Opraven problem s prihlasovanim pri kolizi CN a AN

Zjednodusen kod autorizace

src/warden-server/lib/Warden.pm

@@ -121,6 +121,64 @@ sub getAltNames
 }
 
 
+#-------------------------------------------------------------------------------
+# authorizeClient - authorize client by CN,AN and source IP range
+#-------------------------------------------------------------------------------
+
+sub authorizeClient
+{
+    my ($alt_names, $ip, $service_type, $client_type, $function_name) = @_;
+
+    my $sth;
+    # obtain cidr based on rigth common name and alternate names, service and client_type
+    if($function_name eq 'saveNewEvent') {
+        $sth = $DBH->prepare_cached("SELECT hostname, ip_net_client, receive_own_events 
+                                    FROM clients WHERE hostname IN ($alt_names) AND service = ? AND client_type = ? 
+                                    ORDER BY SUBSTRING_INDEX(ip_net_client,'/', -1) DESC;");
+    }
+    elsif($function_name eq 'getNewEvents') {
+        $sth = $DBH->prepare_cached("SELECT hostname, ip_net_client, receive_own_events 
+                                    FROM clients WHERE hostname IN ($alt_names) AND type = ? AND client_type = ? 
+                                    ORDER BY SUBSTRING_INDEX(ip_net_client,'/', -1) DESC;");
+    }
+
+    if (!defined $sth) { die("Cannot prepare authorization statement in $function_name: $DBI::errstr\n")}
+    $sth->execute($service_type, $client_type);
+    
+    my ($an, $cidr, $receive_own, $cidr_list);
+    my $correct_ip_source = 0;
+    my %ret;
+
+    while(($an, $cidr, $receive_own)  = $sth->fetchrow()) {
+        my $cidr_list = Net::CIDR::Lite-> new -> add($cidr);
+        
+        $ret{'dns'} = $an;
+        $ret{'cidr'} = $cidr;
+        $ret{'receive_own'} = $receive_own;
+           
+        if ($cidr_list->bin_find($ip)) {
+            $correct_ip_source = 1;
+            last;
+        }
+    };
+
+    # check if client is registered
+    if ($sth->rows == 0) {
+        write2log ("err", "Unauthorized access to $function_name from: $ip (CN(AN): $alt_names) - client is not registered");
+        die("Access denied - client is not registered at warden server!");
+        return undef;
+    }
+
+    # check if client has IP from registered CIDR
+    if (!$correct_ip_source) {
+        write2log ("err", "Unauthorized access to $function_name from: $ip (CN(AN): $alt_names) - access from bad subnet: " . $ret{'cidr'});
+        die("Access denied - access from unauthorized subnet!");
+        return undef;
+    }
+
+    return %ret;
+}
+
 
 ################################################################################
 # 				SOAP Functions
@@ -158,46 +216,27 @@ sub saveNewEvent
   my $timeout		= $data->{'TIMEOUT'};
 
 
-  # obtain cidr based on rigth common name and alternate names, service and client_type
-  $sth = $DBH->prepare_cached("SELECT hostname, ip_net_client FROM clients WHERE hostname IN ($alt_names) AND service = ? AND client_type = ? LIMIT 1;");
-  if (!defined $sth) {die("Cannot prepare authorization statement in saveNewEvent: $DBI::errstr\n")}
-  $sth->execute($service, $client_type);
-  my ($an, $cidr) = $sth->fetchrow();
-
-  # check if client is registered
-  if (!defined $cidr) {
-    write2log ("err", "Unauthorized access to saveNewEvent from: $ip (CN: $cn; AN: $an) - client is not registered");
-    die("Access denied - client is not registered at warden server!");
-  } else {
-    $cidr_list = Net::CIDR::Lite
-      -> new
-      -> add($cidr);
-  }
-
-  # check if client has IP from registered CIDR
-  if (!$cidr_list->bin_find($ip)) {
-    write2log ("err", "Unauthorized access to saveNewEvent from: $ip (CN: $cn; AN: $an) - access from bad subnet: $cidr");
-    die("Access denied - access from unauthorized subnet!");
-  } else {
+   my %client = authorizeClient($alt_names, $ip, $service, $client_type, 'saveNewEvent');
+   if(defined %client) {
     # insert new events into DB
     $sth=$DBH->prepare_cached("INSERT INTO events VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);");
     if (!defined $sth) {die("Cannot do insert statement in saveNewEvent: $DBI::errstr\n")}
-    $sth->execute(undef, $cn, $service, $detected, $received, $type, $source_type, $source, $target_proto, $target_port, $attack_scale, $note, $priority, $timeout, $valid);
-
-    # log last inserted ID
-    $sth = $DBH->prepare("SELECT last_insert_id()");
-    if ( !defined $sth ) {die("Cannot prepare last ID statement in saveNewEvent: $DBI::errstr\n")}
-    $sth->execute;
-    my $id= $sth->fetchrow();
-    write2log ("info", "Stored new event (#$id) from $ip (CN: $cn; AN: $an)");
-
-    if (! defined $id) {
-      write2log ("err", "Event from $ip ($cn) was not save: INSERT INTO events VALUES (NULL,$cn,$service,$detected,$received,$type,$source_type,$source,$target_proto,$target_port,$attack_scale,$note,$priority,$timeout,$valid);");
-      die("Event was not save at warden server - database return empty ID!");
-      return 0;
-    } else {
+    $sth->execute(undef, $client{'dns'}, $service, $detected, $received, $type, $source_type, $source, $target_proto, $target_port, $attack_scale, $note, $priority, $timeout, $valid);
+
+    ## log last inserted ID
+    #$sth = $DBH->prepare("SELECT last_insert_id()");
+    #if ( !defined $sth ) {die("Cannot prepare last ID statement in saveNewEvent: $DBI::errstr\n")}
+    #$sth->execute;
+    #my $id= $sth->fetchrow();
+    #write2log ("info", "Stored new event (#$id) from $ip (CN: $cn; AN: $an)");
+
+    #if (! defined $id) {
+    #  write2log ("err", "Event from $ip ($cn) was not save: INSERT INTO events VALUES (NULL,$cn,$service,$detected,$received,$type,$source_type,$source,$target_proto,$target_port,$attack_scale,$note,$priority,$timeout,$valid);");
+    #  die("Event was not save at warden server - database return empty ID!");
+    #  return 0;
+    #} else {
       return 1;
-    }
+    # }
   }
 } # END of saveNewEvent
 
@@ -223,29 +262,10 @@ sub getNewEvents
   my $last_id		 = $data->{'LAST_ID'};
 
 
-  # obtain cidr based on rigth common name, service and client_type
-  $sth = $DBH->prepare_cached("SELECT hostname, receive_own_events, ip_net_client FROM clients WHERE hostname IN ($alt_names) AND type = ? AND client_type = ? LIMIT 1;");
-  if (!defined $sth) {die("Cannot prepare authorization statement in getNewEvents: $DBI::errstr\n")}
-  $sth->execute($requested_type, $client_type);
-  my ($an, $receive_own_events, $cidr) = $sth->fetchrow();
-
-  # check if client is registered
-  if (!defined $cidr) {
-    write2log ("err", "Unauthorized access to getNewEvents from: $ip (CN: $cn; AN: $an) - client is not registered");
-    die("Access denied - client is not registered at warden server!");
-  } else {
-    $cidr_list = Net::CIDR::Lite
-      -> new
-      -> add($cidr);
-  }
-
-  # check if client has IP from registered CIDR
-  if (!$cidr_list->bin_find($ip)) {
-    write2log ("err", "Unauthorized access to getNewEvents from: $ip (CN: $cn; AN: $an) - access from bad subnet: $cidr");
-    die("Access denied - access from unathorized subnet!");
-  } else {
+  my %client = authorizeClient($alt_names, $ip, $requested_type, $client_type, 'getNewEvents');
+  if(defined %client) {
     # check if client want your own events or not
-    if ($receive_own_events eq 't') {
+    if ($client{'receive_own'} eq 't') {
       $sth = $DBH->prepare("SELECT * FROM events WHERE type != 'test' AND id > ? AND type = ? AND valid = 't' ORDER BY id ASC;");
       if (!defined $sth) {die("Cannot prepare ROE statement in getNewEvents: $DBI::errstr\n")}
       $sth->execute($last_id, $requested_type);
@@ -296,9 +316,9 @@ sub getNewEvents
     # log sent ID of events
     if (scalar @events != 0) {
       if (scalar @ids == 1) {
-        write2log("info", "Sent 1 events [#$ids[0]] to $ip (CN: $cn; AN: $an)");
+        write2log("info", "Sent 1 events [#$ids[0]] to $ip (CN(AN): $alt_names)");
       } else {
-        write2log("info", "Sent " . scalar @ids . " events [#$ids[0] - #$ids[-1]] to $ip (CN: $cn; AN: $an)");
+        write2log("info", "Sent " . scalar @ids . " events [#$ids[0] - #$ids[-1]] to $ip (CN(AN): $alt_names)");
       }
     }
     return @events;