summaryrefslogtreecommitdiffstats
path: root/snort-model.lua
blob: c52ce49b3b925909bb2ca516e395c27bd6394f84 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
-- acf model for displaying logfiles recusivly 
module (..., package.seeall)

-- no initializer in model - use controller.init for that

require("fs")
require("posix")
require("procps")

local function file_info ( path )
	local filedetails = posix.stat(path)	
	filedetails["owner"]=rawget((posix.getpasswd(filedetails["uid"])),"name")
	filedetails["group"]=rawget((posix.getgroup(filedetails["gid"])),"name")
	filedetails["atimelong"]=os.date("%c", filedetails["atime"])
	filedetails["mtimelong"]=os.date("%c", filedetails["mtime"])
	filedetails["path"]=path
	filedetails["name"]=basename(path)

	if ( filedetails["size"] > 1073741824 ) then
		filedetails["size"]=((filedetails["size"]/1073741824) - (filedetails["size"]/1073741824%0.1)) .. "G"
	elseif ( filedetails["size"] > 1048576 ) then
		filedetails["size"]=((filedetails["size"]/1048576) - (filedetails["size"]/1048576%0.1))  .. "M"
	elseif ( filedetails["size"] > 1024 ) then
		filedetails["size"]=((filedetails["size"]/1024) - (filedetails["size"]/1024%0.1)) .. "k"
	else
		filedetails["size"]=filedetails["size"]
	end
	return filedetails

end

local function get_version()
	local cmd = "snort -V 2>&1 | grep Version | sed 's/.*ersion\ /snort-/'"
	local cmd_output = io.popen( cmd )
	local cmd_output_result = cmd_output:read("*a") or ""
	cmd_output:close()
	return cmd_output_result
end

local is_running = function( process )
	local statusreport = nil
	if (procps.pidof(process)) then
		statusreport = "Yes"
	end
	return statusreport
end

-- ################################################################################
-- PUBLIC FUNCTIONS

getstatus = function (self)
	local status = {}
	local version = get_version()
	status.version = version
	status.enabled = is_running("snort")
	return status
end
function get_filedetails()
	local filedetails = {}
	local path = "/etc/snort/snort.conf"
	filedetails.details = file_info(path)
	filedetails.content = fs.read_file(path)
	return filedetails
end
service_control = function ( self, srvcmd ) 
	local srvcmd = string.lower(srvcmd)
	local retval = ""
	local line = ""
	if (srvcmd == "start") or (srvcmd == "stop") or (srvcmd == "restart") then
		local file = io.popen( "PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin /etc/init.d/snort " .. srvcmd .. " 2>&1" )
		if file ~= nil then
			line = file:read( "*l" )
			while line ~= nil do
				retval = retval .. "\n" .. line
				line = file:read( "*l" )
			end
			file:close()
		end
	else
		retval = "Unknown command!"
	end
	return retval
end

read_alert = function ()
	local alertfile = "/var/log/snort/alert"
	local alertcount = 0
	local alertpriority = {}
	local alertprioritytmp = ""
	local priority = ""
	local classification = ""
	local currid = ""
	local prevrid = ""
	local count = {}
	local liboutput = fs.read_file_as_array(alertfile)
	if (liboutput) then
		for k,v in ipairs(liboutput) do
			--DEBUG
			--if (k == 1) then break end
			currid = string.match(v, "^.*%[%*%*%]%s*%[(%d+:%d+:%d+)%].*")
			if (currid) then
				local priority = string.match(liboutput[k+1],"^.*%[.*lassification:%s*.*%]%s*%[(.*)%]") or "Priority: Unknown"
				local classification = string.match(liboutput[k+1],"^.*%[.*lassification:%s*(.*)%]%s*%[") or "Classification: Unknown"
				if (alertpriority[priority] == nil) then
					alertpriority[priority] = {}
				end
				if (alertpriority[priority][classification] == nil) then
					alertpriority[priority][classification] = {}
				end
				alertpriority[priority][classification][currid] = {}
				if (alertpriority[priority][classification][currid]["value"] == nil) then
					alertpriority[priority][classification][currid]["value"] = {}
				end
				-- COUNTER
				if not (count[priority..classification..currid]) then
					count[priority..classification..currid] = 0
				end
				count[priority..classification..currid] = count[priority..classification..currid] + 1
				alertpriority[priority][classification][currid]["count"] = count[priority..classification..currid]
				for i=0, 10 do
					local rowvalue = liboutput[k+i]
					if (rowvalue == "") then
						break 
					end
					if (rowvalue) then
						table.insert(alertpriority[priority][classification][currid]["value"],rowvalue)
					end
				end
				alertcount = alertcount + 1
			end
		end
	end
	--Start sorting priority-table
	local sorted_table = {}
	for n in pairs(alertpriority) do 
		table.insert(sorted_table, {name=n, value=alertpriority[n]})
	end
	table.sort(sorted_table, function(a,b) return (a.name < b.name) end)

	return alertcount,sorted_table
end