gchar* sim_event_get_replace_clause(SimEvent *event) { gchar time[TIMEBUF_SIZE]; gchar *timestamp=time; gchar *query; gint c; gint a; int i; /* Temporal HACK */ gchar uuidtext[37]; gchar *values; gchar * e_rep_act_src = NULL, * e_rep_act_dst = NULL; g_return_val_if_fail(event, NULL); g_return_val_if_fail(SIM_IS_EVENT (event), NULL); c = rint(event->risk_c); a = rint(event->risk_a); if (c < 0) c = 0; else if (c > 10) c = 10; if (a < 0) a = 0; else if (a > 10) a = 10; if(event->time_str) timestamp=event->time_str; else strftime (timestamp, TIMEBUF_SIZE, "%F %T", gmtime ((time_t *) &event->time)); if (event->rep_act_src){ e_rep_act_src = g_new0 (gchar,strlen(event->rep_act_src)*2+1); gda_connection_escape_string (sim_database_get_conn (ossim.dbossim),event->rep_act_src,e_rep_act_src); } if (event->rep_act_dst){ e_rep_act_dst = g_new0 (gchar,strlen(event->rep_act_dst)*2+1); gda_connection_escape_string (sim_database_get_conn (ossim.dbossim),event->rep_act_dst,e_rep_act_dst); } uuid_unparse_upper(event->uuid, uuidtext); values = sim_event_get_text_escape_fields_values(event); query = g_strdup_printf( "REPLACE INTO event " "(id, timestamp, sensor, interface, type, plugin_id, plugin_sid, " "protocol, src_ip, dst_ip, src_port, dst_port, " "event_condition, value, time_interval, " "priority, reliability, asset_src, asset_dst, risk_c, risk_a, alarm, " "snort_sid, snort_cid, uuid, rep_prio_src, rep_prio_dst, rep_rel_src, " "rep_rel_dst, rep_act_src, rep_act_dst, %s) " " VALUES (%d, '%s', '%s', '%s', %d, %d, %d," " %d, %u, %u, %d, %d, %d, '%s', %d, %d, %d, %d, %d, %d, %d, %d, %u, %u,'%s'," " %u, %u, %u, %u, '%s', '%s', %s)", sim_event_get_sql_fields(), event->id, timestamp, (event->sensor) ? event->sensor : "", (event->interface) ? event->interface : "", event->type, event->plugin_id, event->plugin_sid, event->protocol, (event->src_ia) ? sim_inetaddr_ntohl(event->src_ia) : -1, (event->dst_ia) ? sim_inetaddr_ntohl(event->dst_ia) : -1, event->src_port, event->dst_port, event->condition, (event->value) ? event->value : "", event->interval, event->priority, event->reliability, event->asset_src, event->asset_dst, c, a, event->alarm, event->snort_sid, event->snort_cid, (!uuid_is_null(event->uuid) ? uuidtext : ""), event->rep_prio_src, event->rep_prio_dst, event->rep_rel_src, event->rep_rel_dst, (event->rep_act_src) ? e_rep_act_src : "", (event->rep_act_dst) ? e_rep_act_dst : "", values); g_free(values); g_free (e_rep_act_src); g_free (e_rep_act_dst); return query; }
gchar * sim_event_get_insert_clause_values (SimEvent *event) { gchar time[TIMEBUF_SIZE]; gchar *timestamp = time; GString *query; gchar *values; gchar *e_rep_act_src = NULL; gchar *e_rep_act_dst = NULL; gchar *e_src_hostname = NULL; gchar *e_dst_hostname = NULL; gchar *src_mac = NULL, *dst_mac = NULL; GdaConnection *conn; g_return_val_if_fail (SIM_IS_EVENT (event), NULL); conn = sim_database_get_conn (ossim.dbossim); values = sim_event_get_text_escape_fields_values (event); // If we already have the timestamp we use it.. else we calculate it if(event->time_str) timestamp = event->time_str; else strftime (timestamp, TIMEBUF_SIZE, "%F %T", gmtime ((time_t *) &event->time)); if (event->str_rep_act_src) e_rep_act_src = sim_str_escape (event->str_rep_act_src, conn, 0); if (event->str_rep_act_dst) e_rep_act_dst = sim_str_escape (event->str_rep_act_dst, conn, 0); if (event->src_hostname) e_src_hostname = sim_str_escape (event->src_hostname, conn, 0); if (event->dst_hostname) e_dst_hostname = sim_str_escape (event->dst_hostname, conn, 0); if (event->src_mac) src_mac = sim_mac_to_db_string (event->src_mac); if (event->dst_mac) dst_mac = sim_mac_to_db_string (event->dst_mac); query = g_string_new (""); g_string_append_printf (query, "(%s", sim_uuid_get_db_string (event->id)); g_string_append_printf (query, ",%s", sim_uuid_get_db_string (sim_context_get_id (event->context))); g_string_append_printf (query, ",'%s'", timestamp); g_string_append_printf (query, ",%f", event->tzone); g_string_append_printf (query, ",%s", sim_uuid_get_db_string (event->sensor_id)); g_string_append_printf (query, ",'%s'", (event->interface) ? event->interface : ""); g_string_append_printf (query, ",%d", event->type); g_string_append_printf (query, ",%d", event->plugin_id); g_string_append_printf (query, ",%d", event->plugin_sid); g_string_append_printf (query, ",%d", event->protocol); g_string_append_printf (query, ",%s", sim_inet_get_db_string (event->src_ia)); g_string_append_printf (query, ",%s", sim_inet_get_db_string (event->dst_ia)); g_string_append_printf (query, ",%s", (event->src_net) ? sim_uuid_get_db_string (sim_net_get_id (event->src_net)) : "NULL"); g_string_append_printf (query, ",%s", (event->dst_net) ? sim_uuid_get_db_string (sim_net_get_id (event->dst_net)) : "NULL"); g_string_append_printf (query, ",%d", event->src_port); g_string_append_printf (query, ",%d", event->dst_port); g_string_append_printf (query, ",%d", event->condition); g_string_append_printf (query, ",%d", event->interval); g_string_append_printf (query, ",%d", 0); //FIXME event->absolute g_string_append_printf (query, ",%d", event->priority); g_string_append_printf (query, ",%d", event->reliability); g_string_append_printf (query, ",%d", event->asset_src); g_string_append_printf (query, ",%d", event->asset_dst); g_string_append_printf (query, ",%d", (gint) event->risk_c); g_string_append_printf (query, ",%d", (gint) event->risk_a); g_string_append_printf (query, ",%d", event->alarm); g_string_append_printf (query, ",%s", values); g_string_append_printf (query, ",%u", event->rep_prio_src); g_string_append_printf (query, ",%u", event->rep_prio_dst); g_string_append_printf (query, ",%u", event->rep_rel_src); g_string_append_printf (query, ",%u", event->rep_rel_dst); g_string_append_printf (query, ",'%s'", (e_rep_act_src) ? e_rep_act_src : ""); g_string_append_printf (query, ",'%s'", (e_rep_act_dst) ? e_rep_act_dst : ""); g_string_append_printf (query, ",'%s'", (e_src_hostname) ? e_src_hostname : ""); g_string_append_printf (query, ",'%s'", (e_dst_hostname) ? e_dst_hostname : ""); g_string_append_printf (query, ",%s", (src_mac) ? src_mac : "NULL"); g_string_append_printf (query, ",%s", (dst_mac) ? dst_mac : "NULL"); g_string_append_printf (query, ",%s", (event->src_id) ? sim_uuid_get_db_string (event->src_id) : "NULL"); g_string_append_printf (query, ",%s)", (event->dst_id) ? sim_uuid_get_db_string (event->dst_id) : "NULL"); g_free (values); return g_string_free (query, FALSE); }