def generateConfigFile(self, filename, elements, configFormat, header = None):
"""Generates an arbritary configurationfile, with the name supplied as "filename".
The method iterates trough elements, and hands them one and one to the method
supplied as configFormat. Whatever this method returns is written as one line in
the configfile."""
logger = logging.getLogger(__name__)
logger.info("Starting to generate %s" % filename)
configfile = ConfigFile(os.path.join(self.configlocation, filename))
if(header):
configfile.addLine(header)
for element in elements:
configfile.addLine(configFormat(element))
configfile.close()
self.configfiles.append(filename)
logger.info("Finished generation of %s" % filename)
def generateRuleFiles(self):
"""Iterates trough all the local rulesets, and prints all the rules in them to
corresponding rule-files. It is also in the same time generating sid-msg.map,
which contains all the sid/msg and references."""
logger = logging.getLogger(__name__)
logger.info("Starting to generate rule-files")
sidmsg = ConfigFile(os.path.join(self.configlocation, "sid-msg.map"))
filters = ConfigFile(os.path.join(self.configlocation, "filters.conf"))
suppresses = ConfigFile(os.path.join(self.configlocation, "suppress.conf"))
# Get the rulesets applied to this sensor:
sets = {x.name: x for x in self.sensor.ruleSets.filter(active=True).all()}
# Get the rulesets applied to any parent sensor:
s = self.sensor.parent
while s != None:
sets.update({x.name: x for x in s.ruleSets.filter(active=True).all()})
s = s.parent
# Get all child-rulesets of the rulesets we already have found.
ruleSets = {}
for s in sets:
ruleSets.update({x.name: x for x in sets[s].getChildSets()})
ruleSets[s] = sets[s]
# For every set we found, create a corresponding rules file
for setname in ruleSets:
ruleFile = ConfigFile(os.path.join(self.configlocation, "%s.rules" % setname))
for rule in ruleSets[setname].rules.filter(active=True).all():
rev = rule.getCurrentRevision()
dFilter = getDetectionFilter(self.sensor, rule)
eFilter = getEventFilter(self.sensor, rule)
suppress = getSuppress(self.sensor, rule)
# If the rule have a detectionFilter, inject it into the rule-string:
if(dFilter):
rawFilter = dFilter.getRaw()
raw = output = re.sub(r'(.*)(sid.*\))', r'\1' + rawFilter + r'\2', rev.raw)
ruleFile.addLine(raw)
# Otherwise, just use the raw string.
else:
ruleFile.addLine(rev.raw)
# Add the message to sidmsg.
sidmsg.addLine("%d || %s" % (rule.SID, rev.msg))
# Add an eventual eventFilter
if(eFilter):
filters.addLine(eFilter.getConfigLine())
# Add an detection-filter
if(suppress):
suppresses.addLine(suppress.getConfigLine())
# Close the ruleFile
ruleFile.close()
self.configfiles.append("%s.rules" % setname)
# When all rules are added, close sid-msg.map, and add the file to the configfiles list.
sidmsg.close()
filters.close()
suppresses.close()
self.configfiles.append("sid-msg.map")
self.configfiles.append("filters.conf")
self.configfiles.append("suppress.conf")
