Skip to content
Snippets Groups Projects
Commit ac58da12 authored by Tomáš Plesník's avatar Tomáš Plesník
Browse files

pridana podpora pro validaci typu prichozich udalosti + doplnen install.sh

parent cca30802
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
src/warden-server/etc/warden-server.conf
+ 8
− 1
View file @ ac58da12
...@@ -34,6 +34,13 @@ $DB_HOST = "localhost"; ...@@ -34,6 +34,13 @@ $DB_HOST = "localhost";
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
# MAX_EVENT_LIMIT - maximum number of events that can be downloaded from # MAX_EVENT_LIMIT - maximum number of events that can be downloaded from
# Warden server in a single getNewEvents client function call # Warden server in a single getNewEvents client function call
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
$MAX_EVENT_LIMIT = "1000000"; $MAX_EVENT_LIMIT = "1000000";
#-------------------------------------------------------------------------------
# VALID_STRINGS - validation hash containing allowed event attributes
#-------------------------------------------------------------------------------
%VALID_STRINGS = (
"type" => ["portscan", "bruteforce", "spam", "phishing", "botnet_c_c", "dos", "malware", "copyright", "webattack", "test", "other", "_any_"],
);
src/warden-server/lib/Warden.pm
+ 65
− 40
View file @ ac58da12
...@@ -19,6 +19,7 @@ use Net::CIDR::Lite; ...@@ -19,6 +19,7 @@ use Net::CIDR::Lite;
use DateTime; use DateTime;
use MIME::Base64; use MIME::Base64;
use Crypt::X509; use Crypt::X509;
use List::Util 'first';
our $VERSION = "2.1"; our $VERSION = "2.1";
...@@ -33,7 +34,8 @@ our $DB_NAME = undef; ...@@ -33,7 +34,8 @@ our $DB_NAME = undef;
our $DB_USER = undef; our $DB_USER = undef;
our $DB_PASS = undef; our $DB_PASS = undef;
our $DB_HOST = undef; our $DB_HOST = undef;
our $MAX_EVENT_LIMIT = undef; our $MAX_EVENT_LIMIT = undef;
our %VALID_STRINGS = undef;
# read config file # read config file
if (!open( TMP, $conf_file)) { if (!open( TMP, $conf_file)) {
...@@ -164,14 +166,14 @@ sub authorizeClient ...@@ -164,14 +166,14 @@ sub authorizeClient
# check if client is registered # check if client is registered
if ($sth->rows == 0) { if ($sth->rows == 0) {
write2log ("err", "Unauthorized access to $function_name from: $ip (CN(AN): $alt_names), used service '$service_type' - client is not registered"); write2log ("err", "Unauthorized access to $function_name from: $ip; CN(AN): $alt_names; used service: '$service_type' - client is not registered");
die("Access denied - client is not registered at warden server!"); die("Access denied - client is not registered at warden server!");
return undef; return undef;
} }
# check if client has IP from registered CIDR # check if client has IP from registered CIDR
if (!$correct_ip_source) { if (!$correct_ip_source) {
write2log ("err", "Unauthorized access to $function_name from: $ip (CN(AN): $alt_names), used service '$service_type' - access from bad subnet: Registered subnet '" . $ret{'cidr'} . "'"); write2log ("err", "Unauthorized access to $function_name from: $ip; CN(AN): $alt_names; used service: '$service_type' - access from bad subnet: Registered subnet '" . $ret{'cidr'} . "'");
die("Access denied - access from unauthorized subnet!"); die("Access denied - access from unauthorized subnet!");
return undef; return undef;
} }
...@@ -198,8 +200,9 @@ sub saveNewEvent ...@@ -198,8 +200,9 @@ sub saveNewEvent
my $ip = $ENV{'REMOTE_ADDR'}; my $ip = $ENV{'REMOTE_ADDR'};
# variables defined by server # variables defined by server
my $client_type = "s"; # incoming client MUST be sender my $function_name = 'saveNewEvent';
my $valid = "t"; # registered sender has valid events my $client_type = 's'; # incoming client MUST be sender
my $valid = 't'; # registered sender has valid events
my $received = DateTime->now; # time of event delivery (UTC) my $received = DateTime->now; # time of event delivery (UTC)
# parse object (event) parameters # parse object (event) parameters
...@@ -215,13 +218,22 @@ sub saveNewEvent ...@@ -215,13 +218,22 @@ sub saveNewEvent
my $priority = $data->{'PRIORITY'}; my $priority = $data->{'PRIORITY'};
my $timeout = $data->{'TIMEOUT'}; my $timeout = $data->{'TIMEOUT'};
my %client = authorizeClient($alt_names, $ip, $service, $client_type, 'saveNewEvent'); my %client = authorizeClient($alt_names, $ip, $service, $client_type, $function_name);
if(defined %client) { if(defined %client) {
# insert new events into DB
$sth=$DBH->prepare("INSERT INTO events VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);"); # check validity of event attributes - TYPE
if (!defined $sth) { die("Cannot do insert statement in saveNewEvent: $DBI::errstr\n") } my $valid_types_ref = $VALID_STRINGS{'type'};
$sth->execute(undef, $client{'dns'}, $service, $detected, $received, $type, $source_type, $source, $target_proto, $target_port, $attack_scale, $note, $priority, $timeout, $valid); my @valid_types = @$valid_types_ref;
return 1; my $match = first { /$type/ } @valid_types;
if ($match) {
$sth=$DBH->prepare("INSERT INTO events VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?);");
if (!defined $sth) { die("Cannot do insert statement in $function_name: $DBI::errstr\n") }
$sth->execute(undef, $client{'dns'}, $service, $detected, $received, $type, $source_type, $source, $target_proto, $target_port, $attack_scale, $note, $priority, $timeout, $valid);
return 1;
} else {
write2log ("err", "Unknown event type - client from: $ip; CN(AN): $alt_names; used type: '$type'");
die("Unknown event type - client sent event with unknown type '$type'!");
}
} }
} # END of saveNewEvent } # END of saveNewEvent
...@@ -239,34 +251,36 @@ sub getNewEvents ...@@ -239,34 +251,36 @@ sub getNewEvents
my $cn = $ENV{'SSL_CLIENT_S_DN_CN'}; my $cn = $ENV{'SSL_CLIENT_S_DN_CN'};
my $alt_names = getAltNames(undef); my $alt_names = getAltNames(undef);
my $ip = $ENV{'REMOTE_ADDR'}; my $ip = $ENV{'REMOTE_ADDR'};
my $client_type = "r"; # incoming client MUST be sender
my $client_type = 'r'; # incoming client MUST be sender
my $function_name = 'getNewEvents';
# parse SOAP data object # parse SOAP data object
my $requested_type = $data->{'REQUESTED_TYPE'}; my $requested_type = $data->{'REQUESTED_TYPE'};
my $last_id = $data->{'LAST_ID'}; my $last_id = $data->{'LAST_ID'};
my %client = authorizeClient($alt_names, $ip, $requested_type, $client_type, 'getNewEvents'); my %client = authorizeClient($alt_names, $ip, $requested_type, $client_type, $function_name);
if(defined %client) { if(defined %client) {
if ($client{'receive_own'} eq 't') { # check if client want your own events or not if ($client{'receive_own'} eq 't') { # check if client want your own events or not
if ($requested_type eq '_any_') { # check if client want each or only one type of messages if ($requested_type eq '_any_') { # check if client want each or only one type of messages
$sth = $DBH->prepare("SELECT * FROM events WHERE type != 'test' AND id > ? AND valid = 't' ORDER BY id ASC limit $MAX_EVENT_LIMIT;"); $sth = $DBH->prepare("SELECT * FROM events WHERE type != 'test' AND id > ? AND valid = 't' ORDER BY id ASC limit $MAX_EVENT_LIMIT;");
if (!defined $sth) {die("Cannot prepare ROE-ANY statement in getNewEvents: $DBI::errstr\n")} if (!defined $sth) {die("Cannot prepare ROE-ANY statement in $function_name: $DBI::errstr\n")}
$sth->execute($last_id); $sth->execute($last_id);
} else { } else {
$sth = $DBH->prepare("SELECT * FROM events WHERE type != 'test' AND id > ? AND type = ? AND valid = 't' ORDER BY id ASC limit $MAX_EVENT_LIMIT;"); $sth = $DBH->prepare("SELECT * FROM events WHERE type != 'test' AND id > ? AND type = ? AND valid = 't' ORDER BY id ASC limit $MAX_EVENT_LIMIT;");
if (!defined $sth) {die("Cannot prepare ROE statement in getNewEvents: $DBI::errstr\n")} if (!defined $sth) {die("Cannot prepare ROE statement in $function_name: $DBI::errstr\n")}
$sth->execute($last_id, $requested_type); $sth->execute($last_id, $requested_type);
} }
} else { } else {
if ($requested_type eq '_any_') { if ($requested_type eq '_any_') {
$sth = $DBH->prepare("SELECT * FROM events WHERE type != 'test' AND id > ? AND valid = 't' AND hostname NOT LIKE ? ORDER BY id ASC limit $MAX_EVENT_LIMIT;"); $sth = $DBH->prepare("SELECT * FROM events WHERE type != 'test' AND id > ? AND valid = 't' AND hostname NOT LIKE ? ORDER BY id ASC limit $MAX_EVENT_LIMIT;");
if (!defined $sth) {die("Cannot prepare ANY statement in getNewEvents: $DBI::errstr\n")} if (!defined $sth) {die("Cannot prepare ANY statement in $function_name: $DBI::errstr\n")}
my ($domain) = $cn =~ /([^\.]+\.[^\.]+)$/; my ($domain) = $cn =~ /([^\.]+\.[^\.]+)$/;
$domain = '\%' . $domain; $domain = '\%' . $domain;
$sth->execute($last_id, $domain); $sth->execute($last_id, $domain);
} else { } else {
$sth = $DBH->prepare("SELECT * FROM events WHERE type != 'test' AND id > ? AND type = ? AND valid = 't' AND hostname NOT LIKE ? ORDER BY id ASC limit $MAX_EVENT_LIMIT;"); $sth = $DBH->prepare("SELECT * FROM events WHERE type != 'test' AND id > ? AND type = ? AND valid = 't' AND hostname NOT LIKE ? ORDER BY id ASC limit $MAX_EVENT_LIMIT;");
if (!defined $sth) {die("Cannot prepare statement in getNewEvents: $DBI::errstr\n")} if (!defined $sth) {die("Cannot prepare statement in $function_name: $DBI::errstr\n")}
my ($domain) = $cn =~ /([^\.]+\.[^\.]+)$/; my ($domain) = $cn =~ /([^\.]+\.[^\.]+)$/;
$domain = '\%' . $domain; $domain = '\%' . $domain;
$sth->execute($last_id, $requested_type, $domain); $sth->execute($last_id, $requested_type, $domain);
...@@ -328,9 +342,10 @@ sub getNewEvents ...@@ -328,9 +342,10 @@ sub getNewEvents
sub getLastId sub getLastId
{ {
my ($class, $arg) = @_; my ($class, $arg) = @_;
my $function_name = 'getLastId';
my $sth = $DBH->prepare("SELECT max(id) FROM events;"); my $sth = $DBH->prepare("SELECT max(id) FROM events;");
if ( !defined $sth ) { die("Cannot prepare statement in getLastId: $DBI::errstr\n") } if ( !defined $sth ) { die("Cannot prepare statement in $function_name: $DBI::errstr\n") }
$sth->execute; $sth->execute;
my $result = $sth->fetchrow(); my $result = $sth->fetchrow();
...@@ -351,8 +366,10 @@ sub registerSender ...@@ -351,8 +366,10 @@ sub registerSender
my $ip = $ENV{'REMOTE_ADDR'}; my $ip = $ENV{'REMOTE_ADDR'};
my $local_ip = $ENV{'SERVER_ADDR'}; my $local_ip = $ENV{'SERVER_ADDR'};
my $function_name = 'registerSender';
if ($local_ip ne $ip) { if ($local_ip ne $ip) {
write2log ("err", "Unauthorized access to registerSender from: $ip ($cn) - access allowed only from localhost"); write2log ("err", "Unauthorized access to $function_name from: $ip ($cn) - access allowed only from localhost");
die("Access denied - access allowed only from localhost!"); die("Access denied - access allowed only from localhost!");
} else { } else {
# defined variables by method # defined variables by method
...@@ -370,7 +387,7 @@ sub registerSender ...@@ -370,7 +387,7 @@ sub registerSender
# check if sender has been already registered # check if sender has been already registered
$sth = $DBH->prepare("SELECT registered FROM clients WHERE hostname = ? AND requestor = ? AND service = ? AND client_type = ? AND type = ? AND receive_own_events = ? AND description_tags = ? AND ip_net_client = ? LIMIT 1;"); $sth = $DBH->prepare("SELECT registered FROM clients WHERE hostname = ? AND requestor = ? AND service = ? AND client_type = ? AND type = ? AND receive_own_events = ? AND description_tags = ? AND ip_net_client = ? LIMIT 1;");
if (!defined $sth) {die("Cannot prepare check statement in registerSender: $DBI::errstr\n")} if (!defined $sth) {die("Cannot prepare check statement in $function_name: $DBI::errstr\n")}
$sth->execute($hostname, $requestor, $service, $client_type, $type, $receive_own_events, $description_tags, $ip_net_client); $sth->execute($hostname, $requestor, $service, $client_type, $type, $receive_own_events, $description_tags, $ip_net_client);
my $result = $sth->fetchrow(); my $result = $sth->fetchrow();
...@@ -380,7 +397,7 @@ sub registerSender ...@@ -380,7 +397,7 @@ sub registerSender
die("Error - sender has already been registered at $result"); die("Error - sender has already been registered at $result");
} else { } else {
$sth = $DBH->prepare("INSERT INTO clients VALUES (?,?,?,?,?,?,?,?,?,?);"); $sth = $DBH->prepare("INSERT INTO clients VALUES (?,?,?,?,?,?,?,?,?,?);");
if (!defined $sth) {die("Cannot do statement in registerSender: $DBI::errstr\n")} if (!defined $sth) {die("Cannot do statement in $function_name: $DBI::errstr\n")}
$sth->execute(undef, $hostname, $registered, $requestor, $service, $client_type, $type, $receive_own_events, $description_tags, $ip_net_client); $sth->execute(undef, $hostname, $registered, $requestor, $service, $client_type, $type, $receive_own_events, $description_tags, $ip_net_client);
write2log("info", "New sender $hostname (service: $service, cidr: $ip_net_client) was registered"); write2log("info", "New sender $hostname (service: $service, cidr: $ip_net_client) was registered");
return 1; return 1;
...@@ -402,8 +419,10 @@ sub registerReceiver ...@@ -402,8 +419,10 @@ sub registerReceiver
my $ip = $ENV{'REMOTE_ADDR'}; my $ip = $ENV{'REMOTE_ADDR'};
my $local_ip = $ENV{'SERVER_ADDR'}; my $local_ip = $ENV{'SERVER_ADDR'};
my $function_name = 'registerReceiver';
if ($local_ip ne $ip) { if ($local_ip ne $ip) {
write2log ("err", "Unauthorized access to registerReceiver from: $ip ($cn) - access allowed only from localhost"); write2log ("err", "Unauthorized access to $function_name from: $ip ($cn) - access allowed only from localhost");
die("Access denied - access allowed only from localhost!"); die("Access denied - access allowed only from localhost!");
} else { } else {
# variables defined by method # variables defined by method
...@@ -421,7 +440,7 @@ sub registerReceiver ...@@ -421,7 +440,7 @@ sub registerReceiver
# check if receiver has been already registered # check if receiver has been already registered
$sth = $DBH->prepare("SELECT registered FROM clients WHERE hostname = ? AND requestor = ? AND service = ? AND client_type = ? AND type = ? AND receive_own_events = ? AND description_tags = ? AND ip_net_client = ? LIMIT 1;"); $sth = $DBH->prepare("SELECT registered FROM clients WHERE hostname = ? AND requestor = ? AND service = ? AND client_type = ? AND type = ? AND receive_own_events = ? AND description_tags = ? AND ip_net_client = ? LIMIT 1;");
if (!defined $sth) {die("Cannot prepare check statement in registerReceiver: $DBI::errstr\n")} if (!defined $sth) {die("Cannot prepare check statement in $function_name: $DBI::errstr\n")}
$sth->execute($hostname, $requestor, $service, $client_type, $type, $receive_own_events, $description_tags, $ip_net_client); $sth->execute($hostname, $requestor, $service, $client_type, $type, $receive_own_events, $description_tags, $ip_net_client);
my $result = $sth->fetchrow(); my $result = $sth->fetchrow();
...@@ -431,7 +450,7 @@ sub registerReceiver ...@@ -431,7 +450,7 @@ sub registerReceiver
die("Error - receiver has already been registered at $result"); die("Error - receiver has already been registered at $result");
} else { } else {
$sth = $DBH->prepare("INSERT INTO clients VALUES (?,?,?,?,?,?,?,?,?,?);"); $sth = $DBH->prepare("INSERT INTO clients VALUES (?,?,?,?,?,?,?,?,?,?);");
if (!defined($sth)) {die("Cannot do statement in registerReceiver: $DBI::errstr\n")} if (!defined($sth)) {die("Cannot do statement in $function_name: $DBI::errstr\n")}
$sth->execute(undef, $hostname, $registered, $requestor, $service, $client_type, $type, $receive_own_events, $description_tags, $ip_net_client); $sth->execute(undef, $hostname, $registered, $requestor, $service, $client_type, $type, $receive_own_events, $description_tags, $ip_net_client);
write2log("info", "New receiver $hostname (type: $type, cidr: $ip_net_client: receive_own_events: $receive_own_events) was registered"); write2log("info", "New receiver $hostname (type: $type, cidr: $ip_net_client: receive_own_events: $receive_own_events) was registered");
return 1; return 1;
...@@ -453,8 +472,10 @@ sub unregisterClient ...@@ -453,8 +472,10 @@ sub unregisterClient
my $ip = $ENV{'REMOTE_ADDR'}; my $ip = $ENV{'REMOTE_ADDR'};
my $local_ip = $ENV{'SERVER_ADDR'}; my $local_ip = $ENV{'SERVER_ADDR'};
my $function_name = 'unregisterClient';
if ($local_ip ne $ip) { if ($local_ip ne $ip) {
write2log ("err", "Unauthorized access to unregisterClients from: $ip ($cn) - access allowed only from localhost"); write2log ("err", "Unauthorized access to $function_name from: $ip ($cn) - access allowed only from localhost");
die("Access denied - access allowed only from localhost!"); die("Access denied - access allowed only from localhost!");
} else { } else {
# parse SOAP data oject # parse SOAP data oject
...@@ -462,7 +483,7 @@ sub unregisterClient ...@@ -462,7 +483,7 @@ sub unregisterClient
# check if receiver has been already registered # check if receiver has been already registered
$sth = $DBH->prepare("SELECT client_id, hostname, service, client_type FROM clients WHERE client_id = ? LIMIT 1;"); $sth = $DBH->prepare("SELECT client_id, hostname, service, client_type FROM clients WHERE client_id = ? LIMIT 1;");
if (!defined $sth) {die("Cannot prepare check statement in unregisterClient: $DBI::errstr\n")} if (!defined $sth) {die("Cannot prepare check statement in $function_name: $DBI::errstr\n")}
$sth->execute($client_id); $sth->execute($client_id);
my ($id, $hostname, $service, $client_type) = $sth->fetchrow(); my ($id, $hostname, $service, $client_type) = $sth->fetchrow();
...@@ -473,18 +494,18 @@ sub unregisterClient ...@@ -473,18 +494,18 @@ sub unregisterClient
} else { } else {
if ($client_type eq 's') { if ($client_type eq 's') {
$sth = $DBH->prepare("DELETE FROM clients WHERE client_id = ?;"); $sth = $DBH->prepare("DELETE FROM clients WHERE client_id = ?;");
if (!defined $sth) {die("Cannot do delete statement of sender in unregisterClient: $DBI::errstr\n")} if (!defined $sth) {die("Cannot do delete statement of sender in $function_name: $DBI::errstr\n")}
$sth->execute($client_id); $sth->execute($client_id);
$sth = $DBH->prepare("UPDATE events SET valid = 'f' where hostname = ? AND service = ?;"); $sth = $DBH->prepare("UPDATE events SET valid = 'f' where hostname = ? AND service = ?;");
if (!defined $sth) {die("Cannot do unvalidation statement in unregisterClient: $DBI::errstr\n")} if (!defined $sth) {die("Cannot do unvalidation statement in $function_name: $DBI::errstr\n")}
$sth->execute($hostname, $service); $sth->execute($hostname, $service);
write2log("info", "Sender $hostname (client_id: $client_id, service: $service) was deleted and its data were invalidated" ); write2log("info", "Sender $hostname (client_id: $client_id, service: $service) was deleted and its data were invalidated" );
return 1; return 1;
} else { } else {
$sth = $DBH->prepare("DELETE FROM clients WHERE client_id = ?;"); $sth = $DBH->prepare("DELETE FROM clients WHERE client_id = ?;");
if (!defined $sth) {die("Cannot do delete statement of receiver in unregisterClient: $DBI::errstr\n")} if (!defined $sth) {die("Cannot do delete statement of receiver in $function_name: $DBI::errstr\n")}
$sth->execute($client_id); $sth->execute($client_id);
write2log("info", "Receiver $hostname (client_id: $client_id) was deleted" ); write2log("info", "Receiver $hostname (client_id: $client_id) was deleted" );
...@@ -507,14 +528,16 @@ sub getClients ...@@ -507,14 +528,16 @@ sub getClients
my $ip = $ENV{'REMOTE_ADDR'}; my $ip = $ENV{'REMOTE_ADDR'};
my $local_ip = $ENV{'SERVER_ADDR'}; my $local_ip = $ENV{'SERVER_ADDR'};
my $function_name = 'getClients';
if ($local_ip ne $ip) { if ($local_ip ne $ip) {
write2log ("err", "Unauthorized access to getClients from: $ip ($cn) - access allowed only from localhost"); write2log ("err", "Unauthorized access to $function_name from: $ip ($cn) - access allowed only from localhost");
die("Access denied - access allowed only from localhost!"); die("Access denied - access allowed only from localhost!");
} else { } else {
my (@clients, $client); my (@clients, $client);
my ($client_id, $hostname, $registered, $requestor, $service, $client_type, $type, $receive_own_events, $description_tags, $ip_net_client); my ($client_id, $hostname, $registered, $requestor, $service, $client_type, $type, $receive_own_events, $description_tags, $ip_net_client);
my $sth = $DBH->prepare("SELECT * FROM clients ORDER BY client_id ASC;"); my $sth = $DBH->prepare("SELECT * FROM clients ORDER BY client_id ASC;");
if (!defined $sth) { die("Cannot prepare statement in getClients: $DBI::errstr\n") } if (!defined $sth) { die("Cannot prepare statement in $function_name: $DBI::errstr\n") }
$sth->execute; $sth->execute;
while ( my @result = $sth->fetchrow() ) { while ( my @result = $sth->fetchrow() ) {
...@@ -562,8 +585,10 @@ sub getStatus ...@@ -562,8 +585,10 @@ sub getStatus
my $ip = $ENV{'REMOTE_ADDR'}; my $ip = $ENV{'REMOTE_ADDR'};
my $local_ip = $ENV{'SERVER_ADDR'}; my $local_ip = $ENV{'SERVER_ADDR'};
my $function_name = 'getStatus';
if ($local_ip ne $ip) { if ($local_ip ne $ip) {
write2log ("err", "Unauthorized access to getStatus from: $ip ($cn) - access allowed only from localhost"); write2log ("err", "Unauthorized access to $function_name from: $ip ($cn) - access allowed only from localhost");
die("Access denied - access allowed only from localhost!"); die("Access denied - access allowed only from localhost!");
} else { } else {
my ($sth, @status); my ($sth, @status);
...@@ -585,35 +610,35 @@ sub getStatus ...@@ -585,35 +610,35 @@ sub getStatus
# sum of records in table events # sum of records in table events
$sth = $DBH->prepare("SELECT count(*) FROM events WHERE valid = 't';"); $sth = $DBH->prepare("SELECT count(*) FROM events WHERE valid = 't';");
if (!defined $sth) { die("Cannot prepare statement in getStatus: $DBI::errstr\n") } if (!defined $sth) { die("Cannot prepare statement in $function_name: $DBI::errstr\n") }
$sth->execute; $sth->execute;
my $events_sum = $sth->fetchrow(); my $events_sum = $sth->fetchrow();
if (!defined $events_sum) { $events_sum = "none" } if (!defined $events_sum) { $events_sum = "none" }
# id of last record in table events # id of last record in table events
$sth = $DBH->prepare("SELECT max(id) FROM events;"); $sth = $DBH->prepare("SELECT max(id) FROM events;");
if (!defined $sth) { die("Cannot prepare statement in getStatus: $DBI::errstr\n") } if (!defined $sth) { die("Cannot prepare statement in $function_name: $DBI::errstr\n") }
$sth->execute; $sth->execute;
my $events_last_id = $sth->fetchrow(); my $events_last_id = $sth->fetchrow();
if (!defined $events_last_id) { $events_last_id = "none" } if (!defined $events_last_id) { $events_last_id = "none" }
# timestamp of first record in table events # timestamp of first record in table events
$sth = $DBH->prepare("SELECT received FROM events WHERE id = (SELECT min(id) FROM events);"); $sth = $DBH->prepare("SELECT received FROM events WHERE id = (SELECT min(id) FROM events);");
if (!defined $sth) { die("Cannot prepare statement in getStatus: $DBI::errstr\n") } if (!defined $sth) { die("Cannot prepare statement in $function_name: $DBI::errstr\n") }
$sth->execute; $sth->execute;
my $events_first_timestamp = $sth->fetchrow(); my $events_first_timestamp = $sth->fetchrow();
if (!defined $events_first_timestamp) { $events_first_timestamp = "none" } if (!defined $events_first_timestamp) { $events_first_timestamp = "none" }
# timestamp of last record in table events # timestamp of last record in table events
$sth = $DBH->prepare("SELECT received FROM events WHERE id = (SELECT max(id) FROM events);"); $sth = $DBH->prepare("SELECT received FROM events WHERE id = (SELECT max(id) FROM events);");
if (!defined $sth) { die("Cannot prepare statement in getStatus: $DBI::errstr\n") } if (!defined $sth) { die("Cannot prepare statement in $function_name: $DBI::errstr\n") }
$sth->execute; $sth->execute;
my $events_last_timestamp = $sth->fetchrow(); my $events_last_timestamp = $sth->fetchrow();
if (!defined $events_last_timestamp) { $events_last_timestamp = "none" } if (!defined $events_last_timestamp) { $events_last_timestamp = "none" }
# sum of records in table clients # sum of records in table clients
$sth = $DBH->prepare("SELECT count(*) FROM clients;"); $sth = $DBH->prepare("SELECT count(*) FROM clients;");
if (!defined $sth) { die("Cannot prepare statement in getStatus: $DBI::errstr\n") } if (!defined $sth) { die("Cannot prepare statement in $function_name: $DBI::errstr\n") }
$sth->execute; $sth->execute;
my $clients_sum = $sth->fetchrow(); my $clients_sum = $sth->fetchrow();
if (!defined $clients_sum) { $clients_sum = "none" } if (!defined $clients_sum) { $clients_sum = "none" }
...@@ -639,7 +664,7 @@ sub getStatus ...@@ -639,7 +664,7 @@ sub getStatus
# statistics of senders # statistics of senders
if ($clients_sum != 0) { if ($clients_sum != 0) {
$sth = $DBH->prepare("SELECT client_id, hostname, service FROM clients WHERE client_type = 's' ORDER BY client_id ASC;"); $sth = $DBH->prepare("SELECT client_id, hostname, service FROM clients WHERE client_type = 's' ORDER BY client_id ASC;");
if (!defined $sth) {die("Cannot prepare statement in getStatus: $DBI::errstr\n")} if (!defined $sth) {die("Cannot prepare statement in $function_name: $DBI::errstr\n")}
$sth->execute; $sth->execute;
my ($client_id, $hostname, $service); my ($client_id, $hostname, $service);
my $client_status; my $client_status;
...@@ -647,13 +672,13 @@ sub getStatus ...@@ -647,13 +672,13 @@ sub getStatus
my $sth2; my $sth2;
# sum of stored events # sum of stored events
$sth2 = $DBH->prepare("SELECT count(*) FROM events WHERE hostname = ? AND service = ?;"); $sth2 = $DBH->prepare("SELECT count(*) FROM events WHERE hostname = ? AND service = ?;");
if (!defined $sth2) {die("Cannot prepare statement in getStatus: $DBI::errstr\n")} if (!defined $sth2) {die("Cannot prepare statement in $function_name: $DBI::errstr\n")}
$sth2->execute($hostname, $service); $sth2->execute($hostname, $service);
my $count = $sth2->fetchrow(); my $count = $sth2->fetchrow();
if (!defined $count) {$count = "none"} if (!defined $count) {$count = "none"}
# timestamp of last stored event # timestamp of last stored event
$sth2 = $DBH->prepare("SELECT max(received) FROM events WHERE hostname = ? AND service = ?;"); $sth2 = $DBH->prepare("SELECT max(received) FROM events WHERE hostname = ? AND service = ?;");
if (!defined $sth2) {die("Cannot prepare statement in getStatus: $DBI::errstr\n")} if (!defined $sth2) {die("Cannot prepare statement in $function_name: $DBI::errstr\n")}
$sth2->execute($hostname, $service); $sth2->execute($hostname, $service);
my $timestamp = $sth2->fetchrow(); my $timestamp = $sth2->fetchrow();
if (!defined $timestamp) {$timestamp = "none"} if (!defined $timestamp) {$timestamp = "none"}
......
src/warden-server/sh/install.sh
+ 8
− 1
View file @ ac58da12
...@@ -227,6 +227,13 @@ make_server_conf() ...@@ -227,6 +227,13 @@ make_server_conf()
# Warden server in a single getNewEvents client function call # Warden server in a single getNewEvents client function call
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
\$MAX_EVENT_LIMIT = \"1000000\"; \$MAX_EVENT_LIMIT = \"1000000\";
#-------------------------------------------------------------------------------
# VALID_STRINGS - validation hash containing allowed event attributes
#-------------------------------------------------------------------------------
%VALID_STRINGS = (
\"type\" => [\"portscan\", \"bruteforce\", \"spam\", \"phishing\", \"botnet_c_c\", \"dos\", \"malware\", \"copyright\", \"webattack\", \"test\", \"other\", \"_any_\"],
);
" > $server_conf 2> $err; ret_val=`echo $?` " > $server_conf 2> $err; ret_val=`echo $?`
if [ $ret_val -eq 0 ]; then if [ $ret_val -eq 0 ]; then
...@@ -281,7 +288,7 @@ create_symlinks() ...@@ -281,7 +288,7 @@ create_symlinks()
#------------------------------------------------------------------------------- #-------------------------------------------------------------------------------
# list of used Perl modules # list of used Perl modules
modules=(SOAP::Lite SOAP::Transport::HTTP DBI DBD::mysql Format::Human::Bytes Sys::Syslog File::Basename Net::CIDR::Lite DateTime Getopt::Std Switch IO::Socket::SSL MIME::Base64 Crypt::X509) modules=(SOAP::Lite SOAP::Transport::HTTP DBI DBD::mysql Format::Human::Bytes Sys::Syslog File::Basename Net::CIDR::Lite DateTime Getopt::Std Switch IO::Socket::SSL MIME::Base64 Crypt::X509 List::Util)
# read input # read input
while getopts "d:k:c:a:Vh" options; do while getopts "d:k:c:a:Vh" options; do
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment