Only process any actions on events if the corresponding parser returns one.

[people/stevee/guardian.git] / modules / Parser.pm

diff --git a/modules/Parser.pm b/modules/Parser.pm
index 86e7aa18df037f13d3b7a8460fb5e907cec4effb..13715e004dcd7fe5d8115e6d492c463b8fe32dc7 100644 (file)
--- a/modules/Parser.pm
+++ b/modules/Parser.pm
@@ -4,12 +4,12 @@ use warnings;
 
 use Exporter qw(import);
 
-our @EXPORT_OK = qw(Parser);
+our @EXPORT_OK = qw(IsSupportedParser Parser);
 
-# This hash contains all supported logfiles and which function
-# has to be called to parse them in the right way.
+# This hash contains all supported parsers and which function
+# has to be called to parse messages in the right way.
 my %logfile_parsers = (
-       "/var/log/snort/alert" => \&message_parser_snort,
+       "snort" => \&message_parser_snort,
 );
 
 #
@@ -20,18 +20,47 @@ my %logfile_parsers = (
 ## any action should be performed.
 #
 sub Parser ($$) {
-        my ($file, @message) = @_;
+        my ($parser, @message) = @_;
 
        # If no responsible message parser could be found, just return nothing.
-       unless (exists($logfile_parsers{$file})) {
+       unless (exists($logfile_parsers{$parser})) {
                return;
        }
 
-       # Call responsible logfile parser.
-       my $action = $logfile_parsers{$file}->(@message);
+       # Call responsible message parser.
+       my $action = $logfile_parsers{$parser}->(@message);
 
-       # Return which action should be performed.
-       return $action;
+       # In case an action has been returned, return it too. 
+       if (defined($action)) {
+               # Return which action should be performed.
+               return "count $action";
+       }
+
+       # Return undef, no action required.
+       return undef;
+}
+
+#
+## IsSupportedParser function.
+#
+## This very tiny function checks if a given parser name is available and
+## therefore a supported parser.
+#
+## To perform these check, the function is going to lookup if a key in the
+## hash of supported parsers is available
+#
+sub IsSupportedParser ($) {
+       my $parser = $_[0];
+
+       # Check if a key for the given parser exists in the hash of logfile_parsers.
+       if(exists($logfile_parsers{$parser})) {
+               # Found a valid parser, so return nothing.
+               return 1;
+       }
+
+       # Return "False" if we got here, and therefore no parser
+       # is available.
+       return;
 }
 
 #
@@ -45,7 +74,7 @@ sub message_parser_snort($) {
 
        # XXX
        # Currently this parser just returns a simple message.
-       return "snort_parser_return\n";
+       return "$message[0] SNORT A simple Snort Message";
 }
 
 1;