Context Navigation

source: trunk/src/sh_prelude.c@ 173

Last change on this file since 173 was 170, checked in by katerina, 17 years ago
Plenty of compiler warnings fixed, SQL query length fixed, doc update.
File size: 37.9 KB

Line
1	/*
2	*
3	* Copyright (C) 2005 Yoann Vandoorselaere, Prelude IDS Technologies
4	* Rainer Wichmann
5	*
6	* This program is free software; you can redistribute it and/or modify
7	* it under the terms of the GNU General Public License as published by
8	* the Free Software Foundation; either version 2, or (at your option)
9	* any later version.
10	*
11	* This program is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14	* GNU General Public License for more details.
15	*
16	* You should have received a copy of the GNU General Public License
17	* along with this program; see the file COPYING. If not, write to
18	* the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
19	*
20	*/
21
22	/*
23	* 28/04/2005 : R.W.:
24	* move libprelude 0.8 code to seperate file
25	*
26	* 23/04/2005 : R.W.:
27	* include libprelude 0.9 code from Yoann Vandoorselaere
28	*/
29
30
31	/*
32	* for strptime()
33	*/
34	#define _GNU_SOURCE 1
35
36	#include "config_xor.h"
37
38	#include <stdio.h>
39	#include <string.h>
40	#include <sys/types.h>
41
42	#if TIME_WITH_SYS_TIME
43
44	# include <sys/time.h>
45	# include <time.h>
46
47	#else
48
49	# if HAVE_SYS_TIME_H
50	# include <sys/time.h>
51	# else
52	# include <time.h>
53	# endif
54
55	#endif
56
57	#include <unistd.h>
58	#include <syslog.h>
59	#include <pwd.h>
60
61	int sh_argc_store;
62	char ** sh_argv_store;
63
64	#if defined(HAVE_LIBPRELUDE) && defined(HAVE_LIBPRELUDE_9)
65
66
67	/*
68	* _() macros are samhain specific; they are used to replace string
69	* constants at runtime. This is part of the samhain stealth mode
70	* (fill string constants with encoded strings, decode at runtime).
71	*/
72	#define FIL__ _("sh_prelude.c")
73
74
75	#include <libprelude/idmef.h>
76	#include <libprelude/prelude.h>
77
78	/*
79	* includes for samhain-specific functions (sl_strstr, sh_error_handle)
80	*/
81	#include "samhain.h"
82	#include "sh_cat.h"
83	#include "sh_error_min.h"
84	#include "sh_prelude.h"
85	#define SH_NEED_PWD_GRP 1
86	#include "sh_static.h"
87	char * sh_util_strdup (const char * str) SH_GNUC_MALLOC;
88	/*
89	* When SH_USE_XML is set, value are formated using name="value".
90	* Otherwise, value is formatted using the format name=<value>.
91	*/
92	#ifdef SH_USE_XML
93	# define VALUE_DELIM_START '"'
94	# define VALUE_DELIM_END '"'
95	#else
96	# define VALUE_DELIM_START '<'
97	# define VALUE_DELIM_END '>'
98	#endif
99
100	#define IDMEF_ANALYZER_MODEL _("Samhain")
101	#define IDMEF_ANALYZER_CLASS _("Integrity Checker")
102	#define IDMEF_ANALYZER_VERSION VERSION
103	#define IDMEF_ANALYZER_MANUFACTURER _("http://www.la-samhna.de/samhain/")
104
105
106
107	/*
108	* 0 = not initialized; -1 = failed; 1 = initialized
109	*/
110	static int initialized = 0;
111	static int ready_for_init = 0;
112
113	static char *profile = NULL;
114	static prelude_client_t *client = NULL;
115
116	static int severity_map[1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH] = {
117	/* 0: unused (?) */ 0,
118	/* 1: INFO */ 0,
119	/* 2: LOW */ SH_ERR_ALL\|SH_ERR_INFO,
120	/* 3: MEDIUM */ SH_ERR_NOTICE\|SH_ERR_WARN\|SH_ERR_STAMP\|SH_ERR_ERR,
121	/* 4: HIGH */ SH_ERR_SEVERE\|SH_ERR_FATAL
122	};
123
124	/* returns 0/tiger, 1/sha1, or 2/md5
125	*/
126	extern int sh_tiger_get_hashtype(void);
127
128	static void clear_and_set (int setpos, int flag)
129	{
130	unsigned int i;
131	/* clear everywhere, and set at correct position */
132	for (i = 1; i < (1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH); ++i)
133	severity_map[i] &= ~flag;
134	severity_map[setpos] \|= flag;
135	return;
136	}
137
138	static int set_prelude_severity_int (const char * str, int prelude_sev)
139	{
140	char * p;
141	char * dup = strdup (str);
142	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
143	char * saveptr;
144	#endif
145
146	if (!dup)
147	return -1;
148
149	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
150	p = strtok_r (dup, ", \t", &saveptr);
151	#else
152	p = strtok (dup, ", \t");
153	#endif
154	if (p) {
155	do {
156	if (0 == strcmp (p, _("alert")))
157	clear_and_set (prelude_sev, SH_ERR_FATAL);
158	else if (0 == strcmp (p, _("crit")))
159	clear_and_set (prelude_sev, SH_ERR_SEVERE);
160	else if (0 == strcmp (p, _("err")))
161	clear_and_set (prelude_sev, SH_ERR_ERR);
162	else if (0 == strcmp (p, _("mark")))
163	clear_and_set (prelude_sev, SH_ERR_STAMP);
164	else if (0 == strcmp (p, _("warn")))
165	clear_and_set (prelude_sev, SH_ERR_WARN);
166	else if (0 == strcmp (p, _("notice")))
167	clear_and_set (prelude_sev, SH_ERR_NOTICE);
168	else if (0 == strcmp (p, _("debug")))
169	clear_and_set (prelude_sev, SH_ERR_ALL);
170	else if (0 == strcmp (p, _("info")))
171	clear_and_set (prelude_sev, SH_ERR_INFO);
172	else {
173	free (dup);
174	return -1;
175	}
176	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
177	p = strtok_r (NULL, ", \t", &saveptr);
178	#else
179	p = strtok (NULL, ", \t");
180	#endif
181	} while (p);
182	}
183	free(dup);
184	return 0;
185	}
186
187	int sh_prelude_map_info (const char * str)
188	{
189	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_INFO));
190	}
191	int sh_prelude_map_low (const char * str)
192	{
193	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_LOW));
194	}
195	int sh_prelude_map_medium (const char * str)
196	{
197	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_MEDIUM));
198	}
199	int sh_prelude_map_high (const char * str)
200	{
201	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_HIGH));
202	}
203
204	static idmef_impact_severity_t map_severity (int sam_sev)
205	{
206	int i;
207	int max = 1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH;
208	idmef_impact_severity_t retval = IDMEF_IMPACT_SEVERITY_MEDIUM;
209
210	for (i = 0; i < max; ++i) {
211	if (severity_map[i] & sam_sev) {
212	retval = (idmef_impact_severity_t) i;
213	}
214	}
215	return retval;
216	}
217
218	static char do_get_value(char ptr, char delim_start, char delim_end)
219	{
220	char *ret = NULL;
221
222	ptr = strchr(ptr, delim_start);
223	if ( ! ptr )
224	return NULL;
225
226	ret = ++ptr;
227
228	ptr = strchr(ptr, delim_end);
229	if ( ! ptr )
230	return NULL;
231
232	*ptr = '\0';
233	ret = strdup(ret);
234	*ptr = delim_end;
235
236	return ret;
237	}
238
239
240
241	static char get_value(char msg, const char toktmp, const char toksuffix)
242	{
243	char *ptr, tok[128];
244
245	snprintf(tok, sizeof(tok), "%s%s=", toktmp, (toksuffix) ? toksuffix : "");
246
247	ptr = strstr(msg, tok);
248	if ( ! ptr )
249	return NULL;
250
251	return do_get_value(ptr, VALUE_DELIM_START, VALUE_DELIM_END);
252	}
253
254
255
256	static char get_time_value(char msg, const char toktmp, const char toksuffix)
257	{
258
259	char ret, ptr, tok[128];
260
261	snprintf(tok, sizeof(tok), "%s%s=", toktmp, (toksuffix) ? toksuffix : "");
262
263	ptr = strstr(msg, tok);
264	if ( ! ptr )
265	return NULL;
266
267	#ifndef SH_USE_XML
268	ret = do_get_value(ptr, '[', ']');
269	#else
270	ret = do_get_value(ptr, VALUE_DELIM_START, VALUE_DELIM_END);
271	#endif
272
273	return ret;
274	}
275
276
277
278
279	#if 0
280	void debug_print_message(idmef_message_t *msg)
281	{
282	int ret;
283	prelude_io_t *fd;
284
285	ret = prelude_io_new(&fd);
286	if ( ret < 0 )
287	return;
288
289	prelude_io_set_file_io(fd, stderr);
290	idmef_message_print(idmef, fd);
291
292	prelude_io_destroy(fd);
293	}
294	#endif
295
296
297
298	static int idmef_time_from_samhain(idmef_time_t *time, const char str)
299	{
300	int ret;
301	char *ptr;
302	time_t utc;
303	struct tm lt;
304
305	/*
306	* Samhain stamp are encoded in UTC.
307	*/
308	ptr = strptime(str, _("%Y-%m-%dT%H:%M:%S"), &lt);
309	if ( ! ptr ) {
310	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
311	_("could not format Samhain time"), _("idmef_time_from_samhain"));
312	return -1;
313	}
314
315	utc = prelude_timegm(&lt);
316
317	ret = idmef_time_new_from_time(time, &utc);
318	if ( ret < 0 )
319	return ret;
320
321	return 0;
322	}
323
324	/* flawfinder: ignore // is part of name, not access() */
325	static void get_access_info(idmef_file_access_t access, char mode, int pos, int mpos)
326	{
327	int got = 0;
328	int ret;
329	prelude_string_t *str;
330
331	do {
332	if ( mode[pos] == 'r' ) {
333	/* flawfinder: ignore // is part of name, not access() */
334	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
335	if ( ret < 0 )
336	return;
337	prelude_string_set_dup(str, _("read"));
338	++got;
339	}
340	else if ( mode[pos] == 'w' ) {
341	/* flawfinder: ignore // is part of name, not access() */
342	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
343	if ( ret < 0 )
344	return;
345	prelude_string_set_dup(str, _("write"));
346	++got;
347	}
348	else if ( mode[pos] == 'x' \|\| mode[pos] == 's' \|\| mode[pos] == 't') {
349	/* flawfinder: ignore // is part of name, not access() */
350	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
351	if ( ret < 0 )
352	return;
353
354	if ( mode[pos] == 'x' && mode[0] == 'd' )
355	prelude_string_set_dup(str, _("search"));
356
357	else if ( mode[pos] == 'x' \|\| mode[pos] == 't' )
358	prelude_string_set_dup(str, _("execute"));
359
360	else /* 's' */
361	prelude_string_set_dup(str, _("executeAs"));
362	++got;
363	}
364	++pos;
365	} while (pos <= mpos);
366
367	if ( got == 0 ) {
368	/* flawfinder: ignore // is part of name, not access() */
369	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
370	if ( ret < 0 )
371	return;
372	prelude_string_set_dup(str, _("noAccess"));
373	}
374	return;
375	}
376
377
378	static void get_file_infos(idmef_target_t target, char msg,
379	idmef_file_category_t category)
380	{
381	int ret;
382	int hashtype = 0;
383	char *ptr;
384	idmef_time_t *time;
385	idmef_file_t *file;
386	idmef_inode_t *inode;
387	prelude_string_t *str;
388	idmef_checksum_t *checksum;
389	idmef_file_access_t access; / flawfinder: ignore */
390	idmef_user_id_t *userid;
391	const char *suffix = (category == IDMEF_FILE_CATEGORY_CURRENT) ? "_new" : "_old";
392	char *mode = NULL;
393
394	ret = idmef_target_new_file(target, &file, IDMEF_LIST_APPEND);
395	if ( ret < 0 )
396	return;
397	idmef_file_set_category(file, category);
398
399	ptr = get_value(msg, _("path"), NULL);
400	if ( ptr ) {
401	/*
402	* In term of IDMEF, this is the full path,
403	* including the name.
404	*/
405	ret = idmef_file_new_path(file, &str);
406	if ( ret < 0 ) {
407	free(ptr);
408	return;
409	}
410	prelude_string_set_nodup(str, ptr);
411
412	ptr = strrchr(ptr, '/');
413	if ( ptr ) {
414	ret = idmef_file_new_name(file, &str);
415	if ( ret == 0 ) {
416	prelude_string_set_dup(str, ptr + 1);
417	}
418	}
419	}
420
421	ptr = get_value(msg, _("size"), suffix);
422	if ( ptr ) {
423	idmef_file_set_data_size(file, strtoul(ptr, NULL, 10));
424	free(ptr);
425	}
426
427	ptr = get_time_value(msg, _("mtime"), suffix);
428	if ( ptr ) {
429	ret = idmef_time_from_samhain(&time, ptr);
430	if ( ret == 0 ) {
431	idmef_file_set_modify_time(file, time);
432	}
433	free(ptr);
434	}
435
436	ptr = get_time_value(msg, _("ctime"), suffix);
437	if ( ptr ) {
438	ret = idmef_time_from_samhain(&time, ptr);
439	if ( ret == 0 ) {
440	idmef_file_set_create_time(file, time);
441	}
442	free(ptr);
443	}
444
445	ptr = get_value(msg, _("inode"), suffix);
446	if ( ptr ) {
447	ret = idmef_file_new_inode(file, &inode);
448	if ( ret == 0 ) {
449	char * dev = get_value(msg, _("dev"), suffix);
450	if (dev) {
451	char * q = strchr(dev, ',');
452	if (*q) {
453	*q = '\0'; ++q;
454	idmef_inode_set_major_device(inode, strtoul(dev, NULL, 0));
455	idmef_inode_set_minor_device(inode, strtoul( q, NULL, 0));
456	}
457	free(dev);
458	}
459	idmef_inode_set_number(inode, strtoul(ptr, NULL, 10));
460	}
461	free(ptr);
462	}
463
464	ptr = get_value(msg, _("chksum"), suffix);
465	if ( ptr ) {
466	ret = idmef_file_new_checksum(file, &checksum, IDMEF_LIST_APPEND);
467	if ( ret < 0 ) {
468	free(ptr);
469	goto get_mode;
470	}
471
472	hashtype = sh_tiger_get_hashtype();
473
474	if (hashtype == 0)
475	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
476
477	else if (hashtype == 1)
478	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_SHA1);
479
480	else if (hashtype == 2)
481	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_MD5);
482
483	else
484	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
485
486
487	ret = idmef_checksum_new_value(checksum, &str);
488	if ( ret < 0 ) {
489	free(ptr);
490	goto get_mode;
491	}
492
493	/* will be freed on destroy()
494	*/
495	prelude_string_set_nodup(str, ptr);
496	}
497
498	get_mode:
499
500	mode = get_value(msg, _("mode"), suffix);
501	if ( mode ) {
502	/* flawfinder: ignore // is part of name, not access() */
503	ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
504	if ( ret < 0 )
505	goto get_owner;
506
507	/* flawfinder: ignore // is part of name, not access() */
508	ret = idmef_file_access_new_user_id(access, &userid);
509	if ( ret < 0 )
510	goto get_owner;
511	idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_OTHER_PRIVS);
512
513	/* flawfinder: ignore // is part of name, not access() */
514	get_access_info ( access, mode, 7, 9 );
515	}
516
517	get_owner:
518
519	ptr = get_value(msg, _("owner"), suffix);
520	if ( ptr ) {
521	char * uid;
522
523	/* flawfinder: ignore // is part of name, not access() */
524	ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
525	if ( ret < 0 ) {
526	free(ptr);
527	goto get_group;
528	}
529
530	/* flawfinder: ignore // is part of name, not access() */
531	ret = idmef_file_access_new_user_id(access, &userid);
532	if ( ret < 0 ) {
533	free(ptr);
534	goto get_group;
535	}
536	idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_USER_PRIVS);
537
538	ret = idmef_user_id_new_name(userid, &str);
539	if ( ret < 0 ) {
540	free(ptr);
541	goto get_group;
542	}
543	prelude_string_set_nodup(str, ptr);
544
545	uid = get_value(msg, _("iowner"), suffix);
546	if ( ! uid )
547	goto get_group;
548
549	idmef_user_id_set_number(userid, strtoul(uid, NULL, 0));
550
551	if ( mode ) {
552	/* flawfinder: ignore // is part of name, not access() */
553	get_access_info ( access, mode, 1, 3 );
554	}
555
556	free(uid);
557	}
558
559	get_group:
560
561	ptr = get_value(msg, _("group"), suffix);
562	if ( ptr ) {
563	char *gid;
564
565	/* flawfinder: ignore // is part of name, not access() */
566	ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
567	if ( ret < 0 ) {
568	free(ptr);
569	goto mode_free;
570	}
571
572	ret = idmef_file_access_new_user_id(access, &userid);/* flawfinder: ignore // is part of name, not access() */
573	if ( ret < 0 ) {
574	free(ptr);
575	goto mode_free;
576	}
577
578	idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_GROUP_PRIVS);
579
580	ret = idmef_user_id_new_name(userid, &str);
581	if ( ret < 0 ) {
582	free(ptr);
583	goto mode_free;
584	}
585
586	prelude_string_set_nodup(str, ptr);
587
588	gid = get_value(msg, _("igroup"), suffix);
589	if ( ! gid )
590	goto mode_free;
591
592	idmef_user_id_set_number(userid, strtoul(gid, NULL, 0));
593
594	if ( mode ) {
595	get_access_info ( access, mode, 4, 6 ); /* flawfinder: ignore */
596	}
597
598	free(gid);
599	}
600
601	mode_free:
602
603	if ( mode ) {
604	free ( mode );
605	}
606
607	return;
608	}
609
610
611
612	static int map_policy_to_class(char msg, unsigned long msgid, idmef_impact_t impact, prelude_string_t *out)
613	{
614	char *ptr;
615	int ret, i;
616	struct tbl {
617	unsigned int msgid;
618	const char *name;
619	idmef_impact_type_t type;
620	} tbl[] = {
621
622	#ifdef SH_USE_UTMP
623	{ MSG_UT_LG1X, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
624	{ MSG_UT_LG1A, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
625	{ MSG_UT_LG1B, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
626	{ MSG_UT_LG2X, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
627	{ MSG_UT_LG2A, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
628	{ MSG_UT_LG2B, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
629	{ MSG_UT_LG3X, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
630	{ MSG_UT_LG3A, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
631	{ MSG_UT_LG3B, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
632	{ MSG_UT_LG3C, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
633	#endif
634
635	#if defined(SH_WITH_CLIENT) \|\| defined(SH_STANDALONE)
636	{ MSG_FI_MISS, N_("File Missing"), IDMEF_IMPACT_TYPE_FILE },
637	{ MSG_FI_MISS2, N_("File Missing"), IDMEF_IMPACT_TYPE_FILE },
638	{ MSG_FI_ADD, N_("File Added"), IDMEF_IMPACT_TYPE_FILE },
639	{ MSG_FI_ADD2, N_("File Added"), IDMEF_IMPACT_TYPE_FILE },
640	{ MSG_FI_CHAN, N_("File Modified"), IDMEF_IMPACT_TYPE_FILE },
641	{ MSG_FI_NODIR, N_("File found where directory was expected"), IDMEF_IMPACT_TYPE_FILE },
642	#endif
643
644	#ifdef SH_USE_KERN
645	{ MSG_KERN_POLICY, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
646	{ MSG_KERN_POL_CO, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
647	{ MSG_KERN_PROC, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
648	{ MSG_KERN_GATE, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
649	{ MSG_KERN_IDT, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
650	{ MSG_KERN_SYSCALL, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
651	#endif
652
653	#ifdef SH_USE_PORTCHECK
654	{ MSG_PORT_MISS, N_("Service closed"), IDMEF_IMPACT_TYPE_OTHER },
655	{ MSG_PORT_NEW, N_("Service opened"), IDMEF_IMPACT_TYPE_OTHER },
656	{ MSG_PORT_RESTART, N_("Service restarted"), IDMEF_IMPACT_TYPE_OTHER },
657	{ MSG_PORT_NEWPORT, N_("Service restarted"), IDMEF_IMPACT_TYPE_OTHER },
658	#endif
659
660	#ifdef SH_USE_SUIDCHK
661	{ MSG_SUID_POLICY, N_("SUID/SGID File Detected"), IDMEF_IMPACT_TYPE_FILE },
662	#endif
663	/*
664	* This must be the last table entry
665	*/
666	{ 0, NULL, IDMEF_IMPACT_TYPE_OTHER },
667	};
668
669	for ( i = 0; tbl[i].name != NULL; i++ ) {
670	if ( tbl[i].msgid != msgid )
671	continue;
672
673	idmef_impact_set_type(impact, tbl[i].type);
674	return prelude_string_cat(out, _(tbl[i].name));
675	}
676
677	/* some other message
678	*/
679	ptr = get_value(msg, _("msg"), NULL);
680	if ( ! ptr ) {
681	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
682	_("could not format Samhain message"), _("map_policy_to_class"));
683	return -1;
684	}
685
686	ret = prelude_string_cat(out, ptr);
687	free(ptr);
688
689	return ret;
690	}
691
692
693	#ifdef SH_USE_PORTCHECK
694	static int get_service_info(char msg, idmef_alert_t alert)
695	{
696	int ret;
697	long port;
698	char ptr, new, tmp, ip, srv, end;
699	prelude_string_t *str;
700	idmef_address_t *address;
701	idmef_node_t *node;
702	idmef_service_t *service;
703	idmef_source_t *source = idmef_alert_get_next_source(alert, NULL);
704
705	new = sh_util_strdup(msg);
706
707	ptr = strstr(new, _("port: "));
708	if ( ! ptr ) {
709	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
710	_("malformed Samhain port check message"), _("get_service_info"));
711	SH_FREE( new );
712	return -1;
713	}
714
715	ptr += 6; /* skip 'port: ', position on first byte of interface */
716	tmp = strchr(ptr, ':');
717	if ( ! tmp ) {
718	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
719	_("malformed Samhain port check message (no port)"), _("get_service_info"));
720	SH_FREE( new );
721	return -1;
722	}
723	*tmp = '\0';
724
725	/* Get interface
726	*/
727	ip = strdup(ptr);
728	if ( ip ) {
729	if ( ! source ) {
730	ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
731	if ( ret < 0 ) {
732	free(ip);
733	SH_FREE( new );
734	return ret;
735	}
736	}
737
738	ret = idmef_source_new_node(source, &node);
739	if ( ret < 0 ) {
740	free(ip);
741	SH_FREE( new );
742	return ret;
743	}
744
745	ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
746	if ( ret < 0 ) {
747	free(ip);
748	SH_FREE( new );
749	return ret;
750	}
751
752	ret = idmef_address_new_address(address, &str);
753	if ( ret < 0 ) {
754	free(ip);
755	SH_FREE( new );
756	return ret;
757	}
758
759	prelude_string_set_nodup(str, ip);
760	}
761
762	ptr = tmp;
763	++ptr;
764	tmp = strchr(ptr, '/');
765	if ( ! tmp ) {
766	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
767	_("malformed Samhain port check message (no protocol)"), _("get_service_info"));
768	SH_FREE( new );
769	return -1;
770	}
771	*tmp = '\0';
772
773	/* Get port number
774	*/
775	port = strtol(ptr, &end, 0);
776	if ( ptr && end == '\0' && port >= 0 && port < 65536) {
777
778	if ( ! source ) {
779	ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
780	if ( ret < 0 ) {
781	free(srv);
782	SH_FREE( new );
783	return ret;
784	}
785	}
786
787	ret = idmef_source_new_service(source, &service);
788	if ( ret < 0 ) {
789	free(srv);
790	SH_FREE( new );
791	return ret;
792	}
793
794	idmef_service_set_port(service, port);
795	}
796
797	ptr = tmp;
798	++ptr;
799	ptr = strchr(ptr, '(');
800	if ( ! ptr ) {
801	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
802	_("malformed Samhain port check message (no service)"), _("get_service_info"));
803	SH_FREE( new );
804	return -1;
805	}
806	++ptr;
807	tmp = strchr(ptr, ')');
808	if ( ! tmp ) {
809	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
810	_("malformed Samhain port check message (service not closed)"), _("get_service_info"));
811	SH_FREE( new );
812	return -1;
813	}
814	*tmp = '\0';
815
816	/* Get service
817	*/
818	srv = strdup(ptr);
819	if ( srv ) {
820	if ( ! source ) {
821	ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
822	if ( ret < 0 ) {
823	free(srv);
824	SH_FREE( new );
825	return ret;
826	}
827	}
828
829	if ( ! service ) {
830	ret = idmef_source_new_service(source, &service);
831	if ( ret < 0 ) {
832	free(srv);
833	SH_FREE( new );
834	return ret;
835	}
836	}
837
838	ret = idmef_service_new_name(service, &str);
839	if ( ret < 0 ) {
840	free(srv);
841	SH_FREE( new );
842	return ret;
843	}
844
845	prelude_string_set_nodup(str, srv);
846	}
847
848	SH_FREE( new );
849
850	return 0;
851	}
852	#endif
853
854	static int get_login_info(char msg, idmef_alert_t alert)
855	{
856	int ret;
857	char ptr, ip;
858	idmef_user_t *user;
859	idmef_node_t *node;
860	struct passwd *pw;
861	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
862	struct passwd pwd;
863	char buffer[SH_PWBUF_SIZE];
864	#endif
865	prelude_string_t *str;
866	idmef_user_id_t *user_id;
867	idmef_address_t *address;
868	idmef_target_t *target = idmef_alert_get_next_target(alert, NULL);
869	idmef_source_t *source = idmef_alert_get_next_source(alert, NULL);
870
871	ip = ptr = get_value(msg, _("ip"), NULL);
872	if ( ptr ) {
873	if ( ! source ) {
874	ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
875	if ( ret < 0 ) {
876	free(ptr);
877	return ret;
878	}
879	}
880
881	ret = idmef_source_new_node(source, &node);
882	if ( ret < 0 ) {
883	free(ptr);
884	return ret;
885	}
886
887	ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
888	if ( ret < 0 ) {
889	free(ptr);
890	return ret;
891	}
892
893	ret = idmef_address_new_address(address, &str);
894	if ( ret < 0 ) {
895	free(ptr);
896	return ret;
897	}
898
899	prelude_string_set_nodup(str, ptr);
900	}
901
902	ptr = get_value(msg, _("host"), NULL);
903	if ( ptr ) {
904	if ( ip && strcmp(ptr, ip) == 0 )
905	free(ptr);
906	else {
907	if ( ! source ) {
908	ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
909	if ( ret < 0 ) {
910	free(ptr);
911	return ret;
912	}
913	}
914
915	ret = idmef_source_new_node(source, &node);
916	if ( ret < 0 ) {
917	free(ptr);
918	return ret;
919	}
920
921	ret = idmef_node_new_name(node, &str);
922	if ( ret < 0 ) {
923	free(ptr);
924	return ret;
925	}
926
927	prelude_string_set_nodup(str, ptr);
928	}
929	}
930
931	ptr = get_value(msg, _("name"), NULL);
932	if ( ptr ) {
933	ret = idmef_target_new_user(target, &user);
934	if ( ret < 0 ) {
935	free(ptr);
936	return ret;
937	}
938
939	idmef_user_set_category(user, IDMEF_USER_CATEGORY_OS_DEVICE);
940
941	ret = idmef_user_new_user_id(user, &user_id, IDMEF_LIST_APPEND);
942	if ( ret < 0 ) {
943	free(ptr);
944	return ret;
945	}
946
947	idmef_user_id_set_type(user_id, IDMEF_USER_ID_TYPE_TARGET_USER);
948
949	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
950	sh_getpwnam_r(ptr, &pwd, buffer, sizeof(buffer), &pw);
951	#else
952	pw = sh_getpwnam(ptr);
953	#endif
954	if ( pw )
955	idmef_user_id_set_number(user_id, pw->pw_uid);
956
957	ret = idmef_user_id_new_name(user_id, &str);
958	if ( ret < 0 ) {
959	free(ptr);
960	return ret;
961	}
962	prelude_string_set_nodup(str, ptr);
963
964	ptr = get_value(msg, _("tty"), NULL);
965	if ( ptr ) {
966	ret = idmef_user_id_new_tty(user_id, &str);
967	if ( ret < 0 ) {
968	free(ptr);
969	return ret;
970	}
971
972	prelude_string_set_nodup(str, ptr);
973	}
974	}
975
976	ptr = get_time_value(msg, _("time"), NULL);
977	if ( ptr ) {
978	idmef_time_t *time;
979
980	ret = idmef_time_from_samhain(&time, ptr);
981	free(ptr);
982
983	if ( ret < 0 )
984	return ret;
985
986	idmef_alert_set_detect_time(alert, time);
987	}
988
989	return 0;
990	}
991
992
993	static int samhain_alert_prelude(int priority, int sh_class,
994	char *message, unsigned long msgid)
995	{
996	int ret;
997	idmef_time_t *time;
998	idmef_alert_t *alert;
999	idmef_message_t *idmef;
1000	idmef_classification_t *classification;
1001	idmef_assessment_t *assessment;
1002	idmef_additional_data_t *data;
1003	idmef_impact_t *impact;
1004	idmef_target_t *target;
1005	idmef_confidence_t *confidence;
1006	prelude_string_t *str;
1007
1008	if ( !client \|\| sh_class == STAMP)
1009	return 0;
1010
1011	ret = idmef_message_new(&idmef);
1012	if ( ret < 0 )
1013	goto err;
1014
1015	ret = idmef_message_new_alert(idmef, &alert);
1016	if ( ret < 0 )
1017	goto err;
1018
1019	idmef_alert_set_analyzer(alert, idmef_analyzer_ref(prelude_client_get_analyzer(client)), IDMEF_LIST_PREPEND);
1020
1021	ret = idmef_time_new_from_gettimeofday(&time);
1022	if ( ret < 0 )
1023	goto err;
1024	idmef_alert_set_detect_time(alert, time);
1025
1026	ret = idmef_time_new_from_gettimeofday(&time);
1027	if ( ret < 0 )
1028	goto err;
1029	idmef_alert_set_create_time(alert, time);
1030
1031	ret = idmef_alert_new_classification(alert, &classification);
1032	if ( ret < 0 )
1033	goto err;
1034
1035	ret = idmef_alert_new_target(alert, &target, IDMEF_LIST_APPEND);
1036	if ( ret < 0 )
1037	goto err;
1038
1039	idmef_target_set_decoy(target, IDMEF_TARGET_DECOY_NO);
1040
1041	if ( idmef_analyzer_get_node(prelude_client_get_analyzer(client)) ) {
1042	idmef_node_ref(idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
1043	idmef_target_set_node(target, idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
1044	}
1045
1046	if ( strstr(message, _("path=")) ) {
1047	#if defined(SH_WITH_CLIENT) \|\| defined(SH_STANDALONE)
1048	if ( msgid != MSG_FI_ADD && msgid != MSG_FI_ADD2 )
1049	get_file_infos(target, message, IDMEF_FILE_CATEGORY_ORIGINAL);
1050	#endif
1051
1052	get_file_infos(target, message, IDMEF_FILE_CATEGORY_CURRENT);
1053	}
1054
1055	ret = idmef_alert_new_assessment(alert, &assessment);
1056	if ( ret < 0 )
1057	goto err;
1058
1059	ret = idmef_assessment_new_impact(assessment, &impact);
1060	if ( ret < 0 )
1061	goto err;
1062
1063	ret = idmef_classification_new_text(classification, &str);
1064	if ( ret < 0 )
1065	goto err;
1066
1067	ret = get_login_info(message, alert);
1068	if ( ret < 0 )
1069	goto err;
1070
1071	#ifdef SH_USE_PORTCHECK
1072	if (msgid == MSG_PORT_MISS \|\| msgid == MSG_PORT_NEW \|\| msgid == MSG_PORT_RESTART \|\| msgid == MSG_PORT_NEWPORT) {
1073	ret = get_service_info(message, alert);
1074	if ( ret < 0 )
1075	goto err;
1076	}
1077	#endif
1078
1079	map_policy_to_class(message, msgid, impact, str);
1080
1081	#if 0
1082	if ( priority == SH_ERR_SEVERE \|\| priority == SH_ERR_FATAL )
1083	idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_HIGH);
1084
1085	else if ( priority == SH_ERR_ALL \|\| priority == SH_ERR_INFO \|\| priority == SH_ERR_NOTICE )
1086	idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_LOW);
1087
1088	else
1089	idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_MEDIUM);
1090	#endif
1091	idmef_impact_set_severity(impact, map_severity(priority));
1092
1093	idmef_impact_set_completion(impact, IDMEF_IMPACT_COMPLETION_SUCCEEDED);
1094
1095	ret = idmef_assessment_new_confidence(assessment, &confidence);
1096	if ( ret < 0 )
1097	goto err;
1098
1099	idmef_confidence_set_rating(confidence, IDMEF_CONFIDENCE_RATING_HIGH);
1100
1101	ret = idmef_alert_new_additional_data(alert, &data, IDMEF_LIST_APPEND);
1102	if ( ret < 0 )
1103	goto err;
1104
1105	ret = idmef_additional_data_new_meaning(data, &str);
1106	if ( ret < 0 )
1107	goto err;
1108
1109	prelude_string_set_dup(str, _("Message generated by Samhain"));
1110	idmef_additional_data_set_type(data, IDMEF_ADDITIONAL_DATA_TYPE_STRING);
1111	idmef_additional_data_set_string_ref(data, message);
1112
1113	/* debug_print_message(idmef); */
1114
1115	prelude_client_send_idmef(client, idmef);
1116	idmef_message_destroy(idmef);
1117
1118	return 0;
1119
1120	err:
1121	idmef_message_destroy(idmef);
1122	return -1;
1123	}
1124
1125
1126	int sh_prelude_alert(int priority, int sh_class, char *message, long msgflags, unsigned long msgid)
1127	{
1128	int ret;
1129
1130	(void) msgflags; /* fix compiler warning */
1131
1132	if ( initialized < 1 )
1133	return -1;
1134
1135	ret = samhain_alert_prelude(priority, sh_class, message, msgid);
1136	if ( ret < 0 ) {
1137	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
1138	_("Problem with IDMEF for prelude-ids support: alert lost"),
1139	_("sh_prelude_alert"));
1140	}
1141
1142	return ret;
1143	}
1144
1145
1146
1147	int sh_prelude_set_profile(const char *arg)
1148	{
1149	if ( profile ) {
1150	free(profile);
1151	profile = NULL;
1152	}
1153
1154	if ( arg ) {
1155	profile = strdup(arg);
1156	if ( ! profile )
1157	return -1;
1158	}
1159
1160	return 0;
1161	}
1162
1163	/* Allow initialization of prelude; to be called
1164	* after forking the daemon. Delays heartbeat
1165	* start after config read until it is safe.
1166	*/
1167	void sh_prelude_reset(void)
1168	{
1169	extern void sh_error_init_prelude();
1170
1171	ready_for_init = 1;
1172	sh_error_init_prelude();
1173	return;
1174	}
1175
1176
1177
1178	void sh_prelude_stop(void)
1179	{
1180	if (initialized < 1)
1181	return;
1182
1183	if (sh.flag.isdaemon == S_TRUE)
1184	prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_FAILURE);
1185	else
1186	prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
1187
1188	client = NULL;
1189
1190	prelude_deinit();
1191
1192	initialized = 0;
1193	return;
1194	}
1195
1196
1197
1198	int sh_prelude_init(void)
1199	{
1200	int ret;
1201	prelude_string_t *str;
1202	idmef_analyzer_t *analyzer;
1203	prelude_client_flags_t flags;
1204	#ifdef SH_NOFAILOVER
1205	prelude_connection_pool_t *pool;
1206	prelude_connection_pool_flags_t conn_flags;
1207	#endif
1208
1209	if (ready_for_init == 0)
1210	return initialized;
1211
1212	if (initialized > 0)
1213	return initialized;
1214
1215	prelude_thread_init(NULL);
1216	prelude_init(&sh_argc_store, sh_argv_store);
1217
1218	ret = prelude_client_new(&client, profile ? profile : _("samhain"));
1219	if ( ret < 0 ) {
1220	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
1221	_("Failed to initialize Prelude"), _("sh_prelude_init"));
1222	initialized = -1;
1223	return -1;
1224	}
1225
1226	/*
1227	* Enable automatic heartbeat sending.
1228	*/
1229	flags = prelude_client_get_flags(client);
1230	ret = prelude_client_set_flags(client, flags \| PRELUDE_CLIENT_FLAGS_ASYNC_TIMER);
1231
1232	analyzer = prelude_client_get_analyzer(client);
1233
1234	ret = idmef_analyzer_new_model(analyzer, &str);
1235	prelude_string_set_dup(str, IDMEF_ANALYZER_MODEL);
1236
1237	ret = idmef_analyzer_new_class(analyzer, &str);
1238	prelude_string_set_dup(str, IDMEF_ANALYZER_CLASS);
1239
1240	ret = idmef_analyzer_new_version(analyzer, &str);
1241	prelude_string_set_dup(str, IDMEF_ANALYZER_VERSION);
1242
1243	#ifdef SH_NOFAILOVER
1244	pool = prelude_client_get_connection_pool(client);
1245	conn_flags = prelude_connection_pool_get_flags(pool);
1246
1247	conn_flags &= ~PRELUDE_CONNECTION_POOL_FLAGS_FAILOVER;
1248	prelude_connection_pool_set_flags(pool, conn_flags);
1249	#endif
1250
1251	ret = prelude_client_start(client);
1252	if ( ret < 0 ) {
1253	prelude_perror(ret, _("error starting prelude client"));
1254
1255	if ( prelude_client_is_setup_needed(ret) )
1256	prelude_client_print_setup_error(client);
1257
1258	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
1259	_("Failed to start Prelude"), _("sh_prelude_init"));
1260	initialized = -1;
1261	return -1;
1262	}
1263
1264	initialized = 1;
1265	return 1;
1266	}
1267
1268	/* HAVE_LIBPRELUDE_9 */
1269	#endif
1270

Note: See TracBrowser for help on using the repository browser.

Download in other formats: