Changeset 180 for trunk/src/sh_prelude.c

Timestamp:

Sep 23, 2008, 6:55:45 PM (16 years ago)

Author:

katerina

Message:

Process lookup (Linux) for open ports (ticket #117). Also fix for minor dnmalloc bug (ticket #119).

File:

• trunk/src/sh_prelude.c (modified) (2 diffs)

trunk/src/sh_prelude.c

@@ -700 +700 @@
         idmef_address_t *address;
         idmef_node_t *node;
+        idmef_user_t *user;
+        idmef_process_t *process;
         idmef_service_t *service;
         idmef_source_t *source = idmef_alert_get_next_source(alert, NULL);
@@ -847 +849 @@
 
         SH_FREE( new );
+
+        ptr = get_value(msg, _("user"), NULL);
+
+        if ( ptr ) {
+
+                ret = idmef_source_new_user(source, &user);
+                if ( ret < 0 ) {
+                        free(ptr);
+                        return ret;
+                }
+
+                ret = idmef_user_new_ident(user, &str);
+                if ( ret < 0 ) {
+                        free(ptr);
+                        return ret;
+                }
+                prelude_string_set_nodup(str, ptr);
+        }
+
+        ptr = get_value(msg, _("path"), NULL);
+
+        if ( ptr ) {
+
+                /*
+                 * In term of IDMEF, this is the full path,
+                 * including the name.
+                 */
+                ret = idmef_source_new_process(source, &process);
+                if ( ret < 0 ) {
+                        free(ptr);
+                        return ret;
+                }
+
+                ret = idmef_process_new_path(process, &str);
+                if ( ret < 0 ) {
+                        free(ptr);
+                        return ret;
+                }
+                prelude_string_set_nodup(str, ptr);
+
+                ptr = strrchr(ptr, '/');
+                if ( ptr ) {
+                        ret = idmef_process_new_name(process, &str);
+                        if ( ret == 0 ) {
+                                prelude_string_set_dup(str, ptr + 1);
+                        }
+                }
+        }
 
         return 0;