diff --git a/src/warden-server/bin/registerReceiver.pl b/src/warden-server/bin/registerReceiver.pl index bcf56a05359fe93cbccbdc3d8cb46e85f364b41a..166ed62cb556d1abda7dc1e7f0720771f73d3e03 100755 --- a/src/warden-server/bin/registerReceiver.pl +++ b/src/warden-server/bin/registerReceiver.pl @@ -66,20 +66,6 @@ sub version { -#------------------------------------------------------------------------------- -# sendMsg - wrapper for more complex WardenCommon::sendMsg function -#------------------------------------------------------------------------------- -sub sendMsg -{ - my $severity = shift; - my $syslog_msg = shift; - - WardenCommon::sendMsg($WardenCommon::SYSLOG, $WardenCommon::SYSLOG_VERBOSE, $WardenCommon::SYSLOG_FACILITY, $severity, - $syslog_msg, undef, $RealScript); -} - - - ################################################################################ # MAIN ################################################################################ @@ -166,7 +152,7 @@ unless (defined $client_id_db) { unless (defined $client_id) { $client_id = $dbh->last_insert_id(undef, undef, "clients", undef); } - sendMsg("info", "New receiver [ID: '$client_id', Hostname: '$hostname', Requestor: '$requestor', Type: '$type', ROE: '$receive_own_events', CIDR: '$ip_net_client'] was registered"); + WardenCommon::sendMsg("info", "New receiver [ID: '$client_id', Hostname: '$hostname', Requestor: '$requestor', Type: '$type', ROE: '$receive_own_events', CIDR: '$ip_net_client'] was registered", undef); WardenCommon::succMsg("Registration of receiver (#$client_id) was SUCCESSFUL!"); } else { WardenCommon::errMsg("Registration of receiver $hostname ($service) FAILED!"); @@ -187,18 +173,18 @@ unless (defined $client_id_db) { $sth = $dbh->prepare("UPDATE clients SET valid = 't' WHERE client_id = ?;") or die "Cannot prepare statement: " . $dbh->errstr; my $ret_val = $sth->execute($client_id_db) or die "Cannot execute statement: " . $sth->errstr; if ($ret_val == 1) { - sendMsg("info", "Receiver [ID: '$client_id_db', Hostname: '$hostname', Requestor: '$requestor', Type: '$type', ROE: '$receive_own_events', CIDR: '$ip_net_client'] was re-activated"); + WardenCommon::sendMsg("info", "Receiver [ID: '$client_id_db', Hostname: '$hostname', Requestor: '$requestor', Type: '$type', ROE: '$receive_own_events', CIDR: '$ip_net_client'] was re-activated", undef); WardenCommon::succMsg("Re-activation of receiver (#$client_id_db) was SUCCESSFUL!"); } else { WardenCommon::errMsg("Re-activation of receiver (#$client_id_db) FAILED!"); } # receiver is already registered and valid - send error msg } elsif (defined $client_id_db && $hostname eq $hostname_db && $client_type eq $client_type_db && $type eq $type_db && $ip_net_client eq $ip_net_client_db && $valid_db eq 't') { - sendMsg("err", "Attempt to register receiver (#$client_id_db) registered at Warden server '$warden_server' in '$registered_db'"); + WardenCommon::sendMsg("err", "Attempt to register receiver (#$client_id_db) registered at Warden server '$warden_server' in '$registered_db'", undef); WardenCommon::errMsg("Receiver has been already registered at Warden server '$warden_server' in '$registered_db' with ID '$client_id_db'"); # user specified client_id is already used - send error msg } else { - sendMsg("err", "Attempt to use client_id (#$client_id_db) registered at Warden server '$warden_server' in '$registered_db'"); + WardenCommon::sendMsg("err", "Attempt to use client_id (#$client_id_db) registered at Warden server '$warden_server' in '$registered_db'", undef); WardenCommon::errMsg("Client ID (#$client_id_db) has been already used at Warden server '$warden_server' in '$registered_db'"); } diff --git a/src/warden-server/bin/registerSender.pl b/src/warden-server/bin/registerSender.pl index 2a605b2ab34387ef9e136c3824e5511cc7502fdd..a245168a9f034a88e7bf93b7463254ae5a2f2f4e 100755 --- a/src/warden-server/bin/registerSender.pl +++ b/src/warden-server/bin/registerSender.pl @@ -65,19 +65,6 @@ sub version { } -#------------------------------------------------------------------------------- -# sendMsg - wrapper for more complex WardenCommon::sendMsg function -#------------------------------------------------------------------------------- -sub sendMsg -{ - my $severity = shift; - my $syslog_msg = shift; - - WardenCommon::sendMsg($WardenCommon::SYSLOG, $WardenCommon::SYSLOG_VERBOSE, $WardenCommon::SYSLOG_FACILITY, $severity, - $syslog_msg, undef, $RealScript); -} - - ################################################################################ # MAIN @@ -157,7 +144,7 @@ unless (defined $client_id_db) { unless (defined $client_id) { $client_id = $dbh->last_insert_id(undef, undef, "clients", undef); } - sendMsg("info", "New sender [ID: '$client_id', Hostname: '$hostname', Requestor: '$requestor', Service: '$service', Description_tags: '$description_tags', CIDR: '$ip_net_client'] was registered"); + WardenCommon::sendMsg("info", "New sender [ID: '$client_id', Hostname: '$hostname', Requestor: '$requestor', Service: '$service', Description_tags: '$description_tags', CIDR: '$ip_net_client'] was registered", undef); WardenCommon::succMsg("Registration of sender (#$client_id) was SUCCESSFUL!"); } else { WardenCommon::errMsg("Registration of sender $hostname ($service) FAILED!"); @@ -178,18 +165,18 @@ unless (defined $client_id_db) { $sth = $dbh->prepare("UPDATE clients SET valid = 't' WHERE client_id = ?;") or die "Cannot prepare statement: " . $dbh->errstr; my $ret_val = $sth->execute($client_id_db) or die "Cannot execute statement: " . $sth->errstr; if ($ret_val == 1) { - sendMsg("info", "Sender [ID: '$client_id_db', Hostname: '$hostname', Requestor: '$requestor', Service: '$service', Description_tags: '$description_tags', CIDR: '$ip_net_client'] was re-activated"); + WardenCommon::sendMsg("info", "Sender [ID: '$client_id_db', Hostname: '$hostname', Requestor: '$requestor', Service: '$service', Description_tags: '$description_tags', CIDR: '$ip_net_client'] was re-activated", undef); WardenCommon::succMsg("Re-activation of sender (#$client_id_db) was SUCCESSFUL! (Client's old data are still obsoleted.)"); } else { WardenCommon::errMsg("Re-activation of sender (#$client_id_db) FAILED!"); } # sender is already registered and valid - send error msg } elsif (defined $client_id_db && $hostname eq $hostname_db && $service eq $service_db && $client_type eq $client_type_db && $ip_net_client eq $ip_net_client_db && $valid_db eq 't') { - sendMsg("err", "Attempt to register sender (#$client_id_db) registered at Warden server '$warden_server' in '$registered_db'"); + WardenCommon::sendMsg("err", "Attempt to register sender (#$client_id_db) registered at Warden server '$warden_server' in '$registered_db'", undef); WardenCommon::errMsg("Sender has been already registered at Warden server '$warden_server' in '$registered_db' with ID '$client_id_db'"); # user specified client_id is already used - send error msg } else { - sendMsg("err", "Attempt to use client_id (#$client_id_db) registered at Warden server '$warden_server' in '$registered_db'"); + WardenCommon::sendMsg("err", "Attempt to use client_id (#$client_id_db) registered at Warden server '$warden_server' in '$registered_db'", undef); WardenCommon::errMsg("Client ID (#$client_id_db) has been already used at Warden server '$warden_server' in '$registered_db'"); } diff --git a/src/warden-server/bin/unregisterClient.pl b/src/warden-server/bin/unregisterClient.pl index df2fcfc381eaf4c0c434e4bd49bfea64c67183e3..c23ec2e407d9308ae9a6a3c2a018a645c8a8b8f2 100755 --- a/src/warden-server/bin/unregisterClient.pl +++ b/src/warden-server/bin/unregisterClient.pl @@ -60,19 +60,6 @@ sub version { } -#------------------------------------------------------------------------------- -# sendMsg - wrapper for more complex WardenCommon::sendMsg function -#------------------------------------------------------------------------------- -sub sendMsg -{ - my $severity = shift; - my $syslog_msg = shift; - - WardenCommon::sendMsg($WardenCommon::SYSLOG, $WardenCommon::SYSLOG_VERBOSE, $WardenCommon::SYSLOG_FACILITY, $severity, - $syslog_msg, undef, $RealScript); -} - - ################################################################################ # MAIN @@ -116,7 +103,7 @@ my ($id, $hostname, $service, $client_type, $type) = $sth->fetchrow(); # delete registered client unless (defined $id) { - sendMsg("err", "Attempt to delete unregister client [Client_id: '$client_id'] from Warden server '$warden_server'"); + WardenCommon::sendMsg("err", "Attempt to delete unregister client [Client_id: '$client_id'] from Warden server '$warden_server'", undef); WardenCommon::errMsg("Client (#$client_id) is not registered at Warden server '$warden_server'"); } else { if ($client_type eq 's') { @@ -126,7 +113,7 @@ unless (defined $id) { $sth = $dbh->prepare("UPDATE events SET valid = 'o' WHERE client_id = ?;") or die "Cannot prepare statement: " . $dbh->errstr; $sth->execute($client_id) or die "Cannot execute statement: " . $sth->errstr; # log message until after invalidate all events - sendMsg("info", "Sender [Client_id: '$client_id', Hostname: '$hostname', Service: '$service'] was unregistered and its data were invalidated from Warden server '$warden_server'"); + WardenCommon::sendMsg("info", "Sender [Client_id: '$client_id', Hostname: '$hostname', Service: '$service'] was unregistered and its data were invalidated from Warden server '$warden_server'", undef); WardenCommon::succMsg("Unregistration of sender (#$client_id) was SUCCESSFUL!"); } else { WardenCommon::errMsg("Unregistration of sender (#$client_id) FAILED!"); @@ -135,7 +122,7 @@ unless (defined $id) { $sth = $dbh->prepare("UPDATE clients SET valid = 'f' WHERE client_id = ?;") or die "Cannot prepare statement: " . $dbh->errstr; my $ret_val = $sth->execute($client_id) or die "Cannot execute statement: " . $sth->errstr; if ($ret_val == 1) { - sendMsg("info", "Receiver [Client_id: '$client_id', Hostname: '$hostname', Type: '$type'] was unregistered from Warden server '$warden_server'"); + WardenCommon::sendMsg("info", "Receiver [Client_id: '$client_id', Hostname: '$hostname', Type: '$type'] was unregistered from Warden server '$warden_server'", undef); WardenCommon::succMsg("Unregistration of receiver (#$client_id) was SUCCESSFUL!"); } else { WardenCommon::errMsg("Unregistration of receiver (#$client_id) FAILED!"); diff --git a/src/warden-server/lib/Warden.pm b/src/warden-server/lib/Warden.pm index b0876bfc72d1f1aa67b786d37466d7261be5c79c..64156530e28aff878398fb7d0e84d50be417fd0b 100755 --- a/src/warden-server/lib/Warden.pm +++ b/src/warden-server/lib/Warden.pm @@ -30,7 +30,6 @@ use WardenCommon; # VARIABLES ################################################################################ our $VERSION = "2.2"; -our $FILENAME = File::Basename::basename(__FILE__); my $lib = File::Basename::dirname(__FILE__); my $etc = "$lib/../etc"; @@ -58,21 +57,6 @@ our $DBH = DBI->connect("DBI:mysql:database=$WardenCommon::DB_NAME;host=$WardenC # FUNCTIONS ################################################################################ -#------------------------------------------------------------------------------- -# sendMsg - wrapper for more complex WardenCommon::sendMsg function -#------------------------------------------------------------------------------- -sub sendMsg -{ - my $severity = shift; - my $syslog_msg = shift; - my $soap_msg = shift; - - # send message via syslog - WardenCommon::sendMsg($WardenCommon::SYSLOG, $WardenCommon::SYSLOG_VERBOSE, $WardenCommon::SYSLOG_FACILITY, $severity, - $syslog_msg, $soap_msg, $FILENAME); -} - - #------------------------------------------------------------------------------- # getAltNames - parse Alternate names from SSL certifiate #------------------------------------------------------------------------------- @@ -124,25 +108,19 @@ sub authorizeClient # check if db handler is defined unless (defined $sth) { - sendMsg("err", - "Cannot prepare authorization statement in function 'authorizeClient': $DBH->errstr", - "Internal 'prepare' server error"); + WardenCommon::sendMsg("err", "Cannot prepare authorization statement in function 'authorizeClient': $DBH->errstr", "Internal 'prepare' server error"); } # execute query for two or none params functions if ($function_name eq 'saveNewEvent' || $function_name eq 'getNewEvents') { $rc = $sth->execute($service_type, $client_type); unless ($rc) { - sendMsg("err", - "Cannot execute authorization statement in function 'authorizeClient': $DBH->errstr", - "Internal 'execute' server error"); + WardenCommon::sendMsg("err", "Cannot execute authorization statement in function 'authorizeClient': $DBH->errstr", "Internal 'execute' server error"); } } else { $rc = $sth->execute; unless ($rc) { - sendMsg("err", - "Cannot execute authorization statement in function 'authorizeClient': $DBH->errstr", - "Internal 'execute' server error"); + WardenCommon::sendMsg("err", "Cannot execute authorization statement in function 'authorizeClient': $DBH->errstr", "Internal 'execute' server error"); } } @@ -164,17 +142,13 @@ sub authorizeClient # check if client is registered if ($sth->rows == 0) { - sendMsg("err", - "Unauthorized access to function '$function_name' from [IP: '$ip'; CN(AN): $alt_names; Client_type: '$client_type'; Service/Type: '$service_type'] - client is not registered at Warden server '$ENV{'SERVER_NAME'}'", - "Access denied - client is not registered at Warden server '$ENV{'SERVER_NAME'}'"); + WardenCommon::sendMsg("err", "Unauthorized access to function '$function_name' from [IP: '$ip'; CN(AN): $alt_names; Client_type: '$client_type'; Service/Type: '$service_type'] - client is not registered at Warden server '$ENV{'SERVER_NAME'}'", "Access denied - client is not registered at Warden server '$ENV{'SERVER_NAME'}'"); return undef; } # check if client has IP from registered CIDR unless ($correct_ip_source) { - sendMsg ("err", - "Unauthorized access to function '$function_name' from [IP: '$ip'; CN(AN): $alt_names; Client_type: '$client_type'; Service/Type: '$service_type'] - access to Warden server '$ENV{'SERVER_NAME'}' from another subnet than '$ip_net_client'", - "Access denied - access to Warden server '$ENV{'SERVER_NAME'}' from unauthorized subnet '$ip_net_client'"); + WardenCommon::sendMsg("err", "Unauthorized access to function '$function_name' from [IP: '$ip'; CN(AN): $alt_names; Client_type: '$client_type'; Service/Type: '$service_type'] - access to Warden server '$ENV{'SERVER_NAME'}' from another subnet than '$ip_net_client'", "Access denied - access to Warden server '$ENV{'SERVER_NAME'}' from unauthorized subnet '$ip_net_client'"); return undef; } @@ -223,9 +197,7 @@ sub saveNewEvent my %client = authorizeClient($alt_names, $ip, $service, $client_type, $function_name); if (%client) { # log incoming event - sendMsg("debug", - "Incoming event: [client_id: '$client{'client_id'}', service: '$service', detected: '$detected', type: '$type', source_type: '$source_type', source: '$source', target_proto: '$target_proto', target_port: '$target_port', attack_scale: '$attack_scale', note: '$note', priority: '$priority', timeout: '$timeout']", - undef); + WardenCommon::sendMsg("info", "Incoming event: [client_id: '$client{'client_id'}', service: '$service', detected: '$detected', type: '$type', source_type: '$source_type', source: '$source', target_proto: '$target_proto', target_port: '$target_port', attack_scale: '$attack_scale', note: '$note', priority: '$priority', timeout: '$timeout']", undef); # MySQL optimalization - replace empty string to undef $service = undef if $service eq ""; @@ -243,21 +215,15 @@ sub saveNewEvent # test event item: 'detected' # http://my.safaribooksonline.com/book/programming/regular-expressions/9780596802837/4dot-validation-and-formatting/id2983571 if ($detected !~ /^((?:[1-9][0-9]*)?[0-9]{4})-(1[0-2]|0[1-9])-(3[0-1]|0[1-9]|[1-2][0-9])T(2[0-3]|[0-1][0-9]):([0-5][0-9]):([0-5][0-9])(\.[0-9]+)?(Z|[+-](?:2[0-3]|[0-1][0-9]):[0-5][0-9])?/) { - sendMsg("err", - "Unknown item 'detected' from client '$client{'client_id'}': '$detected'", - "Unknown detected time format: '$detected'"); + WardenCommon::sendMsg("err", "Unknown item 'detected' from client '$client{'client_id'}': '$detected'", "Unknown detected time format: '$detected'"); } # test event item: 'event_type', 'source_type' (based on VALIDATION HASH) if (%WardenCommon::VALID_STRINGS) { if (!(exists $WardenCommon::VALID_STRINGS{'type'} && grep $type eq $_, @{$WardenCommon::VALID_STRINGS{'type'}})) { - sendMsg("err", - "Unknown item 'event_type' from client '$client{'client_id'}': '$type'", - "Unknown event type: '$type'"); + WardenCommon::sendMsg("err", "Unknown item 'event_type' from client '$client{'client_id'}': '$type'", "Unknown event type: '$type'"); } elsif (!(exists $WardenCommon::VALID_STRINGS{'source_type'} && grep $source_type eq $_, @{$WardenCommon::VALID_STRINGS{'source_type'}})) { - sendMsg("err", - "Unknown item 'source_type' from client '$client{'client_id'}': '$source_type'", - "Unknown source type: '$source_type'"); + WardenCommon::sendMsg("err", "Unknown item 'source_type' from client '$client{'client_id'}': '$source_type'", "Unknown source type: '$source_type'"); } } @@ -285,24 +251,18 @@ sub saveNewEvent my $change_string = join(", ", @change_list); unless ($change_string eq "") { - sendMsg("info", - "Unknown other event items from client '$client{'client_id'}': ($change_string)", - undef); + WardenCommon::sendMsg("info", "Unknown other event items from client '$client{'client_id'}': ($change_string)", undef); } # save new event into database $sth = $DBH->prepare("INSERT INTO events VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?);"); unless (defined $sth) { - sendMsg("err", - "Cannot prepare statement in function '$function_name': $DBH->errstr", - "Internal 'prepare' server error"); + WardenCommon::sendMsg("err", "Cannot prepare statement in function '$function_name': $DBH->errstr", "Internal 'prepare' server error"); } $rc = $sth->execute(undef, $detected, $received, $type, $source_type, $source, $target_proto, $target_port, $attack_scale, $note, $priority, $timeout, $valid, $client{'client_id'}); unless ($rc) { - sendMsg("err", - "Cannot execute statement in function '$function_name': $DBH->errstr", - "Internal 'execute' server error"); + WardenCommon::sendMsg("err", "Cannot execute statement in function '$function_name': $DBH->errstr", "Internal 'execute' server error"); } return 1; } @@ -360,16 +320,12 @@ sub getNewEvents $sth = $DBH->prepare($query); unless (defined $sth) { - sendMsg("err", - "Cannot prepare statement in function '$function_name': $DBH->errstr", - "Internal 'prepare' server error"); + WardenCommon::sendMsg("err", "Cannot prepare statement in function '$function_name': $DBH->errstr", "Internal 'prepare' server error"); } $rc = $sth->execute(@params); unless (defined $rc) { - sendMsg("err", - "Cannot execute statement in function '$function_name': $DBH->errstr", - "Internal 'execute' server error"); + WardenCommon::sendMsg("err", "Cannot execute statement in function '$function_name': $DBH->errstr", "Internal 'execute' server error"); } # obtain event entries from query @@ -398,13 +354,9 @@ sub getNewEvents # log sent ID of events if (scalar @events != 0) { if (scalar @ids == 1) { - sendMsg("info", - "Sent 1 event [#$ids[0]] of type '$requested_type' to client '$client{'client_id'}'", - undef); + WardenCommon::sendMsg("info", "Sent 1 event [#$ids[0]] of type '$requested_type' to client '$client{'client_id'}'", undef); } else { - sendMsg("info", - "Sent " . scalar @ids . " events [#$ids[0] - #$ids[-1]] of type '$requested_type' to client '$client{'client_id'}'", - undef); + WardenCommon::sendMsg("info", "Sent " . scalar @ids . " events [#$ids[0] - #$ids[-1]] of type '$requested_type' to client '$client{'client_id'}'", undef); } } @@ -436,16 +388,12 @@ sub getLastId # obtain max event ID my $sth = $DBH->prepare("SELECT max(id) FROM events;"); unless (defined $sth) { - sendMsg("err", - "Cannot prepare statement in function '$function_name': $DBH->errstr", - "Internal 'prepare' server error"); + WardenCommon::sendMsg("err", "Cannot prepare statement in function '$function_name': $DBH->errstr", "Internal 'prepare' server error"); } my $rc = $sth->execute; unless ($rc) { - sendMsg("err", - "Cannot execute statement in function '$function_name': $DBH->errstr", - "Internal 'execute' server error"); + WardenCommon::sendMsg("err", "Cannot execute statement in function '$function_name': $DBH->errstr", "Internal 'execute' server error"); } my $result = $sth->fetchrow(); @@ -479,16 +427,12 @@ sub getClientInfo # obtain all valid clients from DB my $sth = $DBH->prepare("SELECT * FROM clients WHERE valid = 't' ORDER BY client_id ASC;"); unless (defined $sth) { - sendMsg("err", - "Cannot prepare statement in function '$function_name': $DBH->errstr", - "Internal 'prepare' server error"); + WardenCommon::sendMsg("err", "Cannot prepare statement in function '$function_name': $DBH->errstr", "Internal 'prepare' server error"); } my $rc = $sth->execute; unless ($rc) { - sendMsg("err", - "Cannot execute statement in function '$function_name': $DBH->errstr", - "Internal 'execute' server error"); + WardenCommon::sendMsg("err", "Cannot execute statement in function '$function_name': $DBH->errstr", "Internal 'execute' server error"); } # create SOAP object @@ -511,9 +455,7 @@ sub getClientInfo # log information message my $sum = scalar @clients; - sendMsg("info", - "Sent information about $sum registered clients from Warden server '$ENV{'SERVER_NAME'}' to client '$client{'client_id'}'", - undef); + WardenCommon::sendMsg("info", "Sent information about $sum registered clients from Warden server '$ENV{'SERVER_NAME'}' to client '$client{'client_id'}'", undef); return @clients; } } # END of getClientInfo diff --git a/src/warden-server/lib/WardenCommon.pm b/src/warden-server/lib/WardenCommon.pm index 09d8cbb54f4ceaff4f08f5ef16bce8d99315ae08..60ac19e8431cbf82cfe08496d0782a5e394e6c06 100755 --- a/src/warden-server/lib/WardenCommon.pm +++ b/src/warden-server/lib/WardenCommon.pm @@ -56,20 +56,16 @@ sub trim #------------------------------------------------------------------------------- sub sendMsg { - my $syslog = shift; - my $syslog_verbose = shift; - my $syslog_facility = shift; my $severity = shift; my $syslog_msg = shift; my $soap_msg = shift; - my $filename = shift; - if ($syslog_verbose == 1 && ($severity eq "err" || $severity eq "debug")) { + if ($WardenCommon::SYSLOG_VERBOSE) { $syslog_msg .= "\nStack info: " . Carp::longmess(); } - if ($syslog == 1 && defined $severity && defined $syslog_msg) { - Sys::Syslog::openlog($filename, "cons,pid", $syslog_facility); + if ($WardenCommon::SYSLOG && defined $severity && defined $syslog_msg) { + Sys::Syslog::openlog("warden-server", "cons,pid", $WardenCommon::SYSLOG_FACILITY); Sys::Syslog::syslog($severity, $syslog_msg); Sys::Syslog::closelog(); }