prelude-lml/master: Whitespace police
[email protected] Wed, 28 Oct 2009 16:53:21 +0100 (CET)
| Newsgroups | gmane.comp.security.ids.prelude.cvs |
|---|---|
| Message-ID | <[email protected]> |
commit cb66929a9416140abc7c92864755d1e747e8c33d Author: Yoann Vandoorselaere <[email protected]> Date: Wed Oct 28 16:36:46 2009 +0100 Whitespace police ======================================== plugins/pcre/ruleset/netfilter.rules | 46 ++++++++-------- plugins/pcre/ruleset/pcre.rules | 100 +++++++++++++++++----------------- 2 files changed, 73 insertions(+), 73 deletions(-) ======================================== diff --git a/plugins/pcre/ruleset/netfilter.rules b/plugins/pcre/ruleset/netfilter.rules index 72e7215..72af59f 100644 --- a/plugins/pcre/ruleset/netfilter.rules +++ b/plugins/pcre/ruleset/netfilter.rules @@ -2,13 +2,13 @@ # # Copyright (C) 2005 PreludeIDS Technologies. All Rights Reserved. # Author: Yoann Vandoorselaere <[email protected]> -# +# # Based on original implementation from Laurent Oudot, John Green <[email protected]> # # This file is part of the Prelude-LML program. # # This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by +# it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2, or (at your option) # any later version. # @@ -24,41 +24,41 @@ ##### -# Linux Netfilter support for Prelude-LML. +# Linux Netfilter support for Prelude-LML. ## Packet Matching with improved pattern research -# -# Owing to a specific way of writing iptables rules, you can improve -# the pattern matching of prelude-lml in your logs by specifying few things -# like : was the packet dropped or accepted ? -# -# In order to benefit from this improvement, you have to pay attention -# for netfilter rules that you will create. +# +# Owing to a specific way of writing iptables rules, you can improve +# the pattern matching of prelude-lml in your logs by specifying few things +# like : was the packet dropped or accepted ? +# +# In order to benefit from this improvement, you have to pay attention +# for netfilter rules that you will create. # If you want to log packet using the LOG target with iptables, -# just respect this proposition +# just respect this proposition # (that you can change if you master all of that) : # -# If you use a LOG target for a packet that you Accept +# If you use a LOG target for a packet that you Accept # then add a prefix containing the word "Accept" to your rules: # -j LOG --log-prefix "Accept " # -# If you use a LOG target for a packet that you Drop +# If you use a LOG target for a packet that you Drop # then add a prefix containing the word "Drop" to your rules: # -j LOG --log-prefix "Drop " # regex=[Dd][Rr][Oo][Pp].*PROTO=(UDP|TCP|ICMP|AH|ESP); id=1310; \ - classification.text = $1 packet dropped; \ - assessment.impact.completion = failed; \ - assessment.impact.type = other; \ - assessment.impact.severity = medium; chained; silent; + classification.text = $1 packet dropped; \ + assessment.impact.completion = failed; \ + assessment.impact.type = other; \ + assessment.impact.severity = medium; chained; silent; regex=[Aa][Cc][Cc][Ee][Pp][Tt].*PROTO=(UDP|TCP|ICMP|AH|ESP); id=1311; \ - classification.text = $1 packet accepted; \ - assessment.impact.completion = succeeded; \ - assessment.impact.type = other; \ - assessment.impact.severity = low; chained; silent; + classification.text = $1 packet accepted; \ + assessment.impact.completion = succeeded; \ + assessment.impact.type = other; \ + assessment.impact.severity = low; chained; silent; #LOG: Oct 16 11:16:51 blah kernel: Drop IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=1.1.1.1 DST=2.2.2.2 LEN=48 TOS=0x00 PREC=0x00 TTL=113 ID=12776 DF PROTO=TCP SPT=3979 DPT=139 WINDOW=65535 RES=0x00 SYN URGP=0 @@ -139,9 +139,9 @@ optgoto=1310-1311; regex=IN=(\w*) OUT=(\w*)( MAC=)?([\w:]+)? SRC=([\d\.]+) DST=( last -#LOG: Oct 20 17:13:25 blah kernel: Drop IN=ppp0 OUT= MAC= SRC=1.1.1.1 DST=2.2.2.2 LEN=128 TOS=0x00 PREC=0x00 TTL=234 ID=15586 PROTO=ESP SPI=0xa7d839 +#LOG: Oct 20 17:13:25 blah kernel: Drop IN=ppp0 OUT= MAC= SRC=1.1.1.1 DST=2.2.2.2 LEN=128 TOS=0x00 PREC=0x00 TTL=234 ID=15586 PROTO=ESP SPI=0xa7d839 -#LOG: Oct 20 17:13:25 blah kernel: IN=ppp0 OUT= MAC= SRC=1.1.1.1 DST=2.2.2.2 LEN=128 TOS=0x00 PREC=0x00 TTL=234 ID=15586 PROTO=ESP SPI=0xa7d839 +#LOG: Oct 20 17:13:25 blah kernel: IN=ppp0 OUT= MAC= SRC=1.1.1.1 DST=2.2.2.2 LEN=128 TOS=0x00 PREC=0x00 TTL=234 ID=15586 PROTO=ESP SPI=0xa7d839 optgoto=1310-1311; regex=IN=(\w*) OUT=(\w*)( MAC=)?([\w:]+)? SRC=([\d\.]+) DST=([\d\.]+) LEN=(\d+) TOS=(\w+) PREC=(\w+) TTL=(\d+) ID=(\d+) (CE )?(DF )?(MF )?(FRAG:\d+ )?(OPT \(\w+\) )?PROTO=(AH|ESP) (INCOMPLETE \[\d+ bytes\] )?SPI=(\w+); \ classification.text=$17 packet matched; \ diff --git a/plugins/pcre/ruleset/pcre.rules b/plugins/pcre/ruleset/pcre.rules index 646d111..b4b8257 100644 --- a/plugins/pcre/ruleset/pcre.rules +++ b/plugins/pcre/ruleset/pcre.rules @@ -55,68 +55,68 @@ regex=no appropriate format defined for log entry; \ silent; \ last -regex=EMU; include = apc-emu.rules; -regex=(anomaly|since|firstSeen); include = arbor.rules; -regex=arpwatch; include = arpwatch.rules; +regex=EMU; include = apc-emu.rules; +regex=(anomaly|since|firstSeen); include = arbor.rules; +regex=arpwatch; include = arpwatch.rules; regex=chan_sip.c; include = asterisk.rules; -regex=CactiTholdLog; include = cacti-thold.rules; -regex=product:; include = checkpoint.rules; -regex=%\S+-\d+-\S+; include = cisco-asa.rules; \ - include = cisco-common.rules; \ - include = cisco-router.rules; -regex=(IPV4|SSHD|NETMAN)-\d+; include = cisco-css.rules; -regex=snmptrapd; include = cisco-ips.rules; -regex=SEV=; include = cisco-vpn.rules; +regex=CactiTholdLog; include = cacti-thold.rules; +regex=product:; include = checkpoint.rules; +regex=%\S+-\d+-\S+; include = cisco-asa.rules; \ + include = cisco-common.rules; \ + include = cisco-router.rules; +regex=(IPV4|SSHD|NETMAN)-\d+; include = cisco-css.rules; +regex=snmptrapd; include = cisco-ips.rules; +regex=SEV=; include = cisco-vpn.rules; # Using this regex rather than simpler clamd to handle events from clamav # logging format -regex=(FOUND|virus); include = clamav.rules; -regex=server administrator; include = dell-om.rules -regex=(kernel|grsec); include = grsecurity.rules; +regex=(FOUND|virus); include = clamav.rules; +regex=server administrator; include = dell-om.rules +regex=(kernel|grsec); include = grsecurity.rules; regex=(bigconf|kernel); include = f5-bigip.rules; -regex=(honeyd|icmp|tcp|udp); include = honeyd.rules; -regex=\[([0-9-]+) ([0-9:]+)\]; include = honeytrap.rules -regex=\[(SSHChannel|SSHService); include = kojoney.rules +regex=(honeyd|icmp|tcp|udp); include = honeyd.rules; +regex=\[([0-9-]+) ([0-9:]+)\]; include = honeytrap.rules +regex=\[(SSHChannel|SSHService); include = kojoney.rules # Using this somewhat complex regex instead of the simpler httpd due to the # fact that we might be directly monitoring httpd logs instead of httpd syslog # entries (in which case we won't have the process name to match against) -regex=(\[error\]|Pass|httpd); include = httpd.rules; \ - include = modsecurity.rules; +regex=(\[error\]|Pass|httpd); include = httpd.rules; \ + include = modsecurity.rules; regex=kernel; include = ipchains.rules; \ include = netfilter.rules; \ - include = bonding.rules; -regex=ipfw; include = ipfw.rules; -regex=[Ww]ireless; include = linksys-wap11.rules; -regex=clussvc; include = ms-cluster.rules; -regex=mssql; include = ms-sql.rules; -regex=nagios; include = nagios.rules; -regex=norton; include = navce.rules; -regex=\[[^:]*:[^\]]*\]:; include = netapp-ontap.rules; -regex=system-(emergency|alert)-; include = netscreen.rules; -regex=security\[; include = ntsyslog.rules; -regex=[Pp][Aa][Mm]_; include = pam.rules; -regex=[Ss][Uu]:; include = su.rules; -regex=pcanywhere; include = pcanywhere.rules; -regex=portsentry; include = portsentry.rules; -regex=postfix/; include = postfix.rules; -regex=proftpd; include = proftpd.rules; -regex=popper; include = qpopper.rules; -regex=(ppp|pptpd); include = ppp.rules; -regex=INFO\s+srcIP; include = rishi.rules; -regex=avc:; include = selinux.rules; -regex=sendmail; include = sendmail.rules; -regex=(user|group)(mod|add); include = shadow-utils.rules; + include = bonding.rules; +regex=ipfw; include = ipfw.rules; +regex=[Ww]ireless; include = linksys-wap11.rules; +regex=clussvc; include = ms-cluster.rules; +regex=mssql; include = ms-sql.rules; +regex=nagios; include = nagios.rules; +regex=norton; include = navce.rules; +regex=\[[^:]*:[^\]]*\]:; include = netapp-ontap.rules; +regex=system-(emergency|alert)-; include = netscreen.rules; +regex=security\[; include = ntsyslog.rules; +regex=[Pp][Aa][Mm]_; include = pam.rules; +regex=[Ss][Uu]:; include = su.rules; +regex=pcanywhere; include = pcanywhere.rules; +regex=portsentry; include = portsentry.rules; +regex=postfix/; include = postfix.rules; +regex=proftpd; include = proftpd.rules; +regex=popper; include = qpopper.rules; +regex=(ppp|pptpd); include = ppp.rules; +regex=INFO\s+srcIP; include = rishi.rules; +regex=avc:; include = selinux.rules; +regex=sendmail; include = sendmail.rules; +regex=(user|group)(mod|add); include = shadow-utils.rules; regex=id=firewall; include = sonicwall.rules; regex=spamd; include = spamassassin.rules; # More complex regex to handle data coming directly from Squid log files -regex=(Acceptin|Squid|Disabled|DENIED); include = squid.rules; -regex=sshd; include = ssh.rules; -regex=sudo; include = sudo.rules; -regex=suhosin; include = suhosin.rules; -regex=tripwire; include = tripwire.rules; -regex=[wl]an @Group:; include = vigor.rules; -regex=vpopmail; include = vpopmail.rules; -regex=webmin; include = webmin.rules; -regex=ftpd; include = wu-ftp.rules; +regex=(Acceptin|Squid|Disabled|DENIED); include = squid.rules; +regex=sshd; include = ssh.rules; +regex=sudo; include = sudo.rules; +regex=suhosin; include = suhosin.rules; +regex=tripwire; include = tripwire.rules; +regex=[wl]an @Group:; include = vigor.rules; +regex=vpopmail; include = vpopmail.rules; +regex=webmin; include = webmin.rules; +regex=ftpd; include = wu-ftp.rules; # Openhostapd.rules doesn't have specific stuff we can match: regex=(removed node|\(rate:\s(\d+)\/(\d+)\ssec\)|sent ADD notification|attached Host AP interface); include = openhostapd.rules; _______________________________________________ Prelude-cvslog site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog