]>
git.ipfire.org Git - people/stevee/guardian.git/blob - modules/Parser.pm
65f770879014c893167314513ea32af66fcad2a7
1 package Guardian
::Parser
;
5 use Exporter
qw(import);
7 our @EXPORT_OK = qw(IsSupportedParser Parser);
9 # This hash contains all supported parsers and which function
10 # has to be called to parse messages in the right way.
11 my %logfile_parsers = (
12 "httpd" => \
&message_parser_httpd
,
13 "snort" => \
&message_parser_snort
,
14 "ssh" => \
&message_parser_ssh
,
18 ## The main parsing function.
20 ## It is used to determine which sub-parser has to be used to
21 ## parse the given message in the right way and to return if
22 ## any action should be performed.
25 my ($parser, @message) = @_;
27 # If no responsible message parser could be found, just return nothing.
28 unless (exists($logfile_parsers{$parser})) {
32 # Call responsible message parser.
33 my $action = $logfile_parsers{$parser}->(@message);
35 # In case an action has been returned, return it too.
36 if (defined($action)) {
37 # Return which action should be performed.
38 return "count $action";
41 # Return undef, no action required.
46 ## IsSupportedParser function.
48 ## This very tiny function checks if a given parser name is available and
49 ## therefore a supported parser.
51 ## To perform these check, the function is going to lookup if a key in the
52 ## hash of supported parsers is available
54 sub IsSupportedParser
($) {
57 # Check if a key for the given parser exists in the hash of logfile_parsers.
58 if(exists($logfile_parsers{$parser})) {
59 # Found a valid parser, so return nothing.
63 # Return "False" if we got here, and therefore no parser
69 ## The Snort message parser.
71 ## This subfunction is responsible for parsing sort alerts and determine if
72 ## an action should be performed.
74 sub message_parser_snort
($) {
78 # Currently this parser just returns a simple message.
79 return "$message[0] SNORT A simple Snort Message";
83 ## The SSH message parser.
85 ## This subfunction is used for parsing and detecting different attacks
86 ## against the SSH service.
88 sub message_parser_ssh
(@
) {
91 # The name of the parser module.
94 # Variable to store the grabbed IP-address.
97 # Variable to store the parsed event.
100 # Loop through all lines, in case multiple one have
102 foreach my $line (@message) {
103 # Check for failed password attempts.
104 if ($line =~/.*sshd.*Failed password for (.*) from (.*) port.*/) {
105 # Store the grabbed IP-address.
109 $message = "Possible SSH-Bruteforce Attack for user: $1.";
112 # This should catch Bruteforce Attacks with enabled preauth
113 elsif ($line =~ /.*sshd.*Received disconnect from (.*):.*\[preauth\]/) {
114 # Store obtained IP-address.
118 $message = "Possible SSH-Bruteforce Attack - failed preauth.";
122 # Check if at least the IP-address information has been extracted.
123 if (defined ($address)) {
124 # Return the extracted values and event message.
125 return "$address $name $message";
128 # If we got here, the provided message is not affected by any filter and
129 # therefore can be skipped. Return nothing (False) in this case.
134 ## The HTTPD message parser.
136 ## This subfunction is used for parsing and detecting different attacks
137 ## against a running HTTPD service.
139 sub message_parser_httpd
(@
) {
142 # The name of the parser module.
145 # Variable to store the grabbed IP-address.
148 # Variable to store the parsed event.
151 # Loop through all lines, in case multiple one have
153 foreach my $line (@message) {
154 # This will catch brute-force attacks against htaccess logins (username).
155 if ($line =~ /.*\[error\] \[client (.*)\] user(.*) not found:.*/) {
156 # Store the grabbed IP-address.
160 $message = "Possible WUI brute-force attack, wrong user: $2.";
163 # Detect htaccess password brute-forcing against a username.
164 elsif ($line =~ /.*\[error\] \[client (.*)\] user(.*): authentication failure for.*/) {
165 # Store the extracted IP-address.
169 $message = "Possible WUI brute-force attack, wrong password for user: $2.";
173 # Check if at least the IP-address information has been extracted.
174 if (defined ($address)) {
175 # Return the extracted values and event message.
176 return "$address $name $message";
179 # If we got here, the provided message is not affected by any filter and
180 # therefore can be skipped. Return nothing (False) in this case.