Context Navigation

source: trunk/src/sh_prelude.c@ 107

Last change on this file since 107 was 106, checked in by rainer, 18 years ago
Patch by Yoann Vandoorselaere for sh_prelude.c.
File size: 31.8 KB

Line
1	/*
2	*
3	* Copyright (C) 2005 Yoann Vandoorselaere, Prelude IDS Technologies
4	* Rainer Wichmann
5	*
6	* This program is free software; you can redistribute it and/or modify
7	* it under the terms of the GNU General Public License as published by
8	* the Free Software Foundation; either version 2, or (at your option)
9	* any later version.
10	*
11	* This program is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14	* GNU General Public License for more details.
15	*
16	* You should have received a copy of the GNU General Public License
17	* along with this program; see the file COPYING. If not, write to
18	* the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
19	*
20	*/
21
22	/*
23	* 28/04/2005 : R.W.:
24	* move libprelude 0.8 code to seperate file
25	*
26	* 23/04/2005 : R.W.:
27	* include libprelude 0.9 code from Yoann Vandoorselaere
28	*/
29
30
31	/*
32	* for strptime()
33	*/
34	#define _GNU_SOURCE 1
35
36	#include "config_xor.h"
37
38	#include <stdio.h>
39	#include <string.h>
40	#include <sys/types.h>
41
42	#if TIME_WITH_SYS_TIME
43
44	# include <sys/time.h>
45	# include <time.h>
46
47	#else
48
49	# if HAVE_SYS_TIME_H
50	# include <sys/time.h>
51	# else
52	# include <time.h>
53	# endif
54
55	#endif
56
57	#include <unistd.h>
58	#include <syslog.h>
59	#include <pwd.h>
60
61	int sh_argc_store;
62	char ** sh_argv_store;
63
64	#if defined(HAVE_LIBPRELUDE) && defined(HAVE_LIBPRELUDE_9)
65
66
67	/*
68	* _() macros are samhain specific; they are used to replace string
69	* constants at runtime. This is part of the samhain stealth mode
70	* (fill string constants with encoded strings, decode at runtime).
71	*/
72	#define FIL__ _("sh_prelude.c")
73
74
75	#include <libprelude/idmef.h>
76	#include <libprelude/prelude.h>
77
78	/*
79	* includes for samhain-specific functions (sl_strstr, sh_error_handle)
80	*/
81	#include "slib.h"
82	#include "sh_cat.h"
83	#include "sh_error_min.h"
84	#include "sh_prelude.h"
85
86	/*
87	* When SH_USE_XML is set, value are formated using name="value".
88	* Otherwise, value is formatted using the format name=<value>.
89	*/
90	#ifdef SH_USE_XML
91	# define VALUE_DELIM_START '"'
92	# define VALUE_DELIM_END '"'
93	#else
94	# define VALUE_DELIM_START '<'
95	# define VALUE_DELIM_END '>'
96	#endif
97
98	#define IDMEF_ANALYZER_MODEL _("Samhain")
99	#define IDMEF_ANALYZER_CLASS _("Integrity Checker")
100	#define IDMEF_ANALYZER_VERSION VERSION
101	#define IDMEF_ANALYZER_MANUFACTURER _("http://www.la-samhna.de/samhain/")
102
103
104
105	/*
106	* 0 = not initialized; -1 = failed; 1 = initialized
107	*/
108	static int initialized = 0;
109	static int ready_for_init = 0;
110
111	static char *profile = NULL;
112	static prelude_client_t *client = NULL;
113
114	static int severity_map[1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH] = {
115	/* 0: unused (?) */ 0,
116	/* 1: INFO */ 0,
117	/* 2: LOW */ SH_ERR_ALL\|SH_ERR_INFO,
118	/* 3: MEDIUM */ SH_ERR_NOTICE\|SH_ERR_WARN\|SH_ERR_STAMP\|SH_ERR_ERR,
119	/* 4: HIGH */ SH_ERR_SEVERE\|SH_ERR_FATAL
120	};
121
122	/* returns 0/tiger, 1/sha1, or 2/md5
123	*/
124	extern int sh_tiger_get_hashtype(void);
125
126	static void clear_and_set (int setpos, int flag)
127	{
128	unsigned int i;
129	/* clear everywhere, and set at correct position */
130	for (i = 1; i < (1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH); ++i)
131	severity_map[i] &= ~flag;
132	severity_map[setpos] \|= flag;
133	return;
134	}
135
136	static int set_prelude_severity_int (const char * str, int prelude_sev)
137	{
138	char * p;
139	char * dup = strdup (str);
140
141	if (!dup)
142	return -1;
143
144	p = strtok (dup, ", \t");
145	if (p) {
146	do {
147	if (0 == strcmp (p, _("alert")))
148	clear_and_set (prelude_sev, SH_ERR_FATAL);
149	else if (0 == strcmp (p, _("crit")))
150	clear_and_set (prelude_sev, SH_ERR_SEVERE);
151	else if (0 == strcmp (p, _("err")))
152	clear_and_set (prelude_sev, SH_ERR_ERR);
153	else if (0 == strcmp (p, _("mark")))
154	clear_and_set (prelude_sev, SH_ERR_STAMP);
155	else if (0 == strcmp (p, _("warn")))
156	clear_and_set (prelude_sev, SH_ERR_WARN);
157	else if (0 == strcmp (p, _("notice")))
158	clear_and_set (prelude_sev, SH_ERR_NOTICE);
159	else if (0 == strcmp (p, _("debug")))
160	clear_and_set (prelude_sev, SH_ERR_ALL);
161	else if (0 == strcmp (p, _("info")))
162	clear_and_set (prelude_sev, SH_ERR_INFO);
163	else {
164	free (dup);
165	return -1;
166	}
167	p = strtok (NULL, ", \t");
168	} while (p);
169	}
170	free(dup);
171	return 0;
172	}
173
174	int sh_prelude_map_info (const char * str)
175	{
176	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_INFO));
177	}
178	int sh_prelude_map_low (const char * str)
179	{
180	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_LOW));
181	}
182	int sh_prelude_map_medium (const char * str)
183	{
184	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_MEDIUM));
185	}
186	int sh_prelude_map_high (const char * str)
187	{
188	return (set_prelude_severity_int(str,(int)IDMEF_IMPACT_SEVERITY_HIGH));
189	}
190
191	static idmef_impact_severity_t map_severity (int sam_sev)
192	{
193	int i;
194	int max = 1 + (unsigned int) IDMEF_IMPACT_SEVERITY_HIGH;
195	idmef_impact_severity_t retval = IDMEF_IMPACT_SEVERITY_MEDIUM;
196
197	for (i = 0; i < max; ++i) {
198	if (severity_map[i] & sam_sev) {
199	retval = (idmef_impact_severity_t) i;
200	}
201	}
202	return retval;
203	}
204
205	static char do_get_value(char ptr, char delim_start, char delim_end)
206	{
207	char *ret = NULL;
208
209	ptr = strchr(ptr, delim_start);
210	if ( ! ptr )
211	return NULL;
212
213	ret = ++ptr;
214
215	ptr = strchr(ptr, delim_end);
216	if ( ! ptr )
217	return NULL;
218
219	*ptr = '\0';
220	ret = strdup(ret);
221	*ptr = delim_end;
222
223	return ret;
224	}
225
226
227
228	static char get_value(char msg, const char toktmp, const char toksuffix)
229	{
230	char *ptr, tok[128];
231
232	snprintf(tok, sizeof(tok), "%s%s=", toktmp, (toksuffix) ? toksuffix : "");
233
234	ptr = strstr(msg, tok);
235	if ( ! ptr )
236	return NULL;
237
238	return do_get_value(ptr, VALUE_DELIM_START, VALUE_DELIM_END);
239	}
240
241
242
243	static char get_time_value(char msg, const char toktmp, const char toksuffix)
244	{
245
246	char ret, ptr, tok[128];
247
248	snprintf(tok, sizeof(tok), "%s%s=", toktmp, (toksuffix) ? toksuffix : "");
249
250	ptr = strstr(msg, tok);
251	if ( ! ptr )
252	return NULL;
253
254	#ifndef SH_USE_XML
255	ret = do_get_value(ptr, '[', ']');
256	#else
257	ret = do_get_value(ptr, VALUE_DELIM_START, VALUE_DELIM_END);
258	#endif
259
260	return ret;
261	}
262
263
264
265
266	#if 0
267	void debug_print_message(idmef_message_t *msg)
268	{
269	int ret;
270	prelude_io_t *fd;
271
272	ret = prelude_io_new(&fd);
273	if ( ret < 0 )
274	return;
275
276	prelude_io_set_file_io(fd, stderr);
277	idmef_message_print(idmef, fd);
278
279	prelude_io_destroy(fd);
280	}
281	#endif
282
283
284
285	static int idmef_time_from_samhain(idmef_time_t *time, const char str)
286	{
287	int ret;
288	char *ptr;
289	time_t utc;
290	struct tm lt;
291
292	/*
293	* Samhain stamp are encoded in UTC.
294	*/
295	ptr = strptime(str, _("%Y-%m-%dT%H:%M:%S"), &lt);
296	if ( ! ptr ) {
297	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
298	_("could not format Samhain time"), _("idmef_time_from_samhain"));
299	return -1;
300	}
301
302	utc = prelude_timegm(&lt);
303
304	ret = idmef_time_new_from_time(time, &utc);
305	if ( ret < 0 )
306	return ret;
307
308	return 0;
309	}
310
311	/* flawfinder: ignore // is part of name, not access() */
312	static void get_access_info(idmef_file_access_t access, char mode, int pos, int mpos)
313	{
314	int got = 0;
315	int ret;
316	prelude_string_t *str;
317
318	do {
319	if ( mode[pos] == 'r' ) {
320	/* flawfinder: ignore // is part of name, not access() */
321	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
322	if ( ret < 0 )
323	return;
324	prelude_string_set_dup(str, _("read"));
325	++got;
326	}
327	else if ( mode[pos] == 'w' ) {
328	/* flawfinder: ignore // is part of name, not access() */
329	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
330	if ( ret < 0 )
331	return;
332	prelude_string_set_dup(str, _("write"));
333	++got;
334	}
335	else if ( mode[pos] == 'x' \|\| mode[pos] == 's' \|\| mode[pos] == 't') {
336	/* flawfinder: ignore // is part of name, not access() */
337	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
338	if ( ret < 0 )
339	return;
340
341	if ( mode[pos] == 'x' && mode[0] == 'd' )
342	prelude_string_set_dup(str, _("search"));
343
344	else if ( mode[pos] == 'x' \|\| mode[pos] == 't' )
345	prelude_string_set_dup(str, _("execute"));
346
347	else /* 's' */
348	prelude_string_set_dup(str, _("executeAs"));
349	++got;
350	}
351	++pos;
352	} while (pos <= mpos);
353
354	if ( got == 0 ) {
355	/* flawfinder: ignore // is part of name, not access() */
356	ret = idmef_file_access_new_permission(access, &str, IDMEF_LIST_APPEND);
357	if ( ret < 0 )
358	return;
359	prelude_string_set_dup(str, _("noAccess"));
360	}
361	return;
362	}
363
364
365	static void get_file_infos(idmef_target_t target, char msg,
366	idmef_file_category_t category)
367	{
368	int ret;
369	int hashtype = 0;
370	char *ptr;
371	idmef_time_t *time;
372	idmef_file_t *file;
373	idmef_inode_t *inode;
374	prelude_string_t *str;
375	idmef_checksum_t *checksum;
376	idmef_file_access_t access; / flawfinder: ignore */
377	idmef_user_id_t *userid;
378	const char *suffix = (category == IDMEF_FILE_CATEGORY_CURRENT) ? "_new" : "_old";
379	char *mode = NULL;
380
381	ret = idmef_target_new_file(target, &file, IDMEF_LIST_APPEND);
382	if ( ret < 0 )
383	return;
384	idmef_file_set_category(file, category);
385
386	ptr = get_value(msg, _("path"), NULL);
387	if ( ptr ) {
388	/*
389	* In term of IDMEF, this is the full path,
390	* including the name.
391	*/
392	ret = idmef_file_new_path(file, &str);
393	if ( ret < 0 ) {
394	free(ptr);
395	return;
396	}
397	prelude_string_set_nodup(str, ptr);
398
399	ptr = strrchr(ptr, '/');
400	if ( ptr ) {
401	ret = idmef_file_new_name(file, &str);
402	if ( ret == 0 ) {
403	prelude_string_set_dup(str, ptr + 1);
404	}
405	}
406	}
407
408	ptr = get_value(msg, _("size"), suffix);
409	if ( ptr ) {
410	idmef_file_set_data_size(file, strtoul(ptr, NULL, 10));
411	free(ptr);
412	}
413
414	ptr = get_time_value(msg, _("mtime"), suffix);
415	if ( ptr ) {
416	ret = idmef_time_from_samhain(&time, ptr);
417	if ( ret == 0 ) {
418	idmef_file_set_modify_time(file, time);
419	}
420	free(ptr);
421	}
422
423	ptr = get_time_value(msg, _("ctime"), suffix);
424	if ( ptr ) {
425	ret = idmef_time_from_samhain(&time, ptr);
426	if ( ret == 0 ) {
427	idmef_file_set_create_time(file, time);
428	}
429	free(ptr);
430	}
431
432	ptr = get_value(msg, _("inode"), suffix);
433	if ( ptr ) {
434	ret = idmef_file_new_inode(file, &inode);
435	if ( ret == 0 ) {
436	char * dev = get_value(msg, _("dev"), suffix);
437	if (dev) {
438	char * q = strchr(dev, ',');
439	if (*q) {
440	*q = '\0'; ++q;
441	idmef_inode_set_major_device(inode, strtoul(dev, NULL, 0));
442	idmef_inode_set_minor_device(inode, strtoul( q, NULL, 0));
443	}
444	free(dev);
445	}
446	idmef_inode_set_number(inode, strtoul(ptr, NULL, 10));
447	}
448	free(ptr);
449	}
450
451	ptr = get_value(msg, _("chksum"), suffix);
452	if ( ptr ) {
453	ret = idmef_file_new_checksum(file, &checksum, IDMEF_LIST_APPEND);
454	if ( ret < 0 ) {
455	free(ptr);
456	goto get_mode;
457	}
458
459	hashtype = sh_tiger_get_hashtype();
460
461	if (hashtype == 0)
462	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
463
464	else if (hashtype == 1)
465	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_SHA1);
466
467	else if (hashtype == 2)
468	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_MD5);
469
470	else
471	idmef_checksum_set_algorithm(checksum, IDMEF_CHECKSUM_ALGORITHM_TIGER);
472
473
474	ret = idmef_checksum_new_value(checksum, &str);
475	if ( ret < 0 ) {
476	free(ptr);
477	goto get_mode;
478	}
479
480	/* will be freed on destroy()
481	*/
482	prelude_string_set_nodup(str, ptr);
483	}
484
485	get_mode:
486
487	mode = get_value(msg, _("mode"), suffix);
488	if ( mode ) {
489	/* flawfinder: ignore // is part of name, not access() */
490	ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
491	if ( ret < 0 )
492	goto get_owner;
493
494	/* flawfinder: ignore // is part of name, not access() */
495	ret = idmef_file_access_new_user_id(access, &userid);
496	if ( ret < 0 )
497	goto get_owner;
498	idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_OTHER_PRIVS);
499
500	/* flawfinder: ignore // is part of name, not access() */
501	get_access_info ( access, mode, 7, 9 );
502	}
503
504	get_owner:
505
506	ptr = get_value(msg, _("owner"), suffix);
507	if ( ptr ) {
508	char * uid;
509
510	/* flawfinder: ignore // is part of name, not access() */
511	ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
512	if ( ret < 0 ) {
513	free(ptr);
514	goto get_group;
515	}
516
517	/* flawfinder: ignore // is part of name, not access() */
518	ret = idmef_file_access_new_user_id(access, &userid);
519	if ( ret < 0 ) {
520	free(ptr);
521	goto get_group;
522	}
523	idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_USER_PRIVS);
524
525	ret = idmef_user_id_new_name(userid, &str);
526	if ( ret < 0 ) {
527	free(ptr);
528	goto get_group;
529	}
530	prelude_string_set_nodup(str, ptr);
531
532	uid = get_value(msg, _("iowner"), suffix);
533	if ( ! uid )
534	goto get_group;
535
536	idmef_user_id_set_number(userid, strtoul(uid, NULL, 0));
537
538	if ( mode ) {
539	/* flawfinder: ignore // is part of name, not access() */
540	get_access_info ( access, mode, 1, 3 );
541	}
542
543	free(uid);
544	}
545
546	get_group:
547
548	ptr = get_value(msg, _("group"), suffix);
549	if ( ptr ) {
550	char *gid;
551
552	/* flawfinder: ignore // is part of name, not access() */
553	ret = idmef_file_new_file_access(file, &access, IDMEF_LIST_APPEND);
554	if ( ret < 0 ) {
555	free(ptr);
556	goto mode_free;
557	}
558
559	ret = idmef_file_access_new_user_id(access, &userid);/* flawfinder: ignore // is part of name, not access() */
560	if ( ret < 0 ) {
561	free(ptr);
562	goto mode_free;
563	}
564
565	idmef_user_id_set_type(userid, IDMEF_USER_ID_TYPE_GROUP_PRIVS);
566
567	ret = idmef_user_id_new_name(userid, &str);
568	if ( ret < 0 ) {
569	free(ptr);
570	goto mode_free;
571	}
572
573	prelude_string_set_nodup(str, ptr);
574
575	gid = get_value(msg, _("igroup"), suffix);
576	if ( ! gid )
577	goto mode_free;
578
579	idmef_user_id_set_number(userid, strtoul(gid, NULL, 0));
580
581	if ( mode ) {
582	get_access_info ( access, mode, 4, 6 ); /* flawfinder: ignore */
583	}
584
585	free(gid);
586	}
587
588	mode_free:
589
590	if ( mode ) {
591	free ( mode );
592	}
593
594	return;
595	}
596
597
598
599	static int map_policy_to_class(char msg, unsigned long msgid, idmef_impact_t impact, prelude_string_t *out)
600	{
601	char *ptr;
602	int ret, i;
603	struct tbl {
604	unsigned int msgid;
605	const char *name;
606	idmef_impact_type_t type;
607	} tbl[] = {
608
609	#ifdef SH_USE_UTMP
610	{ MSG_UT_LG1X, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
611	{ MSG_UT_LG1A, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
612	{ MSG_UT_LG1B, N_("User Login"), IDMEF_IMPACT_TYPE_USER },
613	{ MSG_UT_LG2X, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
614	{ MSG_UT_LG2A, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
615	{ MSG_UT_LG2B, N_("Multiple User Login"), IDMEF_IMPACT_TYPE_USER },
616	{ MSG_UT_LG3X, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
617	{ MSG_UT_LG3A, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
618	{ MSG_UT_LG3B, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
619	{ MSG_UT_LG3C, N_("User Logout"), IDMEF_IMPACT_TYPE_USER },
620	#endif
621
622	#if defined(SH_WITH_CLIENT) \|\| defined(SH_STANDALONE)
623	{ MSG_FI_MISS, N_("File Missing"), IDMEF_IMPACT_TYPE_FILE },
624	{ MSG_FI_MISS2, N_("File Missing"), IDMEF_IMPACT_TYPE_FILE },
625	{ MSG_FI_ADD, N_("File Added"), IDMEF_IMPACT_TYPE_FILE },
626	{ MSG_FI_ADD2, N_("File Added"), IDMEF_IMPACT_TYPE_FILE },
627	{ MSG_FI_CHAN, N_("File Modified"), IDMEF_IMPACT_TYPE_FILE },
628	{ MSG_FI_NODIR, N_("File found where directory was expected"), IDMEF_IMPACT_TYPE_FILE },
629	#endif
630
631	#ifdef SH_USE_KERN
632	{ MSG_KERN_POLICY, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
633	{ MSG_KERN_POL_CO, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
634	{ MSG_KERN_PROC, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
635	{ MSG_KERN_GATE, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
636	{ MSG_KERN_IDT, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
637	{ MSG_KERN_SYSCALL, N_("Kernel Modified"), IDMEF_IMPACT_TYPE_OTHER },
638	#endif
639
640	#ifdef SH_USE_SUIDCHK
641	{ MSG_SUID_POLICY, N_("SUID/SGID File Detected"), IDMEF_IMPACT_TYPE_FILE },
642	#endif
643	/*
644	* This must be the last table entry
645	*/
646	{ 0, NULL, IDMEF_IMPACT_TYPE_OTHER },
647	};
648
649	for ( i = 0; tbl[i].name != NULL; i++ ) {
650	if ( tbl[i].msgid != msgid )
651	continue;
652
653	idmef_impact_set_type(impact, tbl[i].type);
654	return prelude_string_cat(out, _(tbl[i].name));
655	}
656
657	/* some other message
658	*/
659	ptr = get_value(msg, _("msg"), NULL);
660	if ( ! ptr ) {
661	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
662	_("could not format Samhain message"), _("map_policy_to_class"));
663	return -1;
664	}
665
666	ret = prelude_string_cat(out, ptr);
667	free(ptr);
668
669	return ret;
670	}
671
672
673
674	static int get_login_info(char msg, idmef_alert_t alert)
675	{
676	int ret;
677	char ptr, ip;
678	idmef_user_t *user;
679	idmef_node_t *node;
680	struct passwd *pw;
681	prelude_string_t *str;
682	idmef_user_id_t *user_id;
683	idmef_address_t *address;
684	idmef_target_t *target = idmef_alert_get_next_target(alert, NULL);
685	idmef_source_t *source = idmef_alert_get_next_source(alert, NULL);
686
687	ip = ptr = get_value(msg, _("ip"), NULL);
688	if ( ptr ) {
689	if ( ! source ) {
690	ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
691	if ( ret < 0 ) {
692	free(ptr);
693	return ret;
694	}
695	}
696
697	ret = idmef_source_new_node(source, &node);
698	if ( ret < 0 ) {
699	free(ptr);
700	return ret;
701	}
702
703	ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
704	if ( ret < 0 ) {
705	free(ptr);
706	return ret;
707	}
708
709	ret = idmef_address_new_address(address, &str);
710	if ( ret < 0 ) {
711	free(ptr);
712	return ret;
713	}
714
715	prelude_string_set_nodup(str, ptr);
716	}
717
718	ptr = get_value(msg, _("host"), NULL);
719	if ( ptr ) {
720	if ( ip && strcmp(ptr, ip) == 0 )
721	free(ptr);
722	else {
723	if ( ! source ) {
724	ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
725	if ( ret < 0 ) {
726	free(ptr);
727	return ret;
728	}
729	}
730
731	ret = idmef_source_new_node(source, &node);
732	if ( ret < 0 ) {
733	free(ptr);
734	return ret;
735	}
736
737	ret = idmef_node_new_name(node, &str);
738	if ( ret < 0 ) {
739	free(ptr);
740	return ret;
741	}
742
743	prelude_string_set_nodup(str, ptr);
744	}
745	}
746
747	ptr = get_value(msg, _("name"), NULL);
748	if ( ptr ) {
749	ret = idmef_target_new_user(target, &user);
750	if ( ret < 0 ) {
751	free(ptr);
752	return ret;
753	}
754
755	idmef_user_set_category(user, IDMEF_USER_CATEGORY_OS_DEVICE);
756
757	ret = idmef_user_new_user_id(user, &user_id, IDMEF_LIST_APPEND);
758	if ( ret < 0 ) {
759	free(ptr);
760	return ret;
761	}
762
763	idmef_user_id_set_type(user_id, IDMEF_USER_ID_TYPE_TARGET_USER);
764
765	pw = getpwnam(ptr);
766	if ( pw )
767	idmef_user_id_set_number(user_id, pw->pw_uid);
768
769	ret = idmef_user_id_new_name(user_id, &str);
770	if ( ret < 0 ) {
771	free(ptr);
772	return ret;
773	}
774	prelude_string_set_nodup(str, ptr);
775
776	ptr = get_value(msg, _("tty"), NULL);
777	if ( ptr ) {
778	ret = idmef_user_id_new_tty(user_id, &str);
779	if ( ret < 0 ) {
780	free(ptr);
781	return ret;
782	}
783
784	prelude_string_set_nodup(str, ptr);
785	}
786	}
787
788	ptr = get_time_value(msg, _("time"), NULL);
789	if ( ptr ) {
790	idmef_time_t *time;
791
792	ret = idmef_time_from_samhain(&time, ptr);
793	free(ptr);
794
795	if ( ret < 0 )
796	return ret;
797
798	idmef_alert_set_detect_time(alert, time);
799	}
800
801	return 0;
802	}
803
804
805	static int samhain_alert_prelude(int priority, int sh_class,
806	char *message, unsigned long msgid)
807	{
808	int ret;
809	idmef_time_t *time;
810	idmef_alert_t *alert;
811	idmef_message_t *idmef;
812	idmef_classification_t *classification;
813	idmef_assessment_t *assessment;
814	idmef_additional_data_t *data;
815	idmef_impact_t *impact;
816	idmef_target_t *target;
817	idmef_confidence_t *confidence;
818	prelude_string_t *str;
819
820	if ( !client \|\| sh_class == STAMP)
821	return 0;
822
823	ret = idmef_message_new(&idmef);
824	if ( ret < 0 )
825	goto err;
826
827	ret = idmef_message_new_alert(idmef, &alert);
828	if ( ret < 0 )
829	goto err;
830
831	idmef_alert_set_analyzer(alert, idmef_analyzer_ref(prelude_client_get_analyzer(client)), IDMEF_LIST_PREPEND);
832
833	ret = idmef_time_new_from_gettimeofday(&time);
834	if ( ret < 0 )
835	goto err;
836	idmef_alert_set_detect_time(alert, time);
837
838	ret = idmef_time_new_from_gettimeofday(&time);
839	if ( ret < 0 )
840	goto err;
841	idmef_alert_set_create_time(alert, time);
842
843	ret = idmef_alert_new_classification(alert, &classification);
844	if ( ret < 0 )
845	goto err;
846
847	ret = idmef_alert_new_target(alert, &target, IDMEF_LIST_APPEND);
848	if ( ret < 0 )
849	goto err;
850
851	idmef_target_set_decoy(target, IDMEF_TARGET_DECOY_NO);
852
853	if ( idmef_analyzer_get_node(prelude_client_get_analyzer(client)) ) {
854	idmef_node_ref(idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
855	idmef_target_set_node(target, idmef_analyzer_get_node(prelude_client_get_analyzer(client)));
856	}
857
858	if ( strstr(message, _("path=")) ) {
859	#if defined(SH_WITH_CLIENT) \|\| defined(SH_STANDALONE)
860	if ( msgid != MSG_FI_ADD && msgid != MSG_FI_ADD2 )
861	get_file_infos(target, message, IDMEF_FILE_CATEGORY_ORIGINAL);
862	#endif
863
864	get_file_infos(target, message, IDMEF_FILE_CATEGORY_CURRENT);
865	}
866
867	ret = idmef_alert_new_assessment(alert, &assessment);
868	if ( ret < 0 )
869	goto err;
870
871	ret = idmef_assessment_new_impact(assessment, &impact);
872	if ( ret < 0 )
873	goto err;
874
875	ret = idmef_classification_new_text(classification, &str);
876	if ( ret < 0 )
877	goto err;
878
879	ret = get_login_info(message, alert);
880	if ( ret < 0 )
881	goto err;
882
883	map_policy_to_class(message, msgid, impact, str);
884
885	#if 0
886	if ( priority == SH_ERR_SEVERE \|\| priority == SH_ERR_FATAL )
887	idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_HIGH);
888
889	else if ( priority == SH_ERR_ALL \|\| priority == SH_ERR_INFO \|\| priority == SH_ERR_NOTICE )
890	idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_LOW);
891
892	else
893	idmef_impact_set_severity(impact, IDMEF_IMPACT_SEVERITY_MEDIUM);
894	#endif
895	idmef_impact_set_severity(impact, map_severity(priority));
896
897	idmef_impact_set_completion(impact, IDMEF_IMPACT_COMPLETION_SUCCEEDED);
898
899	ret = idmef_assessment_new_confidence(assessment, &confidence);
900	if ( ret < 0 )
901	goto err;
902
903	idmef_confidence_set_rating(confidence, IDMEF_CONFIDENCE_RATING_HIGH);
904
905	ret = idmef_alert_new_additional_data(alert, &data, IDMEF_LIST_APPEND);
906	if ( ret < 0 )
907	goto err;
908
909	ret = idmef_additional_data_new_meaning(data, &str);
910	if ( ret < 0 )
911	goto err;
912
913	prelude_string_set_dup(str, _("Message generated by Samhain"));
914	idmef_additional_data_set_type(data, IDMEF_ADDITIONAL_DATA_TYPE_STRING);
915	idmef_additional_data_set_string_ref(data, message);
916
917	/* debug_print_message(idmef); */
918
919	prelude_client_send_idmef(client, idmef);
920	idmef_message_destroy(idmef);
921
922	return 0;
923
924	err:
925	idmef_message_destroy(idmef);
926	return -1;
927	}
928
929
930	int sh_prelude_alert(int priority, int sh_class, char *message, long msgflags, unsigned long msgid)
931	{
932	int ret;
933
934	(void) msgflags; /* fix compiler warning */
935
936	if ( initialized < 1 )
937	return -1;
938
939	ret = samhain_alert_prelude(priority, sh_class, message, msgid);
940	if ( ret < 0 ) {
941	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
942	_("Problem with IDMEF for prelude-ids support: alert lost"),
943	_("sh_prelude_alert"));
944	}
945
946	return ret;
947	}
948
949
950
951	int sh_prelude_set_profile(const char *arg)
952	{
953	if ( profile ) {
954	free(profile);
955	profile = NULL;
956	}
957
958	if ( arg ) {
959	profile = strdup(arg);
960	if ( ! profile )
961	return -1;
962	}
963
964	return 0;
965	}
966
967	/* Allow initialization of prelude; to be called
968	* after forking the daemon. Delays heartbeat
969	* start after config read until it is safe.
970	*/
971	void sh_prelude_reset(void)
972	{
973	extern void sh_error_init_prelude();
974
975	ready_for_init = 1;
976	sh_error_init_prelude();
977	return;
978	}
979
980
981
982	void sh_prelude_stop(void)
983	{
984	if (initialized < 1)
985	return;
986	prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
987	client = NULL;
988	initialized = 0;
989	return;
990	}
991
992
993
994	int sh_prelude_init(void)
995	{
996	int ret;
997	prelude_string_t *str;
998	idmef_analyzer_t *analyzer;
999	prelude_client_flags_t flags;
1000	#ifdef SH_NOFAILOVER
1001	prelude_connection_pool_t *pool;
1002	prelude_connection_pool_flags_t conn_flags;
1003	#endif
1004
1005	if (ready_for_init == 0)
1006	return initialized;
1007
1008	if (initialized > 0)
1009	return initialized;
1010
1011	prelude_thread_init(NULL);
1012	prelude_init(&sh_argc_store, sh_argv_store);
1013
1014	ret = prelude_client_new(&client, profile ? profile : _("samhain"));
1015	if ( ret < 0 ) {
1016	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
1017	_("Failed to initialize Prelude"), _("sh_prelude_init"));
1018	initialized = -1;
1019	return -1;
1020	}
1021
1022	/*
1023	* Enable automatic heartbeat sending.
1024	*/
1025	flags = prelude_client_get_flags(client);
1026	ret = prelude_client_set_flags(client, flags \| PRELUDE_CLIENT_FLAGS_ASYNC_TIMER);
1027
1028	analyzer = prelude_client_get_analyzer(client);
1029
1030	ret = idmef_analyzer_new_model(analyzer, &str);
1031	prelude_string_set_dup(str, IDMEF_ANALYZER_MODEL);
1032
1033	ret = idmef_analyzer_new_class(analyzer, &str);
1034	prelude_string_set_dup(str, IDMEF_ANALYZER_CLASS);
1035
1036	ret = idmef_analyzer_new_version(analyzer, &str);
1037	prelude_string_set_dup(str, IDMEF_ANALYZER_VERSION);
1038
1039	#ifdef SH_NOFAILOVER
1040	pool = prelude_client_get_connection_pool(client);
1041	conn_flags = prelude_connection_pool_get_flags(pool);
1042
1043	conn_flags &= ~PRELUDE_CONNECTION_POOL_FLAGS_FAILOVER;
1044	prelude_connection_pool_set_flags(pool, conn_flags);
1045	#endif
1046
1047	ret = prelude_client_start(client);
1048	if ( ret < 0 ) {
1049	prelude_perror(ret, _("error starting prelude client"));
1050
1051	if ( prelude_client_is_setup_needed(ret) )
1052	prelude_client_print_setup_error(client);
1053
1054	sh_error_handle((-1), FIL__, __LINE__, -1, MSG_E_SUBGEN,
1055	_("Failed to start Prelude"), _("sh_prelude_init"));
1056	initialized = -1;
1057	return -1;
1058	}
1059
1060	initialized = 1;
1061	return 1;
1062	}
1063
1064	/* HAVE_LIBPRELUDE_9 */
1065	#endif
1066

Note: See TracBrowser for help on using the repository browser.

Download in other formats: