diff -rupN ossec-hids-2.6.orig/etc/internal_options.conf ossec-hids-2.6/etc/internal_options.conf --- ossec-hids-2.6.orig/etc/internal_options.conf 2011-07-11 21:36:57.000000000 +0200 +++ ossec-hids-2.6/etc/internal_options.conf 2012-06-04 22:09:36.972012900 +0200 @@ -55,6 +55,9 @@ maild.groupping=1 # Maild full subject (0=disabled, 1=enabled) maild.full_subject=0 +# Maild display GeoIP data (0=disabled, 1=enabled) +maild.geoip=1 + # Monitord day_wait. Ammount of seconds to wait before compressing/signing # the files. diff -rupN ossec-hids-2.6.orig/src/analysisd/alerts/log.c ossec-hids-2.6/src/analysisd/alerts/log.c --- ossec-hids-2.6.orig/src/analysisd/alerts/log.c 2011-07-11 21:36:58.000000000 +0200 +++ ossec-hids-2.6/src/analysisd/alerts/log.c 2012-06-04 20:21:55.224206230 +0200 @@ -18,6 +18,56 @@ #include "eventinfo.h" #include "config.h" +#ifdef GEOIP +/* GeoIP Stuff */ +#include "GeoIP.h" +#include "GeoIPCity.h" + +static const char * _mk_NA( const char * p ){ + return p ? p : "N/A"; +} + +/* GeoIPLookup */ +/* Use the GeoIP API to locate an IP address + */ +char *GeoIPLookup(char *ip) +{ + GeoIP *gi; + GeoIPRecord *gir; + char buffer[OS_SIZE_1024 +1]; + + /* Dump way to detect an IPv6 address */ + if (strchr(ip, ':')) { + /* Use the IPv6 DB */ + gi = GeoIP_open(Config.geoip_db_path, GEOIP_INDEX_CACHE); + if (gi == NULL) { + merror(INVALID_GEOIP_DB, ARGV0, Config.geoip6_db_path); + return("Unknown"); + } + gir = GeoIP_record_by_name_v6(gi, (const char *)ip); + } + else { + /* Use the IPv4 DB */ + gi = GeoIP_open(Config.geoip_db_path, GEOIP_INDEX_CACHE); + if (gi == NULL) { + merror(INVALID_GEOIP_DB, ARGV0, Config.geoip_db_path); + return("Unknown"); + } + gir = GeoIP_record_by_name(gi, (const char *)ip); + } + if (gir != NULL) { + sprintf(buffer,"%s,%s,%s", + _mk_NA(gir->country_code), + _mk_NA(GeoIP_region_name_by_code(gir->country_code, gir->region)), + _mk_NA(gir->city) + ); + GeoIP_delete(gi); + return(buffer); + } + GeoIP_delete(gi); + return("Unknown"); +} +#endif /* GEOIP */ /* Drop/allow patterns */ OSMatch FWDROPpm; @@ -51,10 +101,17 @@ void OS_Store(Eventinfo *lf) void OS_LogOutput(Eventinfo *lf) { +#ifdef GEOIP + char geoip_msg[OS_SIZE_1024 +1]; + geoip_msg[0] = '\0'; + if (Config.loggeoip && lf->srcip) { + strcpy(geoip_msg, GeoIPLookup(lf->srcip)); + } +#endif printf( "** Alert %d.%ld:%s - %s\n" "%d %s %02d %s %s%s%s\nRule: %d (level %d) -> '%s'" - "%s%s%s%s%s%s%s%s%s%s\n%.1256s\n", + "%s%s%s%s%s%s%s%s%s%s%s%s\n%.1256s\n", lf->time, __crt_ftell, lf->generated_rule->alert_opts & DO_MAILALERT?" mail ":"", @@ -73,6 +130,14 @@ void OS_LogOutput(Eventinfo *lf) lf->srcip == NULL?"":"\nSrc IP: ", lf->srcip == NULL?"":lf->srcip, +#ifdef GEOIP + (strlen(geoip_msg) == 0)?"":"\nSrc Location: ", + (strlen(geoip_msg) == 0)?"":geoip_msg, +#else + "", + "", +#endif + lf->srcport == NULL?"":"\nSrc Port: ", lf->srcport == NULL?"":lf->srcport, @@ -112,11 +177,18 @@ void OS_LogOutput(Eventinfo *lf) /* _writefile: v0.2, 2005/02/09 */ void OS_Log(Eventinfo *lf) { +#ifdef GEOIP + char geoip_msg[OS_SIZE_1024 +1]; + geoip_msg[0] = '\0'; + if (Config.loggeoip && lf->srcip) { + strcpy(geoip_msg, GeoIPLookup(lf->srcip)); + } +#endif /* Writting to the alert log file */ fprintf(_aflog, "** Alert %d.%ld:%s - %s\n" "%d %s %02d %s %s%s%s\nRule: %d (level %d) -> '%s'" - "%s%s%s%s%s%s%s%s%s%s\n%.1256s\n", + "%s%s%s%s%s%s%s%s%s%s%s%s\n%.1256s\n", lf->time, __crt_ftell, lf->generated_rule->alert_opts & DO_MAILALERT?" mail ":"", @@ -135,6 +207,14 @@ void OS_Log(Eventinfo *lf) lf->srcip == NULL?"":"\nSrc IP: ", lf->srcip == NULL?"":lf->srcip, +#ifdef GEOIP + (strlen(geoip_msg) == 0)?"":"\nSrc Location: ", + (strlen(geoip_msg) == 0)?"":geoip_msg, +#else + "", + "", +#endif + lf->srcport == NULL?"":"\nSrc Port: ", lf->srcport == NULL?"":lf->srcport, diff -rupN ossec-hids-2.6.orig/src/analysisd/compiled_rules/compiled_rules.h ossec-hids-2.6/src/analysisd/compiled_rules/compiled_rules.h --- ossec-hids-2.6.orig/src/analysisd/compiled_rules/compiled_rules.h 1970-01-01 01:00:00.000000000 +0100 +++ ossec-hids-2.6/src/analysisd/compiled_rules/compiled_rules.h 2012-06-04 20:52:14.835207716 +0200 @@ -0,0 +1,32 @@ +/* This file is auto generated by ./register_rule.sh. Do not touch it. */ + +/* Adding the function definitions. */ +void *check_id_size(Eventinfo *lf); +void *comp_mswin_targetuser_calleruser_diff(Eventinfo *lf); +void *comp_srcuser_dstuser(Eventinfo *lf); +void *is_simple_http_request(Eventinfo *lf); +void *is_valid_crawler(Eventinfo *lf); + +/* Adding the rules list. */ +void *(compiled_rules_list[]) = +{ + check_id_size, + comp_mswin_targetuser_calleruser_diff, + comp_srcuser_dstuser, + is_simple_http_request, + is_valid_crawler, + NULL +}; + +/* Adding the rules list names. */ +char *(compiled_rules_name[]) = +{ + "check_id_size", + "comp_mswin_targetuser_calleruser_diff", + "comp_srcuser_dstuser", + "is_simple_http_request", + "is_valid_crawler", + NULL +}; + +/* EOF */ Binary files ossec-hids-2.6.orig/src/analysisd/ossec-logtest and ossec-hids-2.6/src/analysisd/ossec-logtest differ Binary files ossec-hids-2.6.orig/src/analysisd/ossec-makelists and ossec-hids-2.6/src/analysisd/ossec-makelists differ diff -rupN ossec-hids-2.6.orig/src/config/alerts-config.c ossec-hids-2.6/src/config/alerts-config.c --- ossec-hids-2.6.orig/src/config/alerts-config.c 2011-07-11 21:36:58.000000000 +0200 +++ ossec-hids-2.6/src/config/alerts-config.c 2012-06-04 20:16:50.052156631 +0200 @@ -24,6 +24,11 @@ int Read_Alerts(XML_NODE node, void *con /* XML definitions */ char *xml_email_level = "email_alert_level"; char *xml_log_level = "log_alert_level"; + +#ifdef GEOIP + /* GeoIP */ + char *xml_log_geoip = "use_geoip"; +#endif _Config *Config; @@ -63,6 +68,22 @@ int Read_Alerts(XML_NODE node, void *con } Config->logbylevel = atoi(node[i]->content); } +#ifdef GEOIP + /* Enable GeoIP */ + else if(strcmp(node[i]->element, xml_log_geoip) == 0) + { + if(strcmp(node[i]->content, "yes") == 0) + { if(Config) Config->loggeoip = 1;} + else if(strcmp(node[i]->content, "no") == 0) + {if(Config) Config->loggeoip = 0;} + else + { + merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content); + return(OS_INVALID); + } + + } +#endif else { merror(XML_INVELEM, ARGV0, node[i]->element); diff -rupN ossec-hids-2.6.orig/src/config/global-config.c ossec-hids-2.6/src/config/global-config.c --- ossec-hids-2.6.orig/src/config/global-config.c 2011-07-11 21:36:58.000000000 +0200 +++ ossec-hids-2.6/src/config/global-config.c 2012-06-04 20:18:24.491312042 +0200 @@ -164,6 +164,12 @@ int Read_Global(XML_NODE node, void *con char *xml_smtpserver = "smtp_server"; char *xml_mailmaxperhour = "email_maxperhour"; +#ifdef GEOIP + /* GeoIP */ + char *xml_geoip_db_path = "geoip_db_path"; + char *xml_geoip6_db_path = "geoip6_db_path"; +#endif + _Config *Config; MailConfig *Mail; @@ -519,6 +525,24 @@ int Read_Global(XML_NODE node, void *con } } } +#ifdef GEOIP + /* GeoIP v4 DB location */ + else if(strcmp(node[i]->element, xml_geoip_db_path) == 0) + { + if(Config) + { + os_strdup(node[i]->content, Config->geoip_db_path); + } + } + /* GeoIP v6 DB location */ + else if(strcmp(node[i]->element, xml_geoip6_db_path) == 0) + { + if(Config) + { + os_strdup(node[i]->content, Config->geoip6_db_path); + } + } +#endif else { merror(XML_INVELEM, ARGV0, node[i]->element); diff -rupN ossec-hids-2.6.orig/src/config/global-config.h ossec-hids-2.6/src/config/global-config.h --- ossec-hids-2.6.orig/src/config/global-config.h 2011-07-11 21:36:58.000000000 +0200 +++ ossec-hids-2.6/src/config/global-config.h 2012-06-04 20:18:51.431792553 +0200 @@ -74,6 +74,13 @@ typedef struct __Config /* Global rule hash. */ void *g_rules_hash; +#ifdef GEOIP + /* GeoIP support */ + u_int8_t loggeoip; + char *geoip_db_path; + char *geoip6_db_path; +#endif + }_Config; diff -rupN ossec-hids-2.6.orig/src/config/mail-config.h ossec-hids-2.6/src/config/mail-config.h --- ossec-hids-2.6.orig/src/config/mail-config.h 2011-07-11 21:36:58.000000000 +0200 +++ ossec-hids-2.6/src/config/mail-config.h 2012-06-04 20:19:08.644464853 +0200 @@ -35,6 +35,12 @@ typedef struct _MailConfig int *gran_set; int *gran_format; char **gran_to; + +#ifdef GEOIP + /* Use GeoIP */ + int geoip; +#endif + OSMatch **gran_location; OSMatch **gran_group; }MailConfig; diff -rupN ossec-hids-2.6.orig/src/Config.Make ossec-hids-2.6/src/Config.Make --- ossec-hids-2.6.orig/src/Config.Make 2011-07-11 21:36:58.000000000 +0200 +++ ossec-hids-2.6/src/Config.Make 2012-06-04 20:51:33.223473333 +0200 @@ -8,7 +8,7 @@ include ${PT}LOCATION include ${PT}Config.OS -CFLAGS = -g -Wall -I${PT} -I${PT}headers ${CPATH} ${CEXTRA} ${DEXTRA} ${EEXTRA} ${FEXTRA} ${GEXTRA} ${HEXTRA} -DARGV0=\"${NAME}\" -DXML_VAR=\"var\" -DOSSECHIDS +CFLAGS = -g -Wall -I${PT} -I${PT}headers ${CPATH} ${CEXTRA} ${DEXTRA} ${EEXTRA} ${FEXTRA} ${GEXTRA} ${HEXTRA} ${CGEOIP} -DARGV0=\"${NAME}\" -DXML_VAR=\"var\" -DOSSECHIDS SOURCES = *.c OBJECTS = *.o diff -rupN ossec-hids-2.6.orig/src/Config.OS ossec-hids-2.6/src/Config.OS --- ossec-hids-2.6.orig/src/Config.OS 1970-01-01 01:00:00.000000000 +0100 +++ ossec-hids-2.6/src/Config.OS 2012-06-04 21:07:24.907448953 +0200 @@ -0,0 +1 @@ + diff -rupN ossec-hids-2.6.orig/src/error_messages/error_messages.h ossec-hids-2.6/src/error_messages/error_messages.h --- ossec-hids-2.6.orig/src/error_messages/error_messages.h 2011-07-11 21:36:58.000000000 +0200 +++ ossec-hids-2.6/src/error_messages/error_messages.h 2012-06-04 20:22:32.363470644 +0200 @@ -126,6 +126,9 @@ #define INVALID_CAT "%s(1273): ERROR: Invalid category '%s' chosen." #define INVALID_CONFIG "%s(1274): ERROR: Invalid configuration. Element '%s': %s." #define INVALID_HOSTNAME "%s(1275): ERROR: Invalid hostname in syslog message: '%s'." +#ifdef GEOIP +#define INVALID_GEOIP_DB "%s(1276): ERROR: Cannot open GeoIP database: '%s'." +#endif /* Log collector */ diff -rupN ossec-hids-2.6.orig/src/headers/read-alert.h ossec-hids-2.6/src/headers/read-alert.h --- ossec-hids-2.6.orig/src/headers/read-alert.h 2011-07-11 21:36:58.000000000 +0200 +++ ossec-hids-2.6/src/headers/read-alert.h 2012-06-04 20:24:45.903871127 +0200 @@ -37,6 +37,9 @@ typedef struct _alert_data char *user; char *filename; char **log; +#ifdef GEOIP + char *geoipdata; +#endif }alert_data; Binary files ossec-hids-2.6.orig/src/isbigendian and ossec-hids-2.6/src/isbigendian differ diff -rupN ossec-hids-2.6.orig/src/isbigendian.c ossec-hids-2.6/src/isbigendian.c --- ossec-hids-2.6.orig/src/isbigendian.c 1970-01-01 01:00:00.000000000 +0100 +++ ossec-hids-2.6/src/isbigendian.c 2012-06-04 20:51:41.343332673 +0200 @@ -0,0 +1 @@ +int main() { short one = 1; char *cp = (char*)&one; if ( *cp == 0 ) return(1); else return(0); } diff -rupN ossec-hids-2.6.orig/src/Makefile ossec-hids-2.6/src/Makefile --- ossec-hids-2.6.orig/src/Makefile 2011-07-11 21:36:58.000000000 +0200 +++ ossec-hids-2.6/src/Makefile 2012-06-04 20:48:59.835530233 +0200 @@ -18,6 +18,7 @@ none: @echo "\"make setdb\" to enable database support." @echo "\"make unsetdb\" to disable database support." @echo "\"make setoneway\" to enable one-way connection to the manager." + @echo "\"make setgeoip\" to enable source IP geolocalization." clean: @/bin/sh ./Makeall clean @@ -54,6 +55,9 @@ unsetclang: setprelude: @echo "CPRELUDE=-DPRELUDE -lprelude `libprelude-config --pthread-cflags` `libprelude-config --libs`" >> ./Config.OS +setgeoip: + @echo "CGEOIP=-DGEOIP -lGeoIP" >> ./Config.OS + setdb: @cd ./os_dbd; echo "CDB=`./dbmake.sh`" >> ../Config.OS; setmaxagents: diff -rupN ossec-hids-2.6.orig/src/os_maild/config.c ossec-hids-2.6/src/os_maild/config.c --- ossec-hids-2.6.orig/src/os_maild/config.c 2011-07-11 21:36:59.000000000 +0200 +++ ossec-hids-2.6/src/os_maild/config.c 2012-06-04 20:28:56.799973548 +0200 @@ -39,6 +39,9 @@ int MailConf(int test_config, char *cfgf Mail->gran_format = NULL; Mail->groupping = 1; Mail->strict_checking = 0; +#ifdef GEOIP + Mail->geoip = 0; +#endif if(ReadConfig(modules, cfgfile, NULL, Mail) < 0) return(OS_INVALID); diff -rupN ossec-hids-2.6.orig/src/os_maild/config.h ossec-hids-2.6/src/os_maild/config.h --- ossec-hids-2.6.orig/src/os_maild/config.h 1970-01-01 01:00:00.000000000 +0100 +++ ossec-hids-2.6/src/os_maild/config.h 2011-07-11 21:36:58.000000000 +0200 @@ -0,0 +1,26 @@ +/* @(#) $Id$ */ + +/* Copyright (C) 2009 Trend Micro Inc. + * All right reserved. + * + * This program is a free software; you can redistribute it + * and/or modify it under the terms of the GNU General Public + * License (version 2) as published by the FSF - Free Software + * Foundation + */ + + + +#ifndef _CONFIG__H + +#define _CONFIG__H + +#include "config/config.h" +#include "config/global-config.h" + +long int __crt_ftell; /* Global ftell pointer. */ +_Config Config; /* Global Config structure */ + + + +#endif diff -rupN ossec-hids-2.6.orig/src/os_maild/maild.c ossec-hids-2.6/src/os_maild/maild.c --- ossec-hids-2.6.orig/src/os_maild/maild.c 2011-07-11 21:36:59.000000000 +0200 +++ ossec-hids-2.6/src/os_maild/maild.c 2012-06-04 20:28:35.544380303 +0200 @@ -25,7 +25,6 @@ #include "maild.h" #include "mail_list.h" - void OS_Run(MailConfig *mail); int main(int argc, char **argv) @@ -97,7 +96,6 @@ int main(int argc, char **argv) if((uid < 0)||(gid < 0)) ErrorExit(USER_ERROR,ARGV0,user,group); - /* Reading configuration */ if(MailConf(test_config, cfg, &mail) < 0) ErrorExit(CONFIG_ERROR, ARGV0, cfg); @@ -117,6 +115,13 @@ int main(int argc, char **argv) mail.subject_full = getDefine_Int("maild", "full_subject", 0, 1); + +#ifdef GEOIP + /* Get GeoIP */ + mail.geoip = getDefine_Int("maild", + "geoip", + 0, 1); +#endif /* Exit here if test config is set */ diff -rupN ossec-hids-2.6.orig/src/os_maild/maild.h ossec-hids-2.6/src/os_maild/maild.h --- ossec-hids-2.6.orig/src/os_maild/maild.h 2011-07-11 21:36:59.000000000 +0200 +++ ossec-hids-2.6/src/os_maild/maild.h 2012-06-04 20:15:19.083933540 +0200 @@ -36,13 +36,22 @@ #define MAIL_SUBJECT_FULL2 "%d - %s - %s" #endif +#ifdef GEOIP #define MAIL_BODY "\r\nOSSEC HIDS Notification.\r\n" \ "%s\r\n\r\n" \ "Received From: %s\r\n" \ "Rule: %d fired (level %d) -> \"%s\"\r\n" \ + "%s" \ "Portion of the log(s):\r\n\r\n%s\r\n" \ "\r\n\r\n --END OF NOTIFICATION\r\n\r\n\r\n" - +#else +#define MAIL_BODY "\r\nOSSEC HIDS Notification.\r\n" \ + "%s\r\n\r\n" \ + "Received From: %s\r\n" \ + "Rule: %d fired (level %d) -> \"%s\"\r\n" \ + "Portion of the log(s):\r\n\r\n%s\r\n" \ + "\r\n\r\n --END OF NOTIFICATION\r\n\r\n\r\n" +#endif /* Mail msg structure */ typedef struct _MailMsg diff -rupN ossec-hids-2.6.orig/src/os_maild/os_maild_client.c ossec-hids-2.6/src/os_maild/os_maild_client.c --- ossec-hids-2.6.orig/src/os_maild/os_maild_client.c 2011-07-11 21:36:59.000000000 +0200 +++ ossec-hids-2.6/src/os_maild/os_maild_client.c 2012-06-04 20:15:47.071214986 +0200 @@ -13,6 +13,10 @@ #include "shared.h" #include "maild.h" +/* GeoIP Stuff */ +#ifdef GEOIP +#include "config.h" +#endif /* OS_RecvMailQ, * v0.1, 2005/03/15 @@ -25,6 +29,9 @@ MailMsg *OS_RecvMailQ(file_queue *fileq, int i = 0, body_size = OS_MAXSTR -3, log_size, sms_set = 0,donotgroup = 0; char logs[OS_MAXSTR + 1]; char *subject_host; +#ifdef GEOIP + char geoip_msg[OS_SIZE_1024 +1]; +#endif MailMsg *mail; alert_data *al_data; @@ -103,16 +110,35 @@ MailMsg *OS_RecvMailQ(file_queue *fileq, *subject_host = '-'; } +#ifdef GEOIP + /* Get GeoIP information */ + if (Mail->geoip) { + sprintf(geoip_msg, "Src Location: %s\r\n", al_data->geoipdata); + } + else { + geoip_msg[0] = '\0'; + } +#endif /* Body */ +#ifdef GEOIP snprintf(mail->body, BODY_SIZE -1, MAIL_BODY, al_data->date, al_data->location, al_data->rule, al_data->level, al_data->comment, + geoip_msg, logs); - +#else + snprintf(mail->body, BODY_SIZE -1, MAIL_BODY, + al_data->date, + al_data->location, + al_data->rule, + al_data->level, + al_data->comment, + logs); +#endif /* Checking for granular email configs */ if(Mail->gran_to) diff -rupN ossec-hids-2.6.orig/src/shared/read-alert.c ossec-hids-2.6/src/shared/read-alert.c --- ossec-hids-2.6.orig/src/shared/read-alert.c 2011-07-11 21:36:59.000000000 +0200 +++ ossec-hids-2.6/src/shared/read-alert.c 2012-06-04 20:23:46.140037423 +0200 @@ -27,6 +27,8 @@ #define RULE_BEGIN_SZ 6 #define SRCIP_BEGIN "Src IP: " #define SRCIP_BEGIN_SZ 8 +#define GEOIP_BEGIN "Src Location: " +#define GEOIP_BEGIN_SZ 14 #define SRCPORT_BEGIN "Src Port: " #define SRCPORT_BEGIN_SZ 10 #define DSTIP_BEGIN "Dst IP: " @@ -81,6 +83,12 @@ void FreeAlertData(alert_data *al_data) al_data->log++; } } +#ifdef GEOIP + if (al_data->geoipdata) + { + free(al_data->geoipdata); + } +#endif free(al_data); al_data = NULL; } @@ -104,6 +112,9 @@ alert_data *GetAlertData(int flag, FILE char *group = NULL; char *filename = NULL; char **log = NULL; +#ifdef GEOIP + char *geoipdata = NULL; +#endif int level, rule, srcport, dstport; @@ -136,6 +147,9 @@ alert_data *GetAlertData(int flag, FILE al_data->user = user; al_data->date = date; al_data->filename = filename; +#ifdef GEOIP + al_data->geoipdata = geoipdata; +#endif return(al_data); @@ -294,6 +308,15 @@ alert_data *GetAlertData(int flag, FILE p = str + SRCIP_BEGIN_SZ; os_strdup(p, srcip); } +#ifdef GEOIP + /* GeoIP */ + else if (strncmp(GEOIP_BEGIN, str, GEOIP_BEGIN_SZ) == 0) + { + os_clearnl(str,p); + p = str + GEOIP_BEGIN_SZ; + os_strdup(p, geoipdata); + } +#endif /* srcport */ else if(strncmp(SRCPORT_BEGIN, str, SRCPORT_BEGIN_SZ) == 0) { @@ -376,6 +399,13 @@ alert_data *GetAlertData(int flag, FILE free(srcip); srcip = NULL; } +#ifdef GEOIP + if(geoipdata) + { + free(geoipdata); + geoipdata = NULL; + } +#endif if(user) { free(user);