Only process any actions on events if the corresponding parser returns one.
[people/stevee/guardian.git] / modules / Parser.pm
CommitLineData
88d9af2c
SS
1package Guardian::Parser;
2use strict;
3use warnings;
4
5use Exporter qw(import);
6
cfe5a220 7our @EXPORT_OK = qw(IsSupportedParser Parser);
88d9af2c 8
cfe5a220
SS
9# This hash contains all supported parsers and which function
10# has to be called to parse messages in the right way.
88d9af2c 11my %logfile_parsers = (
cfe5a220 12 "snort" => \&message_parser_snort,
88d9af2c
SS
13);
14
15#
16## The main parsing function.
17#
18## It is used to determine which sub-parser has to be used to
19## parse the given message in the right way and to return if
20## any action should be performed.
21#
22sub Parser ($$) {
cfe5a220 23 my ($parser, @message) = @_;
88d9af2c
SS
24
25 # If no responsible message parser could be found, just return nothing.
cfe5a220 26 unless (exists($logfile_parsers{$parser})) {
88d9af2c
SS
27 return;
28 }
29
cfe5a220
SS
30 # Call responsible message parser.
31 my $action = $logfile_parsers{$parser}->(@message);
88d9af2c 32
8fba3c57
SS
33 # In case an action has been returned, return it too.
34 if (defined($action)) {
35 # Return which action should be performed.
36 return "count $action";
37 }
38
39 # Return undef, no action required.
40 return undef;
88d9af2c
SS
41}
42
cfe5a220
SS
43#
44## IsSupportedParser function.
45#
46## This very tiny function checks if a given parser name is available and
47## therefore a supported parser.
48#
49## To perform these check, the function is going to lookup if a key in the
50## hash of supported parsers is available
51#
52sub IsSupportedParser ($) {
53 my $parser = $_[0];
54
55 # Check if a key for the given parser exists in the hash of logfile_parsers.
56 if(exists($logfile_parsers{$parser})) {
57 # Found a valid parser, so return nothing.
58 return 1;
59 }
60
61 # Return "False" if we got here, and therefore no parser
62 # is available.
63 return;
64}
65
88d9af2c
SS
66#
67## The Snort message parser.
68#
69## This subfunction is responsible for parsing sort alerts and determine if
70## an action should be performed.
71#
72sub message_parser_snort($) {
73 my @message = @_;
74
75 # XXX
76 # Currently this parser just returns a simple message.
ebd440a9 77 return "$message[0] SNORT A simple Snort Message";
88d9af2c
SS
78}
79
801;