]>
Commit | Line | Data |
---|---|---|
88d9af2c SS |
1 | package Guardian::Parser; |
2 | use strict; | |
3 | use warnings; | |
4 | ||
5 | use Exporter qw(import); | |
6 | ||
cfe5a220 | 7 | our @EXPORT_OK = qw(IsSupportedParser Parser); |
88d9af2c | 8 | |
cfe5a220 SS |
9 | # This hash contains all supported parsers and which function |
10 | # has to be called to parse messages in the right way. | |
88d9af2c | 11 | my %logfile_parsers = ( |
cfe5a220 | 12 | "snort" => \&message_parser_snort, |
88d9af2c SS |
13 | ); |
14 | ||
15 | # | |
16 | ## The main parsing function. | |
17 | # | |
18 | ## It is used to determine which sub-parser has to be used to | |
19 | ## parse the given message in the right way and to return if | |
20 | ## any action should be performed. | |
21 | # | |
22 | sub Parser ($$) { | |
cfe5a220 | 23 | my ($parser, @message) = @_; |
88d9af2c SS |
24 | |
25 | # If no responsible message parser could be found, just return nothing. | |
cfe5a220 | 26 | unless (exists($logfile_parsers{$parser})) { |
88d9af2c SS |
27 | return; |
28 | } | |
29 | ||
cfe5a220 SS |
30 | # Call responsible message parser. |
31 | my $action = $logfile_parsers{$parser}->(@message); | |
88d9af2c | 32 | |
8fba3c57 SS |
33 | # In case an action has been returned, return it too. |
34 | if (defined($action)) { | |
35 | # Return which action should be performed. | |
36 | return "count $action"; | |
37 | } | |
38 | ||
39 | # Return undef, no action required. | |
40 | return undef; | |
88d9af2c SS |
41 | } |
42 | ||
cfe5a220 SS |
43 | # |
44 | ## IsSupportedParser function. | |
45 | # | |
46 | ## This very tiny function checks if a given parser name is available and | |
47 | ## therefore a supported parser. | |
48 | # | |
49 | ## To perform these check, the function is going to lookup if a key in the | |
50 | ## hash of supported parsers is available | |
51 | # | |
52 | sub IsSupportedParser ($) { | |
53 | my $parser = $_[0]; | |
54 | ||
55 | # Check if a key for the given parser exists in the hash of logfile_parsers. | |
56 | if(exists($logfile_parsers{$parser})) { | |
57 | # Found a valid parser, so return nothing. | |
58 | return 1; | |
59 | } | |
60 | ||
61 | # Return "False" if we got here, and therefore no parser | |
62 | # is available. | |
63 | return; | |
64 | } | |
65 | ||
88d9af2c SS |
66 | # |
67 | ## The Snort message parser. | |
68 | # | |
69 | ## This subfunction is responsible for parsing sort alerts and determine if | |
70 | ## an action should be performed. | |
71 | # | |
72 | sub message_parser_snort($) { | |
73 | my @message = @_; | |
74 | ||
75 | # XXX | |
76 | # Currently this parser just returns a simple message. | |
ebd440a9 | 77 | return "$message[0] SNORT A simple Snort Message"; |
88d9af2c SS |
78 | } |
79 | ||
80 | 1; |