prelude-correlator/master: [OpenSSHAuth]: Fix reference to Correlated Alert

commit 88d7d04acb73c7d4f4de9fc20f41c0126fa2396e
Author: Yoann Vandoorselaere <[email protected]>
Date:   Fri Jan 15 11:21:14 2010 +0100

    [OpenSSHAuth]: Fix reference to Correlated Alert
    
    Each reference was set twice, and we were creating new reference
    even for already known authentication type.


========================================

 PreludeCorrelator/plugins/opensshauth.py |   11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)

========================================

diff --git a/PreludeCorrelator/plugins/opensshauth.py b/PreludeCorrelator/plugins/opensshauth.py
index f1896af..9a89481 100644
--- a/PreludeCorrelator/plugins/opensshauth.py
+++ b/PreludeCorrelator/plugins/opensshauth.py
@@ -47,10 +47,11 @@ class OpenSSHAuthPlugin(Plugin):
 
         for username in idmef.Get("alert.target(*).user.user_id(*).name"):
             for target in idmef.Get("alert.target(*).node.address(*).address"):
-                ctx = Context("SSH_MAT_" + target + username, { "expire": 30, "alert_on_expire": self.alert }, update = True, idmef=idmef)
-                ctx.addAlertReference(idmef)
-
-                if not hasattr(ctx, "authtype"):
+                ctx = Context("SSH_MAT_" + target + username, { "expire": 30, "alert_on_expire": self.alert }, update=True)
+                if ctx.getUpdateCount() == 0:
                     ctx.authtype = { data: True }
-                else:
+                    ctx.addAlertReference(idmef)
+
+                elif not ctx.authtype.has_key(data):
                     ctx.authtype[data] = True
+                    ctx.addAlertReference(idmef)
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog