gchar*
sim_event_to_string(SimEvent *event)
{
GString *str;
gchar *ip;
gchar * base64;
gint base64_len;
gchar uuidtext[37];
int i;
g_return_if_fail(event);
g_return_if_fail(SIM_IS_EVENT (event));
gchar *e_filename = NULL, *e_username = NULL, *e_password = NULL;
gchar *e_userdata1 = NULL, *e_userdata2 = NULL, *e_userdata3 = NULL, *e_userdata4 = NULL;
gchar *e_userdata5 = NULL, *e_userdata6 = NULL, *e_userdata7 = NULL, *e_userdata8 = NULL;
gchar *e_userdata9 = NULL, *e_data = NULL, *e_log = NULL;
str = g_string_new("event ");
g_string_append_printf(str, "id=\"%u\" ", event->id);
g_string_append_printf(str, "alarm=\"%d\" ", event->alarm);
gchar *aux = sim_event_get_str_from_type(event->type);
if (aux)
{
g_string_append_printf(str, "type=\"%s\" ", aux);
g_free(aux);
}
g_string_append_printf(str, "date=\"%u\" ", event->time);
g_string_append_printf(str, "tzone=\"%4.2f\" ", event->tzone);
if (event->time_str)
g_string_append_printf(str, "fdate=\"%s\" ", event->time_str);
if (event->plugin_id)
g_string_append_printf(str, "plugin_id=\"%d\" ", event->plugin_id);
if (event->plugin_sid)
g_string_append_printf(str, "plugin_sid=\"%d\" ", event->plugin_sid);
if (event->src_ia)
{
ip = gnet_inetaddr_get_canonical_name(event->src_ia);
g_string_append_printf(str, "src_ip=\"%s\" ", ip);
g_free(ip);
}
if (event->src_port)
g_string_append_printf(str, "src_port=\"%d\" ", event->src_port);
if (event->dst_ia)
{
ip = gnet_inetaddr_get_canonical_name(event->dst_ia);
g_string_append_printf(str, "dst_ip=\"%s\" ", ip);
g_free(ip);
}
if (event->dst_port)
g_string_append_printf(str, "dst_port=\"%d\" ", event->dst_port);
if (event->sensor)
g_string_append_printf(str, "sensor=\"%s\" ", event->sensor);
if (event->device)
g_string_append_printf(str, "device=\"%s\" ", event->device);
if (event->interface)
g_string_append_printf(str, "interface=\"%s\" ", event->interface);
if (event->protocol)
{
gchar *value = sim_protocol_get_str_from_type(event->protocol);
g_string_append_printf(str, "protocol=\"%s\" ", value);
g_free(value);
}
if (event->condition)
{
gchar *value = sim_condition_get_str_from_type(event->condition);
g_string_append_printf(str, "condition=\"%s\" ", value);
g_free(value);
}
if (event->value)
g_string_append_printf(str, "value=\"%s\" ", event->value);
if (event->interval)
g_string_append_printf(str, "interval=\"%d\" ", event->interval);
if (event->is_priority_set)
g_string_append_printf(str, "priority=\"%d\" ", event->priority);
if (event->is_reliability_set)
g_string_append_printf(str, "reliability=\"%d\" ", event->reliability);
if (event->asset_src)
g_string_append_printf(str, "asset_src=\"%d\" ", event->asset_src);
if (event->asset_dst)
g_string_append_printf(str, "asset_dst=\"%d\" ", event->asset_dst);
if (event->risk_c)
g_string_append_printf(str, "risk_a=\"%lf\" ", event->risk_a);
if (event->risk_a)
g_string_append_printf(str, "risk_c=\"%lf\" ", event->risk_c);
if (event->snort_sid)
g_string_append_printf(str, "snort_sid=\"%u\" ", event->snort_sid);
if (event->snort_cid)
g_string_append_printf(str, "snort_cid=\"%u\" ", event->snort_cid);
// if (event->data)
// g_string_append_printf(str, "data=\"%s\" ", event->data);
if (event->log && (base64_len = strlen(event->log)))
{
base64 = g_base64_encode(event->log, base64_len);
assert(base64!=NULL);
g_string_append_printf(str, "log=\"%s\" ", base64);
g_free(base64);
}
if (event->rep_prio_src)
g_string_append_printf(str, "rep_prio_src=\"%u\" ", event->rep_prio_src);
if (event->rep_prio_dst)
g_string_append_printf(str, "rep_prio_dst=\"%u\" ", event->rep_prio_dst);
if (event->rep_rel_src)
g_string_append_printf(str, "rep_rel_src=\"%u\" ", event->rep_rel_src);
if (event->rep_rel_dst)
g_string_append_printf(str, "rep_rel_dst=\"%u\" ", event->rep_rel_dst);
if (event->rep_act_src && (base64_len = strlen(event->rep_act_src)))
{
base64 = g_base64_encode( (guchar*)event->rep_act_src, base64_len);
assert (base64 != NULL);
g_string_append_printf(str, "rep_act_src=\"%s\" ", base64);
g_free(base64);
}
if (event->rep_act_dst && (base64_len = strlen(event->rep_act_dst)))
{
base64 = g_base64_encode( (guchar*)event->rep_act_dst, base64_len);
assert (base64 != NULL);
g_string_append_printf(str, "rep_act_dst=\"%s\" ", base64);
g_free(base64);
}
//g_string_append_printf(str, "log=\"%s\" ", event->log);
for (i = 0; i < N_TEXT_FIELDS; i++)
{
if ((event->textfields[i] != NULL) && (base64_len = strlen(event->textfields[i])))
{
base64 = g_base64_encode(event->textfields[i], base64_len);
assert(base64!=NULL);
g_string_append_printf(str, "%s=\"%s\" ", sim_text_field_get_name(i), base64);
g_free(base64);
}
}
if (!uuid_is_null(event->uuid))
{
uuid_unparse_upper(event->uuid, uuidtext);
g_string_append_printf(str, "uuid=\"%s\" ", uuidtext);
}
if (event->packet)
if (event->packet->payloadlen > 0)
{
gchar *payload;
payload = sim_bin2hex(event->packet->payload, event->packet->payloadlen);
g_string_append_printf(str, "payload=\"%s\" ", payload);
g_free(payload);
}
g_string_append_printf(str, "\n");
return g_string_free(str, FALSE);
}
/**
* sim_event_to_string:
* @event: a #SimEvent object.
*
*/
gchar *
sim_event_to_string (SimEvent * event)
{
GString *str;
gchar *ip;
gchar * base64;
gint base64_len;
SimUuid * net_id;
g_return_val_if_fail(SIM_IS_EVENT (event), NULL);
str = g_string_new("event ");
g_string_append_printf(str, "event_id=\"%s\" ", sim_uuid_get_string (event->id));
g_string_append_printf(str, "ctx=\"%s\" ", sim_uuid_get_string (sim_context_get_id (event->context)));
g_string_append_printf(str, "alarm=\"%d\" ", event->alarm);
str = g_string_append (str, "is_remote=\"1\" ");
gchar *aux = sim_event_get_str_from_type(event->type);
if (aux)
{
g_string_append_printf(str, "type=\"%s\" ", aux);
g_free(aux);
}
g_string_append_printf(str, "date=\"%u\" ", (guint)event->time);
g_string_append_printf(str, "tzone=\"%4.2f\" ", event->tzone);
if (event->time_str)
g_string_append_printf(str, "fdate=\"%s\" ", event->time_str);
if (event->plugin_id)
g_string_append_printf(str, "plugin_id=\"%d\" ", event->plugin_id);
if (event->plugin_sid)
g_string_append_printf(str, "plugin_sid=\"%d\" ", event->plugin_sid);
if (event->src_ia)
{
ip = sim_inet_get_canonical_name (event->src_ia);
g_string_append_printf (str, "src_ip=\"%s\" ", ip);
g_free (ip);
}
if (event->src_port)
g_string_append_printf(str, "src_port=\"%d\" ", event->src_port);
if (event->dst_ia)
{
ip = sim_inet_get_canonical_name (event->dst_ia);
g_string_append_printf (str, "dst_ip=\"%s\" ", ip);
g_free (ip);
}
if (event->dst_port)
g_string_append_printf(str, "dst_port=\"%d\" ", event->dst_port);
if (event->src_net)
{
net_id = sim_net_get_id (event->src_net);
g_string_append_printf (str, "src_net=\"%s\" ", sim_uuid_get_string (net_id));
}
if (event->dst_net)
{
net_id = sim_net_get_id (event->dst_net);
g_string_append_printf (str, "dst_net=\"%s\" ", sim_uuid_get_string (net_id));
}
if (event->sensor)
{
ip = sim_inet_get_canonical_name (event->sensor);
g_string_append_printf(str, "sensor=\"%s\" ", ip);
g_free (ip);
}
if (event->sensor_id)
g_string_append_printf(str, "sensor_id=\"%s\" ", sim_uuid_get_string (event->sensor_id));
if (event->device)
{
ip = sim_inet_get_canonical_name (event->device);
g_string_append_printf(str, "device=\"%s\" ", ip);
g_free (ip);
}
if (event->device_id)
g_string_append_printf (str, "device_id=\"%d\" ", event->device_id);
#if 0
if (event->server)
g_string_append_printf (str, "server=\"%s\" ", event->server);
#endif
if (event->interface)
g_string_append_printf(str, "interface=\"%s\" ", event->interface);
if (event->protocol)
{
gchar *value = sim_protocol_get_str_from_type(event->protocol);
g_string_append_printf(str, "protocol=\"%s\" ", value);
g_free(value);
}
if (event->condition)
{
gchar *value = sim_condition_get_str_from_type(event->condition);
g_string_append_printf(str, "condition=\"%s\" ", value);
g_free(value);
}
if (event->value)
g_string_append_printf(str, "value=\"%s\" ", event->value);
if (event->interval)
g_string_append_printf(str, "interval=\"%d\" ", event->interval);
if (event->is_priority_set)
g_string_append_printf(str, "priority=\"%d\" ", event->priority);
if (event->is_reliability_set)
g_string_append_printf(str, "reliability=\"%d\" ", event->reliability);
g_string_append_printf(str, "asset_src=\"%d\" ", event->asset_src);
g_string_append_printf(str, "asset_dst=\"%d\" ", event->asset_dst);
if (event->risk_c)
g_string_append_printf(str, "risk_a=\"%lf\" ", event->risk_a);
if (event->risk_a)
g_string_append_printf(str, "risk_c=\"%lf\" ", event->risk_c);
// Only forward this field if this is a special event.
if ((event->data) && sim_event_is_special (event))
{
gchar *base64;
base64 = g_base64_encode ((guchar *)event->data, strlen(event->data));
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf (str, "data=\"%s\" ", base64);
g_free (base64);
}
if (event->log)
{
base64 = g_base64_encode((guchar*)event->log->str, event->log->len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "log=\"%s\" ", base64);
g_free(base64);
}
if (event->filename && (base64_len = strlen(event->filename)))
{
base64 = g_base64_encode( (guchar*)event->filename, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "filename=\"%s\" ", base64);
g_free(base64);
}
if (event->username && (base64_len = strlen(event->username)))
{
base64 = g_base64_encode( (guchar*)event->username, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "username=\"%s\" ", base64);
g_free(base64);
}
if (event->password && (base64_len = strlen(event->password)))
{
base64 = g_base64_encode( (guchar*) event->password, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "password=\"%s\" ", base64);
g_free(base64);
}
if (event->userdata1 && (base64_len = strlen(event->userdata1)))
{
base64 = g_base64_encode( (guchar*)event->userdata1, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "userdata1=\"%s\" ", base64);
g_free(base64);
}
if (event->userdata2 && (base64_len = strlen(event->userdata2)))
{
base64 = g_base64_encode( (guchar*)event->userdata2, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "userdata2=\"%s\" ", base64);
g_free(base64);
}
if (event->userdata3 && (base64_len = strlen(event->userdata3)))
{
base64 = g_base64_encode( (guchar*)event->userdata3, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "userdata3=\"%s\" ", base64);
g_free(base64);
}
if (event->userdata4 && (base64_len = strlen(event->userdata4)))
{
base64 = g_base64_encode( (guchar*)event->userdata4, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "userdata4=\"%s\" ", base64);
g_free (base64);
}
if (event->userdata5 && (base64_len = strlen(event->userdata5)))
{
base64 = g_base64_encode( (guchar*)event->userdata5, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "userdata5=\"%s\" ", base64);
g_free(base64);
}
if (event->userdata6 && (base64_len = strlen(event->userdata6)))
{
base64 = g_base64_encode( (guchar*)event->userdata6, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "userdata6=\"%s\" ", base64);
g_free(base64);
}
if (event->userdata7 && (base64_len = strlen(event->userdata7)))
{
base64 = g_base64_encode( (guchar*)event->userdata7, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "userdata7=\"%s\" ", base64);
g_free(base64);
}
if (event->userdata8 && (base64_len = strlen(event->userdata8)))
{
base64 = g_base64_encode( (guchar*)event->userdata8, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "userdata8=\"%s\" ", base64);
g_free(base64);
}
if (event->userdata9 && (base64_len = strlen(event->userdata9)))
{
base64 = g_base64_encode( (guchar*)event->userdata9, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "userdata9=\"%s\" ", base64);
g_free(base64);
}
if (event->src_username_raw && (base64_len = strlen(event->src_username_raw)))
{
base64 = g_base64_encode ((guchar *)event->src_username_raw, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "src_username=\"%s\" ", base64);
g_free (base64);
}
if (event->dst_username_raw && (base64_len = strlen (event->dst_username_raw)))
{
base64 = g_base64_encode ((guchar *)event->dst_username_raw, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "dst_username=\"%s\" ", base64);
g_free (base64);
}
if (event->src_id)
g_string_append_printf(str, "src_id=\"%s\" ", sim_uuid_get_string (event->src_id));
if (event->dst_id)
g_string_append_printf(str, "dst_id=\"%s\" ", sim_uuid_get_string (event->dst_id));
if (event->src_hostname)
g_string_append_printf(str, "src_hostname=\"%s\" ", event->src_hostname);
if (event->dst_hostname)
g_string_append_printf(str, "dst_hostname=\"%s\" ", event->dst_hostname);
if (event->src_mac)
g_string_append_printf(str, "src_mac=\"%s\" ", event->src_mac);
if (event->dst_mac)
g_string_append_printf(str, "dst_mac=\"%s\" ", event->dst_mac);
if (event->rep_prio_src)
g_string_append_printf(str, "rep_prio_src=\"%u\" ", event->rep_prio_src);
if (event->rep_prio_dst)
g_string_append_printf(str, "rep_prio_dst=\"%u\" ", event->rep_prio_dst);
if (event->rep_rel_src)
g_string_append_printf(str, "rep_rel_src=\"%u\" ", event->rep_rel_src);
if (event->rep_rel_dst)
g_string_append_printf(str, "rep_rel_dst=\"%u\" ", event->rep_rel_dst);
if (event->str_rep_act_src && (base64_len = strlen(event->str_rep_act_src)))
{
base64 = g_base64_encode( (guchar*)event->str_rep_act_src, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "rep_act_src=\"%s\" ", base64);
g_free(base64);
}
if (event->str_rep_act_dst && (base64_len = strlen(event->str_rep_act_dst)))
{
base64 = g_base64_encode( (guchar*)event->str_rep_act_dst, base64_len);
if(base64 == NULL)
return g_string_free(str, TRUE);
g_string_append_printf(str, "rep_act_dst=\"%s\" ", base64);
g_free(base64);
}
/* We need to check that the */
if (event->binary_data != NULL)
{
g_string_append_printf(str,"binary_data=\"%s\" ", event->binary_data);
}
g_string_append_printf(str, "\n");
return g_string_free(str, FALSE);
}
