Re: prelude-manager xmlmod report plugin

Hi Raymond,

Le lundi 22 septembre 2008 à 16:44 +0200, raymond durand a écrit : 
> I use the XMLmod report plugin at the prelude-manager level (I use
> prelude-manager 0.9.14.2).
> I have made some tests and I found that the output file did not contain the
> XML Prologue with XML version and does not contain the xml name space also.
> 
> I would like that the XML file coming from the xmlmod output plugin begin
> with a prologue specifying the xml version, so I could be fully compliance
> with RFC 4765:
> 
> IDMEF documents being exchanged between IDMEF-compliant applications
>    MUST begin with an XML declaration, and MUST specify the XML version
> 
>    in use.
> 
> Could you please tell me if it is possible to specify explicitly the XML
> version?
> How?

This is a libprelude bug, that we can not correct immediately because it
would make some earlier version of Prelude-Manager dump a lot of
assertion. 

However, I'll try to commit a workaround to the Prelude-Manager xmlmod
plugin. Could you please try the attached patch in the meantime?


> Could you also please tell me if it is possible to specify explicitly the
> name space to have an output file using the idmef name space like this
> (<idmef:) like this extract of an example in RFC 4765
> 
>    <*idmef*:IDMEF-Message version="1.0"
>                   xmlns:idmef="http://iana.org/idmef">
> 
>      <*idmef*:Alert messageid="abc123456789">
> 
> How could I do that?

Not sure how this could be handled: libxml2 doesn't seem to provide any
helper for this. If you could get in touch with libxml2 developers so
that they provide their insight, it might help!

Regards,

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)9 50 70 21 58                  Fax: +33(0)9 57 25 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user

diff --git a/plugins/reports/xmlmod/xmlmod.c b/plugins/reports/xmlmod/xmlmod.c
index 6138d8f..6800ff2 100644
--- a/plugins/reports/xmlmod/xmlmod.c
+++ b/plugins/reports/xmlmod/xmlmod.c
@@ -127,6 +127,20 @@ static void idmef_attr_string(xmlNodePtr node, const char *attr, prelude_string_
 
 
 
+static void idmef_attr_string_or_default(xmlNodePtr node, const char *attr, prelude_string_t *string, const char *defstr)
+{
+        const char *content;
+
+        if ( string )
+                content = prelude_string_get_string_or_default(string, defstr);
+        else
+                content = defstr;
+
+        xmlSetProp(node, (const xmlChar *) attr, (const xmlChar *) (content ? content : ""));
+}
+
+
+
 static void _idmef_attr_enum(xmlNodePtr node, const char *attr, int value, const char *(*convert)(int))
 {
         const char *content = convert(value);
@@ -923,6 +937,8 @@ static int xmlmod_run(prelude_plugin_instance_t *pi, idmef_message_t *message)
                 return -1;
         }
 
+        idmef_attr_string_or_default(root, "version", idmef_message_get_version(message), "1.0");
+
         xmlDocSetRootElement(document, root);
 
         switch ( idmef_message_get_type(message) ) {