gchar* sim_event_to_string(SimEvent *event) { GString *str; gchar *ip; gchar * base64; gint base64_len; gchar uuidtext[37]; int i; g_return_if_fail(event); g_return_if_fail(SIM_IS_EVENT (event)); gchar *e_filename = NULL, *e_username = NULL, *e_password = NULL; gchar *e_userdata1 = NULL, *e_userdata2 = NULL, *e_userdata3 = NULL, *e_userdata4 = NULL; gchar *e_userdata5 = NULL, *e_userdata6 = NULL, *e_userdata7 = NULL, *e_userdata8 = NULL; gchar *e_userdata9 = NULL, *e_data = NULL, *e_log = NULL; str = g_string_new("event "); g_string_append_printf(str, "id=\"%u\" ", event->id); g_string_append_printf(str, "alarm=\"%d\" ", event->alarm); gchar *aux = sim_event_get_str_from_type(event->type); if (aux) { g_string_append_printf(str, "type=\"%s\" ", aux); g_free(aux); } g_string_append_printf(str, "date=\"%u\" ", event->time); g_string_append_printf(str, "tzone=\"%4.2f\" ", event->tzone); if (event->time_str) g_string_append_printf(str, "fdate=\"%s\" ", event->time_str); if (event->plugin_id) g_string_append_printf(str, "plugin_id=\"%d\" ", event->plugin_id); if (event->plugin_sid) g_string_append_printf(str, "plugin_sid=\"%d\" ", event->plugin_sid); if (event->src_ia) { ip = gnet_inetaddr_get_canonical_name(event->src_ia); g_string_append_printf(str, "src_ip=\"%s\" ", ip); g_free(ip); } if (event->src_port) g_string_append_printf(str, "src_port=\"%d\" ", event->src_port); if (event->dst_ia) { ip = gnet_inetaddr_get_canonical_name(event->dst_ia); g_string_append_printf(str, "dst_ip=\"%s\" ", ip); g_free(ip); } if (event->dst_port) g_string_append_printf(str, "dst_port=\"%d\" ", event->dst_port); if (event->sensor) g_string_append_printf(str, "sensor=\"%s\" ", event->sensor); if (event->device) g_string_append_printf(str, "device=\"%s\" ", event->device); if (event->interface) g_string_append_printf(str, "interface=\"%s\" ", event->interface); if (event->protocol) { gchar *value = sim_protocol_get_str_from_type(event->protocol); g_string_append_printf(str, "protocol=\"%s\" ", value); g_free(value); } if (event->condition) { gchar *value = sim_condition_get_str_from_type(event->condition); g_string_append_printf(str, "condition=\"%s\" ", value); g_free(value); } if (event->value) g_string_append_printf(str, "value=\"%s\" ", event->value); if (event->interval) g_string_append_printf(str, "interval=\"%d\" ", event->interval); if (event->is_priority_set) g_string_append_printf(str, "priority=\"%d\" ", event->priority); if (event->is_reliability_set) g_string_append_printf(str, "reliability=\"%d\" ", event->reliability); if (event->asset_src) g_string_append_printf(str, "asset_src=\"%d\" ", event->asset_src); if (event->asset_dst) g_string_append_printf(str, "asset_dst=\"%d\" ", event->asset_dst); if (event->risk_c) g_string_append_printf(str, "risk_a=\"%lf\" ", event->risk_a); if (event->risk_a) g_string_append_printf(str, "risk_c=\"%lf\" ", event->risk_c); if (event->snort_sid) g_string_append_printf(str, "snort_sid=\"%u\" ", event->snort_sid); if (event->snort_cid) g_string_append_printf(str, "snort_cid=\"%u\" ", event->snort_cid); // if (event->data) // g_string_append_printf(str, "data=\"%s\" ", event->data); if (event->log && (base64_len = strlen(event->log))) { base64 = g_base64_encode(event->log, base64_len); assert(base64!=NULL); g_string_append_printf(str, "log=\"%s\" ", base64); g_free(base64); } if (event->rep_prio_src) g_string_append_printf(str, "rep_prio_src=\"%u\" ", event->rep_prio_src); if (event->rep_prio_dst) g_string_append_printf(str, "rep_prio_dst=\"%u\" ", event->rep_prio_dst); if (event->rep_rel_src) g_string_append_printf(str, "rep_rel_src=\"%u\" ", event->rep_rel_src); if (event->rep_rel_dst) g_string_append_printf(str, "rep_rel_dst=\"%u\" ", event->rep_rel_dst); if (event->rep_act_src && (base64_len = strlen(event->rep_act_src))) { base64 = g_base64_encode( (guchar*)event->rep_act_src, base64_len); assert (base64 != NULL); g_string_append_printf(str, "rep_act_src=\"%s\" ", base64); g_free(base64); } if (event->rep_act_dst && (base64_len = strlen(event->rep_act_dst))) { base64 = g_base64_encode( (guchar*)event->rep_act_dst, base64_len); assert (base64 != NULL); g_string_append_printf(str, "rep_act_dst=\"%s\" ", base64); g_free(base64); } //g_string_append_printf(str, "log=\"%s\" ", event->log); for (i = 0; i < N_TEXT_FIELDS; i++) { if ((event->textfields[i] != NULL) && (base64_len = strlen(event->textfields[i]))) { base64 = g_base64_encode(event->textfields[i], base64_len); assert(base64!=NULL); g_string_append_printf(str, "%s=\"%s\" ", sim_text_field_get_name(i), base64); g_free(base64); } } if (!uuid_is_null(event->uuid)) { uuid_unparse_upper(event->uuid, uuidtext); g_string_append_printf(str, "uuid=\"%s\" ", uuidtext); } if (event->packet) if (event->packet->payloadlen > 0) { gchar *payload; payload = sim_bin2hex(event->packet->payload, event->packet->payloadlen); g_string_append_printf(str, "payload=\"%s\" ", payload); g_free(payload); } g_string_append_printf(str, "\n"); return g_string_free(str, FALSE); }
/** * sim_event_to_string: * @event: a #SimEvent object. * */ gchar * sim_event_to_string (SimEvent * event) { GString *str; gchar *ip; gchar * base64; gint base64_len; SimUuid * net_id; g_return_val_if_fail(SIM_IS_EVENT (event), NULL); str = g_string_new("event "); g_string_append_printf(str, "event_id=\"%s\" ", sim_uuid_get_string (event->id)); g_string_append_printf(str, "ctx=\"%s\" ", sim_uuid_get_string (sim_context_get_id (event->context))); g_string_append_printf(str, "alarm=\"%d\" ", event->alarm); str = g_string_append (str, "is_remote=\"1\" "); gchar *aux = sim_event_get_str_from_type(event->type); if (aux) { g_string_append_printf(str, "type=\"%s\" ", aux); g_free(aux); } g_string_append_printf(str, "date=\"%u\" ", (guint)event->time); g_string_append_printf(str, "tzone=\"%4.2f\" ", event->tzone); if (event->time_str) g_string_append_printf(str, "fdate=\"%s\" ", event->time_str); if (event->plugin_id) g_string_append_printf(str, "plugin_id=\"%d\" ", event->plugin_id); if (event->plugin_sid) g_string_append_printf(str, "plugin_sid=\"%d\" ", event->plugin_sid); if (event->src_ia) { ip = sim_inet_get_canonical_name (event->src_ia); g_string_append_printf (str, "src_ip=\"%s\" ", ip); g_free (ip); } if (event->src_port) g_string_append_printf(str, "src_port=\"%d\" ", event->src_port); if (event->dst_ia) { ip = sim_inet_get_canonical_name (event->dst_ia); g_string_append_printf (str, "dst_ip=\"%s\" ", ip); g_free (ip); } if (event->dst_port) g_string_append_printf(str, "dst_port=\"%d\" ", event->dst_port); if (event->src_net) { net_id = sim_net_get_id (event->src_net); g_string_append_printf (str, "src_net=\"%s\" ", sim_uuid_get_string (net_id)); } if (event->dst_net) { net_id = sim_net_get_id (event->dst_net); g_string_append_printf (str, "dst_net=\"%s\" ", sim_uuid_get_string (net_id)); } if (event->sensor) { ip = sim_inet_get_canonical_name (event->sensor); g_string_append_printf(str, "sensor=\"%s\" ", ip); g_free (ip); } if (event->sensor_id) g_string_append_printf(str, "sensor_id=\"%s\" ", sim_uuid_get_string (event->sensor_id)); if (event->device) { ip = sim_inet_get_canonical_name (event->device); g_string_append_printf(str, "device=\"%s\" ", ip); g_free (ip); } if (event->device_id) g_string_append_printf (str, "device_id=\"%d\" ", event->device_id); #if 0 if (event->server) g_string_append_printf (str, "server=\"%s\" ", event->server); #endif if (event->interface) g_string_append_printf(str, "interface=\"%s\" ", event->interface); if (event->protocol) { gchar *value = sim_protocol_get_str_from_type(event->protocol); g_string_append_printf(str, "protocol=\"%s\" ", value); g_free(value); } if (event->condition) { gchar *value = sim_condition_get_str_from_type(event->condition); g_string_append_printf(str, "condition=\"%s\" ", value); g_free(value); } if (event->value) g_string_append_printf(str, "value=\"%s\" ", event->value); if (event->interval) g_string_append_printf(str, "interval=\"%d\" ", event->interval); if (event->is_priority_set) g_string_append_printf(str, "priority=\"%d\" ", event->priority); if (event->is_reliability_set) g_string_append_printf(str, "reliability=\"%d\" ", event->reliability); g_string_append_printf(str, "asset_src=\"%d\" ", event->asset_src); g_string_append_printf(str, "asset_dst=\"%d\" ", event->asset_dst); if (event->risk_c) g_string_append_printf(str, "risk_a=\"%lf\" ", event->risk_a); if (event->risk_a) g_string_append_printf(str, "risk_c=\"%lf\" ", event->risk_c); // Only forward this field if this is a special event. if ((event->data) && sim_event_is_special (event)) { gchar *base64; base64 = g_base64_encode ((guchar *)event->data, strlen(event->data)); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf (str, "data=\"%s\" ", base64); g_free (base64); } if (event->log) { base64 = g_base64_encode((guchar*)event->log->str, event->log->len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "log=\"%s\" ", base64); g_free(base64); } if (event->filename && (base64_len = strlen(event->filename))) { base64 = g_base64_encode( (guchar*)event->filename, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "filename=\"%s\" ", base64); g_free(base64); } if (event->username && (base64_len = strlen(event->username))) { base64 = g_base64_encode( (guchar*)event->username, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "username=\"%s\" ", base64); g_free(base64); } if (event->password && (base64_len = strlen(event->password))) { base64 = g_base64_encode( (guchar*) event->password, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "password=\"%s\" ", base64); g_free(base64); } if (event->userdata1 && (base64_len = strlen(event->userdata1))) { base64 = g_base64_encode( (guchar*)event->userdata1, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "userdata1=\"%s\" ", base64); g_free(base64); } if (event->userdata2 && (base64_len = strlen(event->userdata2))) { base64 = g_base64_encode( (guchar*)event->userdata2, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "userdata2=\"%s\" ", base64); g_free(base64); } if (event->userdata3 && (base64_len = strlen(event->userdata3))) { base64 = g_base64_encode( (guchar*)event->userdata3, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "userdata3=\"%s\" ", base64); g_free(base64); } if (event->userdata4 && (base64_len = strlen(event->userdata4))) { base64 = g_base64_encode( (guchar*)event->userdata4, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "userdata4=\"%s\" ", base64); g_free (base64); } if (event->userdata5 && (base64_len = strlen(event->userdata5))) { base64 = g_base64_encode( (guchar*)event->userdata5, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "userdata5=\"%s\" ", base64); g_free(base64); } if (event->userdata6 && (base64_len = strlen(event->userdata6))) { base64 = g_base64_encode( (guchar*)event->userdata6, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "userdata6=\"%s\" ", base64); g_free(base64); } if (event->userdata7 && (base64_len = strlen(event->userdata7))) { base64 = g_base64_encode( (guchar*)event->userdata7, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "userdata7=\"%s\" ", base64); g_free(base64); } if (event->userdata8 && (base64_len = strlen(event->userdata8))) { base64 = g_base64_encode( (guchar*)event->userdata8, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "userdata8=\"%s\" ", base64); g_free(base64); } if (event->userdata9 && (base64_len = strlen(event->userdata9))) { base64 = g_base64_encode( (guchar*)event->userdata9, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "userdata9=\"%s\" ", base64); g_free(base64); } if (event->src_username_raw && (base64_len = strlen(event->src_username_raw))) { base64 = g_base64_encode ((guchar *)event->src_username_raw, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "src_username=\"%s\" ", base64); g_free (base64); } if (event->dst_username_raw && (base64_len = strlen (event->dst_username_raw))) { base64 = g_base64_encode ((guchar *)event->dst_username_raw, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "dst_username=\"%s\" ", base64); g_free (base64); } if (event->src_id) g_string_append_printf(str, "src_id=\"%s\" ", sim_uuid_get_string (event->src_id)); if (event->dst_id) g_string_append_printf(str, "dst_id=\"%s\" ", sim_uuid_get_string (event->dst_id)); if (event->src_hostname) g_string_append_printf(str, "src_hostname=\"%s\" ", event->src_hostname); if (event->dst_hostname) g_string_append_printf(str, "dst_hostname=\"%s\" ", event->dst_hostname); if (event->src_mac) g_string_append_printf(str, "src_mac=\"%s\" ", event->src_mac); if (event->dst_mac) g_string_append_printf(str, "dst_mac=\"%s\" ", event->dst_mac); if (event->rep_prio_src) g_string_append_printf(str, "rep_prio_src=\"%u\" ", event->rep_prio_src); if (event->rep_prio_dst) g_string_append_printf(str, "rep_prio_dst=\"%u\" ", event->rep_prio_dst); if (event->rep_rel_src) g_string_append_printf(str, "rep_rel_src=\"%u\" ", event->rep_rel_src); if (event->rep_rel_dst) g_string_append_printf(str, "rep_rel_dst=\"%u\" ", event->rep_rel_dst); if (event->str_rep_act_src && (base64_len = strlen(event->str_rep_act_src))) { base64 = g_base64_encode( (guchar*)event->str_rep_act_src, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "rep_act_src=\"%s\" ", base64); g_free(base64); } if (event->str_rep_act_dst && (base64_len = strlen(event->str_rep_act_dst))) { base64 = g_base64_encode( (guchar*)event->str_rep_act_dst, base64_len); if(base64 == NULL) return g_string_free(str, TRUE); g_string_append_printf(str, "rep_act_dst=\"%s\" ", base64); g_free(base64); } /* We need to check that the */ if (event->binary_data != NULL) { g_string_append_printf(str,"binary_data=\"%s\" ", event->binary_data); } g_string_append_printf(str, "\n"); return g_string_free(str, FALSE); }