Changeset 673

Timestamp:

10/22/06 22:56:08 (2 years ago)

Author:

common

Message:

nepenthes

• log-surfnet
  
  • use the sqlhandler-postgres, get rid of DatabaseConnection?.*pp
    
  • tricky caching to avoid loosing data when we have to log _something_ related to a connection before we get the connections attack id, works fine here
    
  • attached the required plpgsql fns in the conf.dist file, might be better if kees moves them to the surfnet ids table layout later
    
  • now we support 2 modes, list and any, list will only log activity on a given list of ports, any will log on any port
    

Files:

• nepenthes/trunk/modules/log-surfnet/DatabaseConnection.cpp (deleted)
• nepenthes/trunk/modules/log-surfnet/DatabaseConnection.hpp (deleted)
• nepenthes/trunk/modules/log-surfnet/Makefile.am (modified) (1 diff)
• nepenthes/trunk/modules/log-surfnet/log-surfnet.conf.dist (modified) (2 diffs)
• nepenthes/trunk/modules/log-surfnet/log-surfnet.cpp (modified) (18 diffs)
• nepenthes/trunk/modules/log-surfnet/log-surfnet.hpp (modified) (5 diffs)

nepenthes/trunk/modules/log-surfnet/Makefile.am

@@ -11 +11 @@
-pkglib_LTLIBRARIES = logsurfnet.la
-
-DatabaseConnection.cpp DatabaseConnection.hpp 
+
-
-logsurfnet_la_LDFLAGS = -module -no-undefined -avoid-version

nepenthes/trunk/modules/log-surfnet/log-surfnet.conf.dist

@@ -1 +1 @@
-log-surfnet
-{
+        server  "127.0.0.1"; // must be ip
+        user    "user";
+        pass    "pass";
+        db      "idsserver";
+        
+        options ""; // sslmode=required for example if you want to use ssl 
+
+
+
+        /* mode: 
+         *      * any means log accepted connections on _all_ ports
+         *      * list means, use the port list 
+         */
+         
+        mode    "any"; 
+        
+
-        ports   (
-                "21",
@@ -31 +48 @@
-                "27347");
-
-        server  "127.0.0.1"; // must be ip
-        user    "user";
-        pass    "pass";
-        db      "idsserver";
-};
+
+
+/*
+
+don't forget to create these fn's in your surfnet ids database.
+
+
+CREATE PROCEDURAL LANGUAGE plpgsql;
+
+CREATE FUNCTION surfnet_attack_add(integer, inet, integer, inet, integer, macaddr, inet) RETURNS integer
+    AS $_$DECLARE
+        p_severity      ALIAS FOR $1; 
+        p_attackerip    ALIAS FOR $2;
+        p_attackerport  ALIAS FOR $3;
+        p_decoyip       ALIAS FOR $4;
+        p_decoyport     ALIAS FOR $5;
+        p_hwa           ALIAS FOR $6;
+        p_localhost     ALIAS FOR $7;
+        m_attackid INTEGER;
+        m_sensorid INTEGER;
+BEGIN
+
+        SELECT INTO m_sensorid surfnet_sensorid_get(p_localhost);
+        SELECT INTO m_attackid surfnet_attack_add_by_id(p_severity,
+                p_attackerip, p_attackerport, p_decoyip,
+                p_decoyport, p_hwa, m_sensorid);
+
+        return m_attackid;
+END$_$
+    LANGUAGE plpgsql;
+
+
+CREATE FUNCTION surfnet_attack_add_by_id(integer, inet, integer, inet, integer, macaddr, integer) RETURNS integer
+    AS $_$DECLARE
+        p_severity      ALIAS FOR $1; 
+        p_attackerip    ALIAS FOR $2;
+        p_attackerport  ALIAS FOR $3;
+        p_decoyip       ALIAS FOR $4;
+        p_decoyport     ALIAS FOR $5;
+        p_hwa           ALIAS FOR $6;
+        p_sensorid      ALIAS FOR $7;
+        m_attackid      INTEGER;
+BEGIN
+        INSERT INTO attacks
+                (severity,
+                 timestamp,
+                 dest,
+                 dport,
+                 source,
+                 sport,
+                 sensorid,
+                 src_mac)
+        VALUES
+                (p_severity,
+                 extract(epoch from current_timestamp(0))::integer,
+                 p_attackerip,
+                 p_attackerport,
+                 p_decoyip,
+                 p_decoyport,
+                 p_sensorid,
+                 p_hwa);
+
+        SELECT INTO m_attackid currval('attacks_id_seq');
+        return m_attackid;
+END$_$
+    LANGUAGE plpgsql;
+
+
+
+CREATE FUNCTION surfnet_attack_update_severity(integer, integer) RETURNS void
+    AS $_$DECLARE
+        p_attackid ALIAS FOR $1;
+        p_severity ALIAS FOR $2;
+BEGIN
+        UPDATE attacks SET severity = p_severity WHERE id = p_attackid;
+        return;
+END;$_$
+    LANGUAGE plpgsql;
+
+
+CREATE FUNCTION surfnet_detail_add(integer, inet, integer, character varying) RETURNS void
+    AS $_$DECLARE
+        p_attackid ALIAS FOR $1;
+        p_localhost ALIAS FOR $2;
+        p_type ALIAS FOR $3;
+        p_data ALIAS FOR $4;
+
+        m_sensorid INTEGER;
+BEGIN
+        SELECT INTO m_sensorid surfnet_sensorid_get(p_localhost);
+
+        INSERT INTO details
+                (attackid,sensorid,type,text)
+        VALUES
+                (p_attackid,m_sensorid,p_type,p_data);
+END$_$
+    LANGUAGE plpgsql;
+
+
+CREATE FUNCTION surfnet_detail_add_by_id(integer, integer, integer, character varying) RETURNS void
+    AS $_$DECLARE
+        p_attackid ALIAS FOR $1;
+        m_sensorid ALIAS FOR $2;
+        p_type ALIAS FOR $3;
+        p_data ALIAS FOR $4;
+BEGIN
+        INSERT INTO details
+                (attackid,sensorid,type,text)
+        VALUES
+                (p_attackid,m_sensorid,p_type,p_data);
+END$_$
+    LANGUAGE plpgsql;
+
+
+CREATE FUNCTION surfnet_detail_add_download(inet, inet, character varying, character varying) RETURNS void
+    AS $_$DECLARE
+        p_remotehost ALIAS FOR $1;
+        p_localhost ALIAS FOR $2;
+        p_url ALIAS FOR $3;
+        p_hash ALIAS FOR $4;
+
+        m_sensorid INTEGER;
+        m_attackid INTEGER;
+BEGIN
+        SELECT INTO m_sensorid surfnet_sensorid_get(p_localhost);
+        SELECT INTO m_attackid surfnet_attack_add_by_id(32,p_remotehost, 0,
+                p_localhost, 0,
+                NULL,m_sensorid);
+
+        PERFORM surfnet_detail_add_by_id(m_attackid,
+                                m_sensorid,4,p_url);
+        PERFORM surfnet_detail_add_by_id(m_attackid,
+                                m_sensorid,8,p_hash);
+
+        return;
+END;    $_$
+    LANGUAGE plpgsql;
+
+
+CREATE FUNCTION surfnet_detail_add_offer(inet, inet, character varying) RETURNS void
+    AS $_$DECLARE
+        p_remotehost ALIAS FOR $1;
+        p_localhost ALIAS FOR $2;
+        p_url ALIAS FOR $3;
+
+        m_sensorid INTEGER;
+        m_attackid INTEGER;
+BEGIN
+        SELECT INTO m_sensorid surfnet_sensorid_get(p_localhost);
+        SELECT INTO m_attackid surfnet_attack_add_by_id(16,p_remotehost, 0,
+                p_localhost, 0,
+                NULL,m_sensorid);
+
+        PERFORM surfnet_detail_add_by_id(m_attackid,
+                                m_sensorid,4,p_url);
+        return;
+END;    $_$
+    LANGUAGE plpgsql;
+
+
+CREATE FUNCTION surfnet_sensorid_get(inet) RETURNS integer
+    AS $_$DECLARE
+  p_localhost ALIAS FOR $1;
+  m_sensorid  INTEGER;
+BEGIN
+        SELECT INTO m_sensorid id FROM sensors WHERE tapip = p_localhost;
+        return m_sensorid;
+END
+$_$
+    LANGUAGE plpgsql;
+
+
+*/

nepenthes/trunk/modules/log-surfnet/log-surfnet.cpp

@@ -26 +26 @@
- *******************************************************************************/
-
-
+
+
+
+
+
+
+
-
-#include "log-surfnet.hpp"
-
+
-
-#include "LogManager.hpp"
@@ -43 +49 @@
-#include "Config.hpp"
-
+#include "SQLHandler.hpp"
+#include "SQLResult.hpp"
+#include "SQLManager.hpp"
+
-using namespace nepenthes;
-
-#ifdef STDTAGS 
-
+       
-#endif
-#define STDTAGS l_mod | l_ev | l_hlr
+
+
+
+
+LSDetail::LSDetail(uint32_t host, int type, string data)
+{
+        
+        m_host = inet_ntoa(*(in_addr *)&host);
+        m_type = type;
+        m_data = data;
+}
+
+
+LSContext::LSContext()
+{
+        m_attackID = 0;
+        m_closed = false;
+
+        m_severity = 0;
+}
+
+
+
-
-
@@ -83 +116 @@
-
-        g_Nepenthes = nepenthes;
+
+        m_RunningMode = LS_MODE_LIST;
-}
-
@@ -121 +156 @@
-        string pass;
-        string db;
+        string options;
+        string mode;
-        try
-        {
-                sList = *m_Config->getValStringList("log-surfnet.ports");
-
-
-
-
-
+
+
+
+
+
+
+
+
-        {
-                logCrit("Error setting needed vars, check your config\n");
@@ -137 +177 @@
-        m_MaxPorts = sList.size();
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        }
-
@@ -192 +268 @@
-        logInfo("Event %i\n",event->getType());
-
-    
+       
-        Dialogue *dia=NULL;
-        ShellcodeHandler *handler=NULL;
@@ -200 +276 @@
-        string md5sum = "";
-
-
-(event->getType()
+
+ ( event->getType() 
-        {
-        case EV_SOCK_TCP_ACCEPT:
@@ -242 +318 @@
-
-        bool process=false;
-uint32_
+LSContex
-        uint32_t attackid=0;
-
-(event->getType()
+ ( event->getType() 
-        {
-        case EV_SOCK_TCP_ACCEPT:
-                {
-
-
-
+
-                        {
-
+
+
+
+
+
+
+
-                                {
-
+
+
+
+
+
-                                }
-                                i++;
-                        }
-                }
@@ -266 +349 @@
-        case EV_SHELLCODE_DONE:
-                {
-m_SocketTracker.count((uintptr_t) socket) == 0
+ m_SocketTracker.count((uintptr_t) socket) == 0 
-                        {
-
-
+
+
+
+
-                        {
-                                process=true;
-                                attackit = m_SocketTracker.find((uintptr_t) socket);
-
+.m_attackID
-                        }
-                }
@@ -288 +373 @@
-
-
-process == true
-
-(event->getType()
+ process == true 
+
+ ( event->getType() 
-                {
-                case EV_SOCK_TCP_ACCEPT:
@@ -320 +405 @@
-                        logWarn("this should not happen\n");
-                }
-
+
+
-
-        return 0;
-}
-
+string  itos( long i )
+{
+        std::ostringstream s;
+        s << i;
+        return s.str();
+}
+
-
-void LogSurfNET::handleTCPAccept(Socket *socket)
-{
-
+
+
-                        "\tSocket 0x%x\n",
-                        (uint32_t) ((intptr_t)socket));
@@ -335 +429 @@
-        socket->getRemoteHWA(&hwa);
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
-void LogSurfNET::handleTCPclose(Socket *socket, uint32_t attackid)
-{
-
+
+
-                        "\tSocket 0x%x\n"
-                        "\tattackID %i\n",
@@ -350 +472 @@
-                        attackid);
-
-.erase((uintptr_t) socket)
+[(uintptr_t) socket].m_closed = true
-}
-
-void LogSurfNET::handleDialogueAssignAndDone(Socket *socket, Dialogue *dia, uint32_t attackid)
-{
-
+
+
-                        "\tSocket 0x%x\n"
-                        "\tDialogue %s\n"
@@ -363 +486 @@
-                        attackid);
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-}
@@ -374 +526 @@
-void LogSurfNET::handleShellcodeDone(Socket *socket, ShellcodeHandler *handler, uint32_t attackid)
-{
-Crit
+Spam
-                        "\tSocket 0x%x\n"
-                        "\tShellcodeHandler %s\n"
@@ -382 +534 @@
-                        attackid);
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -391 +562 @@
-void LogSurfNET::handleDownloadOffer(uint32_t localhost, uint32_t remotehost,const char *url)
-{
+        logPF();
-        string hwa = "";
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
-void LogSurfNET::handleDownloadSuccess(uint32_t localhost, uint32_t remotehost, const char *url, const char *md5hash)
-{
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -412 +677 @@
-extern "C" int32_t module_init(int32_t version, Module **module, Nepenthes *nepenthes)
-{
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+

nepenthes/trunk/modules/log-surfnet/log-surfnet.hpp

@@ -35 +35 @@
-#include "Nepenthes.hpp"
-#include "EventHandler.hpp"
+#include "SQLCallback.hpp"
+
-
-using namespace std;
@@ -62 +64 @@
-        };
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-        class ShellcodeHandler;
-
+
+
-
-        /**
@@ -72 +100 @@
-         * 
-     */
-
+, public SQLCallback
-        {
-        public:
@@ -82 +110 @@
-                uint32_t handleEvent(Event *event);
-
+                bool sqlSuccess(SQLResult *result);
+                bool sqlFailure(SQLResult *result);
+                void sqlConnected();
+                void sqlDisconnected();
+
+
-        private:
-uint32_
+LSContex
-
-                uint16_t                *m_Ports;
@@ -100 +134 @@
-                void handleDownloadSuccess(uint32_t localhost, uint32_t remotehost,const char *url, const char *md5hash);
-
-DatabaseConnection *m_DB
-               //
+SQLHandler             *m_SQLHandler
+log_surfnet_mode       m_RunningMode;
-        };
+        
-
-}