# --- SDE-COPYRIGHT-NOTE-BEGIN ---
# This copyright note is auto-generated by ./scripts/Create-CopyPatch.
#
# Filename: package/.../sancp/sancp-1.6.1-stable-prelude-3.diff
# Copyright (C) 2007 The OpenSDE Project
#
# More information can be found in the files COPYING and README.
#
# This patch file is dual-licensed. It is available under the license the
# patched project is licensed under, as long as it is an OpenSource license
# as defined at http://www.opensource.org/ (e.g. BSD, X11) or under the terms
# of the GNU General Public License as published by the Free Software
# Foundation; either version 2 of the License, or (at your option) any later
# version.
# --- SDE-COPYRIGHT-NOTE-END ---
diff -ruN sancp-1.6.1-stable.vanilla/Makefile sancp-1.6.1-stable/Makefile
--- sancp-1.6.1-stable.vanilla/Makefile 2007-07-07 00:46:11.000000000 +0200
+++ sancp-1.6.1-stable/Makefile 2007-07-24 13:44:01.000000000 +0200
@@ -9,7 +9,7 @@
# LINUX and BSD CFLAGS
-CFLAGS = -O3 -I/usr/include/pcap -I/usr/local/include/pcap -I./ -L/usr/lib/libsocket.so -g -L/opt/csw/lib -ggdb
+CFLAGS = -g -O3 -I/usr/include/pcap -I/usr/local/include/pcap -I./ -L/usr/lib/libsocket.so -g -L/opt/csw/lib -ggdb `libprelude-config --cflags`
# LINUX LFLAGS
LFLAGS = -lresolv -lnsl -lpcap -L/usr/lib/libpcap.so.0.6.2
@@ -41,10 +41,10 @@
bsd :
@(echo "#define PLATFORM_BSD" > platform.h)
@make final
- g++ -Wall $(BFLAGS) $(CFLAGS) -o sancp sancp.o misc_functs.o check_packet.o statefull_logging.o build_acl.o apply_rule.o decode.o pcap_functions.o pcapFileHandle.o fileHandle.o MemoryPool.o permissions.o outputFileHandle.o help.o
+ g++ -Wall $(BFLAGS) $(CFLAGS) -o sancp sancp.o misc_functs.o check_packet.o statefull_logging.o build_acl.o apply_rule.o decode.o pcap_functions.o pcapFileHandle.o fileHandle.o MemoryPool.o permissions.o outputFileHandle.o help.o `libprelude-config --libs` `libprelude-config --ldflags`
linux :
@(echo "#define PLATFORM_LINUX" > platform.h)
@make final
- g++ -Wall $(LFLAGS) $(CFLAGS) -o sancp sancp.o misc_functs.o check_packet.o statefull_logging.o build_acl.o apply_rule.o decode.o pcap_functions.o pcapFileHandle.o fileHandle.o MemoryPool.o permissions.o outputFileHandle.o help.o
+ g++ -Wall $(LFLAGS) $(CFLAGS) -o sancp sancp.o misc_functs.o check_packet.o statefull_logging.o build_acl.o apply_rule.o decode.o pcap_functions.o pcapFileHandle.o fileHandle.o MemoryPool.o permissions.o outputFileHandle.o help.o `libprelude-config --libs` `libprelude-config --ldflags`
diff -ruN sancp-1.6.1-stable.vanilla/apply_rule.cc sancp-1.6.1-stable/apply_rule.cc
--- sancp-1.6.1-stable.vanilla/apply_rule.cc 2007-07-05 18:12:20.000000000 +0200
+++ sancp-1.6.1-stable/apply_rule.cc 2007-07-24 13:44:01.000000000 +0200
@@ -47,6 +47,12 @@
tc->tcplag=myacl->tcplag;
tc->status=myacl->status;
tc->rid=myacl->rid;
+ tc->prelude_impact_severity=myacl->prelude_impact_severity;
+ tc->prelude_impact_completion=myacl->prelude_impact_completion;
+ tc->prelude_impact_type=myacl->prelude_impact_type;
+ tc->prelude_confidence_rating=myacl->prelude_confidence_rating;
+
+
if(myacl->pmode==OMODE_UNIQ)
{
@@ -112,6 +118,10 @@
nc->rgid=myacl->rgid;
nc->zone=myacl->zone;
nc->node=myacl->node;
+ nc->prelude_impact_severity=myacl->prelude_impact_severity;
+ nc->prelude_impact_completion=myacl->prelude_impact_completion;
+ nc->prelude_impact_type=myacl->prelude_impact_type;
+ nc->prelude_confidence_rating=myacl->prelude_confidence_rating;
myacl->ctr++;
return;
}
@@ -130,6 +140,10 @@
nc->timeout=gVars.default_timeout;
nc->tcplag=gVars.default_tcplag;
nc->node=gVars.default_node;
+ nc->prelude_impact_severity=gVars.prelude_impact_severity;
+ nc->prelude_impact_completion=gVars.prelude_impact_completion;
+ nc->prelude_impact_type=gVars.prelude_impact_type;
+ nc->prelude_confidence_rating=gVars.prelude_confidence_rating;
gVars.default_ctr++;
#ifdef DEBUG
printf("Setting stats: %d pcap: %d realtime: %d limit: %d timeout: %d tcplag: %d\n", nc->stats, nc->pcap, nc->realtime, nc->limit, nc->timeout, nc->tcplag);
diff -ruN sancp-1.6.1-stable.vanilla/build_acl.cc sancp-1.6.1-stable/build_acl.cc
--- sancp-1.6.1-stable.vanilla/build_acl.cc 2007-07-05 18:12:20.000000000 +0200
+++ sancp-1.6.1-stable/build_acl.cc 2007-07-24 13:44:01.000000000 +0200
@@ -1168,6 +1168,62 @@
fprintf(stdout,"Didn't set default for %s to %s\n",tok,tmp);
#endif
}
+ if(strcmp(tok,"prelude_impact_severity")==0)
+ {
+ if((tmp = get_tok(&rules,accept))==NULL)
+ {
+ syslog(LOG_ERR,"Format error, prelude_impact_severity specified but none provided, using prelude_impact_severity %s\n",PRELUDE_IMPACT_SEVERITY);
+ free(rule);
+ return;
+ }
+ gVars.prelude_impact_severity = strdup(tmp);
+ free(rule);
+ }
+ if(strcmp(tok,"prelude_impact_completion")==0)
+ {
+ if((tmp = get_tok(&rules,accept))==NULL)
+ {
+ syslog(LOG_ERR,"Format error, prelude_impact_completion specified but none provided, using prelude_impact_completion %s\n",PRELUDE_IMPACT_COMPLETION);
+ free(rule);
+ return;
+ }
+ gVars.prelude_impact_completion = strdup(tmp);
+ free(rule);
+ }
+ if(strcmp(tok,"prelude_impact_type")==0)
+ {
+ if((tmp = get_tok(&rules,accept))==NULL)
+ {
+ syslog(LOG_ERR,"Format error, prelude_impact_type specified but none provided, using prelude_impact_type %s\n",PRELUDE_IMPACT_TYPE);
+ free(rule);
+ return;
+ }
+ gVars.prelude_impact_type = strdup(tmp);
+ free(rule);
+ }
+ if(strcmp(tok,"prelude_confidence_rating")==0)
+ {
+ if((tmp = get_tok(&rules,accept))==NULL)
+ {
+ syslog(LOG_ERR,"Format error, prelude_confidence_rating specified but none provided, using prelude_confidence_rating %s\n",PRELUDE_CONFIDENCE_RATING);
+ free(rule);
+ return;
+ }
+ gVars.prelude_confidence_rating = strdup(tmp);
+ free(rule);
+ }
+ if(strcmp(tok,"prelude_profile")==0)
+ {
+ if((tmp = get_tok(&rules,accept))==NULL)
+ {
+ syslog(LOG_ERR,"Format error, prelude_profile specified but none provided, using prelude_profile %s\n",PRELUDE_PROFILE);
+ free(rule);
+ return;
+ }
+ gVars.prelude_profile = strdup(tmp);
+ free(rule);
+ }
+
}
void parse_var(char *c_rule, char *accept)
@@ -1426,6 +1482,10 @@
}else{
n_acl->fH = 0;
}
+ n_acl->prelude_impact_severity = gVars.prelude_impact_severity;
+ n_acl->prelude_impact_completion = gVars.prelude_impact_completion;
+ n_acl->prelude_impact_type = gVars.prelude_impact_type;
+ n_acl->prelude_confidence_rating = gVars.prelude_confidence_rating;
// FIELD 0 - required - Get the h_proto
n_acl->h_proto_h = 0xFFFF;
@@ -2061,6 +2121,46 @@
n_acl->retro = true;
continue;
}
+ if(strcmp(tok,"severity")==0)
+ {
+ if((tmp = get_tok(rules,accept))==NULL)
+ {
+ syslog(LOG_ERR,"Format error, severity specified but no option provided%s\n",rule);
+ return;
+ }
+ n_acl->prelude_impact_severity = strdup(tmp);
+ continue;
+ }
+ if(strcmp(tok,"completion")==0)
+ {
+ if((tmp = get_tok(rules,accept))==NULL)
+ {
+ syslog(LOG_ERR,"Format error, completion specified but no option provided%s\n",rule);
+ return;
+ }
+ n_acl->prelude_impact_completion = strdup(tmp);
+ continue;
+ }
+ if(strcmp(tok,"type")==0)
+ {
+ if((tmp = get_tok(rules,accept))==NULL)
+ {
+ syslog(LOG_ERR,"Format error, type specified but no option provided%s\n",rule);
+ return;
+ }
+ n_acl->prelude_impact_type = strdup(tmp);
+ continue;
+ }
+ if(strcmp(tok,"confidence")==0)
+ {
+ if((tmp = get_tok(rules,accept))==NULL)
+ {
+ syslog(LOG_ERR,"Format error, confidence specified but no option provided%s\n",rule);
+ return;
+ }
+ n_acl->prelude_confidence_rating = strdup(tmp);
+ continue;
+ }
syslog(LOG_ERR,"Skipping, invalid option in rule: %s %s\n", tok,*rules);
return;
}
diff -ruN sancp-1.6.1-stable.vanilla/docs/README sancp-1.6.1-stable/docs/README
--- sancp-1.6.1-stable.vanilla/docs/README 2007-07-06 03:33:14.000000000 +0200
+++ sancp-1.6.1-stable/docs/README 2007-07-24 13:44:01.000000000 +0200
@@ -277,6 +277,10 @@
strip-80211 { disable|enable }
node <number>
debug_pcap_raw { disable|enable }
+ prelude_impact_severity [string]
+ prelude_impact_completion [string]
+ prelude_impact_type [string]
+ prelude_confidence_rating [string]
known_port syntax:
-----------------------:
@@ -310,6 +314,9 @@
b) tagging options
i.e. status=16 rid=1112 node=2
+ c) prelude options
+ i.e. severity=severe, completion=succeeded, type=other, confidence=high
+
[<ether protocol>[-<end_range>] [<src_ip{/<CIDR>|<dotted>}>] [<dst_ip{/<CIDR>|<dotted>}>] [{tcp|udp|icmp|<proto number>[-<end_range>] }]
[<src_port>{-[<end_port_range>]}] [<dst_port>{-[<end_port_range>]}]
{ ignore | stats [{log|pass}] | realtime [{log|pass}] |
diff -ruN sancp-1.6.1-stable.vanilla/gvars.h sancp-1.6.1-stable/gvars.h
--- sancp-1.6.1-stable.vanilla/gvars.h 2007-07-05 18:12:20.000000000 +0200
+++ sancp-1.6.1-stable/gvars.h 2007-07-24 13:44:01.000000000 +0200
@@ -17,7 +17,8 @@
/* Make certain all id's are represented in the same order (as strings) in fmtnames[] */
/* 'null' is a place holder - in the list for field 0 */
-enum id {null,sancp_id,start_time_gmt,start_time_local,stop_time_gmt,stop_time_local,erased_time_gmt,erased_time_local,eth_proto_hex,eth_proto,ip_proto,src_ip_decimal,src_ip_dotted,src_port,dst_ip_decimal,dst_ip_dotted,dst_port,duration,timeout,src_pkts,dst_pkts,src_bytes,dst_bytes,sflags_hex,sflags,sflags_1,sflags_2,sflags_U,sflags_A,sflags_P,sflags_R,sflags_S,sflags_F,dflags_hex,dflags,dflags_1,dflags_2,dflags_U,dflags_A,dflags_P,dflags_R,dflags_S,dflags_F,cflags_hex,cflags,cflags_DA,cflags_SA,cflags_DR,cflags_SR,cflags_DF,cflags_SF,ip_len_s,ip_ttl_s,ip_df_s,tcp_wss_s,tcp_mss_s,tcp_wscale_s,tcp_sack_ok_s,tcp_nop_s,ip_len_d,ip_ttl_d,ip_df_d,tcp_wss_d,tcp_mss_d,tcp_wscale_d,tcp_sack_ok_d,tcp_nop_d,total_bytes,collect,collected,climit,tcplag,pcap,realtime,stats,reversed,hash,rid,rgid,node,zone,status,retro,src_mac,dst_mac };
+enum id
+{null,sancp_id,start_time_gmt,start_time_local,stop_time_gmt,stop_time_local,erased_time_gmt,erased_time_local,eth_proto_hex,eth_proto,ip_proto,src_ip_decimal,src_ip_dotted,src_port,dst_ip_decimal,dst_ip_dotted,dst_port,duration,timeout,src_pkts,dst_pkts,src_bytes,dst_bytes,sflags_hex,sflags,sflags_1,sflags_2,sflags_U,sflags_A,sflags_P,sflags_R,sflags_S,sflags_F,dflags_hex,dflags,dflags_1,dflags_2,dflags_U,dflags_A,dflags_P,dflags_R,dflags_S,dflags_F,cflags_hex,cflags,cflags_DA,cflags_SA,cflags_DR,cflags_SR,cflags_DF,cflags_SF,ip_len_s,ip_ttl_s,ip_df_s,tcp_wss_s,tcp_mss_s,tcp_wscale_s,tcp_sack_ok_s,tcp_nop_s,ip_len_d,ip_ttl_d,ip_df_d,tcp_wss_d,tcp_mss_d,tcp_wscale_d,tcp_sack_ok_d,tcp_nop_d,total_bytes,collect,collected,climit,tcplag,pcap,realtime,stats,reversed,hash,rid,rgid,node,zone,status,retro,src_mac,dst_mac,prelude_impact_sevirty,prelude_impact_completion,prelude_impact_type,prelude_confidence_rating,prelude_profile };
struct cnx_queue {
struct cnx *head;
@@ -102,5 +103,10 @@
int stdout_fmt_len;
pcap_t *ph; // pcap handle
struct pcap_pkthdr *g_pkthdr;//
+ char *prelude_impact_severity;
+ char *prelude_impact_completion;
+ char *prelude_impact_type;
+ char *prelude_confidence_rating;
+ char *prelude_profile;
};
diff -ruN sancp-1.6.1-stable.vanilla/sancp.cc sancp-1.6.1-stable/sancp.cc
--- sancp-1.6.1-stable.vanilla/sancp.cc 2007-07-05 18:12:20.000000000 +0200
+++ sancp-1.6.1-stable/sancp.cc 2007-07-24 13:44:01.000000000 +0200
@@ -48,7 +48,40 @@
//char dfltfmt[]= { sancp_id,start_time_gmt,src_mac,dst_mac,eth_proto,src_ip_dotted,dst_ip_dotted,ip_proto,src_port,dst_port };
char dfltfmt_human_readable[]= { sancp_id,start_time_gmt,stop_time_gmt,erased_time_gmt,eth_proto,ip_proto,src_ip_dotted,src_port,dst_ip_dotted,dst_port,duration,timeout,src_pkts,dst_pkts,src_bytes,dst_bytes,sflags_hex,dflags_hex,cflags_hex,ip_len_s,ip_ttl_s,ip_df_s,tcp_wss_s,tcp_mss_s,tcp_wscale_s,tcp_sack_ok_s,tcp_nop_s,ip_len_d,ip_ttl_d,ip_df_d,tcp_wss_d,tcp_mss_d,tcp_wscale_d,tcp_sack_ok_d,tcp_nop_d,total_bytes,collect,collected,climit,tcplag,pcap,realtime,stats,reversed,hash,rid,rgid,node,zone,status,retro,src_mac,dst_mac };
+prelude_client_t *client;
+static idmef_analyzer_t *idmef_analyzer;
+int sancp_alert_init(prelude_client_t *client)
+{
+ int ret;
+ prelude_string_t *string;
+
+ idmef_analyzer = prelude_client_get_analyzer(client);
+ if ( ! idmef_analyzer )
+ return -1;
+
+ ret = idmef_analyzer_new_model(idmef_analyzer, &string);
+ if ( ret < 0 )
+ return -1;
+ prelude_string_set_constant(string, PRELUDE_ANALYZER_MODEL);
+
+ ret = idmef_analyzer_new_class(idmef_analyzer, &string);
+ if ( ret < 0 )
+ return -1;
+ prelude_string_set_constant(string, PRELUDE_ANALYZER_CLASS);
+
+ ret = idmef_analyzer_new_manufacturer(idmef_analyzer, &string);
+ if ( ret < 0 )
+ return -1;
+ prelude_string_set_constant(string, PRELUDE_ANALYZER_MANUFACTURER);
+
+ ret = idmef_analyzer_new_version(idmef_analyzer, &string);
+ if ( ret < 0 )
+ return -1;
+ prelude_string_set_constant(string, VERSION);
+
+ return 0;
+}
/*************
* Main *
*************/
@@ -56,6 +89,7 @@
int main(int argc, char *argv[]) {
extern struct gvars gVars;
int cKey;
+ int ret;
pid_t pid=0;
/*
@@ -102,6 +136,14 @@
gVars.stdout_delimiter=DEFAULT_DELIMITER;
gVars.stdout_eor=DEFAULT_EOR;
+ gVars.prelude_impact_severity=PRELUDE_IMPACT_SEVERITY;
+ gVars.prelude_impact_completion=PRELUDE_IMPACT_COMPLETION;
+ gVars.prelude_impact_type=PRELUDE_IMPACT_TYPE;
+ gVars.prelude_confidence_rating=PRELUDE_CONFIDENCE_RATING;
+ gVars.prelude_profile=PRELUDE_PROFILE;
+
+
+
for(cKey=0; cKey<HASH_KEYS; cKey++)
{
gVars.cnx_head[cKey]=NULL;
@@ -116,6 +158,8 @@
parse_args(argc, argv);
+
+
if(gVars.human_readable){
if(gVars.realtime_fmt_len!=sizeof(dfltfmt_human_readable)){
free(gVars.realtime_fmt);
@@ -143,7 +187,15 @@
setsid();
}
+ prelude_log_set_flags((prelude_log_flags_t)PRELUDE_LOG_FLAGS_SYSLOG);
}
+
+ /* Initialize prelude */
+ ret = prelude_init(&argc, argv);
+ if (ret < 0) {
+ prelude_perror(ret, "unable to initialize the prelude library");
+ exit_all(0);
+ }
/* Retrieve the last cnxid from cache file if we haven't already in parse_args() */
if(!gVars.cnx_id)
@@ -197,6 +249,29 @@
build_config(1);
+ /* Create prelude sensor */
+
+ ret = prelude_client_new(&client, gVars.prelude_profile);
+ if ( ! client ) {
+ prelude_perror(ret, "Unable to create a prelude client object");
+ exit_all(0);
+ }
+
+ /* Start prelude sensor */
+ sancp_alert_init(client);
+ ret = prelude_client_start(client);
+ if ( ret < 0 ) {
+ prelude_perror(ret, "Unable to start prelude client");
+ exit_all(0);
+ }
+
+ ret = prelude_client_set_flags(client, (prelude_client_flags_t)
+ (PRELUDE_CLIENT_FLAGS_ASYNC_SEND|PRELUDE_CLIENT_FLAGS_ASYNC_TIMER));
+ if ( ret < 0 ) {
+ fprintf(stderr, "Unable to set asynchronous send and timer.\n");
+ exit_all(0);
+ }
+
/* Open files for output */
/* Be r3al l33t h3r3 */
diff -ruN sancp-1.6.1-stable.vanilla/sancp.h sancp-1.6.1-stable/sancp.h
--- sancp-1.6.1-stable.vanilla/sancp.h 2007-07-06 06:18:04.000000000 +0200
+++ sancp-1.6.1-stable/sancp.h 2007-07-24 13:44:01.000000000 +0200
@@ -47,6 +47,10 @@
#include "gvars.h"
#endif
+#include <libprelude/prelude.h>
+#include <libprelude/prelude-log.h>
+#include <netdb.h>
+
#define NCP_H
#define Y 'Y'
#define N 'N'
@@ -79,6 +83,7 @@
struct vars *next;
};
+extern prelude_client_t *client;
int main(int argc, char *argv[]);
struct cnx *process(struct cnx*, int len, u_char * pkt);
char * createPcapFileName();
@@ -185,6 +190,15 @@
#define OMODE_RULE 5
#define OMODE_UNIQ 6
+#define PRELUDE_IMPACT_SEVERITY "medium"
+#define PRELUDE_IMPACT_COMPLETION "succeeded"
+#define PRELUDE_IMPACT_TYPE "other"
+#define PRELUDE_CONFIDENCE_RATING "high"
+#define PRELUDE_ANALYZER_MODEL "Sancp"
+#define PRELUDE_ANALYZER_CLASS "NIDS"
+#define PRELUDE_ANALYZER_MANUFACTURER "http://www.metre.net/sancp.html"
+#define PRELUDE_PROFILE "sancp"
+
// Need to distinguish between classes of variables
#define VCLASS_0 1 // eth_proto class vars
#define VCLASS_1 2 // ip_addr class vars
@@ -276,6 +290,10 @@
u_int16_t rgid;
u_int16_t node;
u_int16_t zone;
+ char *prelude_impact_severity;
+ char *prelude_impact_completion;
+ char *prelude_impact_type;
+ char *prelude_confidence_rating;
CBuffer *CBufferPtr;
struct acl *next;
};
@@ -314,6 +332,10 @@
u_int16_t rgid;
u_int16_t node;
u_int16_t zone;
+ char *prelude_impact_severity;
+ char *prelude_impact_completion;
+ char *prelude_impact_type;
+ char *prelude_confidence_rating;
CBuffer *CBufferPtr;
struct os_info os_info;
struct os_info os_info2;
diff -ruN sancp-1.6.1-stable.vanilla/statefull_logging.cc sancp-1.6.1-stable/statefull_logging.cc
--- sancp-1.6.1-stable.vanilla/statefull_logging.cc 2007-07-05 18:12:20.000000000 +0200
+++ sancp-1.6.1-stable/statefull_logging.cc 2007-07-24 13:44:01.000000000 +0200
@@ -183,6 +183,208 @@
snprintf(buf,len,"%s",currenttime);
}
+static int add_idmef_object(idmef_message_t *message, const char *object, const char *value)
+{
+ int ret;
+ idmef_value_t *val;
+ idmef_path_t *path;
+
+ ret = idmef_path_new(&path, object);
+ if ( ret < 0 )
+ return -1;
+
+ ret = idmef_value_new_from_path(&val, path, value);
+ if ( ret < 0 ) {
+ idmef_path_destroy(path);
+ return -1;
+ }
+
+ ret = idmef_path_set(path, message, val);
+
+ idmef_value_destroy(val);
+ idmef_path_destroy(path);
+
+ return ret;
+}
+
+#define IDMEF(x) { \
+ int ret = (x); \
+ if (ret < 0) { idmef_message_destroy(idmef); printf("error\n"); return; } \
+ }
+
+void record_prelude(struct cnx *cn) {
+ char LOG[MAXENTRYLEN];
+
+ idmef_message_t *idmef;
+ idmef_alert_t *alert;
+ idmef_time_t *time;
+
+ struct servent *sourceservent;
+ struct protoent *protoent;
+
+ IDMEF(idmef_message_new(&idmef));
+ IDMEF(idmef_message_new_alert(idmef, &alert));
+
+ /* alert.detecttime */
+ if (cn->start_time) {
+ IDMEF(idmef_time_new_from_time(&time, &cn->start_time));
+ } else {
+ /* using the curen time */
+ IDMEF(idmef_time_new_from_gettimeofday(&time));
+ }
+ idmef_alert_set_detect_time(alert, time);
+
+ /* alert.createtime */
+ time = NULL;
+ IDMEF(idmef_time_new_from_gettimeofday(&time));
+ idmef_alert_set_create_time(alert, time);
+
+ /* alert.analyzer */
+ idmef_alert_set_analyzer(alert,idmef_analyzer_ref(prelude_client_get_analyzer(client)),0);
+
+ /* alert.classification.text */
+ add_idmef_object(idmef, "alert.classification.text",
+ "Unauthorized network connectivity");
+
+ /* alert.messageid */
+ snprintf(LOG,MAXENTRYLEN,"%lld",cn->cid);
+ add_idmef_object(idmef, "alert.messageid", LOG);
+
+ /* alert.impact.severity */
+ add_idmef_object(idmef, "alert.assessment.impact.severity",
+ cn->prelude_impact_severity);
+
+ /* alert.impact.completion */
+ add_idmef_object(idmef, "alert.assessment.impact.completion",
+ cn->prelude_impact_completion);
+
+ /* alert.impact.type */
+ add_idmef_object(idmef, "alert.assessment.impact.type",
+ cn->prelude_impact_type);
+
+ /* alert.confidence.rating */
+ add_idmef_object(idmef, "alert.assessment.confidence.rating",
+ cn->prelude_confidence_rating);
+
+ /* alert.additionaldata(0) */
+ add_idmef_object(idmef, "alert.additionaldata(0).type", "integer");
+ add_idmef_object(idmef, "alert.additionaldata(0).meaning", "status");
+ snprintf(LOG,MAXENTRYLEN,"%u",cn->status);
+ add_idmef_object(idmef, "alert.additionaldata(0).integer", LOG);
+
+ /* alert.additionaldata(1) */
+ add_idmef_object(idmef, "alert.additionaldata(1).type", "integer");
+ add_idmef_object(idmef, "alert.additionaldata(1).meaning", "Network node");
+ snprintf(LOG,MAXENTRYLEN,"%u",cn->node);
+ add_idmef_object(idmef, "alert.additionaldata(1).integer", LOG);
+
+ /* IP versios */
+ if (cn->h_proto == 8) {
+ add_idmef_object(idmef, "alert.source(0).service.ip_version", "4");
+ add_idmef_object(idmef, "alert.target(0).service.ip_version", "4");
+ } else {
+ /* bail out */
+ idmef_message_destroy(idmef);
+ return;
+ }
+
+ /* alert.source(0).node.address(0) (ip address) */
+ if(cn->reversed==CNX_REVERSED){
+ snprintf_inaddr_toa(LOG,MAXENTRYLEN,(struct in_addr*) &cn->d_ip,'\0');
+ }else{
+ snprintf_inaddr_toa(LOG,MAXENTRYLEN,(struct in_addr*) &cn->s_ip,'\0');
+ }
+ add_idmef_object(idmef, "alert.source(0).node.address(0).category",
+ "ipv4-addr");
+ add_idmef_object(idmef, "alert.source(0).node.address(0).address", LOG);
+
+ /* alert.source(0).node.address(1) (mac address) */
+ add_idmef_object(idmef, "alert.source(0).node.address(1).category", "mac");
+ {
+ struct myether_addr *es=(struct myether_addr *)&cn->eth_hdr.ether_shost;
+ snprintf(LOG,MAXENTRYLEN,"%0x:%0x:%0x:%0x:%0x:%0x",es->octet[0],es->octet[1],es->octet[2],es->octet[3],es->octet[4],es->octet[5]);
+ }
+ add_idmef_object(idmef, "alert.source(0).node.address(1).address", LOG);
+
+ protoent = getprotobynumber(cn->proto);
+
+ /* alert.source(0).iana_protocol_number */
+ snprintf(LOG,MAXENTRYLEN,"%u",(cn->proto));
+ add_idmef_object(idmef, "alert.source(0).service.iana_protocol_number", LOG);
+
+ /* alert.target(0).iana_protocol_number */
+ add_idmef_object(idmef, "alert.target(0).service.iana_protocol_number", LOG);
+
+
+ if (protoent) {
+ /* alert.source(0).iana_protocol_name */
+ add_idmef_object(idmef, "alert.source(0).service.iana_protocol_name",
+ protoent->p_name);
+
+ /* alert.target(0).iana_protocol_name */
+ add_idmef_object(idmef, "alert.target(0).service.iana_protocol_name",
+ protoent->p_name);
+
+ /* alert.source(0).service */
+ setservent(1);
+ if(cn->reversed==CNX_REVERSED){
+ snprintf(LOG,MAXENTRYLEN,"%u",ntohs(cn->d_port));
+ sourceservent = getservbyport(ntohs(cn->d_port), protoent->p_name);
+ }else{
+ snprintf(LOG,MAXENTRYLEN,"%u",ntohs(cn->s_port));
+ sourceservent = getservbyport(ntohs(cn->s_port), protoent->p_name);
+ }
+
+ if (sourceservent && sourceservent->s_name)
+ add_idmef_object(idmef, "alert.source(0).service.name",
+ sourceservent->s_name );
+ add_idmef_object(idmef, "alert.source(0).service.port",
+ LOG);
+ add_idmef_object(idmef, "alert.source(0).service.protocol",
+ protoent->p_name);
+
+ /* alert.target(0).service */
+ if(cn->reversed==CNX_REVERSED){
+ snprintf(LOG,MAXENTRYLEN,"%u",ntohs(cn->s_port));
+ sourceservent = getservbyport(ntohs(cn->s_port), protoent->p_name);
+ }else{
+ snprintf(LOG,MAXENTRYLEN,"%u",ntohs(cn->d_port));
+ sourceservent = getservbyport(ntohs(cn->d_port), protoent->p_name);
+ }
+
+ if (sourceservent && sourceservent->s_name)
+ add_idmef_object(idmef, "alert.target(0).service.name",
+ sourceservent->s_name );
+ add_idmef_object(idmef, "alert.target(0).service.port",
+ LOG);
+ add_idmef_object(idmef, "alert.target(0).service.protocol",
+ protoent->p_name);
+ }
+/*
+*/
+
+ /* alert.target(0).node.address(0) (ip address) */
+ if(cn->reversed==CNX_REVERSED){
+ snprintf_inaddr_toa(LOG,MAXENTRYLEN,(struct in_addr*) &cn->s_ip,'\0');
+ }else{
+ snprintf_inaddr_toa(LOG,MAXENTRYLEN,(struct in_addr*) &cn->d_ip,'\0');
+ }
+ add_idmef_object(idmef, "alert.target(0).node.address(0).category",
+ "ipv4-addr");
+ add_idmef_object(idmef, "alert.target(0).node.address(0).address", LOG);
+
+ /* alert.target(0).node_address(1) (mac address) */
+ add_idmef_object(idmef, "alert.target(0).node.address(1).category", "mac");
+ {
+ struct myether_addr *es=(struct myether_addr *)&cn->eth_hdr.ether_dhost;
+ snprintf(LOG,MAXENTRYLEN,"%0x:%0x:%0x:%0x:%0x:%0x",es->octet[0],es->octet[1],es->octet[2],es->octet[3],es->octet[4],es->octet[5]);
+ }
+ add_idmef_object(idmef, "alert.target(0).node.address(1).address", LOG);
+
+ prelude_client_send_idmef(client, idmef);
+ idmef_message_destroy(idmef);
+}
+
void record(struct cnx *cn, outputFileHandle *fH)
{
@@ -199,8 +401,15 @@
char eor=fH->getEor();
+ /* do we want prelude alert generation for this record? */
+
bzero(LOG,MAXENTRYLEN);
+ if (fH == gVars.sfH) {
+ record_prelude(cn);
+ }
+
+
/*
* Structure of a 48-bit Ethernet address.
