Re: [Prelude Hybrid IDS] #176: Reading IDMEF Messages from the Manager

#176: Reading IDMEF Messages from the Manager
-------------------------------+--------------------------------------------
 Reporter:  [email protected]  |        Owner:  yoann            
     Type:  defect             |       Status:  closed           
 Priority:  normal             |    Milestone:  Libprelude 0.9.11
Component:  libprelude         |      Version:  0.9              
 Severity:  normal             |   Resolution:  invalid          
 Keywords:                     |  
-------------------------------+--------------------------------------------
Changes (by yoann):

  * resolution:  => invalid
  * status:  new => closed

Old description:

> Hello,
>
> I'm writing a small sensor to print IDMEF messages to the screen but I
> was wondering how to go about writing the program to do so.
>
> Here's the code I got so far
> ----------------CODE-------------
> int main(int argc, char **argv) {
>
>         int ret;
>
>         ret = prelude_init(&argc, argv);
>         if ( ret < 0 ) {
>                         prelude_perror(ret, "unable to initialize the
> prelude library");
>                         return -1;
>         }
>
>         prelude_client_t *client;
>
>         ret = prelude_client_new(&client, "AcSP");
>         if ( ! client ) {
>                         prelude_perror(ret, "Unable to create a prelude
> client object");
>                         return -1;
>         }
>
>         ret = prelude_client_start(client);
>         if ( ret < 0 ) {
>                    prelude_perror(ret, "Unable to start prelude client");
>                    return -1;
>         }
>
>         ret = prelude_client_set_flags(client,
> PRELUDE_CLIENT_FLAGS_ASYNC_SEND|PRELUDE_CLIENT_FLAGS_ASYNC_TIMER);
>         if ( ret < 0 ) {
>                    fprintf(stderr, "Unable to set asynchronous send and
> timer.\n");
>                    return -1;
>         }
>
>         prelude_msg_t *pmsg;
>         idmef_message_t *message;
>         prelude_io_t *pio;
>
>     do
>         {
>         sleep(1);
>
>                 ret = prelude_io_new(&pio);
>                 if ( ret < 0 )
>                                 return ret;
>
>                 ret = prelude_msg_new(&pmsg, 10, 32, 1, 0);
>                 if ( ret < 0 )
>                                 return ret;
>
>                 ret = prelude_msg_read(&pmsg, pio);
>                 if ( ret < 0 )
>                                 return ret;
>

>                 ret = idmef_message_new(&message);
>                 if ( ret < 0 )
>                                 return ret;
> /*
>                 ret = idmef_message_read(message, pmsg);
>                 if ( ret < 0 )
>                                 return ret;
> */
>                 prelude_timer_wake_up();
>
>         } while ( ret > 0 );
>
>         prelude_client_destroy(client,
> PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
>
>         return 0;
> }
> -------------------END CODE--------------
>
> But I'm wondering what I'm missing when reading from pio coz after the
> sensor registers I get a Seg Fault.
>
> An example of how to do so would be most welcome!
>
> Thanks in advance,
>
> Samer

New description:

 Hello,

 I'm writing a small sensor to print IDMEF messages to the screen but I was
 wondering how to go about writing the program to do so.

 Here's the code I got so far

 {{{
 int main(int argc, char **argv) {

         int ret;

         ret = prelude_init(&argc, argv);
         if ( ret < 0 ) {
                         prelude_perror(ret, "unable to initialize the
 prelude library");
                         return -1;
         }

         prelude_client_t *client;

         ret = prelude_client_new(&client, "AcSP");
         if ( ! client ) {
                         prelude_perror(ret, "Unable to create a prelude
 client object");
                         return -1;
         }

         ret = prelude_client_start(client);
         if ( ret < 0 ) {
                    prelude_perror(ret, "Unable to start prelude client");
                    return -1;
         }

         ret = prelude_client_set_flags(client,
 PRELUDE_CLIENT_FLAGS_ASYNC_SEND|PRELUDE_CLIENT_FLAGS_ASYNC_TIMER);
         if ( ret < 0 ) {
                    fprintf(stderr, "Unable to set asynchronous send and
 timer.\n");
                    return -1;
         }

         prelude_msg_t *pmsg;
         idmef_message_t *message;
         prelude_io_t *pio;

     do
         {
         sleep(1);

                 ret = prelude_io_new(&pio);
                 if ( ret < 0 )
                                 return ret;

                 ret = prelude_msg_new(&pmsg, 10, 32, 1, 0);
                 if ( ret < 0 )
                                 return ret;

                 ret = prelude_msg_read(&pmsg, pio);
                 if ( ret < 0 )
                                 return ret;


                 ret = idmef_message_new(&message);
                 if ( ret < 0 )
                                 return ret;
 /*
                 ret = idmef_message_read(message, pmsg);
                 if ( ret < 0 )
                                 return ret;
 */
                 prelude_timer_wake_up();

         } while ( ret > 0 );

         prelude_client_destroy(client,
 PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);

         return 0;
 }
 }}}

 But I'm wondering what I'm missing when reading from pio coz after the
 sensor registers I get a Seg Fault.

 An example of how to do so would be most welcome!

 Thanks in advance,

 Samer

Comment:

 Hi,

 Please have a look to the prelude-correlator code, it does exactly what
 you are trying to achieve: https://trac.prelude-ids.org/browser/trunk
 /prelude-correlator/src/prelude-correlator.c

 Using this code, and more specifically the ''poll_manager()'' function,
 you will be able to make your application read forwarded messages from
 Prelude-Manager.

 Note: I'm marking this bug as invalid, since these kind of question really
 belong to the Prelude mailing list.

 Regards,

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/176>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel