X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?p=ossec-hids.git;a=blobdiff_plain;f=contrib%2Fossec-batch-manager.pl;fp=contrib%2Fossec-batch-manager.pl;h=acb7f20f43091693f42f962dd84278c693b315f6;hp=b1b07df263a7a3ffdca02c4145b535110f2014cb;hb=3f728675941dc69d4e544d3a880a56240a6e394a;hpb=927951d1c1ad45ba9e7325f07d996154a91c911b diff --git a/contrib/ossec-batch-manager.pl b/contrib/ossec-batch-manager.pl index b1b07df..acb7f20 100755 --- a/contrib/ossec-batch-manager.pl +++ b/contrib/ossec-batch-manager.pl @@ -53,9 +53,9 @@ #$Id$ # TODO: -# - Add check for ossec 1.4 and support longer agent names -# - Add in eval so that older version of perl without -# Time::HiRes still can use this script. +# - Add check for ossec 1.4 and support longer agent names +# - Add in eval so that older version of perl without +# Time::HiRes still can use this script. use strict; use warnings; @@ -64,6 +64,7 @@ require 5.8.2; # Time::HiRes is standard from this version forth use MIME::Base64; use Digest::MD5 qw(md5_hex); use Getopt::Long; +use Regexp::Common::net; use constant AUTH_KEY_FILE => "/var/ossec/etc/client.keys"; use constant RIDS_PATH => "/var/ossec/queue/rids/"; @@ -98,8 +99,14 @@ elsif (@extracts) { } # Adding a new agent elsif ($add) { - if ($agentname && $ipaddress && $ipaddress =~ - m/(1?\d\d?|2[0-4]\d|25[0-5])(\.(1?\d\d?|2[0-4]\d|25[0-5])){3}/ && + if ($agentname && $ipaddress && + ( + $ipaddress =~ m/$RE{net}{IPv4}/ + || + $ipaddress =~ m/$RE{net}{IPv6}/ + || + $ipaddress eq 'any' + ) && # ossec doesn't like agent names > 32 characters. length($agentname) <= 32) { @@ -118,7 +125,7 @@ elsif ($add) { close(FH); if (@used_agent_ids) { - @used_agent_ids = sort(@used_agent_ids); + @used_agent_ids = sort {$a <=> $b} @used_agent_ids; $agentid = sprintf("%03d", $used_agent_ids[-1] + 1); } } @@ -359,10 +366,11 @@ sub check_if_exists { if(defined($key)) { $rval = 1 if ($id == $newid && $rval == 0); $rval = 2 if ($name eq $newname && $rval == 0); - $rval = 3 if ($ip eq $newip && $rval == 0); + $rval = 3 if ($ip ne 'any' && $ip eq $newip && $rval == 0); } } close(FH); } return $rval; } +