Skip to content
Snippets Groups Projects
Commit 0d1d4deb authored by Tomáš Plesník's avatar Tomáš Plesník
Browse files

zmena na staticke nacitani konfiguracniho souboru; validace logovacich a... 

zmena na staticke nacitani konfiguracniho souboru; validace logovacich a chybovech hlasek; pridana moznost vypnout kontrolni hash VALID_STRING pomoci jejiho zakomentovani v konfiguracnim souboru; odstranena puvodni sendMsg, nepojeno na WardenCommon::sendMsg; pridano automaticke prenastaveni vybranych polozek udalosti na undef, pokud nejsou cele cislo
parent ebe3059f
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
src/warden-server/lib/Warden.pm
+ 66
− 72
View file @ 0d1d4deb
...@@ -19,12 +19,20 @@ use MIME::Base64; ...@@ -19,12 +19,20 @@ use MIME::Base64;
use Crypt::X509; use Crypt::X509;
use SOAP::Lite; use SOAP::Lite;
use Carp; use Carp;
use FindBin qw($RealBin $RealScript); use File::Basename;
use lib "$FindBin::RealBin/../lib";
my $basedir = "/opt/warden-server/";
use lib $basedir . "lib";
use WardenCommon; use WardenCommon;
################################################################################
# VARIABLES
################################################################################
our $VERSION = "2.2"; our $VERSION = "2.2";
my $etc = "$FindBin::RealBin/../etc"; my $etc = $basedir . "etc";
our $FILENAME = File::Basename::basename($0);
...@@ -39,8 +47,8 @@ our $DB_NAME = undef; ...@@ -39,8 +47,8 @@ our $DB_NAME = undef;
our $DB_USER = undef; our $DB_USER = undef;
our $DB_PASS = undef; our $DB_PASS = undef;
our $DB_HOST = undef; our $DB_HOST = undef;
our $MAX_EVENTS_LIMIT = 1000000; # default value our $MAX_EVENTS_LIMIT = 1000000; # default value
our %VALID_STRINGS = undef; our %VALID_STRINGS = (); # inicialization of empty hash
# load set variables by user # load set variables by user
unless (do $conf_file) { unless (do $conf_file) {
...@@ -52,41 +60,29 @@ unless (do $conf_file) { ...@@ -52,41 +60,29 @@ unless (do $conf_file) {
################################################################################ ################################################################################
# VARIABLES # DB CONNECT
################################################################################ ################################################################################
our $DBH = DBI->connect("DBI:mysql:database=$DB_NAME;host=$DB_HOST", $DB_USER, $DB_PASS, {RaiseError => 1, mysql_auto_reconnect => 1}) our $DBH = DBI->connect("DBI:mysql:database=$DB_NAME;host=$DB_HOST", $DB_USER, $DB_PASS, {RaiseError => 1, mysql_auto_reconnect => 1})
|| die "Could not connect to database: $DBH->errstr"; || die "Could not connect to database: $DBH->errstr";
################################################################################ ################################################################################
# LOCAL FUNCTIONS # FUNCTIONS
################################################################################ ################################################################################
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
# sendMsg - sent message to syslog (SYS::Syslog) and to client (SOAP::Fault) # sendMsg - wrapper for more complex WardenCommon::sendMsg function
#
# Args: (SYSLOG severity, SYSLOG msg, SOAP msg)
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
sub sendMsg sub sendMsg
{ {
my $severity = shift; my $severity = shift;
my $syslog_msg = shift; my $syslog_msg = shift;
my $soap_msg = shift; my $soap_msg = shift;
my $filename = $RealScript;
if ($SYSLOG_VERBOSE == 1 && ($severity eq "err" || $severity eq "debug")) { WardenCommon::sendMsg($SYSLOG, $SYSLOG_VERBOSE, $SYSLOG_FACILITY, $severity,
$syslog_msg .= "\nStack info: " . Carp::longmess(); $syslog_msg, $soap_msg, $FILENAME);
} }
if ($SYSLOG == 1 && defined $severity && defined $syslog_msg) {
Sys::Syslog::openlog($filename, "cons,pid", $SYSLOG_FACILITY);
Sys::Syslog::syslog("$severity", "$syslog_msg");
Sys::Syslog::closelog();
}
if (defined $soap_msg) {die SOAP::Fault->faultstring($soap_msg)};
}
} # End of sendMsg
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
...@@ -137,8 +133,8 @@ sub authorizeClient ...@@ -137,8 +133,8 @@ sub authorizeClient
# check db handler # check db handler
if (!defined $sth) { if (!defined $sth) {
sendMsg("err", sendMsg("err",
"Cannot prepare authorization statement in $function_name: $DBH->errstr", "Cannot prepare authorization statement in $function_name: $DBH->errstr",
"Internal 'prepare' server error") "Internal 'prepare' server error");
} }
# execute query for two or none params functions # execute query for two or none params functions
...@@ -169,16 +165,16 @@ sub authorizeClient ...@@ -169,16 +165,16 @@ sub authorizeClient
# check if client is registered # check if client is registered
if ($sth->rows == 0) { if ($sth->rows == 0) {
sendMsg("err", sendMsg("err",
"Unauthorized access to function '$function_name' from: '$ip'; CN(AN): $alt_names; used service: '$service_type' - client is not registered", "Unauthorized access to function '$function_name' from [IP: '$ip'; CN(AN): $alt_names; Client_type: '$client_type'; Service/Type: '$service_type'] - client is not registered at Warden server '$ENV{'SERVER_NAME'}'",
"Access denied - client is not registered at warden server $ENV{'SERVER_NAME'}"); "Access denied - client is not registered at Warden server '$ENV{'SERVER_NAME'}'");
return undef; return undef;
} }
# check if client has IP from registered CIDR # check if client has IP from registered CIDR
if (!$correct_ip_source) { if (!$correct_ip_source) {
sendMsg ("err", sendMsg ("err",
"Unauthorized access to function '$function_name' from: '$ip'; CN(AN): $alt_names; used service: '$service_type' - access from bad subnet: Registered subnet '$ret{'cidr'}'", "Unauthorized access to function '$function_name' from [IP: '$ip'; CN(AN): $alt_names; Client_type: '$client_type'; Service/Type: '$service_type'] - access to Warden server '$ENV{'SERVER_NAME'}' from another subnet than '$ret{'cidr'}'",
"Access denied - access to $ENV{'SERVER_NAME'} from unauthorized subnet"); "Access denied - access to Warden server '$ENV{'SERVER_NAME'}' from unauthorized subnet '$ret{'cidr'}'");
return undef; return undef;
} }
...@@ -224,46 +220,44 @@ sub saveNewEvent ...@@ -224,46 +220,44 @@ sub saveNewEvent
my $timeout = $data->{'TIMEOUT'}; my $timeout = $data->{'TIMEOUT'};
my %client = authorizeClient($alt_names, $ip, $service, $client_type, $function_name); my %client = authorizeClient($alt_names, $ip, $service, $client_type, $function_name);
if(defined %client) { if (defined %client) {
if (!(exists $VALID_STRINGS{'type'} && grep $type eq $_, @{$VALID_STRINGS{'type'}})) { if (%VALID_STRINGS) { # check if hash is not empty - use VALIDATION HASH
sendMsg("err", if (!(exists $VALID_STRINGS{'type'} && grep $type eq $_, @{$VALID_STRINGS{'type'}})) {
"Unknown event type - client from: '$ip'; CN(AN): $alt_names; used type: '$type'", sendMsg("err",
"Unknown event type '$type'"); "Unknown event type from [IP: '$ip'; CN(AN): $alt_names; Service: '$service'; Type: '$type']",
} elsif (!(exists $VALID_STRINGS{'source_type'} && grep $source_type eq $_, @{$VALID_STRINGS{'source_type'}})) { "Unknown event type: '$type'");
sendMsg("err", } elsif (!(exists $VALID_STRINGS{'source_type'} && grep $source_type eq $_, @{$VALID_STRINGS{'source_type'}})) {
"Unknown source type - client from: '$ip'; CN(AN): $alt_names; used source_type: '$source_type'", sendMsg("err",
"Unknown source type '$source_type'"); "Unknown source type from [IP '$ip'; CN(AN): $alt_names; Service: '$service'; Source_type: '$source_type']",
"Unknown source type: '$source_type'");
}
}
# http://my.safaribooksonline.com/book/programming/regular-expressions/9780596802837/4dot-validation-and-formatting/id2983571 # http://my.safaribooksonline.com/book/programming/regular-expressions/9780596802837/4dot-validation-and-formatting/id2983571
} elsif ($detected !~ /^((?:[1-9][0-9]*)?[0-9]{4})-(1[0-2]|0[1-9])-(3[0-1]|0[1-9]|[1-2][0-9])T(2[0-3]|[0-1][0-9]):([0-5][0-9]):([0-5][0-9])(\.[0-9]+)?(Z|[+-](?:2[0-3]|[0-1][0-9]):[0-5][0-9])?/) { if ($detected !~ /^((?:[1-9][0-9]*)?[0-9]{4})-(1[0-2]|0[1-9])-(3[0-1]|0[1-9]|[1-2][0-9])T(2[0-3]|[0-1][0-9]):([0-5][0-9]):([0-5][0-9])(\.[0-9]+)?(Z|[+-](?:2[0-3]|[0-1][0-9]):[0-5][0-9])?/) {
sendMsg("err", sendMsg("err",
"Unknown detected time format - client from: '$ip'; CN(AN): $alt_names; used detected: '$detected'", "Unknown detected time format from [IP: '$ip'; CN(AN): $alt_names; Service: '$service'; Detected: '$detected']",
"Unknown detected time format '$detected'"); "Unknown detected time format: '$detected'");
} elsif ($target_port !~ /^\d+\z/ && defined $target_port) { }
sendMsg("err", if ($target_port !~ /^\d+\z/) {
"Unknown target port - client from: '$ip'; CN(AN): $alt_names; used target_port: '$target_port'", $target_port = undef;
"Unknown target port '$target_port'"); }
} elsif ($attack_scale !~ /^\d+\z/ && defined $attack_scale) { if ($attack_scale !~ /^\d+\z/) {
sendMsg("err", $attack_scale = undef;
"Unknown attack scale - client from: '$ip'; CN(AN): $alt_names; used attack_scale: '$attack_scale'", }
"Unknown attack scale '$attack_scale'"); if ($priority !~ /^\d+\z/) {
} elsif ($priority !~ /^\d+\z/ && defined $priority) { $priority = undef;
sendMsg("err", }
"Unknown priority - client from: '$ip'; CN(AN): $alt_names; used priority: '$priority'", if ($timeout !~ /^\d+\z/) {
"Unknown priority '$priority'"); $timeout = undef;
} elsif ($timeout !~ /^\d+\z/ && defined $timeout) { }
$sth=$DBH->prepare("INSERT INTO events VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);");
if (!defined $sth) {
sendMsg("err", sendMsg("err",
"Unknown timeout - client from: '$ip'; CN(AN): $alt_names; used timeout: '$timeout'", "Cannot prepare statement in function '$function_name': $DBH->errstr",
"Unknown timeout '$timeout'"); "Internal 'prepare' server error");
} else {
$sth=$DBH->prepare("INSERT INTO events VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);");
if (!defined $sth) {
sendMsg("err",
"Cannot prepare statement in function '$function_name': $DBH->errstr",
"Internal 'prepare' server error");
}
$sth->execute(undef, $client{'dns'}, $service, $detected, $received, $type, $source_type, $source, $target_proto, $target_port, $attack_scale, $note, $priority, $timeout, $valid);
return 1;
} }
$sth->execute(undef, $client{'dns'}, $service, $detected, $received, $type, $source_type, $source, $target_proto, $target_port, $attack_scale, $note, $priority, $timeout, $valid);
return 1;
} }
} # END of saveNewEvent } # END of saveNewEvent
...@@ -382,11 +376,11 @@ sub getNewEvents ...@@ -382,11 +376,11 @@ sub getNewEvents
if (scalar @events != 0) { if (scalar @events != 0) {
if (scalar @ids == 1) { if (scalar @ids == 1) {
sendMsg("info", sendMsg("info",
"Sent 1 event [#$ids[0]] to '$ip' [CN(AN): $alt_names], client_limit: '$max_rcv_events_limit', requested_type: '$requested_type'", "Sent 1 event [#$ids[0]] to [IP: '$ip'; CN(AN): $alt_names; Client_limit: '$max_rcv_events_limit', Requested_type: '$requested_type']",
undef); undef);
} else { } else {
sendMsg("info", sendMsg("info",
"Sent " . scalar @ids . " events [#$ids[0] - #$ids[-1]] to '$ip' [CN(AN): $alt_names], client_limit: '$max_rcv_events_limit', requested_type: '$requested_type'", "Sent " . scalar @ids . " events [#$ids[0] - #$ids[-1]] to [IP: '$ip'; CN(AN): $alt_names, Client_limit: '$max_rcv_events_limit', Requested_type: '$requested_type']",
undef); undef);
} }
} }
...@@ -485,7 +479,7 @@ sub getClientInfo ...@@ -485,7 +479,7 @@ sub getClientInfo
} }
my $sum = scalar @clients; my $sum = scalar @clients;
sendMsg("info", sendMsg("info",
"Sending information about '$sum' registered clients from $ENV{'SERVER_NAME'}", "Sent information about $sum registered clients from Warden server '$ENV{'SERVER_NAME'}'",
undef); undef);
return @clients; return @clients;
} }
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment