File ossec-hids-journal_reader.patch of Package ossec-hids

Overview Repositories Revisions Requests Users Attributes Meta

File ossec-hids-journal_reader.patch of Package ossec-hids (Revision 353d960e624d916f604d07c59bce73a9)

Currently displaying revision 353d960e624d916f604d07c59bce73a9 , Show latest

diff -urN ossec-hids-3.3.0/etc/ossec.conf ossec-hids-3.3.0-patch/etc/ossec.conf
--- ossec-hids-3.3.0/etc/ossec.conf	2019-04-19 19:44:09.000000000 +0300
+++ ossec-hids-3.3.0-patch/etc/ossec.conf	2020-04-02 13:28:57.128784475 +0300
@@ -125,6 +125,25 @@
     <timeout>600</timeout>    
   </active-response>  
 
+  
+
+  
+
   
 
   <localfile>
diff -urN ossec-hids-3.3.0/src/config/localfile-config.c ossec-hids-3.3.0-patch/src/config/localfile-config.c
--- ossec-hids-3.3.0/src/config/localfile-config.c	2019-04-19 19:44:09.000000000 +0300
+++ ossec-hids-3.3.0-patch/src/config/localfile-config.c	2020-04-02 13:29:43.124839528 +0300
@@ -279,6 +279,7 @@
             } else if (strcmp(logf[pl].logformat, "command") == 0) {
             } else if (strcmp(logf[pl].logformat, "full_command") == 0) {
             } else if (strcmp(logf[pl].logformat, "audit") == 0) {
+            } else if (strcmp(logf[pl].logformat, "journald") == 0) {
             } else if (strncmp(logf[pl].logformat, "multi-line", 10) == 0) {
                 int x = 0;
                 logf[pl].logformat += 10;
diff -urN ossec-hids-3.3.0/src/config/localfile-config.h ossec-hids-3.3.0-patch/src/config/localfile-config.h
--- ossec-hids-3.3.0/src/config/localfile-config.h	2019-04-19 19:44:09.000000000 +0300
+++ ossec-hids-3.3.0-patch/src/config/localfile-config.h	2020-04-02 13:28:57.132784479 +0300
@@ -45,6 +45,7 @@
 
     void *(*read)(int i, int *rc, int drop_it);
 
+    void *ptr;
     FILE *fp;
 } logreader;
 
diff -urN ossec-hids-3.3.0/src/error_messages/error_messages.h ossec-hids-3.3.0-patch/src/error_messages/error_messages.h
--- ossec-hids-3.3.0/src/error_messages/error_messages.h	2019-04-19 19:44:09.000000000 +0300
+++ ossec-hids-3.3.0-patch/src/error_messages/error_messages.h	2020-04-02 13:28:57.132784479 +0300
@@ -174,6 +174,7 @@
 #define PARSE_ERROR     "%s(1906): ERROR: Error parsing file: '%s'."
 #define READING_FILE    "%s(1950): INFO: Analyzing file: '%s'."
 #define READING_EVTLOG  "%s(1951): INFO: Analyzing event log: '%s'."
+#define READING_JOURNAL "%s(1951): INFO: Analyzing journald log: '%s'."
 #define VAR_LOG_MON     "%s(1952): INFO: Monitoring variable log file: '%s'."
 #define INV_MULTILOG    "%s(1953): ERROR: Invalid DJB multilog file: '%s'."
 
diff -urN ossec-hids-3.3.0/src/logcollector/logcollector.c ossec-hids-3.3.0-patch/src/logcollector/logcollector.c
--- ossec-hids-3.3.0/src/logcollector/logcollector.c	2019-04-19 19:44:09.000000000 +0300
+++ ossec-hids-3.3.0-patch/src/logcollector/logcollector.c	2020-04-02 13:28:57.136784484 +0300
@@ -80,6 +80,7 @@
                 logff[i].file = NULL;
                 logff[i].command = NULL;
                 logff[i].fp = NULL;
+                logff[i].ptr = NULL;
 
                 break;
             }
@@ -99,6 +100,7 @@
             logff[i].file = NULL;
             logff[i].command = NULL;
             logff[i].fp = NULL;
+            logff[i].ptr = NULL;
         }
 
         else if (strcmp(logff[i].logformat, "eventchannel") == 0) {
@@ -116,11 +118,13 @@
             logff[i].file = NULL;
             logff[i].command = NULL;
             logff[i].fp = NULL;
+            logff[i].ptr = NULL;
         }
 
         else if (strcmp(logff[i].logformat, "command") == 0) {
             logff[i].file = NULL;
             logff[i].fp = NULL;
+            logff[i].ptr = NULL;
             logff[i].size = 0;
 
             if (logff[i].command) {
@@ -138,6 +142,7 @@
         } else if (strcmp(logff[i].logformat, "full_command") == 0) {
             logff[i].file = NULL;
             logff[i].fp = NULL;
+            logff[i].ptr = NULL;
             logff[i].size = 0;
             if (logff[i].command) {
                 logff[i].read = read_fullcommand;
@@ -152,6 +157,17 @@
                        ARGV0);
             }
         }
+        else if (strcmp(logff[i].logformat, "journald") == 0) {
+#ifdef HAVE_SYSTEMD
+            verbose(READING_JOURNAL, ARGV0, logff[i].file);
+            logff[i].read = sd_read_journal;
+#else
+            merror("%s: WARN: journald not available on this version of OSSEC", ARGV0);
+#endif
+            logff[i].command = NULL;
+            logff[i].fp = NULL;
+            logff[i].ptr = NULL;
+        }
 
         else {
             logff[i].command = NULL;
@@ -195,6 +211,7 @@
                     if (logff[i].fp) {
                         fclose(logff[i].fp);
                         logff[i].fp = NULL;
+                        logff[i].ptr = NULL;
                     }
                     logff[i].file = NULL;
                 }
@@ -270,7 +287,7 @@
         for (i = 0; i <= max_file; i++) {
             if (!logff[i].fp) {
                 /* Run the command */
-                if (logff[i].command && (f_check % 2)) {
+                if ((logff[i].command || !strncmp(logff[i].logformat, "journald", 7)) && (f_check % 2)) {
                     curr_time = time(0);
                     if ((curr_time - logff[i].size) >= logff[i].ign) {
                         logff[i].size = curr_time;
diff -urN ossec-hids-3.3.0/src/logcollector/logcollector.h ossec-hids-3.3.0-patch/src/logcollector/logcollector.h
--- ossec-hids-3.3.0/src/logcollector/logcollector.h	2019-04-19 19:44:09.000000000 +0300
+++ ossec-hids-3.3.0-patch/src/logcollector/logcollector.h	2020-04-02 13:28:57.136784484 +0300
@@ -73,6 +73,11 @@
 void win_format_event_string(char *string);
 #endif
 
+#ifdef HAVE_SYSTEMD
+/* Read systemd entries */
+void *sd_read_journal(int pos, int *rc, int drop_it);
+#endif
+
 /*** Global variables ***/
 extern int loop_timeout;
 extern int logr_queue;
diff -urN ossec-hids-3.3.0/src/logcollector/read_journald.c ossec-hids-3.3.0-patch/src/logcollector/read_journald.c
--- ossec-hids-3.3.0/src/logcollector/read_journald.c	1970-01-01 02:00:00.000000000 +0200
+++ ossec-hids-3.3.0-patch/src/logcollector/read_journald.c	2020-04-02 13:28:57.136784484 +0300
@@ -0,0 +1,132 @@
+#ifdef HAVE_SYSTEMD
+#include "shared.h"
+#include "logcollector.h"
+#include <systemd/sd-journal.h>
+
+void *prime_sd_journal(int pos) {
+  int ret;
+  sd_journal *jrn;
+  ret = sd_journal_open(&jrn, SD_JOURNAL_LOCAL_ONLY);
+  if (ret < 0) {
+    merror("%s: ERROR: Unable to open journal", ARGV0);
+    return NULL;
+  }
+  // For future use
+  logff[pos].fd = sd_journal_get_fd(jrn);
+  if (ret < 0) {
+    merror("%s: ERROR: Unable to get journal fd", ARGV0);
+    return NULL;
+  }
+  ret = sd_journal_seek_tail(jrn);
+  if (ret < 0) {
+    merror("%s: ERROR: Unable to seek journal tail", ARGV0);
+    return NULL;
+  }
+  // prime sd_journal_next before the reader loop
+  ret = sd_journal_previous(jrn);
+  if (ret < 0) {
+    merror("%s: ERROR: Unable to seek journal previous", ARGV0);
+  }
+  return (void *)jrn;
+}
+
+void *sd_read_journal(int pos, int *rc, int drop_it) {
+  sd_journal *jrn = (sd_journal *) logff[pos].ptr;
+  char *unit = logff[pos].file;
+  int ret;
+  const char *jmsg = NULL, *jsrc = NULL, *jhst = NULL;
+  size_t len;
+  struct timeval tv;
+  uint64_t curr_timestamp;
+  time_t nowtime;
+  struct tm *nowtm;
+  char tmbuf[64], final_msg[OS_MAXSTR], sunitid[128];
+  *rc = 0;
+
+  if (jrn == NULL) {
+     jrn = logff[pos].ptr = prime_sd_journal(pos);
+     if (jrn == NULL) {
+        merror("%s: ERROR: Unable to prime journal", ARGV0);
+        return NULL;
+     }
+  }
+
+  if (unit == NULL) {
+      unit = logff[pos].file = "all";
+  }
+
+  // Anything negative is an error
+  while (ret > 0) {
+      ret = sd_journal_next(jrn);
+      // below 0 Means problem or journal file vanished. Open it again next time and
+      // try again
+      // 0 means there is no new messages
+      if (ret < 0) {
+         sd_journal_close(jrn);
+         logff[pos].ptr = NULL;
+         *rc = -1;
+         continue;
+      } else if (!ret) {
+         continue;
+      }
+      // Check if data is coming from the unit starting with our passed selector
+      ret = sd_journal_get_data(
+        jrn,
+        "SYSLOG_IDENTIFIER",
+        (const void **)&jsrc,
+        &len
+      );
+      // Strip off "SYSLOG_IDENTIFIER=" prefix for unit comparison inline
+      memset(sunitid, 0x00, 128);
+      strncpy(sunitid, (jsrc + 18), 128);
+      // If incoming systemd unit is unit or unit is 'all' which means log everything
+      // or unit starts which char '/' which means unit is directory and
+      // user have malconfigured journald
+      if (!strncmp(sunitid, unit, 128) || !strncmp(unit, "all", 3) || unit[0] == '/') {
+        // Read hostname
+        ret = sd_journal_get_data(jrn, "_HOSTNAME", (const void **)&jhst, &len);
+        // Read data
+        ret = sd_journal_get_data(jrn, "MESSAGE", (const void **)&jmsg, &len);
+        // Read timestamp and format it
+        ret = sd_journal_get_realtime_usec(jrn, &curr_timestamp);
+        tv.tv_sec  = curr_timestamp / 1000000;
+        tv.tv_usec = curr_timestamp % 1000000;
+        nowtime = tv.tv_sec;
+        nowtm = localtime(&nowtime);
+        // We have to mimic syslog-ng for time and date for OSSEC-HIDS
+        // time and date parser.
+        // Syslog-ng It produces broken ISO8601 strings like
+        // 2020-04-01T12:00:00+03:00
+        // Journald reader triest to mimics it.
+        strftime(tmbuf, sizeof tmbuf, "%Y-%m-%dT%T%z", nowtm);
+        tmbuf[strlen(tmbuf) - 2] = '\0';
+        // Build and send message
+        snprintf(
+          final_msg,
+          sizeof(final_msg),
+          "%s:00 %s %s: %.*s\n",
+          tmbuf,
+          // Strip the "_HOSTNAME", "SYSLOG_IDENTIFIER=" and "MESSAGE=" prefixes
+          (char *)(jhst + 10),
+          sunitid,
+          (int) len,
+          (char *)(jmsg + 8)
+        );
+        if (SendMSG(logr_queue, final_msg, "journald", LOCALFILE_MQ) < 0) {
+            merror(QUEUE_SEND, ARGV0);
+        }
+        // These pointers are only valid until next one
+        // So it's safe to just to NULL them
+        jhst = NULL;
+        jmsg = NULL;
+    }
+    // This pointer is only valid until next one
+    // So it's safe to just to NULL them
+    jsrc = NULL;
+    // Prime next iteration condition & journal position
+    ret = sd_journal_next(jrn);
+  }
+  return NULL;
+}
+
+#endif //HAVE_SYSTEMD
diff -urN ossec-hids-3.3.0/src/Makefile ossec-hids-3.3.0-patch/src/Makefile
--- ossec-hids-3.3.0/src/Makefile	2019-04-19 19:44:09.000000000 +0300
+++ ossec-hids-3.3.0-patch/src/Makefile	2020-04-02 13:28:57.132784479 +0300
@@ -30,6 +30,7 @@
 USE_GEOIP?=no
 USE_INOTIFY=no
 USE_PCRE2_JIT=yes
+USE_SYSTEMD?=yes
 
 ifneq (${TARGET},winagent)
 	USE_OPENSSL?=auto
@@ -65,8 +66,12 @@
 ifneq (${TARGET},winagent)
 ifeq (${uname_S},Linux)
 		DEFINES+=-DINOTIFY_ENABLED
-#		DEFINES+=-DUSE_MAGIC
 		OSSEC_LDFLAGS+=-lpthread
+ifeq (${USE_SYSTEMD},yes)
+		DEFINES+=-DHAVE_SYSTEMD
+		OSSEC_LDFLAGS+=-lsystemd
+endif
+#		DEFINES+=-DUSE_MAGIC
 #		OSSEC_LDFLAGS+=-lmagic
 else
 ifeq (${uname_S},AIX)
@@ -595,6 +600,7 @@
 	@echo "    USE_INOTIFY:      ${USE_INOTIFY}"
 	@echo "    USE_SQLITE:       ${USE_SQLITE}"
 	@echo "    USE_PCRE2_JIT:    ${USE_PCRE2_JIT}"
+	@echo "    USE_SYSTEMD:      ${USE_SYSTEMD}"
 	@echo "Mysql settings:"
 	@echo "    includes:         ${MI}"
 	@echo "    libs:             ${ML}"

Places

File ossec-hids-journal_reader.patch of Package ossec-hids (Revision 353d960e624d916f604d07c59bce73a9)

Places