Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add some ifdefs for the md5 whitelist database. #1364

Merged
merged 2 commits into from
Mar 7, 2018
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion src/Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ ifdef DEBUGAD
endif

OSSEC_CFLAGS=${CFLAGS}
ANALYSISD_FLAGS="-lsqlite3"
#ANALYSISD_FLAGS="-lsqlite3"

ifdef DEBUG
OSSEC_CFLAGS+=-g
Expand Down Expand Up @@ -209,6 +209,10 @@ ifneq (,$(filter ${USE_GEOIP},auto yes y Y 1))
OSSEC_LDFLAGS+=-lGeoIP
endif # USE_GEOIP

ifneq (,$(filter ${USE_SQLITE},auto yes y Y 1))
DEFINES+=-DSQLITE_ENABLED
ANALYSISD_FLAGS="-lsqlite3"
endif # USE_SQLITE

MI :=
PI :=
Expand Down Expand Up @@ -558,6 +562,7 @@ settings:
@echo " USE_PRELUDE: ${USE_PRELUDE}"
@echo " USE_OPENSSL: ${USE_OPENSSL}"
@echo " USE_INOTIFY: ${USE_INOTIFY}"
@echo " USE_SQLITE: ${USE_SQLITE}"
@echo "Mysql settings:"
@echo " includes: ${MI}"
@echo " libs: ${ML}"
Expand Down
4 changes: 4 additions & 0 deletions src/analysisd/analysisd.c
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,9 @@
#include "output/zeromq.h"
#endif

#ifdef SQLITE_ENABLED
#include "syscheck-sqlite.h"
#endif

/** Prototypes **/
void OS_ReadMSG(int m_queue);
Expand Down Expand Up @@ -656,6 +658,7 @@ void OS_ReadMSG_analysisd(int m_queue)
Free_Eventinfo(lf);
}

#ifdef SQLITE_ENABLED
/* Open the sqlite db */
extern sqlite3 *conn;
int s_error = 0;
Expand All @@ -666,6 +669,7 @@ void OS_ReadMSG_analysisd(int m_queue)
}

}
#endif

debug1("%s: DEBUG: Startup completed. Waiting for new messages..", ARGV0);

Expand Down
7 changes: 6 additions & 1 deletion src/analysisd/decoders/syscheck.c
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,9 @@
#include "alerts/alerts.h"
#include "decoder.h"

//#include <sqlite3.h>
#ifdef SQLITE_ENABLED
#include "syscheck-sqlite.h"
#endif

typedef struct __sdb {
char buf[OS_MAXSTR + 1];
Expand Down Expand Up @@ -622,7 +623,9 @@ int DecodeSyscheck(Eventinfo *lf)

char *p;
char stmt[OS_MAXSTR + 1];
#ifdef SQLITE_ENABLED
sqlite3_stmt *res;
#endif
int error = 0;
int rec_count = 0;
const char *tail;
Expand Down Expand Up @@ -678,6 +681,7 @@ int DecodeSyscheck(Eventinfo *lf)
* Sample message:
* 0:0:0:0:78f5c869675b1d09ddad870adad073f9:bd6c8d7a58b462aac86475e59af0e22954039c50
*/
#ifdef SQLITE_ENABLED
if (Config.md5_whitelist) {
extern sqlite3 *conn;
if ((p = extract_token(c_sum, ":", 4))) {
Expand All @@ -702,6 +706,7 @@ int DecodeSyscheck(Eventinfo *lf)
sqlite3_finalize(res);
}
}
#endif


/* Search for file changes */
Expand Down
3 changes: 2 additions & 1 deletion src/analysisd/syscheck-sqlite.h
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#ifdef SQLITE_ENABLED
#include <sqlite3.h>

sqlite3 *conn;

#endif
5 changes: 5 additions & 0 deletions src/config/global-config.c
Original file line number Diff line number Diff line change
Expand Up @@ -126,8 +126,10 @@ int Read_Global(XML_NODE node, void *configp, void *mailp)
const char *xml_geoip6_db_path = "geoip6_db_path";
#endif

#ifdef SQLITE_ENABLED
/* MD5 DB */
char *xml_md5_whitelist = "md5_whitelist";
#endif

_Config *Config;
MailConfig *Mail;
Expand Down Expand Up @@ -493,12 +495,15 @@ int Read_Global(XML_NODE node, void *configp, void *mailp)
}
}
#endif

#ifdef SQLITE_ENABLED
/* MD5 DB */
else if(strcmp(node[i]->element, xml_md5_whitelist) == 0) {
if(Config) {
os_strdup(node[i]->content, Config->md5_whitelist);
}
}
#endif

else {
merror(XML_INVELEM, __local_name, node[i]->element);
Expand Down