prelude-correlator/master: [FirewallPlugin]: ability to queue multiples events

commit 39afc4f0c32251b3a2d44b8635d65de0f41d5080
Author: Yoann Vandoorselaere <[email protected]>
Date:   Fri Jan 15 11:25:10 2010 +0100

    [FirewallPlugin]: ability to queue multiples events
    
    The plugin can now report 'non firewall block' for multiples events
    at a time.


========================================

 PreludeCorrelator/plugins/firewall.py |   17 +++++++++--------
 1 files changed, 9 insertions(+), 8 deletions(-)

========================================

diff --git a/PreludeCorrelator/plugins/firewall.py b/PreludeCorrelator/plugins/firewall.py
index af7438e..5c360aa 100644
--- a/PreludeCorrelator/plugins/firewall.py
+++ b/PreludeCorrelator/plugins/firewall.py
@@ -24,25 +24,26 @@ from PreludeCorrelator.pluginmanager import Plugin
 class FirewallPlugin(Plugin):
     def run(self, idmef):
         source = idmef.Get("alert.source(0).node.address(0).address")
-        sport = idmef.Get("alert.source(0).service.port", 0)
         target = idmef.Get("alert.target(0).node.address(0).address")
         dport = idmef.Get("alert.target(0).service.port", 0)
 
         if not source or not target:
                 return
 
-        ctxname = "FIREWALL_" + source + str(sport) + target + str(dport)
+        ctxname = "FIREWALL_" + source + target + str(dport)
 
         if idmef.match("alert.classification.text", re.compile("[Pp]acket [Dd]ropped|[Dd]enied")):
-                # Update context if any, removing the alert_on_expire attribute.
-                ctx = context.Context(ctxname, { "expire": 10 }, update = True)
+                # overwrite any existing context, with the same name.
+                ctx = context.Context(ctxname, { "expire": 10 }, update=True)
+                ctx.block_installed = True
         else:
                 # Begins a timer for every event that contains a source and a target
                 # address which has not been matched by an observed packet denial.  If a packet
                 # denial is not observed in the next 10 seconds, an event alert is generated.
-
-                if not context.search(ctxname):
-                        ctx = context.Context(ctxname, { "expire": 10, "alert_on_expire": True }, idmef=idmef)
+                ctx = context.search(ctxname)
+                if not ctx or ctx.block_installed == False:
+                        ctx = context.Context(ctxname, { "expire": 10, "alert_on_expire": True }, idmef=idmef, update=True)
                         ctx.Set("alert.assessment", idmef.Get("alert.assessment"))
                         ctx.Set("alert.classification", idmef.Get("alert.classification"))
-                        ctx.Set("alert.correlation_alert.name", "Events to firewall correlation")
+                        ctx.Set("alert.correlation_alert.name", "No firewall block observed for these events")
+                        ctx.block_installed = False
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog