src/config/global-config.c

   1 /* @(#) $Id: ./src/config/global-config.c, 2011/09/08 dcid Exp $
   2  */
   3
   4 /* Copyright (C) 2009 Trend Micro Inc.
   5  * All right reserved.
   6  *
   7  * This program is a free software; you can redistribute it
   8  * and/or modify it under the terms of the GNU General Public
   9  * License (version 2) as published by the FSF - Free Software
  10  * Foundation
  11  */
  12
  13 /* Functions to handle the configuration files
  14  */
  15
  16
  17 #include "shared.h"
  18 #include "os_net/os_net.h"
  19 #include "global-config.h"
  20 #include "mail-config.h"
  21
  22
  23 void AssignIgnore_Global(char **ignores, void *configp)
  24 {
  25     _Config *Config;
  26
  27     Config = (_Config *)configp;
  28     if(Config)
  29     {
  30         Config->syscheck_ignore = ignores;
  31     }
  32 }
  33
  34
  35 /* GlobalConfSK v0.1: 2006/04/26
  36  * v0.1 Getting the ignore fields.
  37  */
  38 int Read_GlobalSK(XML_NODE node, void *configp, void *mailp)
  39 {
  40     int i = 0;
  41     int ign_size = 1;
  42     char *xml_ignore = "ignore";
  43     char *xml_auto_ignore = "auto_ignore";
  44     char *xml_alert_new_files = "alert_new_files";
  45
  46     _Config *Config;
  47
  48     Config = (_Config *)configp;
  49
  50
  51     /* Shouldn't be here if !Config */
  52     if(!Config)
  53         return(0);
  54
  55
  56     /* Getting right white_size */
  57     if(Config && Config->syscheck_ignore)
  58     {
  59         char **ww;
  60         ww = Config->syscheck_ignore;
  61
  62         while(*ww != NULL)
  63         {
  64             ign_size++;
  65             ww++;
  66         }
  67     }
  68
  69     while(node[i])
  70     {
  71         if(!node[i]->element)
  72         {
  73             merror(XML_ELEMNULL, ARGV0);
  74             return(OS_INVALID);
  75         }
  76         else if(!node[i]->content)
  77         {
  78             merror(XML_VALUENULL, ARGV0, node[i]->element);
  79             return(OS_INVALID);
  80         }
  81         else if(strcmp(node[i]->element,xml_auto_ignore) == 0)
  82         {
  83             if(strcmp(node[i]->content, "yes") == 0)
  84             {
  85                 Config->syscheck_auto_ignore = 1;
  86             }
  87             else if(strcmp(node[i]->content, "no") == 0)
  88             {
  89                 Config->syscheck_auto_ignore = 0;
  90             }
  91             else
  92             {
  93                 merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
  94                 return(OS_INVALID);
  95             }
  96         }
  97         else if(strcmp(node[i]->element,xml_alert_new_files) == 0)
  98         {
  99             if(strcmp(node[i]->content, "yes") == 0)
 100             {
 101                 Config->syscheck_alert_new = 1;
 102             }
 103             else if(strcmp(node[i]->content, "no") == 0)
 104             {
 105                 Config->syscheck_alert_new = 0;
 106             }
 107             else
 108             {
 109                 merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
 110                 return(OS_INVALID);
 111             }
 112         }
 113         else if(strcmp(node[i]->element,xml_ignore) == 0)
 114         {
 115             ign_size++;
 116             Config->syscheck_ignore =
 117                 realloc(Config->syscheck_ignore, sizeof(char *)*ign_size);
 118             if(!Config->syscheck_ignore)
 119             {
 120                 merror(MEM_ERROR, ARGV0);
 121                 return(OS_INVALID);
 122             }
 123
 124             os_strdup(node[i]->content,Config->syscheck_ignore[ign_size -2]);
 125             Config->syscheck_ignore[ign_size -1] = NULL;
 126         }
 127         i++;
 128     }
 129
 130     return(0);
 131 }
 132
 133
 134 /* GlobalConf v0.2: 2005/03/03
 135  * v0.2: Changing to support the new OS_XML
 136  */
 137 int Read_Global(XML_NODE node, void *configp, void *mailp)
 138 {
 139     int i = 0;
 140
 141     /* White list size */
 142     int white_size = 1;
 143     int hostname_white_size = 1;
 144     int mailto_size = 1;
 145
 146
 147     /* XML definitions */
 148     char *xml_mailnotify = "email_notification";
 149     char *xml_logall = "logall";
 150     char *xml_integrity = "integrity_checking";
 151     char *xml_rootcheckd = "rootkit_detection";
 152     char *xml_hostinfo = "host_information";
 153     char *xml_picviz = "picviz_output";
 154     char *xml_picviz_socket = "picviz_socket";
 155     char *xml_prelude = "prelude_output";
 156     char *xml_prelude_profile = "prelude_profile";
 157     char *xml_prelude_log_level = "prelude_log_level";
 158     char *xml_zeromq_output = "zeromq_output";
 159     char *xml_zeromq_output_uri = "zeromq_uri";
 160     char *xml_stats = "stats";
 161     char *xml_memorysize = "memory_size";
 162     char *xml_white_list = "white_list";
 163     char *xml_compress_alerts = "compress_alerts";
 164     char *xml_custom_alert_output = "custom_alert_output";
 165
 166     char *xml_emailto = "email_to";
 167     char *xml_emailfrom = "email_from";
 168     char *xml_emailidsname = "email_idsname";
 169     char *xml_smtpserver = "smtp_server";
 170     char *xml_mailmaxperhour = "email_maxperhour";
 171
 172 #ifdef GEOIP
 173     /* GeoIP */
 174     char *xml_geoip_db_path = "geoip_db_path";
 175     char *xml_geoip6_db_path = "geoip6_db_path";
 176 #endif
 177
 178     _Config *Config;
 179     MailConfig *Mail;
 180
 181     Config = (_Config *)configp;
 182     Mail = (MailConfig *)mailp;
 183
 184     /* Getting right white_size */
 185     if(Config && Config->white_list)
 186     {
 187         os_ip **ww;
 188         ww = Config->white_list;
 189
 190         while(*ww != NULL)
 191         {
 192             white_size++;
 193             ww++;
 194         }
 195     }
 196
 197      /* Getting right white_size */
 198     if(Config && Config->hostname_white_list)
 199     {
 200         OSMatch **ww;
 201         ww = Config->hostname_white_list;
 202
 203         while(*ww != NULL)
 204         {
 205             hostname_white_size++;
 206             ww++;
 207         }
 208     }
 209
 210     /* Getting mail_to size */
 211     if(Mail && Mail->to)
 212     {
 213         char **ww;
 214         ww = Mail->to;
 215         while(*ww != NULL)
 216         {
 217             mailto_size++;
 218             ww++;
 219         }
 220     }
 221
 222     while(node[i])
 223     {
 224         if(!node[i]->element)
 225         {
 226             merror(XML_ELEMNULL, ARGV0);
 227             return(OS_INVALID);
 228         }
 229         else if(!node[i]->content)
 230         {
 231             merror(XML_VALUENULL, ARGV0, node[i]->element);
 232             return(OS_INVALID);
 233         }
 234         else if(strcmp(node[i]->element, xml_custom_alert_output) == 0)
 235         {
 236           if(Config)
 237           {
 238             Config->custom_alert_output= 1;
 239             os_strdup(node[i]->content, Config->custom_alert_output_format);
 240           }
 241         }
 242         /* Mail notification */
 243         else if(strcmp(node[i]->element, xml_mailnotify) == 0)
 244         {
 245             if(strcmp(node[i]->content, "yes") == 0)
 246             {
 247                 if(Config) Config->mailnotify = 1;
 248                 if(Mail) Mail->mn = 1;
 249             }
 250             else if(strcmp(node[i]->content, "no") == 0)
 251             {
 252                 if(Config) Config->mailnotify = 0;
 253                 if(Mail) Mail->mn = 0;
 254             }
 255             else
 256             {
 257                 merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
 258                 return(OS_INVALID);
 259             }
 260         }
 261         /* Picviz support */
 262         else if(strcmp(node[i]->element, xml_picviz) == 0)
 263         {
 264             if(strcmp(node[i]->content, "yes") == 0)
 265             {
 266                 if(Config) Config->picviz = 1;
 267             }
 268             else if(strcmp(node[i]->content, "no") == 0)
 269             {
 270                 if(Config) Config->picviz = 0;
 271             }
 272             else
 273             {
 274                 merror(XML_VALUEERR,ARGV0,node[i]->element, node[i]->content);
 275                 return(OS_INVALID);
 276             }
 277         }
 278         else if(strcmp(node[i]->element, xml_picviz_socket) == 0)
 279         {
 280             if(Config)
 281             {
 282                 os_strdup(node[i]->content, Config->picviz_socket);
 283             }
 284         }
 285         /* Prelude support */
 286         else if(strcmp(node[i]->element, xml_prelude) == 0)
 287         {
 288             if(strcmp(node[i]->content, "yes") == 0)
 289             {
 290                 if(Config) Config->prelude = 1;
 291             }
 292             else if(strcmp(node[i]->content, "no") == 0)
 293             {
 294                 if(Config) Config->prelude = 0;
 295             }
 296             else
 297             {
 298                 merror(XML_VALUEERR,ARGV0,node[i]->element, node[i]->content);
 299                 return(OS_INVALID);
 300             }
 301         }
 302         else if(strcmp(node[i]->element, xml_prelude_profile) == 0)
 303         {
 304             if(Config)
 305             {
 306                 Config->prelude_profile = strdup(node[i]->content);
 307             }
 308         }
 309         else if(strcmp(node[i]->element, xml_prelude_log_level) == 0)
 310         {
 311             if(!OS_StrIsNum(node[i]->content))
 312             {
 313                 merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
 314                 return(OS_INVALID);
 315             }
 316
 317             if(Config)
 318             {
 319                 Config->prelude_log_level = atoi(node[i]->content);
 320             }
 321         }
 322         /* ZeroMQ output */
 323         else if(strcmp(node[i]->element, xml_zeromq_output) == 0)
 324         {
 325             if(strcmp(node[i]->content, "yes") == 0)
 326             {
 327                 if(Config) Config->zeromq_output = 1;
 328             }
 329             else if(strcmp(node[i]->content, "no") == 0)
 330             {
 331                 if(Config) Config->zeromq_output = 0;
 332             }
 333             else
 334             {
 335                 merror(XML_VALUEERR,ARGV0,node[i]->element, node[i]->content);
 336                 return(OS_INVALID);
 337             }
 338         }
 339         else if(strcmp(node[i]->element, xml_zeromq_output_uri) == 0)
 340         {
 341             if(Config)
 342             {
 343                 Config->zeromq_output_uri = strdup(node[i]->content);
 344             }
 345         }
 346         /* Log all */
 347         else if(strcmp(node[i]->element, xml_logall) == 0)
 348         {
 349             if(strcmp(node[i]->content, "yes") == 0)
 350                 { if(Config) Config->logall = 1;}
 351             else if(strcmp(node[i]->content, "no") == 0)
 352                 {if(Config) Config->logall = 0;}
 353             else
 354             {
 355                 merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
 356                 return(OS_INVALID);
 357             }
 358         }
 359         /* compress alerts */
 360         else if(strcmp(node[i]->element, xml_compress_alerts) == 0)
 361         {
 362             /* removed from here -- compatility issues only */
 363         }
 364         /* Integrity */
 365         else if(strcmp(node[i]->element, xml_integrity) == 0)
 366         {
 367             if(!OS_StrIsNum(node[i]->content))
 368             {
 369                 merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
 370                 return(OS_INVALID);
 371             }
 372             if(Config)
 373             {
 374                 Config->integrity = atoi(node[i]->content);
 375             }
 376         }
 377         /* rootcheck */
 378         else if(strcmp(node[i]->element, xml_rootcheckd) == 0)
 379         {
 380             if(!OS_StrIsNum(node[i]->content))
 381             {
 382                 merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
 383                 return(OS_INVALID);
 384             }
 385             if(Config)
 386             {
 387                 Config->rootcheck = atoi(node[i]->content);
 388             }
 389         }
 390         /* hostinfo */
 391         else if(strcmp(node[i]->element, xml_hostinfo) == 0)
 392         {
 393             if(!OS_StrIsNum(node[i]->content))
 394             {
 395                 merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
 396                 return(OS_INVALID);
 397             }
 398             if(Config)
 399             {
 400                 Config->hostinfo = atoi(node[i]->content);
 401             }
 402         }
 403         /* stats */
 404         else if(strcmp(node[i]->element, xml_stats) == 0)
 405         {
 406             if(!OS_StrIsNum(node[i]->content))
 407             {
 408                 merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
 409                 return(OS_INVALID);
 410             }
 411             if(Config)
 412             {
 413                 Config->stats = atoi(node[i]->content);
 414             }
 415         }
 416         else if(strcmp(node[i]->element, xml_memorysize) == 0)
 417         {
 418             if(!OS_StrIsNum(node[i]->content))
 419             {
 420                 merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
 421                 return(OS_INVALID);
 422             }
 423             if(Config)
 424             {
 425                 Config->memorysize = atoi(node[i]->content);
 426             }
 427         }
 428         /* whitelist */
 429         else if(strcmp(node[i]->element, xml_white_list) == 0)
 430         {
 431             /* Windows do not need it */
 432             #ifndef WIN32
 433
 434             char *ip_address_regex =
 435              "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}/?"
 436              "([0-9]{0,2}|[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})$";
 437
 438             if(Config && OS_PRegex(node[i]->content, ip_address_regex))
 439             {
 440                 white_size++;
 441                 Config->white_list =
 442                     realloc(Config->white_list, sizeof(os_ip *)*white_size);
 443                 if(!Config->white_list)
 444                 {
 445                     merror(MEM_ERROR, ARGV0);
 446                     return(OS_INVALID);
 447                 }
 448
 449                 os_calloc(1, sizeof(os_ip), Config->white_list[white_size -2]);
 450                 Config->white_list[white_size -1] = NULL;
 451
 452                 if(!OS_IsValidIP(node[i]->content,
 453                                  Config->white_list[white_size -2]))
 454                 {
 455                     merror(INVALID_IP, ARGV0,
 456                                        node[i]->content);
 457                     return(OS_INVALID);
 458                 }
 459             }
 460             /* Adding hostname */
 461             else if(Config)
 462             {
 463                 hostname_white_size++;
 464                 Config->hostname_white_list =
 465                     realloc(Config->hostname_white_list,
 466                     sizeof(OSMatch *)*hostname_white_size);
 467
 468                 if(!Config->hostname_white_list)
 469                 {
 470                     merror(MEM_ERROR, ARGV0);
 471                     return(OS_INVALID);
 472                 }
 473                 os_calloc(1,
 474                           sizeof(OSMatch),
 475                           Config->hostname_white_list[hostname_white_size -2]);
 476                 Config->hostname_white_list[hostname_white_size -1] = NULL;
 477
 478                 if(!OSMatch_Compile(
 479                         node[i]->content,
 480                         Config->hostname_white_list[hostname_white_size -2],
 481                         0))
 482                 {
 483                     merror(REGEX_COMPILE, ARGV0, node[i]->content,
 484                            Config->hostname_white_list
 485                            [hostname_white_size -2]->error);
 486                     return(-1);
 487                 }
 488             }
 489
 490             #endif
 491
 492         }
 493
 494         /* For the email now
 495          * email_to, email_from, idsname, smtp_Server and maxperhour.
 496          * We will use a separate structure for that.
 497          */
 498         else if(strcmp(node[i]->element, xml_emailto) == 0)
 499         {
 500             #ifndef WIN32
 501             if(!OS_PRegex(node[i]->content, "[a-zA-Z0-9\\._-]+@[a-zA-Z0-9\\._-]"))
 502             {
 503                 merror("%s: ERROR: Invalid Email address: %s.", ARGV0, node[i]->content);
 504                 return(OS_INVALID);
 505             }
 506             #endif
 507
 508             if(Mail)
 509             {
 510                 mailto_size++;
 511                 Mail->to = realloc(Mail->to, sizeof(char *)*mailto_size);
 512                 if(!Mail->to)
 513                 {
 514                     merror(MEM_ERROR, ARGV0);
 515                     return(OS_INVALID);
 516                 }
 517
 518                 os_strdup(node[i]->content, Mail->to[mailto_size - 2]);
 519                 Mail->to[mailto_size - 1] = NULL;
 520             }
 521         }
 522         else if(strcmp(node[i]->element, xml_emailfrom) == 0)
 523         {
 524             if(Mail)
 525             {
 526                 if(Mail->from)
 527                 {
 528                     free(Mail->from);
 529                 }
 530                 os_strdup(node[i]->content, Mail->from);
 531             }
 532         }
 533         else if(strcmp(node[i]->element, xml_emailidsname) == 0)
 534         {
 535             if(Mail)
 536             {
 537                 if(Mail->idsname)
 538                 {
 539                     free(Mail->idsname);
 540                 }
 541                 os_strdup(node[i]->content, Mail->idsname);
 542             }
 543         }
 544         else if(strcmp(node[i]->element, xml_smtpserver) == 0)
 545         {
 546             #ifndef WIN32
 547             if(Mail && (Mail->mn))
 548             {
 549                 Mail->smtpserver = OS_GetHost(node[i]->content, 5);
 550                 if(!Mail->smtpserver)
 551                 {
 552                     merror(INVALID_SMTP, ARGV0, node[i]->content);
 553                     return(OS_INVALID);
 554                 }
 555             }
 556             #endif
 557         }
 558         else if(strcmp(node[i]->element, xml_mailmaxperhour) == 0)
 559         {
 560             if(Mail)
 561             {
 562                 if(!OS_StrIsNum(node[i]->content))
 563                 {
 564                    merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
 565                    return(OS_INVALID);
 566                 }
 567                 Mail->maxperhour = atoi(node[i]->content);
 568
 569                 if((Mail->maxperhour <= 0) || (Mail->maxperhour > 9999))
 570                 {
 571                    merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
 572                    return(OS_INVALID);
 573                 }
 574             }
 575         }
 576 #ifdef GEOIP
 577         /* GeoIP v4 DB location */
 578         else if(strcmp(node[i]->element, xml_geoip_db_path) == 0)
 579         {
 580             if(Config)
 581             {
 582                 os_strdup(node[i]->content, Config->geoip_db_path);
 583             }
 584         }
 585         /* GeoIP v6 DB location */
 586         else if(strcmp(node[i]->element, xml_geoip6_db_path) == 0)
 587         {
 588             if(Config)
 589             {
 590                 os_strdup(node[i]->content, Config->geoip6_db_path);
 591             }
 592         }
 593 #endif
 594         else
 595         {
 596             merror(XML_INVELEM, ARGV0, node[i]->element);
 597             return(OS_INVALID);
 598         }
 599         i++;
 600     }
 601
 602     return(0);
 603 }
 604
 605
 606 /* EOF */