op_fast.c

知名的开源IDS的日志工具

/* $Id: op_fast.c,v 1.9 2004/03/16 04:18:20 andrewbaker Exp $ */
/*
** Copyright (C) 2001-2002 Andrew R. Baker <[e-mail]>
** Copyright (C) 2001 Martin Roesch <[e-mail]>
**
** This program is distributed under the terms of version 1.0 of the 
** Q Public License.  See LICENSE.QPL for further details.
**
** This program is distributed in the hope that it will be useful,
** but WITHOUT ANY WARRANTY; without even the implied warranty of
** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
**
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/types.h>
#include <netinet/in.h>


#include "input-plugins/dp_alert.h"
#include "strlcpyu.h"
#include "plugbase.h"
#include "op_plugbase.h"
#include "mstring.h"
#include "op_fast.h"
#include "util.h"
#include "sid.h"
#include "classification.h"
#include "barnyard.h"

typedef struct _OpAlertFast_Data 
{
    char *filename;  /* file to open for output */
    char *filepath;  /* file to open for output */
    FILE *file;
} OpAlertFast_Data;


static int OpAlertFast_Setup(OutputPlugin *outputPlugin, char *args);
static int OpAlertFast_Exit(OutputPlugin *);
static int OpAlertFast_Start(OutputPlugin *, void *);
static int OpAlertFast_Stop(OutputPlugin *);
static int OpAlertFast(void *, void *);
static int OpAlertFast_LogConfig(OutputPlugin *);

void ParseFastAlertArgs(char *, OutputPlugin *);
FILE *OpenAlertFile(char *);

/* init routine makes this processor available for dataprocessor directives */
void OpAlertFast_Init()
{
    OutputPlugin *outputPlugin;

    outputPlugin = RegisterOutputPlugin("alert_fast", "alert");
    
    outputPlugin->setupFunc = OpAlertFast_Setup;
    outputPlugin->exitFunc = OpAlertFast_Exit;
    outputPlugin->startFunc = OpAlertFast_Start;
    outputPlugin->stopFunc = OpAlertFast_Stop;
    outputPlugin->outputFunc = OpAlertFast;
    outputPlugin->logConfigFunc = OpAlertFast_LogConfig;
}

static int OpAlertFast_LogConfig(OutputPlugin *outputPlugin)
{
    OpAlertFast_Data *data = NULL;

    if(!outputPlugin || !outputPlugin->data)
        return -1;

    data = (OpAlertFast_Data *)outputPlugin->data;

    LogMessage("OpAlertFast configured\n");
    LogMessage("  Filename: %s\n", data->filename);
    return 0;
}

/* link the output processor functions to an output function node */
int OpAlertFast_Setup(OutputPlugin *outputPlugin, char *args)
{
    ParseFastAlertArgs(args, outputPlugin);

    return 0;
}

int OpAlertFast_Exit(OutputPlugin *outputPlugin)
{
    OpAlertFast_Data *data = (OpAlertFast_Data *)outputPlugin->data;

    if(!data)
        return 0;
    
    if(data->filename)
        free(data->filename);
    data->filename = NULL;
    
    if(data->filepath)
        free(data->filepath);
    data->filepath = NULL;

    return 0;
}


int OpAlertFast_Start(OutputPlugin *outputPlugin, void *spool_header)
{
    OpAlertFast_Data *data = (OpAlertFast_Data *)outputPlugin->data;

    
    if(data == NULL)
        FatalError("ERROR: Unable to find context for AlertFast startup!\n");
    
    if(pv.verbose >= 2)
        OpAlertFast_LogConfig(outputPlugin);
    
    data->filepath = ProcessFileOption(data->filename);
    
    data->file = OpenAlertFile(data->filepath);

    return 0 ;
}


int OpAlertFast_Stop(OutputPlugin *outputPlugin)
{
    OpAlertFast_Data *data = (OpAlertFast_Data *)outputPlugin->data;

    if(data->file)
    {
        fflush(data->file);
        fclose(data->file);
        data->file = NULL;
    }
    if(data->filepath)
        free(data->filepath);
    data->filepath = NULL;

    return 0;
}

int OpAlertFast(void *data, void *alertdata)
{
    char timestamp[256];
    //struct in_addr in;
    UnifiedAlertRecord *ad = (UnifiedAlertRecord *)alertdata;
    OpAlertFast_Data *afd = (OpAlertFast_Data *)data;
    ClassType *ct;
    Sid *tmp = NULL;
    char sip[16];
    char dip[16];


    tmp = GetSid(ad->event.sig_generator, ad->event.sig_id);
    ct = GetClassType(ad->event.classification);

    if(RenderTimeval(&ad->ts, timestamp, 256) == -1)
    {
        /* could not render the timeval */
        LogMessage("ERROR: OpAlertFast failed to render timeval\n");
        return -1;  
    }

    snprintf(sip, 16, "%u.%u.%u.%u", (ad->sip & 0xff000000) >> 24,
            (ad->sip & 0x00ff0000) >> 16, (ad->sip & 0x0000ff00) >> 8,
            ad->sip & 0x000000ff);
    snprintf(dip, 16, "%u.%u.%u.%u", (ad->dip & 0xff000000) >> 24,
            (ad->dip & 0x00ff0000) >> 16, (ad->dip & 0x0000ff00) >> 8,
            ad->dip & 0x000000ff);


    if(ad->protocol == IPPROTO_TCP ||
            ad->protocol == IPPROTO_UDP)
    {
        fprintf(afd->file, "%s {%s} %s:%d -> %s:%d\n"
                "[**] [%d:%d:%d] %s [**]\n"
                "[Classification: %s] [Priority: %d]\n", timestamp, 
                protocol_names[ad->protocol], sip, ad->sp, dip, ad->dp,
                ad->event.sig_generator, ad->event.sig_id, ad->event.sig_rev,
                tmp != NULL?tmp->msg:"ALERT", 
                ct != NULL?ct->name:"Unknown", ad->event.priority);
    }
    else
    {
        fprintf(afd->file, "%s {%s} %s -> %s\n"
                "[**] [%d:%d:%d] %s [**]\n"
                "[Classification: %s] [Priority: %d]\n", timestamp, 
                protocol_names[ad->protocol], sip, dip, 
                ad->event.sig_generator, ad->event.sig_id, ad->event.sig_rev,
                tmp != NULL ? tmp->msg : "ALERT", 
                ct != NULL ? ct->name : "Unknown", ad->event.priority);
    }

    PrintXref(ad->event.sig_generator, ad->event.sig_id, afd->file);

    fprintf(afd->file, "-----------------------------------------------------"
            "-------------------\n");

    fflush(afd->file);
    return 0;
}




/* initialize the output processor for this particular instantiation */
void ParseFastAlertArgs(char *args, OutputPlugin *outputPlugin)
{
    char **toks;
    int num_toks;
    OpAlertFast_Data *data;

    data = (OpAlertFast_Data *)SafeAlloc(sizeof(OpAlertFast_Data));

    if(args == NULL)
    {
       data->filename = strdup("fast.alert");
       outputPlugin->data = (OpAlertFast_Data *) data;
       return;
    }

    toks = mSplit(args, " ", 2, &num_toks, 0);
    
    data->filename = strdup(toks[0]);
    
    FreeToks(toks, num_toks);
    
    outputPlugin->data = (OpAlertFast_Data *) data;

    return;
}


FILE *OpenAlertFile(char *filename)
{
     FILE *tmp;   

    if((tmp = fopen(filename, "a+")) == NULL)
    {
        FatalError("ERROR => fopen(%s) failed: %s\n", filename,
                    strerror(errno));
    }
 
    return tmp;
}