Re: prelude-manager xmlmod report plugin

Well I think this is more a question of an XML doc as opposed to an XML stream.
for example in the financial industry there is a protocol called FIX (
http://www.fixprotocol.org/ ) FIX has an XML incarnation called FIXML
which is used to transmit transaction information over UDP. Yes I know
XML over UDP is a scary concept but due to transaction rate
requirements its a necessary evil and the protocol does specify its
own error detection, retransmit, and message gap detection
capabilities which are implemented at the application level instead of
the TCP stack. When used for streaming over the network the xml
headers are not used, however when the data is written to file for
archival and reporting purposes the standard xml tags along with the
schema version information are included.

libxml2 needs to be usable for processing both full XML files and
streams. the FIX protocol is not the only example of this however it
is a good example, and IDMEF is also a good example of this. By
IDMEF's its nature it implies both file context and a stream context.


On Wed, Jan 28, 2009 at 12:34 PM, raymond durand <[email protected]> wrote:
> Hi Yoann, Hi all,
>
> I just asked to the libxml2 mailing list for this still pending issue.
>
> After having a look at the xmlmod.c file, it seems to me that the
> xmlNodeDumpOutput function appends each xmlNode (1 xmlNode = 1 alert?) into
> the same file (if there is one), am I right?
> If this is the case, may be libxml2 only generates an XML prologue for the
> xmlDoc structure and not for each xmlNode.
> Do you think it could be the origin of the lack of XML prologue for each
> alert using this xmlmod output plugin?
>
> Have you an idea on how to fix it?
>
> Thanks a lot,
> Best regards,
>
> Raymond
>
> 2008/10/7 raymond durand <[email protected]>
>
>>  Hi Yoann,
>>
>> Thanks a lot for your answer.
>>
>> 2008/9/30 Yoann Vandoorselaere <[email protected]>
>>
>>> Hi Raymond,
>>>
>>> Le lundi 22 septembre 2008 à 16:44 +0200, raymond durand a écrit :
>>> > I use the XMLmod report plugin at the prelude-manager level (I use
>>> > prelude-manager 0.9.14.2).
>>> > I have made some tests and I found that the output file did not contain
>>> the
>>> > XML Prologue with XML version and does not contain the xml name space
>>> also.
>>> >
>>> > I would like that the XML file coming from the xmlmod output plugin
>>> begin
>>> > with a prologue specifying the xml version, so I could be fully
>>> compliance
>>> > with RFC 4765:
>>> >
>>> > IDMEF documents being exchanged between IDMEF-compliant applications
>>> >    MUST begin with an XML declaration, and MUST specify the XML version
>>> >
>>> >    in use.
>>> >
>>> > Could you please tell me if it is possible to specify explicitly the XML
>>> > version?
>>> > How?
>>>
>>> This is a libprelude bug, that we can not correct immediately because it
>>> would make some earlier version of Prelude-Manager dump a lot of
>>> assertion.
>>
>>
>> Ok.
>>
>>
>>>
>>>
>>> However, I'll try to commit a workaround to the Prelude-Manager xmlmod
>>> plugin. Could you please try the attached patch in the meantime?
>>>
>>
>>
>> I have just tested the patch which is working well.
>>
>>
>>
>>>
>>>
>>> > Could you also please tell me if it is possible to specify explicitly
>>> the
>>> > name space to have an output file using the idmef name space like this
>>> > (<idmef:) like this extract of an example in RFC 4765
>>> >
>>> >    <*idmef*:IDMEF-Message version="1.0"
>>> >                   xmlns:idmef="http://iana.org/idmef">
>>> >
>>> >      <*idmef*:Alert messageid="abc123456789">
>>> >
>>> > How could I do that?
>>>
>>> Not sure how this could be handled: libxml2 doesn't seem to provide any
>>> helper for this. If you could get in touch with libxml2 developers so
>>> that they provide their insight, it might help!
>>>
>>
>> I feel uncomfortable in contacting them as I do not know very well how
>> libxml2 is used.
>> I wonder if you could contact them or help me asking them?
>>
>>
>>
>>>
>>> Regards,
>>>
>>> --
>>> Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
>>> Tel: +33 (0)9 50 70 21 58                  Fax: +33(0)9 57 25 21 58
>>> http://www.prelude-ids.com
>>>
>>
>>
>> Best regards,
>>
>> Raymond
>>
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user