912
913 else
914 idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_MEDIUM);
915#endif
916 idmef_impact_set_severity(impact, map_severity(priority));
917
918 idmef_impact_set_completion(impact, IDMEF_IMPACT_COMPLETION_SUCCEEDED);
919
920 ret = idmef_assessment_new_confidence(assessment, &confidence);
921 if ( ret < 0 )
922 goto err;
923
924 idmef_confidence_set_rating(confidence, IDMEF_CONFIDENCE_RATING_HIGH);
925
926 ret = idmef_alert_new_additional_data(alert, &data, IDMEF_LIST_APPEND);
927 if ( ret < 0 )
928 goto err;
929
930 ret = idmef_additional_data_new_meaning(data, &str);
931 if ( ret < 0 )
932 goto err;
933
934 prelude_string_set_dup(str, _("Message generated by Samhain"));
935 idmef_additional_data_set_type(data, IDMEF_ADDITIONAL_DATA_TYPE_STRING);
936 idmef_additional_data_set_string_ref(data, message);
937
938 /* debug_print_message(idmef); */
939
940 prelude_client_send_idmef(client, idmef);
941 idmef_message_destroy(idmef);
942
943 return 0;
944
945 err:
946 idmef_message_destroy(idmef);
947 return -1;
948}
949
950
951int sh_prelude_alert(int priority, int sh_class, char *message, long msgflags, unsigned long msgid)
952{
953 int ret;
954
955 (void) msgflags; /* fix compiler warning */
956
957 if ( initialized < 1 )
958 return -1;
959
960 ret = samhain_alert_prelude(priority, sh_class, message, msgid);
961 if ( ret < 0 ) {
962 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
963 _("Problem with IDMEF for prelude-ids support: alert lost"),
964 _("sh_prelude_alert"));
965 }
966
967 return ret;
968}
969
970
971
972int sh_prelude_set_profile(const char *arg)
973{
974 if ( profile ) {
975 free(profile);
976 profile = NULL;
977 }
978
979 if ( arg ) {
980 profile = strdup(arg);
981 if ( ! profile )
982 return -1;
983 }
984
985 return 0;
986}
987
988/* Allow initialization of prelude; to be called
989 * after forking the daemon. Delays heartbeat
990 * start after config read until it is safe.
991 */
992void sh_prelude_reset(void)
993{
994 extern void sh_error_init_prelude();
995
996 ready_for_init = 1;
997 sh_error_init_prelude();
998 return;
999}
1000
1001
1002
1003void sh_prelude_stop(void)
1004{
1005 if (initialized < 1)
1006 return;
1007
1008 if (sh.flag.isdaemon == S_TRUE)
1009 prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_FAILURE);
1010 else
1011 prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
1012
1013 client = NULL;
1014
1015 prelude_deinit();
1016
1017 initialized = 0;
1018 return;
1019}
1020
1021
1022
1023int sh_prelude_init(void)
1024{
1025 int ret;
1026 prelude_string_t *str;
1027 idmef_analyzer_t *analyzer;
1028 prelude_client_flags_t flags;
1029#ifdef SH_NOFAILOVER
1030 prelude_connection_pool_t *pool;
1031 prelude_connection_pool_flags_t conn_flags;
1032#endif
1033
1034 if (ready_for_init == 0)
1035 return initialized;
1036
1037 if (initialized > 0)
1038 return initialized;
1039
1040 prelude_thread_init(NULL);
1041 prelude_init(&sh_argc_store, sh_argv_store);
1042
1043 ret = prelude_client_new(&client, profile ? profile : _("samhain"));
1044 if ( ret < 0 ) {
1045 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
1046 _("Failed to initialize Prelude"), _("sh_prelude_init"));
1047 initialized = -1;
1048 return -1;
1049 }
1050
1051 /*
1052 * Enable automatic heartbeat sending.
1053 */
1054 flags = prelude_client_get_flags(client);
1055 ret = prelude_client_set_flags(client, flags | PRELUDE_CLIENT_FLAGS_ASYNC_TIMER);
1056
1057 analyzer = prelude_client_get_analyzer(client);
1058
1059 ret = idmef_analyzer_new_model(analyzer, &str);
1060 prelude_string_set_dup(str, IDMEF_ANALYZER_MODEL);
1061
1062 ret = idmef_analyzer_new_class(analyzer, &str);
1063 prelude_string_set_dup(str, IDMEF_ANALYZER_CLASS);
1064
1065 ret = idmef_analyzer_new_version(analyzer, &str);
1066 prelude_string_set_dup(str, IDMEF_ANALYZER_VERSION);
1067
1068#ifdef SH_NOFAILOVER
1069 pool = prelude_client_get_connection_pool(client);
1070 conn_flags = prelude_connection_pool_get_flags(pool);
1071
1072 conn_flags &= ~PRELUDE_CONNECTION_POOL_FLAGS_FAILOVER;
1073 prelude_connection_pool_set_flags(pool, conn_flags);
1074#endif
1075
1076 ret = prelude_client_start(client);
1077 if ( ret < 0 ) {
1078 prelude_perror(ret, _("error starting prelude client"));
1079
1080 if ( prelude_client_is_setup_needed(ret) )
1081 prelude_client_print_setup_error(client);
1082
1083 sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
1084 _("Failed to start Prelude"), _("sh_prelude_init"));
1085 initialized = -1;
1086 return -1;
1087 }
1088
1089 initialized = 1;
1090 return 1;
1091}
1092
1093/* HAVE_LIBPRELUDE_9 */
1094#endif
1095
Note: See TracBrowser for help on using the repository browser.