--- analysisd.c.orig 2010-10-12 21:17:37.000000000 +0200 +++ analysisd.c 2011-02-02 10:29:33.763532283 +0100 @@ -35,6 +35,10 @@ #include "os_regex/os_regex.h" #include "os_net/os_net.h" +/* Include database support */ +#include "os_dbd/dbd.h" +#include + /** Local headers **/ #include "active-response.h" @@ -122,6 +126,10 @@ int hourly_syscheck; int hourly_firewall; +/* Database support */ +DBConfig db_config; +char *IsIPSuspicious(char *ip, char *source, DBConfig *db_config); +char *IsUserSuspicious(char *user, char *source, DBConfig *db_config); /** int main(int argc, char **argv) */ @@ -139,6 +147,8 @@ char *cfg = DEFAULTCPATH; + db_config.error_count = 0; + /* Setting the name */ OS_SetName(ARGV0); @@ -275,6 +285,53 @@ chown(Config.picviz_socket, uid, gid); } + /* Read the database configuration */ + if ((c = OS_ReadDBConf(test_config, cfg, &db_config)) < 0) + { + ErrorExit(CONFIG_ERROR, ARGV0, cfg); + } + + /* Exit here if test config is set */ + if(test_config) + exit(0); + + /* Setting config pointer */ + osdb_setconfig(&db_config); + + /* Getting maximum reconned attempts */ + db_config.maxreconnect = getDefine_Int("dbd", + "reconnect_attempts", 1, 9999); + + /* Connecting to the database */ + c = 0; + while(c <= (db_config.maxreconnect * 10)) + { + db_config.conn = osdb_connect(db_config.host, db_config.user, + db_config.pass, db_config.db, + db_config.port,db_config.sock); + + /* If we are able to reconnect, keep going */ + if(db_config.conn) + { + break; + } + + c++; + sleep(c * 60); + + } + + /* If after the maxreconnect attempts, it still didn't work, exit here. */ + if(!db_config.conn) + { + merror(DB_CONFIGERR, ARGV0); + ErrorExit(CONFIG_ERROR, ARGV0, cfg); + } + + /* We must notify that we connected -- easy debugging */ + verbose("%s: Connected to database '%s' at '%s'.", + ARGV0, db_config.db, db_config.host); + /* Setting the group */ if(Privsep_SetGroup(gid) < 0) ErrorExit(SETGID_ERROR,ARGV0,group); @@ -519,6 +576,7 @@ } + /* Start up message */ verbose(STARTUP_MSG, ARGV0, (int)getpid()); @@ -549,9 +607,12 @@ { int i; char msg[OS_MAXSTR +1]; + char source[OS_MAXSTR +1]; + char buf[OS_MAXSTR +1]; Eventinfo *lf; RuleInfo *stats_rule; + RuleInfo *suspicious_rule; /* Null to global currently pointers */ @@ -761,7 +822,7 @@ /* Currently rule must be null in here */ currently_rule = NULL; - + suspicious_rule = NULL; /** Checking the date/hour changes **/ @@ -907,6 +968,81 @@ } } + /* Checking if the source or destination address is suspicious */ + if (lf->srcip != NULL) + { + if (IsIPSuspicious(lf->srcip, source, &db_config)) + { + if (!(suspicious_rule = (RuleInfo *)calloc(1,sizeof(RuleInfo)))) + ErrorExit(MEM_ERROR, ARGV0); + sprintf(buf, "Suspicious IP address (Source: %s)", + source); + suspicious_rule->comment = buf; + suspicious_rule->group = "suspicious,"; + suspicious_rule->sigid = 99999; + suspicious_rule->level = 12; + lf->generated_rule = suspicious_rule; + __crt_ftell = ftell(_aflog); + OS_Log(lf); + free(suspicious_rule); + } + } + if (lf->dstip != NULL) + { + if (IsIPSuspicious(lf->dstip, source, &db_config)) + { + if (!(suspicious_rule = (RuleInfo *)calloc(1,sizeof(RuleInfo)))) + ErrorExit(MEM_ERROR, ARGV0); + sprintf(buf, "Suspicious IP address (Source: %s)", + source); + suspicious_rule->comment = buf; + suspicious_rule->group = "suspicious,"; + suspicious_rule->sigid = 99999; + suspicious_rule->level = 12; + lf->generated_rule = suspicious_rule; + __crt_ftell = ftell(_aflog); + OS_Log(lf); + free(suspicious_rule); + } + } + + /* Checking if the source or destination user is suspicious */ + if (lf->srcuser != NULL) + { + if (IsUserSuspicious(lf->srcuser, source, &db_config)) + { + if (!(suspicious_rule = (RuleInfo *)calloc(1,sizeof(RuleInfo)))) + ErrorExit(MEM_ERROR, ARGV0); + sprintf(buf, "Suspicious user (Source: %s)", + source); + suspicious_rule->comment = buf; + suspicious_rule->group = "suspicious,"; + suspicious_rule->sigid = 99999; + suspicious_rule->level = 12; + lf->generated_rule = suspicious_rule; + __crt_ftell = ftell(_aflog); + OS_Log(lf); + free(suspicious_rule); + } + } + if (lf->dstuser != NULL) + { + if (IsUserSuspicious(lf->dstuser, source, &db_config)) + { + if (!(suspicious_rule = (RuleInfo *)calloc(1,sizeof(RuleInfo)))) + ErrorExit(MEM_ERROR, ARGV0); + sprintf(buf, "Suspicious user (Source: %s)", + source); + suspicious_rule->comment = buf; + suspicious_rule->group = "suspicious,"; + suspicious_rule->sigid = 99999; + suspicious_rule->level = 12; + lf->generated_rule = suspicious_rule; + __crt_ftell = ftell(_aflog); + OS_Log(lf); + free(suspicious_rule); + } + } /* Checking the rules */ DEBUG_MSG("%s: DEBUG: Checking the rules - %d ", @@ -1714,7 +1850,107 @@ fclose(flog); } +/** char *IsIPSuspicious(); + * Looking the temporary table for a suspicious IP address + */ +char *IsIPSuspicious(char *ip, char *source, DBConfig *db_config) +{ + int result = 0; + char sql_query[OS_SIZE_1024]; + MYSQL_RES *result_data; + MYSQL_ROW result_row; -/* EOF */ + memset(sql_query, '\0', OS_SIZE_1024); + + /* Generating SQL */ + snprintf(sql_query, OS_SIZE_1024 -1, + "SELECT source FROM suspicious_ip " + "WHERE ip LIKE '%s'", + ip); + + /* Sending the query. It can not fail. */ + if(mysql_query(db_config->conn, sql_query) != 0) + { + /* failure; report error */ + merror(DBQUERY_ERROR, ARGV0, sql_query, mysql_error(db_config->conn)); + osdb_seterror(); + return(0); + } + + /* Getting result */ + result_data = mysql_use_result(db_config->conn); + if(result_data == NULL) + { + /* failure; report error */ + merror(DBQUERY_ERROR, ARGV0, sql_query, mysql_error(db_config->conn)); + osdb_seterror(); + return(0); + } + + /* Getting row. We only care about the first result. */ + result_row = mysql_fetch_row(result_data); + if(result_row && (result_row[0] != NULL)) + { + strcpy(source, result_row[0]); + result++; + } + + mysql_free_result(result_data); + + return(result); +} + +/** char *IsUserSuspicious(); + * Looking the temporary table for a suspicious user + */ +char *IsUserSuspicious(char *user, char *source, DBConfig *db_config) +{ + int result = 0; + char sql_query[OS_SIZE_1024]; + + MYSQL_RES *result_data; + MYSQL_ROW result_row; + + memset(sql_query, '\0', OS_SIZE_1024); + /* Generating SQL */ + snprintf(sql_query, OS_SIZE_1024 -1, + "SELECT source FROM suspicious_user " + "WHERE user LIKE '%s'", + user); + + /* Sending the query. It can not fail. */ + if(mysql_query(db_config->conn, sql_query) != 0) + { + /* failure; report error */ + merror(DBQUERY_ERROR, ARGV0, sql_query, mysql_error(db_config->conn)); + osdb_seterror(); + return(0); + } + + /* Getting result */ + result_data = mysql_use_result(db_config->conn); + if(result_data == NULL) + { + /* failure; report error */ + merror(DBQUERY_ERROR, ARGV0, sql_query, mysql_error(db_config->conn)); + osdb_seterror(); + return(0); + } + + /* Getting row. We only care about the first result. */ + result_row = mysql_fetch_row(result_data); + if(result_row && (result_row[0] != NULL)) + { + strcpy(source, result_row[0]); + result++; + } + + mysql_free_result(result_data); + + return(result); +} + + +/* EOF */