Improve Makefile.

[people/stevee/guardian.git] / modules / Parser.pm

diff --git a/modules/Parser.pm b/modules/Parser.pm
index 4f03bf958064598ff5e9a38974f6ea46805bb713..255e6cc3012aa80e54df13639f2f5d02794e8a07 100644 (file)
--- a/modules/Parser.pm
+++ b/modules/Parser.pm
@@ -9,6 +9,7 @@ our @EXPORT_OK = qw(IsSupportedParser Parser);
 # This hash contains all supported parsers and which function
 # has to be called to parse messages in the right way.
 my %logfile_parsers = (
+       "httpd" => \&message_parser_httpd,
        "snort" => \&message_parser_snort,
        "ssh" => \&message_parser_ssh,
 );
@@ -29,15 +30,15 @@ sub Parser ($$) {
        }
 
        # Call responsible message parser.
-       my $action = $logfile_parsers{$parser}->(@message);
+       my @actions = $logfile_parsers{$parser}->(@message);
 
        # In case an action has been returned, return it too. 
-       if (defined($action)) {
-               # Return which action should be performed.
-               return "count $action";
+       if (@actions) {
+               # Return which actions should be performed.
+               return @actions;
        }
 
-       # Return undef, no action required.
+       # Return undef, if no actions are required.
        return undef;
 }
 
@@ -70,12 +71,58 @@ sub IsSupportedParser ($) {
 ## This subfunction is responsible for parsing sort alerts and determine if
 ## an action should be performed.
 #
-sub message_parser_snort($) {
+## XXX Currently the parser only supports IPv4. Add support for IPv6 at a
+## later time.
+#
+sub message_parser_snort(@) {
        my @message = @_;
 
-       # XXX
-       # Currently this parser just returns a simple message.
-       return "$message[0] SNORT A simple Snort Message";
+       # The name of the parser module.
+       my $name = "SNORT";
+
+       # Variable to store the grabbed IP-address.
+       my $address;
+
+       # Default returned message in case no one could be grabbed
+       # from the snort alert.
+       my $message = "An active snort rule has matched and gained an alert.";
+
+       # A snort alert contains multiple lines, loop through all lines
+       # to parse the complete alert.
+       foreach my $line (@message) {
+               # Check Priority Level and skip the alert if it is to low.
+               #if ($line =~ /.*\[Priority: (\d+)\].*/) {
+               #       return unless($1 < $priority);
+               #}
+
+               # Search for a line like xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx
+               if ($line =~ /(\d+\.\d+\.\d+\.\d+)+ -\> (\d+\.\d+\.\d+\.\d+)+/) {
+                       # Store the grabbed IP-address.
+                       $address = $1;
+               }
+
+               # Search for a line like xxx.xxx.xxx.xxx:xxx -> xxx.xxx.xxx.xxx:xxx
+               elsif ($line =~ /(\d+\.\d+\.\d+\.\d+):\d+ -\> (\d+\.\d+\.\d+\.\d+):\d+/) {
+                       # Store the obtained IP-address.
+                       $address = $1;
+               }
+
+               # Obtain the reported reason.
+               if ($line =~ /.*msg:\"(.*)\".*/) {
+                       # Store the extracted message.
+                       $message = $1;
+               }
+       }
+
+       # Check if at least the IP-address information are obtained from the
+       # provided alert.
+       if ($address) {
+               # Return the extracted values.
+               return "$address $name $message";
+       }
+
+       # If we got here, the alert could not be parsed correctly, return nothing.
+       return;
 }
 
 #
@@ -86,6 +133,7 @@ sub message_parser_snort($) {
 #
 sub message_parser_ssh (@) {
        my @message = @_;
+       my @actions;
 
        # The name of the parser module.
        my $name = "SSH";
@@ -116,12 +164,75 @@ sub message_parser_ssh (@) {
                        # Set event message.
                        $message = "Possible SSH-Bruteforce Attack - failed preauth.";
                }
+
+               # Check if at least the IP-address information has been extracted.
+               if (defined ($address)) {
+                       # Add the extracted values and event message for the computed
+                       # event to the actions array.
+                       push(@actions, "count $address $name $message");
+               }
        }
 
-       # Check if at least the IP-address information has been extracted.
-       if (defined ($address)) {
-               # Return the extracted values and event message.
-               return "$address $name $message";
+       # If any actions are required, return the array.
+       if (@actions) {
+               return (@actions);
+       }
+
+       # If we got here, the provided message is not affected by any filter and
+       # therefore can be skipped. Return nothing (False) in this case.
+       return;
+}
+
+#
+## The HTTPD message parser.
+#
+## This subfunction is used for parsing and detecting different attacks
+## against a running HTTPD service.
+#
+sub message_parser_httpd (@) {
+       my @message = @_;
+       my @actions;
+
+       # The name of the parser module.
+       my $name = "HTTPD";
+
+       # Variable to store the grabbed IP-address.
+       my $address;
+
+       # Variable to store the parsed event.
+       my $message;
+
+       # Loop through all lines, in case multiple one have
+       # been passed.
+       foreach my $line (@message) {
+               # This will catch brute-force attacks against htaccess logins (username).
+               if ($line =~ /.*\[error\] \[client (.*)\] user(.*) not found:.*/) {
+                       # Store the grabbed IP-address.
+                       $address = $1;
+
+                       # Set event message.
+                       $message = "Possible WUI brute-force attack, wrong user: $2.";
+               }
+
+               # Detect htaccess password brute-forcing against a username.
+               elsif ($line =~ /.*\[error\] \[client (.*)\] user(.*): authentication failure for.*/) {
+                       # Store the extracted IP-address.
+                       $address = $1;
+
+                       # Set event message.
+                       $message = "Possible WUI brute-force attack, wrong password for user: $2.";
+               }
+
+               # Check if at least the IP-address information has been extracted.
+               if (defined ($address)) {
+                       # Add the extracted values and event message to the actions array.
+                       push(@actions, "count $address $name $message");
+               }
+       }
+
+       # If any actions are required, return the array.
+       if (@actions) {
+               return @actions;
        }
 
        # If we got here, the provided message is not affected by any filter and