src/contrib/meta/wardentest-lenny-meta.sh

-#!/bin/bash
-
-#IP serveru 
-SERVER=""
-PORT=""
-
-#Cesta ke scriptum a zdrojakum, typicky AFS, napr. /afs/zcu.cz/users/v/vomacka/public/wardentest
-BASE=""
-
-HNAME=`hostname -f`
-
-# STAGEIN
-WDIR="/scratch/${PBS_O_LOGNAME}/wardentest.$$"
-mkdir -p $WDIR || exit 1
-cd $WDIR
-
-tar xzf $BASE/warden-client-meta.tgz 
-perl -pi -e "s#\[path\]#$WDIR#" performance-sender.pm
-perl -pi -e "s#\[path\]#$WDIR#" etc/warden-client.conf
-perl -pi -e "s#\[server\]#$SERVER#" etc/warden-client.conf
-perl -pi -e "s#\[port\]#$PORT#" etc/warden-client.conf
-
-openssl req -new -nodes -keyform PEM -outform PEM -config ./ca/openssl.cnf -keyout ./ca/server-key.pem -out ./ca/server.csr -subj "/CN=$HNAME" -days 365 
-openssl ca -batch -keyform PEM -passin pass:test -name client_ca -config ./ca/openssl.cnf -out ./ca/server-cert.pem -infiles ./ca/server.csr
-
-# JOB
-for i in `seq 1 1000`; do 
-./performance-sender.pm test 10 &> /dev/null
-done
-
-date
-
-# STAGEOUT
-#cp p1.log $BASE/output-p1.log.$PBS_JOBID.$HNAME
-#cp p2.log $BASE/output-p2.log.$PBS_JOBID.$HNAME
-cd /tmp
-rm -rf $WDIR
-

src/contrib/meta/wtw-lenny-meta.sh

-#!/bin/bash
-#PBS -N wtw-lenny.sh
-#PBS -q short
-#PBS -l nodes=1:ppn=1:^cl_luna
-#PBS -j oe
-#PBS -m abe
-#
-# describtion from 'man qsub':
-# -N ... declares a name for the job.  The name specified may be up to and including 15 characters in  length.   It
-#        must consist of printable, non white space characters with the first character alphabetic.
-# -q ... defines the destination of the job (queue)
-# -l ... defines  the  resources that are required by the job
-# -j oe ... standard error stream of the job will be merged with the standard output stream
-# -m ace ...  mail is sent anytime
-
-#in file name of which can be found in variable PBS_NODEFILE, is list of allocated machines
-echo '***PBS_NODEFILE***START*******'
-cat $PBS_NODEFILE
-echo '***PBS_NODEFILE***END*********'
-
-#Cesta ke scriptum a zdrojakum, typicky AFS, napr. /afs/zcu.cz/users/v/vomacka/public/wardentest
-BASE=""
-cd $BASE || exit 1
-
-# spusti dany prikaz na vsech pridelenych strojich
-pbsdsh -o -- bash ${BASE}/wardentest-lenny-meta.sh
-
-

src/contrib/networkReporter-client/networkReporter.pl

-#!/usr/bin/perl
-#
-#  networkReporter.pl - Warden client for communication with RT ticketing system
-# 
-#  Copyright (C) 2012 Masaryk University
-#  Author(s): Jakub CEGAN <cegan@ics.muni.cz>
-#
-#  Redistribution and use in source and binary forms, with or without
-#  modification, are permitted provided that the following conditions are met:
-#
-#   * Redistributions of source code must retain the above copyright notice,
-#     this list of conditions and the following disclaimer.
-#   * Redistributions in binary form must reproduce the above copyright notice,
-#     this list of conditions and the following disclaimer in the documentation
-#     and/or other materials provided with the distribution.
-#   * Neither the name of Masaryk University nor the names of its contributors may be
-#     used to endorse or promote products derived from this software without
-#     specific prior written permission.
-#
-#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-#  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-#  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-#  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
-#  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-#  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-#  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-#  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-#  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-#  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-#  POSSIBILITY OF SUCH DAMAGE.
-#
-
-use warnings;
-use strict;
-
-use lib '/opt/warden-client';
-use Email::Simple;
-use Sys::Hostname;
-use Text::Wrap;
-use DateTime;
-
-
-sub sendmailWrapper{
-  my $message = shift;
-
-  if(open(my $sendmail, '|/usr/sbin/sendmail -oi -t')){
-    print $sendmail $message;
-    close $sendmail;
-    return 1;
-  } else {
-    return (0, "Sending email failed: $!");
-  }
-}
-
-sub timeToLocal{
-  my $time = shift;
-
-  my ($y,$m,$d,$h,$mm,$s);
-  if(!($$time =~ m/(\d{4})\-(\d{2})\-(\d{2})\ (\d{2})\:(\d{2})\:(\d{2})/)){
-    return (0, "Bad time format!\n");
-  }
-
-  ($y,$m,$d,$h,$mm,$s) = $$time =~ m/(\d{4})\-(\d{2})\-(\d{2})\ (\d{2})\:(\d{2})\:(\d{2})/;
-  eval{
-  my $dt = DateTime->new(
-        year   => $y,
-        month  => $m,
-        day    => $d,
-        hour   => $h,
-        minute => $mm,
-        second => $s,
-        time_zone =>'gmt');
-  $dt->set_time_zone('local');
-  $$time = $dt->strftime('%d. %m. %Y v %H:%M');};
-  if($@){
-    return (0, "Can't convert time to epoch format!\n");
-  }
-  return 1;
-}
-
-#-------------------------------------------------------------------------------
-# reportToRT - fuction for creating tickets in the RT system
-#
-#  param: hash with gateway address and warden event array
-#
-# return: ok || fail
-#-------------------------------------------------------------------------------
-sub reportToRT{
-
-  my $inputData  = shift;
-  my $toGateway  = $$inputData{'gateway'};
-  my @event      = @{$$inputData{'data'}};
-
-  my $fromHostname;
-  my $message;
-  my ($rc, $err);
-
-  if(!($toGateway)){
-    return (0, "Empty 'To' email header!\n");
-  }
-
-  eval{
-    $fromHostname = hostname();
-    if(!($fromHostname =~ m/\.ics\.muni\.cz/gi)){
-      $fromHostname .= '.ics.muni.cz';
-    }
-  };
-  if($@){
-    return (0, "Can't retrive hostname for 'From' header!\n");
-  }
-
-  ($rc, $err) = timeToLocal(\$event[3]);
-  if(!$rc){
-    return (0, $err);
-  }
-
-  my $text = "Dobrý den,
-  z Vaší IP adresy $event[6] jsme zaznamenali $event[3] celkem $event[9] pokus(y) o připojení k neexistující službě (tzv. honeypotu). V tomto konkrétním případě se jednalo o protokol $event[7] a port číslo $event[8]. Je pravděpodobné, že se jedná o virus, napadený počítač či zneužitý uživatelský účet. Doporučujeme Vám zkontrolovat zabezpečení tohoto počitače.
-
-  S pozdravem
-
-  CSIRT-MU
-  http://www.muni.cz/csirt";
-
-  eval{
-  $message = Email::Simple->create(
-    header => [
-      To                    => $toGateway,
-      From                  => 'tools@'.$fromHostname,
-      Subject               => 'Pristup na honeypot v siti CESNET'],
-      body => fill('','',$text));
-  };
-  if($@){
-    return (0, "Can't create email message\n");
-  }
-
-  ($rc, $err) = sendmailWrapper($message->as_string);
-  if(!$rc){
-    return (0, $err);
-  }
-  return 1;
-}
-
-
-my $warden_path = '/opt/warden-client';
-
-require $warden_path . '/lib/WardenClientReceive.pm';
-
-my $requested_type = "portscan";
-my $ip_reg = '147\.251\.\d+\.\d+';
-my $client = 'CESNET_IDS';
-my $gateway = 'rt@rt-devel.ics.muni.cz';
-
-$Text::Wrap::columns = 90;
-
-
-my $logger;
-my @new_events;
-
-@new_events = WardenClientReceive::getNewEvents($warden_path, $requested_type);
-#@new_events = (["5179620","au1.cesnet.cz","CESNET_IDS","2012-11-08 17:04:56","portscan","IP","147.251.216.8","XXX","666","2","","0","720"]);
-foreach (@new_events) {
-  my @event = @$_;
-
-  if(($event[6] =~ /^$ip_reg$/i) and ($event[2] =~ /^$client$/i)){
-    my %input = (gateway => $gateway, data => \@event);
-    my ($rc,$err) = reportToRT(\%input);
-    if(!$rc){
-      #print "ERR: $err\n";
-      syslog("err|Warden client - networkReporter $err\n");
-    }
-  }
-}
-
-exit 0;

src/contrib/warden-app/Modules/DNSblacklist.pm

-package DNSblacklist;
-use strict;
-use warnings;
-use Data::Dumper;
-
-my  %CONSTANTS =    (
-                       target      => "127.0.0.2",
-                       outputfile  => "tmp/blacklist.csv",
-                       threshold   => 10,
-                       excludedip  => [],
-                       eventtype   => [],
-                       maxage      => "1D",
-                       ttl         => "3600",
-                       zone        => "@",
-                       dns         => "dns.example.com",
-                       hostmaster  => "hostmaster\@example.com",
-                       refresh     => "1800    ; refresh (30 minutes)",
-                       retry       => "600     ; retry (10 minutes)",
-                       expire      => "1209600 ; expire (2 weeks)",
-                       minimum     => "86400   ; minimum (1 day)",
-                     );
-
-my %FORMAT   =      (   maxage     => qr/\d+[hdmHDM]/, );
-
-sub run {
-    my (undef, $modprefix, $cfg, $dbh, $db_engine) = @_;
-    
-    my $v = Constants::mergeConfigs($cfg, $modprefix, \%CONSTANTS, \%FORMAT);
-
-    my $eventtype_query = DB::joinIN("type", \@{$v->{'eventtype'}});
-    my $excluded_query  = DB::joinNotIN("source", \@{$v->{'excludedip'}});
-
-    my $condition = substr($excluded_query . $eventtype_query, 0, -5);
-    my @columns= ("source", "note");
-    my @params = ($condition, DB::getOldDataDB($db_engine, "NEWER", $v->{'maxage'}));
-    my $query = DB::getQueryCondThreshold($db_engine, "events", \@columns, \@params, $v->{'threshold'});
-
-    my @rows = Utils::fetchall_array_hashref($dbh, $query);
-
-    my ($sec, $min, $hr, $day, $mon, $year) = localtime;
-    
-    $v->{'serial'} = sprintf("%02d%02d%02d%02d%02d", $year - 100 , $mon + 1, $day,  $hr, $min); 
-    $v->{'hostmaster'} =~ s/\@/\./;
-
-    sub header { my $v = shift; return "\$ORIGIN .\n\$TTL $v->{'ttl'}\n$v->{'zone'}\t\t\t\t\t\tIN\tSOA\t$v->{'dns'}. $v->{'hostmaster'}. (\n\t\t\t\t\t\t\t\t$v->{'serial'} ; serial\n\t\t\t\t\t\t\t\t$v->{'refresh'}\n\t\t\t\t\t\t\t\t$v->{'retry'}\n\t\t\t\t\t\t\t\t$v->{'expire'}\n\t\t\t\t\t\t\t\t$v->{'minimum'}\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\tNS\t$v->{'dns'}.\n"; };
- 
-    sub record { my ($r, $v) = @_; $r->{'note'} = "" if !defined $r->{'note'};  return ";" . "$r->{'source'}\n" . join(".", reverse( split(/\./, $r->{'source'}))) . "\t\tIN\t\tA\t$v->{'target'}\n\t\t\t\t\tIN\t\tTXT\t\"$r->{'note'}\"\n"; }; 
-
-    my $ret = Utils::generateOutput($v->{'outputfile'}, \@rows, \&header, \&record, undef, $v);
-    return $ret;
-}
-1;

src/contrib/warden-app/Modules/IPblacklist.pm

-package IPblacklist;
-use strict;
-use warnings;
-use Data::Dumper;
-
-my %CONSTANTS =    (
-                       outputfile  => "tmp/blacklist.csv",
-                       threshold   => 200,
-                       excludedip  => [],
-                       eventtype   => [],
-                       maxage      => "1D",
-                    );
-
-my %FORMAT   =      (  maxage     => qr/\d+[hdmHDM]/, );
-
-
-sub run {
-    my (undef, $modprefix, $cfg, $dbh, $db_engine) = @_;
-    my $v = Constants::mergeConfigs($cfg, $modprefix, \%CONSTANTS, \%FORMAT);
-
-    my $eventtype_query = DB::joinIN("type", \@{$v->{'eventtype'}});
-    my $excluded_query  = DB::joinNotIN("source", \@{$v->{'excludedip'}});
-
-    my $condition = substr($excluded_query . $eventtype_query, 0, -5);
-    my @columns= ("source");
-    my @params = ($condition, DB::getOldDataDB($db_engine, "NEWER", $v->{'maxage'}));
-    my $query = DB::getQueryCondThreshold($db_engine, "events", \@columns, \@params, $v->{'threshold'});
-
-    my @rows = Utils::fetchall_array_hashref($dbh, $query);
-
-    sub record { my $r = shift; return "$r->{'source'},\n"; };
-    
-    my $ret = Utils::generateOutput($v->{'outputfile'}, \@rows, undef, \&record, undef, $v);
-    return $ret;
-}
-1;

src/contrib/warden-app/Modules/IPset.pm

-package IPset;
-use strict;
-use warnings;
-use Data::Dumper;
-
-my %CONSTANTS =    (
-                        enabled    =>  "no",
-                        outputfile =>  "tmp/ipset.txt",
-                        threshold  =>  250,
-                        excludedip =>  [],
-                        eventtype  =>  [],
-                        setname  =>  "BLOCK",
-                        maxage     =>  "1D",
-                     );
-
-my %FORMAT   =      (   maxage     => qr/\d+[hdmHDM]/, logging  => qr/enable|disable/,);
-
-sub run {
-    my (undef, $modprefix, $cfg, $dbh, $db_engine) = @_;
-   
-    my $v = Constants::mergeConfigs($cfg, $modprefix, \%CONSTANTS, \%FORMAT);
-    
-    my $eventtype_query = DB::joinIN("type", \@{$v->{'eventtype'}});
-    my $excluded_query  = DB::joinNotIN("source", \@{$v->{'excludedip'}});
-
-    my $condition = substr($excluded_query . $eventtype_query, 0, -5);
-    my @columns= ("source");
-    my @params = ($condition, DB::getOldDataDB($db_engine, "NEWER", $v->{'maxage'}));
-    my $query = DB::getQueryCondThreshold($db_engine, "events", \@columns, \@params, $v->{'threshold'});
-
-    my @rows = Utils::fetchall_array_hashref($dbh, $query);
-
-    sub header { my $v = shift; return "create $v->{'setname'}_tmp hash:ip\n"; };
-    sub record { my ($r, $v) = @_; return "add $v->{'setname'}_tmp $r->{'source'}\n" if ($r->{'source'}=~/\d+\.\d+\.\d+\.\d+/); };
-    sub footer { my ($v) = @_; return "swap $v->{'setname'}_tmp $v->{'setname'}\ndestroy $v->{'setname'}_tmp\nquit\n"; };
-
-    my $ret = Utils::generateOutput($v->{'outputfile'}, \@rows, \&header, \&record, \&footer, $v);
-    return $ret;
-}
-1;

src/contrib/warden-app/Modules/IPtables.pm

-package IPtables;
-use strict;
-use warnings;
-use Data::Dumper;
-
-my %CONSTANTS =    (
-                        enabled    =>  "no",
-                        outputfile =>  "tmp/iptables.txt",
-                        threshold  =>  250,
-                        excludedip =>  [],
-                        eventtype  =>  [],
-                        chainname  =>  "BLOCK",
-                        destchain  =>  "DROP",
-                        maxage     =>  "1D",
-                     );
-
-my %FORMAT   =      (   maxage     => qr/\d+[hdmHDM]/, logging  => qr/enable|disable/,);
-
-sub run {
-    my (undef, $modprefix, $cfg, $dbh, $db_engine) = @_;
-   
-    my $v = Constants::mergeConfigs($cfg, $modprefix, \%CONSTANTS, \%FORMAT);
-    
-    my $eventtype_query = DB::joinIN("type", \@{$v->{'eventtype'}});
-    my $excluded_query  = DB::joinNotIN("source", \@{$v->{'excludedip'}});
-
-    my $condition = substr($excluded_query . $eventtype_query, 0, -5);
-    my @columns= ("source");
-    my @params = ($condition, DB::getOldDataDB($db_engine, "NEWER", $v->{'maxage'}));
-    my $query = DB::getQueryCondThreshold($db_engine, "events", \@columns, \@params, $v->{'threshold'});
-
-    my @rows = Utils::fetchall_array_hashref($dbh, $query);
-
-    sub header { my $v = shift; return "/sbin/iptables -F $v->{'chainname'}\n"; };
-    sub record { my ($r, $v) = @_; return "/sbin/iptables -A $v->{'chainname'} -s $r->{'source'}/32 -j $v->{'destchain'}\n"; };
-
-    my $ret = Utils::generateOutput($v->{'outputfile'}, \@rows, \&header, \&record, undef, $v);
-    return $ret;
-}
-1;

src/contrib/warden-app/Modules/MailReport.pm

-package MailReport;
-use strict;
-use warnings;
-
-my %CONSTANTS =      (
-                       tool        => "sendmail",
-                       sender      => "",
-                       recipients  => [],
-                       subject     => "",
-                       subnets     => ["147."],
-                       signature   => "XXX",
-                       threshold   => 0,
-                       excludedsensor => [],
-                       excludedip  => [],
-                       eventtype   => [],
-                       maxage      => "1D",
-                       summary     => "yes",
-                     );
-
-my %FORMAT   =      (   maxage     => qr/\d+[hdmHDM]/, 
-                        tool       => qr/(ssmtp|sendmail)/,
-                    );
-
-sub run {
-    my (undef, $modprefix, $cfg, $dbh, $db_engine) = @_;
-
-    my $v = Constants::mergeConfigs($cfg, $modprefix, \%CONSTANTS, \%FORMAT);
-
-    my $eventtype_query = DB::joinIN("type", \@{$v->{'eventtype'}});
-    my $excluded_query  = DB::joinNotIN("source", \@{$v->{'excludedip'}});
-    my $excludedsensor_query  = DB::joinNotIN("service", \@{$v->{'excludedsensor'}});
-    my $subnets_query  = DB::joinLIKE("source", \@{$v->{'subnets'}});
-
-    my $condition = substr($excluded_query . $eventtype_query . $excludedsensor_query . $subnets_query, 0, -5);
-    my @columns= ("source", "hostname", "service", "type", "detected", "target_proto", "target_port", "attack_scale");
-    my @params = ($condition, DB::getOldDataDB($db_engine, "NEWER", $v->{'maxage'}));
-    my $query = DB::getQueryCondThreshold($db_engine, "events", \@columns, \@params, $v->{'threshold'});
-
-    my @rows = Utils::fetchall_array_hashref($dbh, $query);
-
-    if($v->{'subject'} eq "") {
-        my $hostname = `hostname -f`;
-        $v->{'subject'} = "$modprefix (Warden-app) on $hostname";
-    }
-    
-    $v->{'modprefix'} = $modprefix;
-   
-    sub header { 
-        my $v = shift; 
-        my $header; 
-
-        $header = "$v->{'modprefix'} noticed following events during $v->{'maxage'} timeframe:\n\n";
-        $header   .= sprintf("+-------------------------------+---------------------+------------+-----------------+-------+----------+--------+\n"); 
-        $header   .= sprintf("|       Detector/Service        |       Detected      |    Type    |      Source     | Dport |   Proto  | Volume |\n"); 
-        $header   .= sprintf("+-------------------------------+---------------------+------------+-----------------+-------+----------+--------+\n"); 
-
-        return $header
-    };
-
-    sub record { my $r = shift; return sprintf("|%30s | %19s | %10s | %15s | %5s | %8s | %6s |\n", "$r->{'hostname'}/$r->{'service'}", $r->{'detected'}, $r->{'type'}, $r->{'source'}, $r->{'target_port'}, $r->{'target_proto'}, $r->{'attack_scale'}); };
-
-    sub footer { 
-        my $v = shift; 
-        my $footer = sprintf("+-------------------------------+---------------------+------------+-----------------+-------+----------+--------+\n\n");
-        $footer    .= $v->{'signature'};
-   
-        return $footer; 
-    };
-
-    Utils::generateEmails($v->{'tool'}, \@{$v->{'recipients'}}, $v->{'sender'}, $v->{'subject'}, \@rows, \&header, \&record, \&footer, $v, $v->{'summary'});
-
-    return 1;
-}
-1;

src/contrib/warden-app/WardenApp/Constants.pm

-package Constants;
-use strict;
-use warnings;
-use Data::Dumper;
-
-use constant SCALAR => 'SCALAR';
-
-our %DEFAULTS = 
-(
-    factory     =>  {
-                        GENERAL_logfile         =>  "var/log/factory.log",
-                        GENERAL_modpath         =>  "Modules",
-                     },
-
-    receiver    =>  {
-                        GENERAL_method          =>  ( "stdout" ),
-                        GENERAL_logfile         =>  "var/log/receiver.log",
-                        GENERAL_wardenpath      =>  "/opt/warden/client",
-                        GENERAL_requested_type  =>  "",
-                        
-                        FILE_directory          =>  "var/fileout/",
-                        FILE_method             =>  "append",
-                        FILE_appendfilename     =>  "received",
-                        FILE_extension          =>  "csv",
-                        
-                        DB_dbengine               =>  "sqlite",
-                    },
-
-
-    db          =>  {
-                        SQLITE_db   =>  "var/db.sqlite",
-                        SQLITE_user =>  "",
-                        SQLITE_pass =>  "",
-                        
-                        MYSQL_db    =>  "warden",
-                        MYSQL_user  =>  "root",
-                        MYSQL_pass  =>  "",
-                        MYSQL_host  =>  "localhost",
-                        MYSQL_port  =>  "3306",
-                    },
-
-    cleaner     =>  {
-                        GENERAL_method  =>  ( "db" ),
-                        GENERAL_maxage  =>  "11D",
-                    },
-);
-
-
-sub getDefaultValue {
-    my ($valuename, $section) = @_;
-    
-    $valuename =~ s/\./_/g;
-    my @value = $DEFAULTS{$section}{$valuename};
-    die "Value '$valuename' is not defined" if not @value;
-    
-    return (wantarray ? @value : $value[0]);
-}
-
-sub assignValue {
-    my ($valuename, $cfg, $section, $nocheck) = @_;
-    
-    my @configvalue = $cfg->param($valuename);
-    $valuename =~ s/\./_/g;
-
-    my @value;
-
-    if(!defined $nocheck) { 
-        my @defaultvalue = getDefaultValue($valuename, $section);
-        @value = (@configvalue ? @configvalue : @defaultvalue);
-    } 
-    else {
-        @value = @configvalue;     
-    }
-    die "Value '$valuename' is not defined" if not defined $value[0];
-
-    if(wantarray and $value[0] eq "") {
-        return ();
-    }
-    else {
-        return (wantarray ? @value : $value[0]);
-    }
-}
-
-
-sub mergeConfigs {
-    my ($config, $section, $constants, $format) = @_;
-    my %ret;
- 
-    my $conf_hash = $config->get_block($section);
-
-    foreach my $const_key ( keys %$constants )
-    {
-        if( exists $conf_hash->{$const_key} ) {
-            if(ref($constants->{$const_key}) eq ref($conf_hash->{$const_key})) {
-                $ret{$const_key} = $conf_hash->{$const_key};
-            }
-            elsif (ref($constants->{$const_key}) eq 'ARRAY') {
-                $ret{$const_key} = (defined $conf_hash->{$const_key} ? [$conf_hash->{$const_key}] : []);
-            }
-            elsif (ref(\$constants->{$const_key}) eq 'SCALAR') {
-                $ret{$const_key} = (defined $conf_hash->{$const_key} ? $conf_hash->{$const_key}->[0] : "");
-            } 
-
-            if(exists $format->{$const_key}) {
-                if($ret{$const_key} !~ $format->{$const_key}) {
-                    $ret{$const_key} = $constants->{$const_key};
-                }
-            }
-        }
-        else {
-            $ret{$const_key} = $constants->{$const_key};
-        }
-    }
-
-    return \%ret;
-}

src/contrib/warden-app/WardenApp/DB.pm

-package DB;
-use strict;
-use warnings;
-
-use WardenApp::Constants;
-
-use constant DB_ENGINE_MYSQL => 'mysql';
-use constant DB_ENGINE_SQLITE => 'sqlite';
-use constant DB_SECTION => 'db';
-
-use DBI;
-
-sub connectDB {
-    my ($cfg, $db_engine) = @_;
-    
-    my $dbh;
-
-     if(lc $db_engine eq DB_ENGINE_MYSQL) {
-        
-        my $db      = Constants::assignValue('MYSQL.db',  $cfg, DB_SECTION);
-        my $host    = Constants::assignValue('MYSQL.host',  $cfg, DB_SECTION);
-        my $user    = Constants::assignValue('MYSQL.user',  $cfg, DB_SECTION);
-        my $pass    = Constants::assignValue('MYSQL.pass',  $cfg, DB_SECTION);
-        my $port    = Constants::assignValue('MYSQL.port',  $cfg, DB_SECTION);
-
-        $dbh = DBI->connect("DBI:mysql:host=" . $host . ";port=" . $port . ";database=" . $db,
-                            $user,
-                            $pass,
-                            {RaiseError => 0,AutoCommit => 0}) || die "Database connection not made: $DBI::errstr";
-    }
-    elsif (lc $db_engine eq DB_ENGINE_SQLITE) {
-        
-        my $db      = Constants::assignValue('SQLITE.db',  $cfg, DB_SECTION);
-        my $user    = Constants::assignValue('SQLITE.user',  $cfg, DB_SECTION);
-        my $pass    = Constants::assignValue('SQLITE.pass',  $cfg, DB_SECTION);
-
-        $dbh = DBI->connect("DBI:SQLite:" . $db,
-                            $user,
-                            $pass,
-                            {RaiseError => 0,AutoCommit => 1}) || die "Database connection not made: $DBI::errstr";
-    }
-
-    return \$dbh;
-}
-
-sub getOldDataDB {
-
-    my ($db_engine, $expr, $maxage) = @_;
-
-    my ($num, $word) = $maxage =~ /(\d+)([dmhDMH])/;
-    my ($word_long, $word_desc);
-
-    $word_long = "HOUR" if $word =~ /[hH]/;
-    $word_long = "DAY"  if $word =~ /[dD]/;
-    $word_long = "MONTH" if $word =~ /[mM]/;
-
-    my $c;
-    $c = "<" if($expr eq "OLDER");
-    $c = ">" if($expr eq "NEWER");
-
-
-    if($db_engine eq DB_ENGINE_MYSQL) {
-        return sprintf("detected %s DATE_SUB(NOW(), INTERVAL %d %s)", $c, $num, $word_long);
-    }
-    
-    if($db_engine eq DB_ENGINE_SQLITE) {
-        return sprintf("datetime(detected) %s datetime('now','-%d %s')", $c, $num, $word_long);
-    }
-
-    return "";
-}
-
-sub closeDB {
-    my $dbh = shift;
-    $$dbh->disconnect;
-}
-
-sub getQueryCondThreshold {
-    my ($db_engine, $table, $columns, $params, $threshold) = @_;
-    
-    my $columns_q = join ", ", @$columns;
-    my $params_q = join " AND ", grep { $_ } @$params;
-    
-    return sprintf("SELECT %s FROM %s WHERE %s GROUP BY source HAVING COUNT(id) > %s", $columns_q, $table, $params_q, $threshold);
-}
-
-sub joinIN {
-    my ($column, $data) = @_;
-    return (@$data ? sprintf("%s IN (%s) AND ", $column, join ",", map { "'$_'" } @$data)  : "");
-}
-
-sub joinNotIN {
-    my ($column, $data) = @_;
-    return (@$data ? sprintf("%s NOT IN (%s) AND ", $column, join ",", map { "'$_'" } @$data)  : "");
-}
-
-sub joinLIKE {
-    my ($column, $data) = @_;
-    my $ret = (@$data ? sprintf("%s",  join ",", map { "$column LIKE '$_%' OR " } @$data)  : "");
-    
-    return ($ret ne "" ? substr($ret, 0, -4) . " AND " : "");
-}
-
-
-1;

src/contrib/warden-app/WardenApp/Factory.pm

-package Factory;
-use strict;
-use warnings;
-
-use Config::Simple;
-use WardenApp::Constants;
-use WardenApp::DB;
-use WardenApp::Utils;
-use Data::Dumper;
-
-use constant TRUE   => 1;
-use constant FALSE  => 0;
-use constant ENABLED  => 'yes';
-
-use constant DB_ENGINE_MYSQL  => 'mysql';
-use constant DB_ENGINE_SQLITE => 'sqlite';
-
-use constant FACTORY_SECTION  => 'factory';
-use constant CFG_MODULE_DIR   => 'GENERAL.modpath';
-
-
-sub isModEnabled {
-    my ($modprefix, $cfg) = @_;
-
-    my $enabled = Constants::assignValue($modprefix . ".enabled", $cfg, FACTORY_SECTION);
-    if ($enabled eq ENABLED) {
-        return TRUE;
-    }
-    else {
-        return FALSE;
-    }
-}
-
-sub runModule {
-    my ($modulename, $cfg, $dbh, $db_engine) = @_;
- 
-    unless(isModEnabled($modulename, $cfg)) {
-        print "Module '$modulename' disabled! See configuration file!\n";
-        return 0;    
-    }
- 
-    my $moddir  = Constants::assignValue(CFG_MODULE_DIR,  $cfg, FACTORY_SECTION);
-    my $module  = Constants::assignValue($modulename . ".module",  $cfg, FACTORY_SECTION, "nocheck");  
-    
-    require "$moddir/$module.pm";
-    
-    print "Module '$modulename' started\n"; 
-    my $ret = $module->run($modulename, $cfg, $dbh, $db_engine); 
-    
-    if($ret) { 
-        print "Module '$modulename' finished\n"; 
-        return 1;
-    }
-    else {
-        print "Module '$modulename' finished with errors\n"; 
-        return 0;
-    }
-}
-1;

src/contrib/warden-app/WardenApp/Receiver.pm

-package Receiver;
-use strict;
-use warnings;
-
-use WardenApp::Constants;
-
-use constant RECEIVER_SECTION  => 'receiver';
-use constant SQL_INSERT_EVENT  => "INSERT INTO events VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)";
-
-sub openfile {
-    my ($cfg) = @_;
-    my ($filename, $openparam);
-
-    my $method = Constants::assignValue('FILE.method', $cfg, RECEIVER_SECTION);
-
-    if($method ne 'newfile' and $method ne 'append') {
-        $method = Constants::getDefaultValue('FILE.method', RECEIVER_SECTION);
-    }
-    
-    if($method eq 'newfile') {
-        my ($sec, $min, $hr, $day, $mon, $year) = localtime;
-        
-        $openparam = ">";
-        $filename = sprintf("%02d-%02d-%04d_%02d-%02d", $day, $mon + 1, 1900 + $year, $hr, $min);
-    
-    }
-    elsif ($method eq 'append') {
-        $openparam = ">>";
-        $filename = Constants::assignValue('FILE.appendfilename', $cfg, RECEIVER_SECTION); 
-    }
-
-
-    my $directory = Constants::assignValue('FILE.directory', $cfg, RECEIVER_SECTION); 
-    my $extension = Constants::assignValue('FILE.extension', $cfg, RECEIVER_SECTION);
-
-    my $openstring = $openparam . $directory . "/" .  $filename . "." . $extension; 
-    open FILE, $openstring or die $!;
-    return \*FILE;
-
-}
-
-sub saveToDB {
-    my ($dbh, $event, $db_engine) = @_;
-    
-    my $sth = $$dbh->prepare(SQL_INSERT_EVENT);
-    #my $data = join(',', @$event);
-    $sth->execute(@$event) || die $sth->errstr;
-
-    print "Receiver-$db_engine:\tError \"$@\" while processing data\n" if $@;
-}
-
-sub saveToFile {
-    my ($file, $event) = @_;
-    my $data = join(';', @$event);
-
-    print $file $data . "\n";
-}
-
-sub printToStdout {
-    my $event = shift;   
-    
-    print "| " . join(' | ', @$event ) . " |" . "\n";
-}
-
-sub closeFile {
-    my $file = shift;
-    close $file;
-}
-
-1;
-

src/contrib/warden-app/WardenApp/Utils.pm

-package Utils;
-use strict;
-use warnings;
-use Data::Dumper;
-
-
-sub generateOutput {
-    my ($outputfile, $rows, $header, $record, $footer, $values) = @_;
-
-    return 0 if not defined $record;
- 
-    if(open FILE, ">$outputfile") { 
-        print FILE &$header($values) if defined $header;
-        
-        foreach my $r (@$rows) {
-            my $record_alt = &$record($r, $values); 
-            print FILE $record_alt;
-        }
-
-        print FILE &$footer($values) . "\n"  if defined $footer; 
-        close FILE;
-
-        return 1; 
-    } 
-    else {
-        return 0;    
-    }
-}
-
-
-sub generateEmails {
-    my ($tool, $to, $from, $subject, $rows, $header, $record, $footer, $values, $summary) = @_;
-   
-    my ($msg, $body) = ("", "");
-    if($summary eq "yes") {
-        foreach my $r (@$rows) {
-            $body .= &$record($r, $values) if defined $record;
-        }
-      
-        if($body ne "") {
-            $msg .= &$header($values) if defined $header;
-            $msg .= $body;
-            $msg .= &$footer($values) if defined $footer;
-
-            foreach my $recipient (@$to) {
-                    sendEmail($tool, $recipient, $from, $subject, $msg) if defined $record;
-            }
-        }
-    }
-    else {
-        foreach my $r (@$rows) {
-            $msg  = "";
-            $msg .= &$header($values) if defined &$header;
-            $msg .= &$record($r, $values);
-            $msg .= &$footer($values) . "\n" if defined $footer;
-            
-            if(defined $record) {
-                foreach my $recipient (@$to) {
-                    sendEmail($tool, $recipient, $from, $subject, $msg) if defined $record;
-                }
-            }
-        }
-    }
-}
-
-sub sendEmail {
-    my($tool, $to, $from, $subject, $body) = @_;
-
-    if(($from !~ /^(\w|\-|\_|\.)+\@((\w|\-|\_)+\.)+[a-zA-Z]{2,}$/) || ($from =~ /\.@|\.\./)) {
-        print "Senders address ('$from') is not valid!\n";
-        return 0;
-    } 
-     
-    if(($to !~ /^(\w|\-|\_|\.)+\@((\w|\-|\_)+\.)+[a-zA-Z]{2,}$/) || ($to =~ /\.@|\.\./)) {
-        print "Recipients address ('$to') is not valid!\n";
-        return 0;
-    } 
-
-    if($subject eq "") {
-        print "Subject cannot be empty!\n";
-        return 0;
-    }
-
-    if(open(MAIL, "|/usr/sbin/$tool -t")) {
-        print MAIL "To: $to\n";
-        print MAIL "From: $from\n";
-        print MAIL "Subject: $subject\n\n";
-
-        print MAIL "$body";
-        close(MAIL);
-        return 1;
-    }
-    else {
-        return (0, "Sending email failed: $!");
-    } 
-}
-
-sub fetchall_array_hashref {
-    my ($dbh, $query) = @_;
-
-    my $sth = $$dbh->prepare($query);
-    $sth->execute();
-
-    my (@rows, $x);
-    push(@rows, $x) while ($x  = $sth->fetchrow_hashref());
-
-    return @rows;
-}
-
-
-1;

src/contrib/warden-app/bin/warden-cleaner.pl

-#!/usr/bin/perl
-use strict;
-use warnings;
-
-use FindBin qw($Bin);
-use lib "$Bin/../";
-
-use WardenApp::DB;
-use WardenApp::Constants;
-use Config::Simple;
-
-use constant GENERAL_CONFIG_FILE => "$Bin/../etc/cleaner.conf";
-use constant DB_CONFIG_FILE => "$Bin/../etc/db.conf";
-use constant RECV_CONFIG_FILE => "$Bin/../etc/receiver.conf";
-use constant RECEIVER_SECTION => 'receiver';
-use constant CLEANER_SECTION => 'cleaner';
-
-use constant DB_ENGINE_MYSQL  => 'mysql';
-use constant DB_ENGINE_SQLITE => 'sqlite';
-
-use constant TRUE   => 1;
-use constant FALSE  => 0;
-
-my $cfg = new Config::Simple;
-$cfg->read(GENERAL_CONFIG_FILE) or die $cfg->error();
-
-my $cfg_rcv = new Config::Simple;
-$cfg_rcv->read(RECV_CONFIG_FILE) or die $cfg_rcv->error();
-
-my $cfg_db = new Config::Simple;
-$cfg_db->read(DB_CONFIG_FILE) or die $cfg_db->error();
-
-my @general_method          =  Constants::assignValue('GENERAL.method', $cfg, CLEANER_SECTION);
-my $general_method_db       = (grep (/db/, @general_method) ? TRUE : FALSE);
-my $general_maxage          =  Constants::assignValue('GENERAL.maxage', $cfg, CLEANER_SECTION);
-$general_maxage             =  Constants::getDefaultValue('GENERAL.maxage', CLEANER_SECTION) if $general_maxage !~ /\d+[hdmHDM]/;
-
-if($general_method_db) {
-    my $db_engine =  Constants::assignValue('DB.dbengine', $cfg_rcv, RECEIVER_SECTION);
-    my $dbh = DB::connectDB($cfg_db, $db_engine);
-    if($dbh) {
-        my $query = sprintf("DELETE FROM events WHERE %s", DB::getOldDataDB($db_engine, "OLDER", $general_maxage));
-        my $sth = $$dbh->prepare($query);
-        $sth->execute;
-
-        my $num_deleted = $sth->rows;
-        print "Removed '$num_deleted' events older than $general_maxage.\n";
-
-        DB::closeDB($dbh);
-        
-        exit 1;
-    }
-    else {
-        exit 0;    
-    }
-} 
-else {
-    print "General DB method is not configured\n";
-    exit 0;
-}
-

src/contrib/warden-app/bin/warden-factory.pl

-#!/usr/bin/perl
-use strict;
-use warnings;
-
-use FindBin qw($Bin);
-use lib "$Bin/../";
-
-use WardenApp::DB;
-use WardenApp::Factory;
-use Config::Simple;
-
-use WardenApp::Constants;
-
-use constant RECEIVER_SECTION  => 'receiver';
-use constant DB_CONFIG_FILE => "$Bin/../etc/db.conf";
-use constant RECV_CONFIG_FILE => "$Bin/../etc/receiver.conf";
-use constant GENERAL_CONFIG_FILE => "$Bin/../etc/factory.conf";
-
-my $cfg = new Config::Simple;
-$cfg->read(GENERAL_CONFIG_FILE) or die $cfg->error();
-
-my $cfg_rcv = new Config::Simple;
-$cfg_rcv->read(RECV_CONFIG_FILE) or die $cfg_rcv->error();
-
-my $cfg_db = new Config::Simple;
-$cfg_db->read(DB_CONFIG_FILE) or die $cfg_db->error();
-
-my $db_engine = Constants::assignValue("DB.dbengine",  $cfg_rcv, RECEIVER_SECTION);
-my $dbh = DB::connectDB($cfg_db, $db_engine);
-if(not defined $dbh) {
-    exit 0;
-}
-
-if(defined $ARGV[0] and $ARGV[0] ne "") {
-    if(Factory::runModule($ARGV[0], $cfg, $dbh, $db_engine)) {
-        exit 1;
-    }
-    else {
-        exit 0;
-    }
-}
-else {
-    print "Use module's name as parameter", "\n";
-    exit 0;
-}
-
-DB::closeDB($dbh);
-

src/contrib/warden-app/bin/warden-receiver.pl

-#!/usr/bin/perl -w
-use strict;
-use warnings;
-
-use FindBin qw($Bin);
-use lib "$Bin/../";
-
-use Config::Simple;
-use WardenApp::DB;
-use WardenApp::Receiver;
-use WardenApp::Constants;
-
-use constant GENERAL_CONFIG_FILE => "$Bin/../etc/receiver.conf";
-use constant DB_CONFIG_FILE => "$Bin/../etc/db.conf";
-use constant RECEIVER_SECTION => 'receiver';
-use constant DEFAULT_REQ_ALL => undef;
-
-use constant TRUE   => 1;
-use constant FALSE  => 0;
-
-use Data::Dumper;
-
-my $cfg = new Config::Simple;
-$cfg->read(GENERAL_CONFIG_FILE) or exit 0;
-
-my $cfg_db = new Config::Simple;
-$cfg_db->read(DB_CONFIG_FILE) or exit 0;
-
-my @general_method          = Constants::assignValue('GENERAL.method',  $cfg, RECEIVER_SECTION);
-my $general_method_stdout   = (grep (/stdout/, @general_method) ? TRUE : FALSE);
-my $general_method_file     = (grep (/file/, @general_method) ? TRUE : FALSE);
-my $general_method_db       = (grep (/db/, @general_method) ? TRUE : FALSE);
-
-my $warden_path     = Constants::assignValue('GENERAL.wardenpath',      $cfg, RECEIVER_SECTION);
-my $requested_type  = Constants::assignValue('GENERAL.requested_type',  $cfg, RECEIVER_SECTION);
-$requested_type     = DEFAULT_REQ_ALL if $requested_type eq "";
-
-my $logfile         = Constants::assignValue('GENERAL.logfile',         $cfg, RECEIVER_SECTION);
-my $db_engine       = Constants::assignValue('DB.dbengine',               $cfg, RECEIVER_SECTION);
-
-my $dbh             = DB::connectDB($cfg_db, $db_engine) if $general_method_db;
-my $file_ref        = Receiver::openfile($cfg) if $general_method_file;  
-
-require $warden_path . '/lib/WardenClientReceive.pm';
-
-# Download of new evetns from Warden server
-while (my @new_events = WardenClientReceive::getNewEvents($warden_path, $requested_type)) {
-    foreach my $event_ref (@new_events) {
-        if($general_method_stdout) {
-            Receiver::printToStdout($event_ref); 
-        }
-
-        if($general_method_file) {
-            Receiver::saveToFile($file_ref, $event_ref);
-        }
-
-        if($general_method_db) {
-            Receiver::saveToDB($dbh, $event_ref, $db_engine);
-        }
-    }
-}
-
-DB::closeDB($dbh) if $general_method_db;
-Receiver::closeFile($file_ref) if $general_method_file;
-

src/contrib/warden-app/doc/WApp.README

-+-------------------------------+
-| README - WardenApp (WApp) 0.1 |
-+-------------------------------+
-
-Content
-
- A.  Overall Information
- B.  Installation Dependencies
- C.  Installation
- D.  Uninstallation
- E.  Configuration
- F.  Modules
- G.  Run
- H.  The requirements of modules
- X.  Tutorial: Running of the WApp along with the database backend
- XX. Tutorial: Writing your own module
-
---------------------------------------------------------------------------------
-A. Overall Information
-
- 1. About WardenApp
-	
-    Warden is a client-based architecture service designed to share detected
-    security events (issues) among CSIRT and CERT teams in a simple and fast
-    way.
-
-    WardenApp included in this package is an extension of classical Warden Client.
-    It allows automated evaluation received data and generates base of data for 
-    another tools or just allows generating reports for human checking.  
-
- 2. Version
-  
-    0.1 (2013-03-20)
-    
- 3. Package structure
-
-    warden-app/
-    |-- bin
-    |   |-- warden-cleaner.pl
-    |   |-- warden-factory.pl
-    |   `-- warden-receiver.pl
-    |-- doc
-    |   |-- WApp.cron
-    |   `-- WApp.README
-    |-- etc
-    |   |-- cleaner.conf
-    |   |-- db.conf
-    |   |-- factory.conf
-    |   `-- receiver.conf
-    |-- Modules
-    |   |-- DNSblacklist.pm
-    |   |-- IPblacklist.pm
-    |   |-- IPtables.pm
-    |   |-- IPset.pm
-    |   `-- MailReport.pm
-    |-- sh
-    |   |-- create_tables_mysql.sh
-    |   `-- create_tables_sqlite.sh
-    `-- WardenApp
-        |-- Constants.pm
-        |-- DB.pm
-        |-- Factory.pm
-        |-- Receiver.pm
-        `-- Utils.pm
-
-
---------------------------------------------------------------------------------
-A1. Essence of WardenApp
-
-    The core consists of three parts with this specific functions:
-
-    Receiver - Receives data and stores it in the selected location (stdout, file, db [sqlite, MySQL])
-
-    Factory  - Generates output that is requested. In short, it processes the data from the database 
-               and generates an output dependent on the module. More about modules in section X.
-
-    Cleaner  - Erases old unnecessary events. 
-
-    Each part is represented by a Perl script that runs at defined intervals by the cron daemon. See
-    section H.
-
---------------------------------------------------------------------------------
-B. Installation Dependencies
-  
-    Perl                  >= 5.10.1  
-    Config::Simple        >= 4.59-5
-    DBI
-    
-    Supported drivers for DBI are DBD::mysql and DBD::SQLite.
-                   
---------------------------------------------------------------------------------
-C. Installation 
-
- 1. Check SHA1 checksum of corresponding WardenApp package archive
-
-    $ sha1sum -c warden-app-0.1.tar.gz.sig
-
- 2. Untar it
-
-    $ tar xzvf warden-app-0.1.tar.gz
-
- 3. Just copy
-  
-    Copy to any directory. For simplicity, use the default location of the Warden 
-    project (/opt).
-
- 4. Installation Privileges
-
-    The Warden client is designed to be run under standard privileges. It should 
-    be a part of other applications that are run under usual user privileges.
-
- 5. Configuration files
-
-    The files are located in directory 'conf'. For defails, see section E.
-
- 6. Initialize database backend
-
-    WApp has interface for use MySQL or sqlite as database engine. Preparing 
-    for the basic database structure can use the scripts from 'bin' directory. 
-	
-    MySQL  -  create_tables_mysql.sh
-    sqlite -  create_tables_sqlite.sh
-
---------------------------------------------------------------------------------
-D. Uninstallation
-
-   Simply delete all files from WardenApp's installation directory.
-   Optionally delete database if you used this choice.
-
---------------------------------------------------------------------------------
-E. Configuration
-    
-   All configuration files are placed in 'conf' directory. File 'factory.conf' 
-   is used for configuration each of modules, other 'db.conf', 'receiver.conf' 
-   and 'cleaner.conf' are used for general purposes.
-   
-   Each of configuration parameters is described directly in configuration file.
-
---------------------------------------------------------------------------------
-F. Modules
-
-   Modules are placed in 'Modules' directory. Module is assigned to specific configuration
-   section in 'conf/facory.conf' file.
-
-   This package includes these modules with these specific functions:
-	
-   DNSblacklist	- generates zone file for the most widely used DNS software on the Internet.
-   IPblacklist	- generates traditional CSV file with IP addresses.
-   IPtables 	- generates iptables rules.
-   IPset 	    - generates ipset rules (use on big sets of addresses rather than iptables).
-   MailReport	- generates reports which are sent to specific recipients.
-
-   Section XX. describes how to write own module. 
-   
-   Some modules require additional requirements for their proper functioning. Specific 
-   examples are described in section H.
- 
---------------------------------------------------------------------------------       
-G. Run
-
-   1. Receiver
-	Usage: warden-receiver.pl
-
-   2. Factory
-	Usage: warden-factory.pl MODULE_CONF_NAME
-
-	MODULE_CONF_NAME
-	Represents specific configuration section placed in 'factory.conf'. Each of modules 
-	can have more configuration alternatives which are distinguished by name.
-		
-	For simple call of individual modules is possible use prepared cron script 
-	placed in 'etc/cron.d/' directory.
-
-
-	*WARNING: When generating a report using cron, the interval in configuration file and
-		  interval in cron script must be IDENTICAL, otherwise a result may be INACCURATE.
-
-    3. Cleaner
-	Usage: warden-cleaner.pl
-
---------------------------------------------------------------------------------       
-H. The requirements of modules
-
-   These modules require an initial steps:
-
-   1. IPtables
-
-   Redirect of specific traffic to chain specified in the configuration. 
-   If the 'chainname="BLOCK"' option is used and you are interested in SSH attackers (tcp/22), 
-   it's necessary use these commands:
-
-   iptables -N BLOCK
-   iptables -I INPUT 1 --protocol tcp --dport 22 --jump BLOCK
-   
-   2. IPset
-
-   Initialize the new set and create a blocking rule in iptables.   
-   If the 'setname="BLOCK"' and 'outputfile="rules.txt"' options are used and and you are 
-   interested in SSH attackers (tcp/22) it's necessary use these commands:
-
-   ipset --create BLOCK iphash
-   iptables -I INPUT 1 --protocol tcp --dport 22 -m set --match-set BLOCK src --jump DROP
-
-   Change of the rules using script consume a lot of CPU resources, so it is necessary 
-   to use a pipe:
-
-   ipset - < rules.txt 
-
---------------------------------------------------------------------------------       
-X. Tutorial: Running of the WApp along with the database backend
-
-    1. Database engine configuration (conf/db.conf)
-	
-	[SQLITE]
-        db="var/warden.db"
-	    user=
-	    pass=
-
-    2. Receiver configuration (conf/receiver.conf)
-
-	[GENERAL]
-        method="db"
-	    wardenpath="/opt/warden-client"
-	    # Type of event which will be requested. To get all types of event, leave this option blank.
-        requested_type=
-
-	[DB]
-	    dbengine="sqlite"
-
-    3. Factory configuration, IPtables module (conf/factory.conf)
-
-	[MOD_IPTABLES_1]
-   	    enabled="yes"
-	    module="IPtables"
-	    outputfile="tmp/iptables.txt"
-	    threshold="10"
-	    excludedip="1.1.1.1","2.2.2.2"
-	    eventtype=
-	    chainname="BLOCK"
-	    destchain="DROP"
-	    maxage="4M"
-
-    4. Cleaner configuration (conf/cleaner.conf)
-
-	[GENERAL]
-  	    method="db"
-	    maxage="5D"
-
-    5. Run
-
-	I. Manually
-	    # ./warden-receiver.pl
-	    # ./warden-factory.pl MOD_IPTABLES_1
-	    # ./warden-cleaner.pl
-
-	II. Regularly using cron (example in etc/cron.d/wardenapp)
-
-	    SCRIPT_PATH=/opt/warden-app/
-
-	    */5  *   * * *  root    cd $SCRIPT_PATH; ./warden-receiver.pl
-	    21   *   * * *  root    cd $SCRIPT_PATH; ./warden-factory.pl MOD_IPTABLES_1
-	    1    1   * * *  root    cd $SCRIPT_PATH; ./warden-cleaner.pl
-
-
---------------------------------------------------------------------------------       
-X.  Tutorial: Writing your own module
-
-   The base for modules is interface with hashes '%CONSTANTS', '%FORMAT' and sub 'run()'. 
-   Both of them has to be implemented. Modules are placed in 'Modules' directory.
-
-   sub run()  	- Main subroutine, which is always called from the parent's environment.
-   %CONSTANTS 	- Variable with all supported options and their default values.
-   %FORMAT	- Regexp for variables which must have a specific format.
-
-   IPtables module more deeply
-   ===========================
-
-   1. Defining configuration parameters
-   	All configuration options with their default values are stored in %CONSTANTS hash.
-
-	   my %CONSTANTS =    (
-				enabled    =>  "no",
-				outputfile =>  "tmp/iptables.txt",
-				threshold  =>  250,
-				excludedip =>  [],
-				eventtype  =>  [],
-				chainname  =>  "BLOCK",
-				destchain  =>  "DROP",
-				maxage     =>  "1D",
-			     );
-
-	In this case is used parameter maxage which must be in format '\d+[hdmHDM]'. Then it is
-	possible use '%FORMAT' hash to enforce specific format, otherwise will be used default 
-	value from '%CONSTANTS'.
-
-	   my %FORMAT   =      (   maxage     => qr/\d+[hdmHDM]/, );
-
-
-   2. Implementation of the main function
-
-	I.   The usual start function, reading the parameters from the parent function and retrieving 
-	     values from the config file.
-
-	   sub run {
-		my (undef, $modprefix, $cfg, $dbh, $db_engine) = @_;
-		my $v = Constants::mergeConfigs($cfg, $modprefix, \%CONSTANTS, \%FORMAT);
-
-	II.  Creating of string with database query. It is possible use built-in routines like joinIN, 
-	     joinNotIN, getOldDataDB or getQueryCondThreshold.
-	
-		my $eventtype_query = DB::joinIN("type", \@{$v->{'eventtype'}});
-		my $excluded_query  = DB::joinNotIN("source", \@{$v->{'excludedip'}});
-
-		my $condition = substr($excluded_query . $eventtype_query, 0, -5);
-		my @columns= ("source");
-		my @params = ($condition, DB::getOldDataDB($db_engine, "NEWER", $v->{'maxage'}));
-		my $query = DB::getQueryCondThreshold($db_engine, "events", \@columns, \@params, $v->{'threshold'});
-
-	III. Executing of created query and storing result to array.
-
-		my @rows = Utils::fetchall_array_hashref($dbh, $query);
-	
-	IV.  Implementing of subroutines 'header', 'record' and 'footer'. References to these functions 
-	     can be used like parameter in routine, which generates the final output. Mentioned routines 
-	     can get configuration values as a parameter and in addition, 'record' gets value of actual 
-             record in loop over result of query.
-
-		sub header { my $v = shift; return "/sbin/iptables -F $v->{'chainname'}\n"; };
-		sub record { my ($r, $v) = @_; return "/sbin/iptables -A $v->{'chainname'} -s $r->{'source'}/32 -j $v->{'destchain'}\n"; };
-
-		my $ret = Utils::generateOutput($v->{'outputfile'}, \@rows, \&header, \&record, undef, $v);
-
-	V.   Exit code is returned to parent.
-
-		return $ret;
-	   }
-
-
---------------------------------------------------------------------------------       
-Copyright (C) 2013 Cesnet z.s.p.o
-

src/contrib/warden-app/doc/WApp.cron

-#+--------------------------- minute [0-59;*/10 means every 10 minutes (0,10,20,30,40,50)]
-#|       +------------------- hour [0-23]
-#|       |   +--------------- day of month [1-31]
-#|       |   | +------------- month [1-12]
-#|       |   | | +----------- day of week [0-7; 0 or 7 is Sunday]
-#|       |   | | |  +-------- user
-#|       |   | | |  |     +-- command
-#|       |   | | |  |     |
-
-SCRIPT_PATH=/opt/warden-app/
-
-*/5  *   * * *  root    cd $SCRIPT_PATH; ./warden-receiver.pl
-
-21   *   * * *  root    cd $SCRIPT_PATH; ./warden-factory.pl MOD_IPTABLES_1
-
-21   *   * * *  root    cd $SCRIPT_PATH; ./warden-factory.pl MOD_BLACKLISTIP_1
-
-1    1   * * *  root    cd $SCRIPT_PATH; ./warden-cleaner.pl
-

src/contrib/warden-app/etc/cleaner.conf

-#CLEANER configuration file
-
-[GENERAL]
-#What will be cleaned; [db]
-method="db"
-#How old events will be deleted [D - Days, M - Months, H - Hours]; 
-maxage="5M"
-