Skip to content
Snippets Groups Projects
Commit 3f9dc03c authored by Jan Soukal's avatar Jan Soukal
Browse files

task #519, kod klienta uzavren do eval bloku

parent 4a2fbcab
No related branches found
No related tags found
No related merge requests found
...@@ -18,17 +18,14 @@ use strict; ...@@ -18,17 +18,14 @@ use strict;
# This code should developer add into his/her application. # This code should developer add into his/her application.
# Path to warden-client directory # Path to warden-client directory
my $warden_path = '/opt/warden-client'; my $warden_path = '/home/soukal/client-test/2.0.0_beta/warden-client/';
# Inclusion of warden-client receiving functionality # Inclusion of warden-client receiving functionality
require $warden_path . '/lib/WardenClientReceive.pm'; require $warden_path . '/lib/WardenClientReceive.pm';
# Definition of requested event type. This attributes is also set on server # Definition of requested event type. This attributes is also set on server
# and must not change. # and must not change.
my $requested_type = "botnet_c_c"; my $requested_type = "portscan";
# Download of new evetns from Warden server
my @new_events = WardenClientReceive::getNewEvents($warden_path, $requested_type);
#------------------------------------------------------------------------------ #------------------------------------------------------------------------------
# Simple code that prints out new events obtained from Warden server. # Simple code that prints out new events obtained from Warden server.
...@@ -37,9 +34,15 @@ print "+------------------------------------------------------------------------ ...@@ -37,9 +34,15 @@ print "+------------------------------------------------------------------------
print "| id | hostname | service | detected | type | source_type | source | target_proto | target_port | attack_scale | note | priority | timeout |\n"; print "| id | hostname | service | detected | type | source_type | source | target_proto | target_port | attack_scale | note | priority | timeout |\n";
print "+------------------------------------------------------------------------------------------------------------------------------------------+\n"; print "+------------------------------------------------------------------------------------------------------------------------------------------+\n";
foreach (@new_events) { # Download of new evetns from Warden server
print "| " . join(' | ', @$_) . " |" . "\n"; while (my @new_events = WardenClientReceive::getNewEvents($warden_path, $requested_type)) {
foreach my $event_ref (@new_events) {
my @event = @$event_ref;
print "| " . join(' | ', @event) . " |" . "\n";
}
print "+------------------------------------------------------------------------------------------------------------------------------------------+\n";
} }
print "+------------------------------------------------------------------------------------------------------------------------------------------+"; print "+------------------------------------------------------------------------------------------------------------------------------------------+";
print "\n"; print "\n";
print "Last events in: " . scalar(localtime(time)) . "\n"; print "Last events in: " . scalar(localtime(time)) . "\n";
......
...@@ -81,94 +81,102 @@ sub c2s ...@@ -81,94 +81,102 @@ sub c2s
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
sub getNewEvents sub getNewEvents
{ {
my $warden_path = shift; my @events;
my $requested_type = shift;
eval {
my $vardir = $warden_path . "/var/";
my $etcdir = $warden_path . "/etc/"; my $warden_path = shift;
my $libdir = $warden_path . "/lib/"; my $requested_type = shift;
# read the config file my $vardir = $warden_path . "/var/";
require $libdir . "WardenClientConf.pm"; my $etcdir = $warden_path . "/etc/";
my $conf_file = $etcdir . "warden-client.conf"; my $libdir = $warden_path . "/lib/";
my ($uri, $ssl_key_file, $ssl_cert_file, $ssl_ca_file, $max_rcv_events_limit) = WardenClientConf::loadConf($conf_file);
# read the config file
# set name of ID file for each client aplication require $libdir . "WardenClientConf.pm";
my $caller_name = $FindBin::Script; my $conf_file = $etcdir . "warden-client.conf";
my $id_file = $vardir . $caller_name . ".id"; my ($uri, $ssl_key_file, $ssl_cert_file, $ssl_ca_file, $max_rcv_events_limit) = WardenClientConf::loadConf($conf_file);
#----------------------------------------------------------------------------- # set name of ID file for each client aplication
# get last ID from ID file (if exist) or my $caller_name = $FindBin::Script;
# get last ID from warden server DB and save it into ID file my $id_file = $vardir . $caller_name . ".id";
my $last_id;
if (-e $id_file) { #-----------------------------------------------------------------------------
open(ID, "< $id_file") || errMsg("Cannot open ID file $id_file: $!"); # get last ID from ID file (if exist) or
foreach(<ID>) { # get last ID from warden server DB and save it into ID file
$last_id = $_; my $last_id;
if (-e $id_file) {
open(ID, "< $id_file") || errMsg("Cannot open ID file $id_file: $!");
foreach(<ID>) {
$last_id = $_;
}
close ID;
} else {
my $response = c2s($uri, $ssl_key_file, $ssl_cert_file, $ssl_ca_file, "getLastId");
$last_id = $response->result;
open(ID, "> $id_file") || die ("Cannot open ID file $id_file: $!");
print ID $last_id;
close ID;
} }
close ID;
} else {
my $response = c2s($uri, $ssl_key_file, $ssl_cert_file, $ssl_ca_file, "getLastId");
$last_id = $response->result;
open(ID, "> $id_file") || die ("Cannot open ID file $id_file: $!");
print ID $last_id;
close ID;
}
#----------------------------------------------------------------------------- #-----------------------------------------------------------------------------
# get new events from warden server DB based on gathered last ID # get new events from warden server DB based on gathered last ID
# create SOAP data obejct # create SOAP data obejct
my $request_data = SOAP::Data->name( my $request_data = SOAP::Data->name(
request => \SOAP::Data->value( request => \SOAP::Data->value(
SOAP::Data->name(REQUESTED_TYPE => $requested_type), SOAP::Data->name(REQUESTED_TYPE => $requested_type),
SOAP::Data->name(LAST_ID => $last_id), SOAP::Data->name(LAST_ID => $last_id),
SOAP::Data->name(MAX_RCV_EVENTS_LIMIT => $max_rcv_events_limit) SOAP::Data->name(MAX_RCV_EVENTS_LIMIT => $max_rcv_events_limit)
) )
); );
# call server method getNewEvents # call server method getNewEvents
my $response = c2s($uri, $ssl_key_file, $ssl_cert_file, $ssl_ca_file, "getNewEvents", $request_data); my $response = c2s($uri, $ssl_key_file, $ssl_cert_file, $ssl_ca_file, "getNewEvents", $request_data);
# parse returned SOAP data object # parse returned SOAP data object
my ($id, $hostname, $service, $detected, $type, $source_type, $source, $target_proto, $target_port, $attack_scale, $note, $priority, $timeout); my ($id, $hostname, $service, $detected, $type, $source_type, $source, $target_proto, $target_port, $attack_scale, $note, $priority, $timeout);
my @events; # my @events;
my @response_list = $response->valueof('/Envelope/Body/getNewEventsResponse/event/'); my @response_list = $response->valueof('/Envelope/Body/getNewEventsResponse/event/');
while (scalar @response_list) { while (scalar @response_list) {
my $response_data = shift(@response_list); my $response_data = shift(@response_list);
my @event; my @event;
# parse items of one event # parse items of one event
$id = $response_data->{'ID'}; $id = $response_data->{'ID'};
$hostname = $response_data->{'HOSTNAME'}; $hostname = $response_data->{'HOSTNAME'};
$service = $response_data->{'SERVICE'}; $service = $response_data->{'SERVICE'};
$detected = $response_data->{'DETECTED'}; $detected = $response_data->{'DETECTED'};
$type = $response_data->{'TYPE'}; $type = $response_data->{'TYPE'};
$source_type = $response_data->{'SOURCE_TYPE'}; $source_type = $response_data->{'SOURCE_TYPE'};
$source = $response_data->{'SOURCE'}; $source = $response_data->{'SOURCE'};
$target_proto = $response_data->{'TARGET_PROTO'}; $target_proto = $response_data->{'TARGET_PROTO'};
$target_port = $response_data->{'TARGET_PORT'}; $target_port = $response_data->{'TARGET_PORT'};
$attack_scale = $response_data->{'ATTACK_SCALE'}; $attack_scale = $response_data->{'ATTACK_SCALE'};
$note = $response_data->{'NOTE'}; $note = $response_data->{'NOTE'};
$priority = $response_data->{'PRIORITY'}; $priority = $response_data->{'PRIORITY'};
$timeout = $response_data->{'TIMEOUT'}; $timeout = $response_data->{'TIMEOUT'};
# push new event from warden server into @events which is returned # push new event from warden server into @events which is returned
@event = ($id, $hostname, $service, $detected, $type, $source_type, $source, $target_proto, $target_port, $attack_scale, $note, $priority, $timeout); @event = ($id, $hostname, $service, $detected, $type, $source_type, $source, $target_proto, $target_port, $attack_scale, $note, $priority, $timeout);
push (@events, \@event); push (@events, \@event);
# set maximum received ID from current batch # set maximum received ID from current batch
if ($id > $last_id) { if ($id > $last_id) {
$last_id = $id; $last_id = $id;
}
} #end of while loop
# write last return ID
if (defined $last_id) { # must be defined for first check ID
open(ID, "> $id_file") || die ("Cannot open ID file $id_file: $!");
print ID $last_id;
close ID;
} }
} #end of while loop } # End of eval block
or do {
# write last return ID return;
if (defined $last_id) { # must be defined for first check ID };
open(ID, "> $id_file") || die ("Cannot open ID file $id_file: $!");
print ID $last_id;
close ID;
}
return @events; return @events;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment