Allow to process multiple events at once.

[people/stevee/guardian.git] / modules / Parser.pm

diff --git a/modules/Parser.pm b/modules/Parser.pm
index 65f770879014c893167314513ea32af66fcad2a7..5c2f53fa79437753d3a10dbdcf7fd44a4676d0e9 100644 (file)
--- a/modules/Parser.pm
+++ b/modules/Parser.pm
@@ -30,15 +30,15 @@ sub Parser ($$) {
        }
 
        # Call responsible message parser.
-       my $action = $logfile_parsers{$parser}->(@message);
+       my @actions = $logfile_parsers{$parser}->(@message);
 
        # In case an action has been returned, return it too. 
-       if (defined($action)) {
-               # Return which action should be performed.
-               return "count $action";
+       if (@actions) {
+               # Return which actions should be performed.
+               return @actions;
        }
 
-       # Return undef, no action required.
+       # Return undef, if no actions are required.
        return undef;
 }
 
@@ -87,6 +87,7 @@ sub message_parser_snort($) {
 #
 sub message_parser_ssh (@) {
        my @message = @_;
+       my @actions;
 
        # The name of the parser module.
        my $name = "SSH";
@@ -117,12 +118,18 @@ sub message_parser_ssh (@) {
                        # Set event message.
                        $message = "Possible SSH-Bruteforce Attack - failed preauth.";
                }
+
+               # Check if at least the IP-address information has been extracted.
+               if (defined ($address)) {
+                       # Add the extracted values and event message for the computed
+                       # event to the actions array.
+                       push(@actions, "count $address $name $message");
+               }
        }
 
-       # Check if at least the IP-address information has been extracted.
-       if (defined ($address)) {
-               # Return the extracted values and event message.
-               return "$address $name $message";
+       # If any actions are required, return the array.
+       if (@actions) {
+               return (@actions);
        }
 
        # If we got here, the provided message is not affected by any filter and
@@ -138,6 +145,7 @@ sub message_parser_ssh (@) {
 #
 sub message_parser_httpd (@) {
        my @message = @_;
+       my @actions;
 
        # The name of the parser module.
        my $name = "HTTPD";
@@ -168,12 +176,17 @@ sub message_parser_httpd (@) {
                        # Set event message.
                        $message = "Possible WUI brute-force attack, wrong password for user: $2.";
                }
+
+               # Check if at least the IP-address information has been extracted.
+               if (defined ($address)) {
+                       # Add the extracted values and event message to the actions array.
+                       push(@actions, "count $address $name $message");
+               }
        }
 
-       # Check if at least the IP-address information has been extracted.
-       if (defined ($address)) {
-               # Return the extracted values and event message.
-               return "$address $name $message";
+       # If any actions are required, return the array.
+       if (@actions) {
+               return @actions;
        }
 
        # If we got here, the provided message is not affected by any filter and