OSSEC an open source HIDS --- LogCollector

这些天仔细分析了OSSEC日志收集(LogCollector)部分的细节。

       OSSEC-LogCollector是创建一个无限循环，类似一个监听日志的守护进程，只要监听到日志有变动，就用SOCEKT发送消息给日志分析(analysisd)的守护进程，然后进行解码、匹配等操作。

      

下面先讲OSSEC是如何读取日志的。以读取WINDOWS XP下的事件日志为例。

读取事件日志主要是用到了Windows.h中的几个API：

OpenEventLog,CloseEventLog,ReadEventLog,GetLastError,等。

代码在最下面，我先说明一下每个函数的作用。

int StartEL(char *app, HIDSEL *el) 

打开日志，返回该日志的数目。

char *GetELCategory(int categoryID)

根据类型ID获取日志类型。

char *GetEventDLL(char *evt_name, char *source, char *evt) 

从注册表获取日志的名称。

char *GetELMsg(EVENTLOGRECORD *er,  char *name,  char * source, LPTSTR *elSStr) 

获取该条日志的描述信息。

void ReadEL(HIDSEL *el, int printit)

读取事件日志。注，若只需要读取一次日志，printit设为1即可。OSSEC设置此参数的做法，我想是要忽略已有的日志，只对新产生的日志做处理。

#include "stdio.h"
#include "windows.h"

#define BUFFER_SIZE 2048*256
#define HIDS_MAXSTR 6144
#define HIDS_FLSIZE 256
#define HIDS_LOG_HEADER 256

/*Event logging local structure*/
typedef struct _HIDSEL
{
	int timeOfLast;
	char *name;
	
	EVENTLOGRECORD *er;
	HANDLE h;
	DWORD record;
}HIDSEL;

/*
 *Starts the event logging for each el
 */
int StartEL(char *app, HIDSEL *el)
{
	DWORD recordNum = 0;

	/*Opening the event log*/
	el->h = OpenEventLog(NULL,app);
	if(!el->h)
	{
		printf("HIDS-LogCollecotor ERROR: Uable to open the event log : %s.", app); 
		return (-1);
	}
	
	el->name = app;
	
	if(GetOldestEventLogRecord(el->h, &el->record) == 0)
	{
		/*Unable to read oldest event log record*/
		printf("HIDS-LogCollecotor ERROR: Uable to query last event log from: %s.", app); 
		CloseEventLog(el->h);
		el->h = NULL;
		return(-1);
	}
	
	if(GetNumberOfEventLogRecords(el->h, &recordNum) == 0)
	{		 
		printf("HIDS-LogCollecotor ERROR: Uable to get the number of event logs from: %s.", app); 
		CloseEventLog(el->h);
		el->h = NULL;
		return(-1);
	}
	
	if(recordNum <= 0)
	{
		return 0;
	}
	
	return (int)recordNum;
}

/* 
 * Returns a string related to the category id of the log.
 */
char *GetELCategory(int categoryID)
{
    char *cat;
    switch(categoryID)
    {
        case EVENTLOG_ERROR_TYPE:
            cat = "ERROR";
            break;
        case EVENTLOG_WARNING_TYPE:
            cat = "WARNING";
            break;
        case EVENTLOG_INFORMATION_TYPE:
            cat = "INFORMATION";
            break;
        case EVENTLOG_AUDIT_SUCCESS:
            cat = "AUDIT_SUCCESS";
            break;
        case EVENTLOG_AUDIT_FAILURE:
            cat = "AUDIT_FAILURE";
            break;
        default:
            cat = "Unknown";
            break;
    }
    return	cat;
}


/**
 * Returns the event.
 */
char *GetEventDLL(char *evt_name, char *source, char *evt) 
{
    //char *retStr;
    HKEY key;
    DWORD ret;
    char keyName[512];


    keyName[511] = '\0';

    _snprintf(keyName, 510, 
            "System\\CurrentControlSet\\Services\\EventLog\\%s\\%s", 
            evt_name, 
            source);


    /* Checking if we have it in memory. */
    
    //retStr = OSHash_Get(dll_hash, keyName + 42);
    //if(retStr)
    //{
    //    return(retStr);
    //}
    
    /* Opening registry */	    
    if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, keyName, 0, 
                    KEY_ALL_ACCESS, &key) != ERROR_SUCCESS)
    {
        return(NULL);    
    }


    ret = MAX_PATH -1;	
    if (RegQueryValueEx(key, "EventMessageFile", NULL, 
                NULL, (LPBYTE)evt, &ret) != ERROR_SUCCESS)
    {
        evt[0] = '\0';	
        RegCloseKey(key);
        return(NULL);
    }
    else
    {
        /* Adding to memory. */
        char *skey;
        char *sval;

        skey = strdup(keyName + 42);
        sval = strdup(evt);
        
        if(skey && sval)
        {
            //OSHash_Add(dll_hash, skey, sval); 
        }
        else
        {
            printf("Log Collector: ERROR: Not enough Memory. Exiting.");
        }
    }
    
    RegCloseKey(key);
    return(evt);
}


/**
 * Returns a descriptive message of the event.
 */
char *GetELMsg(EVENTLOGRECORD *er,  char *name, 
		    char * source, LPTSTR *elSStr) 
{
    DWORD fmFlags = 0;
    char strTmp[257];
    char event[MAX_PATH +1];
    char *curr_str;
    char *next_str;
    LPSTR message = NULL;

    HMODULE hevt;

    /* Initializing variables */
    event[MAX_PATH] = '\0';
    strTmp[256] = '\0';


    /* Flags for format event */
    fmFlags |= FORMAT_MESSAGE_FROM_HMODULE;
    fmFlags |= FORMAT_MESSAGE_ALLOCATE_BUFFER;
    fmFlags |= FORMAT_MESSAGE_ARGUMENT_ARRAY;



    /* Get the file name from the registry (stored on event) */
    if(!(curr_str = GetEventDLL(name, source, event)))
    {
        return(NULL);	    
    }	    



    /* If our event has multiple libraries, try each one of them */ 
    while((next_str = strchr(curr_str, ';')))
    {
        *next_str = '\0';

        ExpandEnvironmentStrings(curr_str, strTmp, 255);

        /* Reverting back old value. */
        *next_str = ';';
        

        /* Loading library. */
        hevt = LoadLibraryEx(strTmp, NULL, 
                             DONT_RESOLVE_DLL_REFERENCES |
                             LOAD_LIBRARY_AS_DATAFILE);
        if(hevt)
        {
            if(!FormatMessage(fmFlags, hevt, er->EventID, 0,
                              (LPTSTR) &message, 0, elSStr))
            {
                message = NULL;		  
            }
            FreeLibrary(hevt);

            /* If we have a message, we can return it */
            if(message)
                return(message);
        }


        curr_str = next_str +1;
    }

    
    /* Getting last value. */
    ExpandEnvironmentStrings(curr_str, strTmp, 255);
    hevt = LoadLibraryEx(strTmp, NULL, 
                         DONT_RESOLVE_DLL_REFERENCES |
                         LOAD_LIBRARY_AS_DATAFILE);
    if(hevt)
    {
        int hr;    
        if(!(hr = FormatMessage(fmFlags, hevt, er->EventID, 
                        0,
                        (LPTSTR) &message, 0, elSStr)))
        {
            message = NULL;		  
        }
        FreeLibrary(hevt);

        /* If we have a message, we can return it */
        if(message)
            return(message);
    }

    return(NULL);
}


/*
 *Reads the event log.
 */
void ReadEL(HIDSEL *el, int printit)
{
	DWORD _evtid = 65535;
    DWORD nstr;
    DWORD usrSize;
    DWORD domainSize;
    DWORD read, needed;
    int sizeLeft;
    int strSize;
    int id;

    char mbuffer[BUFFER_SIZE +1];
    LPSTR sstr = NULL;

    char *strTmp = NULL;
    char *category;
    char *source;
    char *computerName;
    char *descriptiveMsg;

    char elUsr[HIDS_FLSIZE +1];
    char elDomain[HIDS_FLSIZE +1];
    char elStr[HIDS_MAXSTR +1];
    char finalMsg[HIDS_MAXSTR +1];
    LPSTR elSStr[HIDS_FLSIZE +1];

    /* Er must point to the mbuffer */
    el->er = (EVENTLOGRECORD *) &mbuffer; 

    /* Zeroing the values */
    elStr[HIDS_MAXSTR] = '\0';
    elUsr[HIDS_FLSIZE] = '\0';
    elDomain[HIDS_FLSIZE] = '\0';
    finalMsg[HIDS_MAXSTR] = '\0';
    elSStr[0] = NULL;
    elSStr[HIDS_FLSIZE] = NULL;
    
    /* Event log is not open */
    if(!el->h)
    {
        return;
    }
    
    /* Reading the event log */
    while(ReadEventLog(el->h,
				EVENTLOG_FORWARDS_READ|EVENTLOG_SEQUENTIAL_READ,
				0,
				el->er, BUFFER_SIZE - 1, &read, &needed))
	{
        if(!printit)
        {
            /* Setting er to the beginning of the buffer */
            el->er = (EVENTLOGRECORD *)&mbuffer;
            continue;
        }

        
        while(read > 0)
        {
            /* We need to initialize every variable before the loop */
            category = GetELCategory(el->er->EventType);
            source = (LPSTR) ((LPBYTE) el->er + sizeof(EVENTLOGRECORD));
            computerName = source + strlen(source) + 1;
            descriptiveMsg = NULL;

            /* Getting event id. */
            id = (int)el->er->EventID & _evtid;
                            
            /* Initialing domain/user size */
            usrSize = 255; domainSize = 255;
            elDomain[0] = '\0';
            elUsr[0] = '\0';

            /* We must have some description */
            if(el->er->NumStrings)
            {	
                sizeLeft = HIDS_MAXSTR - 1024;	

                sstr = (LPSTR)((LPBYTE)el->er + el->er->StringOffset);
                elStr[0] = '\0';

                for (nstr = 0;nstr < el->er->NumStrings;nstr++)
                {
                    strSize = strlen(sstr);
                    if(sizeLeft > 1)
					{
                        strncat(elStr, sstr, sizeLeft);
                    }

                    strTmp = strchr(elStr, '\0');
                    if(strTmp)
                    {
                        *strTmp = ' ';		
                        strTmp++; *strTmp = '\0';
                    }
                    else
                    {
                        printf("Log Collector: Invalid application string (size+)");
                    }
                    sizeLeft-=strSize + 2;

                    if(nstr <= 92)
                    {
                        elSStr[nstr] = (LPSTR)sstr;
                        elSStr[nstr +1] = NULL;
                    }

                    sstr = strchr((LPSTR)sstr, '\0');
                    
                    if(sstr)
                        sstr++;
                    else
                        break;     
				}

                /* Get a more descriptive message (if available) */                
                descriptiveMsg = GetELMsg(el->er, 
                                          el->name,
                                          source, 
                                          elSStr);                
                                                        
                if(descriptiveMsg != NULL)
                {
                    /* Remove any \n or \r */
                    /* Replace tabs from the argument field to spaces.
                     * So whenever we have option:\tvalue\t, it will
                     * become option: value\t
                     */
                    strTmp = descriptiveMsg;    
                    while(*strTmp != '\0')
                    {
                        if(*strTmp == '\n')
                            *strTmp = ' ';
                        else if(*strTmp == '\r')
                            *strTmp = ' ';
                        else if((*strTmp == ':') && (strTmp[1] == '\t'))
                        {
                            strTmp[1] = ' ';
                            strTmp++;
                        }
                                    
                        strTmp++;
                    }
                }
            }
            else
            {
                strncpy(elStr, "(no message)", 128);	
            }


            /* Getting username */
            if(el->er->UserSidLength)
            {
                SID_NAME_USE account_type;
                if(!LookupAccountSid(NULL, 
                                    (SID *)((LPSTR)el->er + 
                                    el->er->UserSidOffset),
                                    elUsr, 
                                    &usrSize, 
                                    elDomain, 
                                    &domainSize, 
                                    &account_type))		
                {
                    strncpy(elUsr, "(no user)", 255);
                    strncpy(elDomain, "no domain", 255);
                }

            }
            else
            {
                strncpy(elUsr, "(no user)", 255);	
                strncpy(elDomain, "no domain", 255);	
            }


            if(printit)
            {
                DWORD _evtid = 65535;
                int id = (int)el->er->EventID & _evtid; 
               
                finalMsg[HIDS_MAXSTR - HIDS_LOG_HEADER] = '\0'; 
                finalMsg[HIDS_MAXSTR - HIDS_LOG_HEADER -1] = '\0'; 
                
                printf("WinEvtLog: %s: %s(%d): %s: %s: %s: %s: %s\n", 
                        el->name,
                        category, 
                        id,
                        source,
                        elUsr,
                        elDomain,
                        computerName,
                        descriptiveMsg != NULL?descriptiveMsg:elStr);	
                
				/*send msg to server
				 ...................
				 ...................
				 */
            }

            if(descriptiveMsg != NULL)
            {
                LocalFree(descriptiveMsg);
            }

            /* Changing the point to the er */
            read -= el->er->Length;
            el->er = (EVENTLOGRECORD *)((LPBYTE) el->er + el->er->Length);
        }		

        /* Setting er to the beginning of the buffer */	
        el->er = (EVENTLOGRECORD *)&mbuffer;
    }

	
    id = GetLastError();
    if(id == ERROR_HANDLE_EOF)
    {
        return;
    }
    /* Event log was cleared. */
    else if(id == ERROR_EVENTLOG_FILE_CHANGED)
    {
        printf("Log Collector: WARN: Event log cleared: '%s'", el->name);
        
        /* Closing the event log and reopenning. */
        CloseEventLog(el->h);
        el->h = NULL;

        /* Reopening. */
        if(StartEL(el->name, el) < 0)
        {
            printf("Log Collector: ERROR: Unable to reopen event log '%s'", el->name);
        }
    }

    else
    {
        printf("Log Collector: WARN: Error reading event log: %d", id);
    }
}
					  

int main()
{
	HIDSEL hidsEL[3];
	int a,b,c;
	a = StartEL("System",&hidsEL[0]);
	//b = StartEL("Security",&hidsEL[1]);
	//c = StartEL("Application",&hidsEL[2]);
	ReadEL(&hidsEL[0],1);
	//ReadEL(&hidsEL[1],1);
	//ReadEL(&hidsEL[2],1);
	system("pause");
	return 0;
}