modules/Parser.pm

   1 package Guardian::Parser;
   2 use strict;
   3 use warnings;
   4
   5 use Exporter qw(import);
   6
   7 our @EXPORT_OK = qw(IsSupportedParser Parser);
   8
   9 # This hash contains all supported parsers and which function
  10 # has to be called to parse messages in the right way.
  11 my %logfile_parsers = (
  12         "snort" => \&message_parser_snort,
  13 );
  14
  15 #
  16 ## The main parsing function.
  17 #
  18 ## It is used to determine which sub-parser has to be used to
  19 ## parse the given message in the right way and to return if
  20 ## any action should be performed.
  21 #
  22 sub Parser ($$) {
  23         my ($parser, @message) = @_;
  24
  25         # If no responsible message parser could be found, just return nothing.
  26         unless (exists($logfile_parsers{$parser})) {
  27                 return;
  28         }
  29
  30         # Call responsible message parser.
  31         my $action = $logfile_parsers{$parser}->(@message);
  32
  33         # In case an action has been returned, return it too.
  34         if (defined($action)) {
  35                 # Return which action should be performed.
  36                 return "count $action";
  37         }
  38
  39         # Return undef, no action required.
  40         return undef;
  41 }
  42
  43 #
  44 ## IsSupportedParser function.
  45 #
  46 ## This very tiny function checks if a given parser name is available and
  47 ## therefore a supported parser.
  48 #
  49 ## To perform these check, the function is going to lookup if a key in the
  50 ## hash of supported parsers is available
  51 #
  52 sub IsSupportedParser ($) {
  53         my $parser = $_[0];
  54
  55         # Check if a key for the given parser exists in the hash of logfile_parsers.
  56         if(exists($logfile_parsers{$parser})) {
  57                 # Found a valid parser, so return nothing.
  58                 return 1;
  59         }
  60
  61         # Return "False" if we got here, and therefore no parser
  62         # is available.
  63         return;
  64 }
  65
  66 #
  67 ## The Snort message parser.
  68 #
  69 ## This subfunction is responsible for parsing sort alerts and determine if
  70 ## an action should be performed.
  71 #
  72 sub message_parser_snort($) {
  73         my @message = @_;
  74
  75         # XXX
  76         # Currently this parser just returns a simple message.
  77         return "$message[0] SNORT A simple Snort Message";
  78 }
  79
  80 1;