diff --git a/ChangeLog b/ChangeLog index ac394d8..68aa2f7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,10 +5,10 @@ 2010-09-09 Fabio "BlackLight" Manganiello * Makefile.am: Complete support for make dist -2010-09-05 Fabio "BlackLight" Manganiello +2010-05-09 Fabio "BlackLight" Manganiello * all: Using autotools now -2010-09-04 Fabio "BlackLight" Manganiello +2010-04-04 Fabio "BlackLight" Manganiello * mysql.c: This file now only contains the functions for managing MySQL connections in the database wrapper * db.c: Renamed from 'mysql.c' to 'db.c', now it should be abstract diff --git a/Makefile.am b/Makefile.am index 3b564d8..64e85c1 100644 --- a/Makefile.am +++ b/Makefile.am @@ -4,7 +4,7 @@ AUTOMAKE_OPTIONS=foreign no-dependencies libdir = ${exec_prefix}/lib/snort_dynamicpreprocessor lib_LTLIBRARIES = libsf_ai_preproc.la -libsf_ai_preproc_la_CFLAGS = -I./uthash -I./include ${LIBXML2_INCLUDES} -DDYNAMIC_PLUGIN -D_XOPEN_SOURCE -D_GNU_SOURCE -fvisibility=hidden -fno-strict-aliasing -Wall -pedantic -pedantic-errors -fstack-protector +libsf_ai_preproc_la_CFLAGS = -I./uthash -I./include ${LIBXML2_INCLUDES} ${LIBGRAPH_INCLUDES} -DDYNAMIC_PLUGIN -D_XOPEN_SOURCE -D_GNU_SOURCE -fvisibility=hidden -fno-strict-aliasing -Wall -pedantic -pedantic-errors -fstack-protector libsf_ai_preproc_la_LDFLAGS = -module -export-dynamic BUILT_SOURCES = \ diff --git a/Makefile.in b/Makefile.in index 8ff7363..9e0a08c 100644 --- a/Makefile.in +++ b/Makefile.in @@ -150,6 +150,7 @@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ +LIBGRAPH_INCLUDES = @LIBGRAPH_INCLUDES@ LIBOBJS = @LIBOBJS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ @@ -159,7 +160,6 @@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ MAKEINFO = @MAKEINFO@ MKDIR_P = @MKDIR_P@ -MYSQL = @MYSQL@ NM = @NM@ NMEDIT = @NMEDIT@ OBJDUMP = @OBJDUMP@ @@ -235,7 +235,7 @@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ AUTOMAKE_OPTIONS = foreign no-dependencies lib_LTLIBRARIES = libsf_ai_preproc.la -libsf_ai_preproc_la_CFLAGS = -I./uthash -I./include ${LIBXML2_INCLUDES} -DDYNAMIC_PLUGIN -D_XOPEN_SOURCE -D_GNU_SOURCE -fvisibility=hidden -fno-strict-aliasing -Wall -pedantic -pedantic-errors -fstack-protector +libsf_ai_preproc_la_CFLAGS = -I./uthash -I./include ${LIBXML2_INCLUDES} ${LIBGRAPH_INCLUDES} -DDYNAMIC_PLUGIN -D_XOPEN_SOURCE -D_GNU_SOURCE -fvisibility=hidden -fno-strict-aliasing -Wall -pedantic -pedantic-errors -fstack-protector libsf_ai_preproc_la_LDFLAGS = -module -export-dynamic BUILT_SOURCES = \ include/sf_dynamic_preproc_lib.c \ diff --git a/TODO b/TODO index 7703c4e..5b78910 100644 --- a/TODO +++ b/TODO @@ -1,5 +1,6 @@ - Correlation macros valid also for hierarchies flags - Bayesian learning among alerts in alert log +- libgc support - Managing clusters for addresses, timestamps (and more?) - Dynamic cluster_min_size algorithm diff --git a/alert_parser.c b/alert_parser.c index 1a93bb4..b93d0e2 100644 --- a/alert_parser.c +++ b/alert_parser.c @@ -385,6 +385,9 @@ AI_free_alerts ( AI_snort_alert *node ) node->hyperalert = NULL; } + if ( node->derived_alerts ) + free ( node->derived_alerts ); + free ( node ); node = NULL; } /* ----- end of function AI_free_alerts ----- */ diff --git a/autom4te.cache/output.0 b/autom4te.cache/output.0 index d6b9e38..9a532ba 100644 --- a/autom4te.cache/output.0 +++ b/autom4te.cache/output.0 @@ -743,6 +743,7 @@ ac_includes_default="\ # include #endif" +ac_default_prefix=/usr ac_header_list= ac_func_list= ac_subst_vars='am__EXEEXT_FALSE @@ -750,7 +751,9 @@ am__EXEEXT_TRUE LTLIBOBJS LIB@&t@OBJS ALLOCA -MYSQL +LIBGRAPH_INCLUDES +LIBXML2_INCLUDES +CORR_RULES_PREFIX extra_incl CPP OTOOL64 @@ -868,6 +871,7 @@ enable_dependency_tracking with_gnu_ld enable_libtool_lock with_mysql +with_graphviz ' ac_precious_vars='build_alias host_alias @@ -1514,6 +1518,8 @@ Optional Packages: both@:>@ --with-gnu-ld assume the C compiler uses GNU ld @<:@default=no@:>@ --with-mysql Enable support for MySQL alert logs @<:@default=no@:>@ + --without-graphviz Disable Graphviz support for rendering correlated + alerts as a PNG graph @<:@default=yes@:>@ Some influential environment variables: CC C compiler command @@ -10527,6 +10533,9 @@ CC="$lt_save_CC" + +test "$prefix" = "NONE" && prefix=/usr + case "$host" in *-openbsd2.6|*-openbsd2.5|*-openbsd2.4|*-openbsd2.3*) @@ -11367,6 +11376,15 @@ else fi + +@%:@ Check whether --with-graphviz was given. +if test "${with_graphviz+set}" = set; then : + withval=$with_graphviz; +else + with_graphviz=yes +fi + + # Checks for libraries. if test "x$with_mysql" != xno; then : { $as_echo "$as_me:${as_lineno-$LINENO}: checking for mysql_query in -lmysqlclient" >&5 @@ -11375,7 +11393,7 @@ if test "${ac_cv_lib_mysqlclient_mysql_query+set}" = set; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS -LIBS="-lmysqlclient -lmysqlclient $LIBS" +LIBS="-lmysqlclient $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ @@ -11406,15 +11424,12 @@ fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_mysqlclient_mysql_query" >&5 $as_echo "$ac_cv_lib_mysqlclient_mysql_query" >&6; } if test "x$ac_cv_lib_mysqlclient_mysql_query" = x""yes; then : - MYSQL="-lmysqlclient" - - + $as_echo "@%:@define ENABLE_MYSQL 1" >>confdefs.h $as_echo "@%:@define ENABLE_DB 1" >>confdefs.h - else if test "x$with_mysql" != xno; then { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 @@ -11426,7 +11441,63 @@ fi fi -#AC_CHECK_LIB([mysqlclient], [mysql_query]) +#AS_IF([test "x$with_graphviz" != xno], +# [AC_CHECK_LIB([gvc], [agread], +# [AC_DEFINE(ENABLE_GRAPHVIZ, 1, [Define if you want to use libgraphviz for rendering the correlated alerts graph as a PNG image])], +# [if test "x$with_graphviz" != xno; then +# AC_MSG_FAILURE([libgraphviz support required but the library was not found (use --without-graphviz if you do not want to enable the support for it)]) +# fi])]) + +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for xmlReaderForFile in -lxml2" >&5 +$as_echo_n "checking for xmlReaderForFile in -lxml2... " >&6; } +if test "${ac_cv_lib_xml2_xmlReaderForFile+set}" = set; then : + $as_echo_n "(cached) " >&6 +else + ac_check_lib_save_LIBS=$LIBS +LIBS="-lxml2 $LIBS" +cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +/* Override any GCC internal prototype to avoid an error. + Use char because int might match the return type of a GCC + builtin and then its argument prototype would still apply. */ +#ifdef __cplusplus +extern "C" +#endif +char xmlReaderForFile (); +int +main () +{ +return xmlReaderForFile (); + ; + return 0; +} +_ACEOF +if ac_fn_c_try_link "$LINENO"; then : + ac_cv_lib_xml2_xmlReaderForFile=yes +else + ac_cv_lib_xml2_xmlReaderForFile=no +fi +rm -f core conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +LIBS=$ac_check_lib_save_LIBS +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_xml2_xmlReaderForFile" >&5 +$as_echo "$ac_cv_lib_xml2_xmlReaderForFile" >&6; } +if test "x$ac_cv_lib_xml2_xmlReaderForFile" = x""yes; then : + cat >>confdefs.h <<_ACEOF +@%:@define HAVE_LIBXML2 1 +_ACEOF + + LIBS="-lxml2 $LIBS" + +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libxml2 not found on the system +See \`config.log' for more details" "$LINENO" 5 ; } +fi + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pthread_create in -lpthread" >&5 $as_echo_n "checking for pthread_create in -lpthread... " >&6; } if test "${ac_cv_lib_pthread_pthread_create+set}" = set; then : @@ -11470,10 +11541,151 @@ _ACEOF LIBS="-lpthread $LIBS" +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libpthread not found on the system +See \`config.log' for more details" "$LINENO" 5 ; } fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for sqrt in -lm" >&5 +$as_echo_n "checking for sqrt in -lm... " >&6; } +if test "${ac_cv_lib_m_sqrt+set}" = set; then : + $as_echo_n "(cached) " >&6 +else + ac_check_lib_save_LIBS=$LIBS +LIBS="-lm $LIBS" +cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +/* Override any GCC internal prototype to avoid an error. + Use char because int might match the return type of a GCC + builtin and then its argument prototype would still apply. */ +#ifdef __cplusplus +extern "C" +#endif +char sqrt (); +int +main () +{ +return sqrt (); + ; + return 0; +} +_ACEOF +if ac_fn_c_try_link "$LINENO"; then : + ac_cv_lib_m_sqrt=yes +else + ac_cv_lib_m_sqrt=no +fi +rm -f core conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +LIBS=$ac_check_lib_save_LIBS +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_m_sqrt" >&5 +$as_echo "$ac_cv_lib_m_sqrt" >&6; } +if test "x$ac_cv_lib_m_sqrt" = x""yes; then : + cat >>confdefs.h <<_ACEOF +@%:@define HAVE_LIBM 1 +_ACEOF + + LIBS="-lm $LIBS" + +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libm not found on the system +See \`config.log' for more details" "$LINENO" 5 ; } +fi + +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for agread in -lgvc" >&5 +$as_echo_n "checking for agread in -lgvc... " >&6; } +if test "${ac_cv_lib_gvc_agread+set}" = set; then : + $as_echo_n "(cached) " >&6 +else + ac_check_lib_save_LIBS=$LIBS +LIBS="-lgvc $LIBS" +cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +/* Override any GCC internal prototype to avoid an error. + Use char because int might match the return type of a GCC + builtin and then its argument prototype would still apply. */ +#ifdef __cplusplus +extern "C" +#endif +char agread (); +int +main () +{ +return agread (); + ; + return 0; +} +_ACEOF +if ac_fn_c_try_link "$LINENO"; then : + ac_cv_lib_gvc_agread=yes +else + ac_cv_lib_gvc_agread=no +fi +rm -f core conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +LIBS=$ac_check_lib_save_LIBS +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_gvc_agread" >&5 +$as_echo "$ac_cv_lib_gvc_agread" >&6; } +if test "x$ac_cv_lib_gvc_agread" = x""yes; then : + cat >>confdefs.h <<_ACEOF +@%:@define HAVE_LIBGVC 1 +_ACEOF + + LIBS="-lgvc $LIBS" + +fi + +#AC_CHECK_LIB([gvc], [agread], [AC_DEFINE(ENABLE_GRAPHVIZ, 1, [Define if you want to use libgraphviz for rendering the correlated alerts graph as a PNG image])],[]) + #[if test "x$with_graphviz" != xno; then + # AC_MSG_FAILURE([libgraphviz support required but the library was not found (use --without-graphviz if you do not want to enable the support for it or, on a Debian-based system, install libgraphviz-dev)]) + #fi]) + +if test "x$prefix" == x/usr; then : + CORR_RULES_PREFIX="/etc/snort/corr_rules" + +else + CORR_RULES_PREFIX="${prefix}/etc/corr_rules" + +fi # Checks for header files. + +if test ! -z "`pkg-config --cflags libxml-2.0 2> /dev/null`"; then : + LIBXML2_INCLUDES="$(pkg-config --cflags libxml-2.0 2> /dev/null)" + +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libxml2 not found, okr pkg-config not working +See \`config.log' for more details" "$LINENO" 5 ; } +fi + +if test "x$with_graphviz" != xno; then : + if test ! -z "`pkg-config --cflags libgraph 2> /dev/null`"; then : + LIBGRAPH_INCLUDES="$(pkg-config --cflags libgraph 2> /dev/null)" + +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libgraphviz support enabled, but the library was not found or pkg-config is not working +See \`config.log' for more details" "$LINENO" 5 ; } +fi +fi + +if test "x$with_graphviz" != xno; then : + +$as_echo "@%:@define HAVE_BOOLEAN 1" >>confdefs.h + +fi + # The Ultrix 4.2 mips builtin alloca declared by alloca.h only works # for constant arguments. Useless! { $as_echo "$as_me:${as_lineno-$LINENO}: checking for working alloca.h" >&5 @@ -11663,7 +11875,7 @@ _ACEOF fi -for ac_header in inttypes.h limits.h stddef.h stdlib.h string.h unistd.h wchar.h +for ac_header in inttypes.h limits.h stddef.h stdlib.h string.h unistd.h wchar.h math.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" @@ -11672,6 +11884,8 @@ if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : @%:@define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF +else + as_fn_error $? "At least one of the required headers was not found" "$LINENO" 5 fi done @@ -11786,6 +12000,15 @@ cat >>confdefs.h <<_ACEOF _ACEOF +fi +ac_fn_c_check_type "$LINENO" "boolean" "ac_cv_type_boolean" "$ac_includes_default" +if test "x$ac_cv_type_boolean" = x""yes; then : + +cat >>confdefs.h <<_ACEOF +@%:@define HAVE_BOOLEAN 1 +_ACEOF + + fi @@ -12404,6 +12627,8 @@ if eval test \"x\$"$as_ac_var"\" = x"yes"; then : @%:@define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1 _ACEOF +else + as_fn_error $? "At least one of the required functions was not found" "$LINENO" 5 fi done @@ -12424,7 +12649,7 @@ $as_echo "@%:@define PACKAGE_NAME \"sf_ai_preprocessor\"" >>confdefs.h $as_echo "@%:@define PACKAGE_STRING \"Snort AI preprocessor\"" >>confdefs.h -$as_echo "@%:@define PACKAGE_TARNAME \"sf_ai_preprocessor\"" >>confdefs.h +$as_echo "@%:@define PACKAGE_TARNAME \"snort_ai_preproc\"" >>confdefs.h $as_echo "@%:@define PACKAGE_VERSION \"0.1.0\"" >>confdefs.h @@ -12437,6 +12662,11 @@ $as_echo "@%:@define SUP_IP6 /**/" >>confdefs.h $as_echo "@%:@define HAVE_VISIBILITY 1" >>confdefs.h +cat >>confdefs.h <<_ACEOF +@%:@define PREFIX "${prefix}" +_ACEOF + + ac_config_files="$ac_config_files Makefile" cat >confcache <<\_ACEOF diff --git a/autom4te.cache/output.1 b/autom4te.cache/output.1 index 14decfd..ba246c0 100644 --- a/autom4te.cache/output.1 +++ b/autom4te.cache/output.1 @@ -751,9 +751,9 @@ am__EXEEXT_TRUE LTLIBOBJS LIB@&t@OBJS ALLOCA +LIBGRAPH_INCLUDES LIBXML2_INCLUDES CORR_RULES_PREFIX -MYSQL extra_incl CPP OTOOL64 @@ -871,6 +871,7 @@ enable_dependency_tracking with_gnu_ld enable_libtool_lock with_mysql +with_graphviz ' ac_precious_vars='build_alias host_alias @@ -1517,6 +1518,8 @@ Optional Packages: both@:>@ --with-gnu-ld assume the C compiler uses GNU ld @<:@default=no@:>@ --with-mysql Enable support for MySQL alert logs @<:@default=no@:>@ + --without-graphviz Disable Graphviz support for rendering correlated + alerts as a PNG graph @<:@default=yes@:>@ Some influential environment variables: CC C compiler command @@ -11369,6 +11372,15 @@ else fi + +@%:@ Check whether --with-graphviz was given. +if test "${with_graphviz+set}" = set; then : + withval=$with_graphviz; +else + with_graphviz=yes +fi + + # Checks for libraries. if test "x$with_mysql" != xno; then : { $as_echo "$as_me:${as_lineno-$LINENO}: checking for mysql_query in -lmysqlclient" >&5 @@ -11377,7 +11389,7 @@ if test "${ac_cv_lib_mysqlclient_mysql_query+set}" = set; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS -LIBS="-lmysqlclient -lmysqlclient $LIBS" +LIBS="-lmysqlclient $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ @@ -11408,22 +11420,70 @@ fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_mysqlclient_mysql_query" >&5 $as_echo "$ac_cv_lib_mysqlclient_mysql_query" >&6; } if test "x$ac_cv_lib_mysqlclient_mysql_query" = x""yes; then : - MYSQL="-lmysqlclient" + cat >>confdefs.h <<_ACEOF +@%:@define HAVE_LIBMYSQLCLIENT 1 +_ACEOF - -$as_echo "@%:@define ENABLE_MYSQL 1" >>confdefs.h + LIBS="-lmysqlclient $LIBS" - -$as_echo "@%:@define ENABLE_DB 1" >>confdefs.h - - else - if test "x$with_mysql" != xno; then - { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} -as_fn_error $? "--with-mysql option used, but libmysqlclient was not found +as_fn_error $? "--with-mysql option used, but libmysqlclient was not found - do not use --with-mysql, or, on a Debian-based system, install libmysqlclient-dev +See \`config.log' for more details" "$LINENO" 5 ; } +fi + +fi + +if test "x$with_graphviz" != xno; then : + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for agread in -lgvc" >&5 +$as_echo_n "checking for agread in -lgvc... " >&6; } +if test "${ac_cv_lib_gvc_agread+set}" = set; then : + $as_echo_n "(cached) " >&6 +else + ac_check_lib_save_LIBS=$LIBS +LIBS="-lgvc $LIBS" +cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +/* Override any GCC internal prototype to avoid an error. + Use char because int might match the return type of a GCC + builtin and then its argument prototype would still apply. */ +#ifdef __cplusplus +extern "C" +#endif +char agread (); +int +main () +{ +return agread (); + ; + return 0; +} +_ACEOF +if ac_fn_c_try_link "$LINENO"; then : + ac_cv_lib_gvc_agread=yes +else + ac_cv_lib_gvc_agread=no +fi +rm -f core conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +LIBS=$ac_check_lib_save_LIBS +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_gvc_agread" >&5 +$as_echo "$ac_cv_lib_gvc_agread" >&6; } +if test "x$ac_cv_lib_gvc_agread" = x""yes; then : + cat >>confdefs.h <<_ACEOF +@%:@define HAVE_LIBGVC 1 +_ACEOF + + LIBS="-lgvc $LIBS" + +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libgraphviz support required but the library was not found - use --without-graphviz if you do not want to enable the support for it, or, on a Debian-based system, install libgraphviz-dev See \`config.log' for more details" "$LINENO" 5 ; } - fi fi fi @@ -11471,6 +11531,11 @@ _ACEOF LIBS="-lxml2 $LIBS" +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libxml2 not found on the system +See \`config.log' for more details" "$LINENO" 5 ; } fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pthread_create in -lpthread" >&5 @@ -11516,6 +11581,61 @@ _ACEOF LIBS="-lpthread $LIBS" +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libpthread not found on the system +See \`config.log' for more details" "$LINENO" 5 ; } +fi + +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for sqrt in -lm" >&5 +$as_echo_n "checking for sqrt in -lm... " >&6; } +if test "${ac_cv_lib_m_sqrt+set}" = set; then : + $as_echo_n "(cached) " >&6 +else + ac_check_lib_save_LIBS=$LIBS +LIBS="-lm $LIBS" +cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +/* Override any GCC internal prototype to avoid an error. + Use char because int might match the return type of a GCC + builtin and then its argument prototype would still apply. */ +#ifdef __cplusplus +extern "C" +#endif +char sqrt (); +int +main () +{ +return sqrt (); + ; + return 0; +} +_ACEOF +if ac_fn_c_try_link "$LINENO"; then : + ac_cv_lib_m_sqrt=yes +else + ac_cv_lib_m_sqrt=no +fi +rm -f core conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +LIBS=$ac_check_lib_save_LIBS +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_m_sqrt" >&5 +$as_echo "$ac_cv_lib_m_sqrt" >&6; } +if test "x$ac_cv_lib_m_sqrt" = x""yes; then : + cat >>confdefs.h <<_ACEOF +@%:@define HAVE_LIBM 1 +_ACEOF + + LIBS="-lm $LIBS" + +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libm not found on the system +See \`config.log' for more details" "$LINENO" 5 ; } fi @@ -11539,6 +11659,24 @@ as_fn_error $? "libxml2 not found, okr pkg-config not working See \`config.log' for more details" "$LINENO" 5 ; } fi +if test "x$with_graphviz" != xno; then : + if test ! -z "`pkg-config --cflags libgraph 2> /dev/null`"; then : + LIBGRAPH_INCLUDES="$(pkg-config --cflags libgraph 2> /dev/null)" + +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libgraphviz support enabled, but the library was not found or pkg-config is not working +See \`config.log' for more details" "$LINENO" 5 ; } +fi +fi + +if test "x$with_graphviz" != xno; then : + +$as_echo "@%:@define HAVE_BOOLEAN 1" >>confdefs.h + +fi + # The Ultrix 4.2 mips builtin alloca declared by alloca.h only works # for constant arguments. Useless! { $as_echo "$as_me:${as_lineno-$LINENO}: checking for working alloca.h" >&5 @@ -11728,7 +11866,7 @@ _ACEOF fi -for ac_header in inttypes.h limits.h stddef.h stdlib.h string.h unistd.h wchar.h +for ac_header in inttypes.h limits.h stddef.h stdlib.h string.h unistd.h wchar.h math.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" @@ -11853,6 +11991,15 @@ cat >>confdefs.h <<_ACEOF _ACEOF +fi +ac_fn_c_check_type "$LINENO" "boolean" "ac_cv_type_boolean" "$ac_includes_default" +if test "x$ac_cv_type_boolean" = x""yes; then : + +cat >>confdefs.h <<_ACEOF +@%:@define HAVE_BOOLEAN 1 +_ACEOF + + fi diff --git a/autom4te.cache/traces.0 b/autom4te.cache/traces.0 index 6e2e959..70b8dc9 100644 --- a/autom4te.cache/traces.0 +++ b/autom4te.cache/traces.0 @@ -2304,113 +2304,122 @@ m4trace:configure.ac:10: -1- m4_pattern_allow([^CPPFLAGS$]) m4trace:configure.ac:10: -1- m4_pattern_allow([^CPP$]) m4trace:configure.ac:10: -1- m4_pattern_allow([^STDC_HEADERS$]) m4trace:configure.ac:10: -1- m4_pattern_allow([^HAVE_DLFCN_H$]) -m4trace:configure.ac:14: -1- m4_pattern_allow([^OPENBSD$]) -m4trace:configure.ac:15: -1- m4_pattern_allow([^BROKEN_SIOCGIFMTU$]) -m4trace:configure.ac:19: -1- m4_pattern_allow([^OPENBSD$]) -m4trace:configure.ac:23: -1- m4_pattern_allow([^IRIX$]) -m4trace:configure.ac:33: -1- m4_pattern_allow([^IRIX$]) -m4trace:configure.ac:43: -1- m4_pattern_allow([^SOLARIS$]) -m4trace:configure.ac:48: -1- m4_pattern_allow([^SUNOS$]) -m4trace:configure.ac:53: -1- m4_pattern_allow([^LINUX$]) -m4trace:configure.ac:55: -1- m4_pattern_allow([^PCAP_TIMEOUT_IGNORED$]) -m4trace:configure.ac:56: -1- m4_pattern_allow([^extra_incl$]) -m4trace:configure.ac:60: -1- m4_pattern_allow([^HPUX$]) -m4trace:configure.ac:61: -1- m4_pattern_allow([^WORDS_BIGENDIAN$]) -m4trace:configure.ac:62: -1- m4_pattern_allow([^extra_incl$]) -m4trace:configure.ac:67: -1- m4_pattern_allow([^FREEBSD$]) -m4trace:configure.ac:71: -1- m4_pattern_allow([^BSDI$]) -m4trace:configure.ac:74: -1- m4_pattern_allow([^AIX$]) -m4trace:configure.ac:77: -1- m4_pattern_allow([^OSF1$]) +m4trace:configure.ac:17: -1- m4_pattern_allow([^OPENBSD$]) +m4trace:configure.ac:18: -1- m4_pattern_allow([^BROKEN_SIOCGIFMTU$]) +m4trace:configure.ac:22: -1- m4_pattern_allow([^OPENBSD$]) +m4trace:configure.ac:26: -1- m4_pattern_allow([^IRIX$]) +m4trace:configure.ac:36: -1- m4_pattern_allow([^IRIX$]) +m4trace:configure.ac:46: -1- m4_pattern_allow([^SOLARIS$]) +m4trace:configure.ac:51: -1- m4_pattern_allow([^SUNOS$]) +m4trace:configure.ac:56: -1- m4_pattern_allow([^LINUX$]) +m4trace:configure.ac:58: -1- m4_pattern_allow([^PCAP_TIMEOUT_IGNORED$]) +m4trace:configure.ac:59: -1- m4_pattern_allow([^extra_incl$]) +m4trace:configure.ac:63: -1- m4_pattern_allow([^HPUX$]) +m4trace:configure.ac:64: -1- m4_pattern_allow([^WORDS_BIGENDIAN$]) +m4trace:configure.ac:65: -1- m4_pattern_allow([^extra_incl$]) +m4trace:configure.ac:70: -1- m4_pattern_allow([^FREEBSD$]) +m4trace:configure.ac:74: -1- m4_pattern_allow([^BSDI$]) +m4trace:configure.ac:77: -1- m4_pattern_allow([^AIX$]) m4trace:configure.ac:80: -1- m4_pattern_allow([^OSF1$]) m4trace:configure.ac:83: -1- m4_pattern_allow([^OSF1$]) -m4trace:configure.ac:87: -1- m4_pattern_allow([^MACOS$]) -m4trace:configure.ac:88: -1- m4_pattern_allow([^BROKEN_SIOCGIFMTU$]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^CC$]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^CFLAGS$]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^LDFLAGS$]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^LIBS$]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^CPPFLAGS$]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^CC$]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^CC$]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^CC$]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^CC$]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^ac_ct_CC$]) -m4trace:configure.ac:94: -1- _AM_DEPENDENCIES([CC]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^CCDEPMODE$]) -m4trace:configure.ac:94: -1- AM_CONDITIONAL([am__fastdepCC], [ +m4trace:configure.ac:86: -1- m4_pattern_allow([^OSF1$]) +m4trace:configure.ac:90: -1- m4_pattern_allow([^MACOS$]) +m4trace:configure.ac:91: -1- m4_pattern_allow([^BROKEN_SIOCGIFMTU$]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^CC$]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^CFLAGS$]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^LDFLAGS$]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^LIBS$]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^CPPFLAGS$]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^CC$]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^CC$]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^CC$]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^CC$]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^ac_ct_CC$]) +m4trace:configure.ac:97: -1- _AM_DEPENDENCIES([CC]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^CCDEPMODE$]) +m4trace:configure.ac:97: -1- AM_CONDITIONAL([am__fastdepCC], [ test "x$enable_dependency_tracking" != xno \ && test "$am_cv_CC_dependencies_compiler_type" = gcc3]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^am__fastdepCC_TRUE$]) -m4trace:configure.ac:94: -1- m4_pattern_allow([^am__fastdepCC_FALSE$]) -m4trace:configure.ac:94: -1- _AM_SUBST_NOTMAKE([am__fastdepCC_TRUE]) -m4trace:configure.ac:94: -1- _AM_SUBST_NOTMAKE([am__fastdepCC_FALSE]) -m4trace:configure.ac:95: -1- m4_pattern_allow([^LN_S$]) -m4trace:configure.ac:96: -1- m4_pattern_allow([^SET_MAKE$]) -m4trace:configure.ac:106: -1- m4_pattern_allow([^MYSQL$]) -m4trace:configure.ac:106: -1- m4_pattern_allow([^ENABLE_MYSQL$]) -m4trace:configure.ac:106: -1- m4_pattern_allow([^ENABLE_DB$]) -m4trace:configure.ac:118: -1- m4_pattern_allow([^HAVE_LIBPTHREAD$]) -m4trace:configure.ac:121: -1- m4_pattern_allow([^HAVE_ALLOCA_H$]) -m4trace:configure.ac:121: -1- m4_pattern_allow([^HAVE_ALLOCA$]) -m4trace:configure.ac:121: -1- m4_pattern_allow([^ALLOCA$]) -m4trace:configure.ac:121: -1- m4_pattern_allow([^C_ALLOCA$]) -m4trace:configure.ac:121: -1- m4_pattern_allow([^CRAY_STACKSEG_END$]) -m4trace:configure.ac:121: -1- m4_pattern_allow([^STACK_DIRECTION$]) -m4trace:configure.ac:125: -1- m4_pattern_allow([^HAVE_U_INT8_T$]) -m4trace:configure.ac:125: -1- m4_pattern_allow([^HAVE_U_INT16_T$]) -m4trace:configure.ac:125: -1- m4_pattern_allow([^HAVE_U_INT32_T$]) -m4trace:configure.ac:125: -1- m4_pattern_allow([^HAVE_U_INT64_T$]) -m4trace:configure.ac:125: -1- m4_pattern_allow([^HAVE_UINT8_T$]) -m4trace:configure.ac:125: -1- m4_pattern_allow([^HAVE_UINT16_T$]) -m4trace:configure.ac:125: -1- m4_pattern_allow([^HAVE_UINT32_T$]) -m4trace:configure.ac:125: -1- m4_pattern_allow([^HAVE_UINT64_T$]) -m4trace:configure.ac:126: -1- m4_pattern_allow([^HAVE_INT8_T$]) -m4trace:configure.ac:126: -1- m4_pattern_allow([^HAVE_INT16_T$]) -m4trace:configure.ac:126: -1- m4_pattern_allow([^HAVE_INT32_T$]) -m4trace:configure.ac:126: -1- m4_pattern_allow([^HAVE_INT64_T$]) -m4trace:configure.ac:129: -1- m4_pattern_allow([^HAVE__BOOL$]) -m4trace:configure.ac:129: -1- m4_pattern_allow([^HAVE_STDBOOL_H$]) -m4trace:configure.ac:130: -1- m4_pattern_allow([^size_t$]) -m4trace:configure.ac:131: -1- m4_pattern_allow([^uint16_t$]) -m4trace:configure.ac:132: -1- m4_pattern_allow([^_UINT32_T$]) -m4trace:configure.ac:132: -1- m4_pattern_allow([^uint32_t$]) -m4trace:configure.ac:133: -1- m4_pattern_allow([^_UINT8_T$]) -m4trace:configure.ac:133: -1- m4_pattern_allow([^uint8_t$]) -m4trace:configure.ac:134: -1- m4_pattern_allow([^HAVE_PTRDIFF_T$]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^HAVE_STDLIB_H$]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^HAVE_MALLOC$]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^HAVE_MALLOC$]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^LIB@&t@OBJS$]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^malloc$]) -m4trace:configure.ac:138: -1- m4_pattern_allow([^TIME_WITH_SYS_TIME$]) -m4trace:configure.ac:138: -1- AC_DEFUN([_AC_Header_sys_time_h], [m4_divert_text([INIT_PREPARE], [AS_VAR_APPEND([ac_header_list], [" sys/time.h"])]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^am__fastdepCC_TRUE$]) +m4trace:configure.ac:97: -1- m4_pattern_allow([^am__fastdepCC_FALSE$]) +m4trace:configure.ac:97: -1- _AM_SUBST_NOTMAKE([am__fastdepCC_TRUE]) +m4trace:configure.ac:97: -1- _AM_SUBST_NOTMAKE([am__fastdepCC_FALSE]) +m4trace:configure.ac:98: -1- m4_pattern_allow([^LN_S$]) +m4trace:configure.ac:99: -1- m4_pattern_allow([^SET_MAKE$]) +m4trace:configure.ac:115: -1- m4_pattern_allow([^ENABLE_MYSQL$]) +m4trace:configure.ac:115: -1- m4_pattern_allow([^ENABLE_DB$]) +m4trace:configure.ac:130: -1- m4_pattern_allow([^HAVE_LIBXML2$]) +m4trace:configure.ac:131: -1- m4_pattern_allow([^HAVE_LIBPTHREAD$]) +m4trace:configure.ac:132: -1- m4_pattern_allow([^HAVE_LIBM$]) +m4trace:configure.ac:133: -1- m4_pattern_allow([^HAVE_LIBGVC$]) +m4trace:configure.ac:139: -1- m4_pattern_allow([^CORR_RULES_PREFIX$]) +m4trace:configure.ac:139: -1- m4_pattern_allow([^CORR_RULES_PREFIX$]) +m4trace:configure.ac:145: -1- m4_pattern_allow([^LIBXML2_INCLUDES$]) +m4trace:configure.ac:149: -1- m4_pattern_allow([^LIBGRAPH_INCLUDES$]) +m4trace:configure.ac:154: -1- m4_pattern_allow([^HAVE_BOOLEAN$]) +m4trace:configure.ac:157: -1- m4_pattern_allow([^HAVE_ALLOCA_H$]) +m4trace:configure.ac:157: -1- m4_pattern_allow([^HAVE_ALLOCA$]) +m4trace:configure.ac:157: -1- m4_pattern_allow([^ALLOCA$]) +m4trace:configure.ac:157: -1- m4_pattern_allow([^C_ALLOCA$]) +m4trace:configure.ac:157: -1- m4_pattern_allow([^CRAY_STACKSEG_END$]) +m4trace:configure.ac:157: -1- m4_pattern_allow([^STACK_DIRECTION$]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^HAVE_U_INT8_T$]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^HAVE_U_INT16_T$]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^HAVE_U_INT32_T$]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^HAVE_U_INT64_T$]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^HAVE_UINT8_T$]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^HAVE_UINT16_T$]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^HAVE_UINT32_T$]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^HAVE_UINT64_T$]) +m4trace:configure.ac:162: -1- m4_pattern_allow([^HAVE_INT8_T$]) +m4trace:configure.ac:162: -1- m4_pattern_allow([^HAVE_INT16_T$]) +m4trace:configure.ac:162: -1- m4_pattern_allow([^HAVE_INT32_T$]) +m4trace:configure.ac:162: -1- m4_pattern_allow([^HAVE_INT64_T$]) +m4trace:configure.ac:162: -1- m4_pattern_allow([^HAVE_BOOLEAN$]) +m4trace:configure.ac:165: -1- m4_pattern_allow([^HAVE__BOOL$]) +m4trace:configure.ac:165: -1- m4_pattern_allow([^HAVE_STDBOOL_H$]) +m4trace:configure.ac:166: -1- m4_pattern_allow([^size_t$]) +m4trace:configure.ac:167: -1- m4_pattern_allow([^uint16_t$]) +m4trace:configure.ac:168: -1- m4_pattern_allow([^_UINT32_T$]) +m4trace:configure.ac:168: -1- m4_pattern_allow([^uint32_t$]) +m4trace:configure.ac:169: -1- m4_pattern_allow([^_UINT8_T$]) +m4trace:configure.ac:169: -1- m4_pattern_allow([^uint8_t$]) +m4trace:configure.ac:170: -1- m4_pattern_allow([^HAVE_PTRDIFF_T$]) +m4trace:configure.ac:173: -1- m4_pattern_allow([^HAVE_STDLIB_H$]) +m4trace:configure.ac:173: -1- m4_pattern_allow([^HAVE_MALLOC$]) +m4trace:configure.ac:173: -1- m4_pattern_allow([^HAVE_MALLOC$]) +m4trace:configure.ac:173: -1- m4_pattern_allow([^LIB@&t@OBJS$]) +m4trace:configure.ac:173: -1- m4_pattern_allow([^malloc$]) +m4trace:configure.ac:174: -1- m4_pattern_allow([^TIME_WITH_SYS_TIME$]) +m4trace:configure.ac:174: -1- AC_DEFUN([_AC_Header_sys_time_h], [m4_divert_text([INIT_PREPARE], [AS_VAR_APPEND([ac_header_list], [" sys/time.h"])]) _AC_HEADERS_EXPANSION]) -m4trace:configure.ac:138: -1- AC_DEFUN([_AC_Header_unistd_h], [m4_divert_text([INIT_PREPARE], [AS_VAR_APPEND([ac_header_list], [" unistd.h"])]) +m4trace:configure.ac:174: -1- AC_DEFUN([_AC_Header_unistd_h], [m4_divert_text([INIT_PREPARE], [AS_VAR_APPEND([ac_header_list], [" unistd.h"])]) _AC_HEADERS_EXPANSION]) -m4trace:configure.ac:138: -1- AC_DEFUN([_AC_Func_alarm], [m4_divert_text([INIT_PREPARE], [AS_VAR_APPEND([ac_func_list], [" alarm"])]) +m4trace:configure.ac:174: -1- AC_DEFUN([_AC_Func_alarm], [m4_divert_text([INIT_PREPARE], [AS_VAR_APPEND([ac_func_list], [" alarm"])]) _AC_FUNCS_EXPANSION]) -m4trace:configure.ac:138: -1- m4_pattern_allow([^LIB@&t@OBJS$]) -m4trace:configure.ac:139: -1- m4_pattern_allow([^HAVE_STDLIB_H$]) -m4trace:configure.ac:139: -1- m4_pattern_allow([^HAVE_REALLOC$]) -m4trace:configure.ac:139: -1- m4_pattern_allow([^HAVE_REALLOC$]) -m4trace:configure.ac:139: -1- m4_pattern_allow([^LIB@&t@OBJS$]) -m4trace:configure.ac:139: -1- m4_pattern_allow([^realloc$]) -m4trace:configure.ac:142: -1- m4_pattern_allow([^VERSION$]) -m4trace:configure.ac:143: -1- m4_pattern_allow([^PACKAGE$]) -m4trace:configure.ac:144: -1- m4_pattern_allow([^PACKAGE_BUGREPORT$]) -m4trace:configure.ac:145: -1- m4_pattern_allow([^PACKAGE_NAME$]) -m4trace:configure.ac:146: -1- m4_pattern_allow([^PACKAGE_STRING$]) -m4trace:configure.ac:147: -1- m4_pattern_allow([^PACKAGE_TARNAME$]) -m4trace:configure.ac:148: -1- m4_pattern_allow([^PACKAGE_VERSION$]) -m4trace:configure.ac:149: -1- m4_pattern_allow([^SUP_IP6$]) -m4trace:configure.ac:151: -1- m4_pattern_allow([^HAVE_VISIBILITY$]) -m4trace:configure.ac:154: -1- m4_pattern_allow([^LIB@&t@OBJS$]) -m4trace:configure.ac:154: -1- m4_pattern_allow([^LTLIBOBJS$]) -m4trace:configure.ac:154: -1- AM_CONDITIONAL([am__EXEEXT], [test -n "$EXEEXT"]) -m4trace:configure.ac:154: -1- m4_pattern_allow([^am__EXEEXT_TRUE$]) -m4trace:configure.ac:154: -1- m4_pattern_allow([^am__EXEEXT_FALSE$]) -m4trace:configure.ac:154: -1- _AM_SUBST_NOTMAKE([am__EXEEXT_TRUE]) -m4trace:configure.ac:154: -1- _AM_SUBST_NOTMAKE([am__EXEEXT_FALSE]) -m4trace:configure.ac:154: -1- _AC_AM_CONFIG_HEADER_HOOK(["$ac_file"]) -m4trace:configure.ac:154: -1- _AM_OUTPUT_DEPENDENCY_COMMANDS -m4trace:configure.ac:154: -1- _LT_PROG_LTMAIN +m4trace:configure.ac:174: -1- m4_pattern_allow([^LIB@&t@OBJS$]) +m4trace:configure.ac:175: -1- m4_pattern_allow([^HAVE_STDLIB_H$]) +m4trace:configure.ac:175: -1- m4_pattern_allow([^HAVE_REALLOC$]) +m4trace:configure.ac:175: -1- m4_pattern_allow([^HAVE_REALLOC$]) +m4trace:configure.ac:175: -1- m4_pattern_allow([^LIB@&t@OBJS$]) +m4trace:configure.ac:175: -1- m4_pattern_allow([^realloc$]) +m4trace:configure.ac:178: -1- m4_pattern_allow([^VERSION$]) +m4trace:configure.ac:179: -1- m4_pattern_allow([^PACKAGE$]) +m4trace:configure.ac:180: -1- m4_pattern_allow([^PACKAGE_BUGREPORT$]) +m4trace:configure.ac:181: -1- m4_pattern_allow([^PACKAGE_NAME$]) +m4trace:configure.ac:182: -1- m4_pattern_allow([^PACKAGE_STRING$]) +m4trace:configure.ac:183: -1- m4_pattern_allow([^PACKAGE_TARNAME$]) +m4trace:configure.ac:184: -1- m4_pattern_allow([^PACKAGE_VERSION$]) +m4trace:configure.ac:185: -1- m4_pattern_allow([^SUP_IP6$]) +m4trace:configure.ac:187: -1- m4_pattern_allow([^HAVE_VISIBILITY$]) +m4trace:configure.ac:188: -1- m4_pattern_allow([^PREFIX$]) +m4trace:configure.ac:191: -1- m4_pattern_allow([^LIB@&t@OBJS$]) +m4trace:configure.ac:191: -1- m4_pattern_allow([^LTLIBOBJS$]) +m4trace:configure.ac:191: -1- AM_CONDITIONAL([am__EXEEXT], [test -n "$EXEEXT"]) +m4trace:configure.ac:191: -1- m4_pattern_allow([^am__EXEEXT_TRUE$]) +m4trace:configure.ac:191: -1- m4_pattern_allow([^am__EXEEXT_FALSE$]) +m4trace:configure.ac:191: -1- _AM_SUBST_NOTMAKE([am__EXEEXT_TRUE]) +m4trace:configure.ac:191: -1- _AM_SUBST_NOTMAKE([am__EXEEXT_FALSE]) +m4trace:configure.ac:191: -1- _AC_AM_CONFIG_HEADER_HOOK(["$ac_file"]) +m4trace:configure.ac:191: -1- _AM_OUTPUT_DEPENDENCY_COMMANDS +m4trace:configure.ac:191: -1- _LT_PROG_LTMAIN diff --git a/autom4te.cache/traces.1 b/autom4te.cache/traces.1 index 910af02..941259c 100644 --- a/autom4te.cache/traces.1 +++ b/autom4te.cache/traces.1 @@ -570,304 +570,318 @@ m4trace:configure.ac:98: -1- m4_pattern_allow([^LN_S$]) m4trace:configure.ac:99: -1- AC_SUBST([SET_MAKE]) m4trace:configure.ac:99: -1- AC_SUBST_TRACE([SET_MAKE]) m4trace:configure.ac:99: -1- m4_pattern_allow([^SET_MAKE$]) -m4trace:configure.ac:109: -1- AC_SUBST([MYSQL], ["-lmysqlclient"]) -m4trace:configure.ac:109: -1- AC_SUBST_TRACE([MYSQL]) -m4trace:configure.ac:109: -1- m4_pattern_allow([^MYSQL$]) -m4trace:configure.ac:109: -1- AC_DEFINE_TRACE_LITERAL([ENABLE_MYSQL]) -m4trace:configure.ac:109: -1- m4_pattern_allow([^ENABLE_MYSQL$]) -m4trace:configure.ac:109: -1- AH_OUTPUT([ENABLE_MYSQL], [/* Define if you want to use MySQL */ -@%:@undef ENABLE_MYSQL]) -m4trace:configure.ac:109: -1- AC_DEFINE_TRACE_LITERAL([ENABLE_DB]) -m4trace:configure.ac:109: -1- m4_pattern_allow([^ENABLE_DB$]) -m4trace:configure.ac:109: -1- AH_OUTPUT([ENABLE_DB], [/* Define if you want to enable database support */ -@%:@undef ENABLE_DB]) -m4trace:configure.ac:120: -1- AH_OUTPUT([HAVE_LIBXML2], [/* Define to 1 if you have the `xml2\' library (-lxml2). */ +m4trace:configure.ac:115: -1- AH_OUTPUT([HAVE_LIBMYSQLCLIENT], [/* Define to 1 if you have the `mysqlclient\' library (-lmysqlclient). */ +@%:@undef HAVE_LIBMYSQLCLIENT]) +m4trace:configure.ac:115: -1- AC_DEFINE_TRACE_LITERAL([HAVE_LIBMYSQLCLIENT]) +m4trace:configure.ac:115: -1- m4_pattern_allow([^HAVE_LIBMYSQLCLIENT$]) +m4trace:configure.ac:119: -1- AH_OUTPUT([HAVE_LIBGVC], [/* Define to 1 if you have the `gvc\' library (-lgvc). */ +@%:@undef HAVE_LIBGVC]) +m4trace:configure.ac:119: -1- AC_DEFINE_TRACE_LITERAL([HAVE_LIBGVC]) +m4trace:configure.ac:119: -1- m4_pattern_allow([^HAVE_LIBGVC$]) +m4trace:configure.ac:123: -1- AH_OUTPUT([HAVE_LIBXML2], [/* Define to 1 if you have the `xml2\' library (-lxml2). */ @%:@undef HAVE_LIBXML2]) -m4trace:configure.ac:120: -1- AC_DEFINE_TRACE_LITERAL([HAVE_LIBXML2]) -m4trace:configure.ac:120: -1- m4_pattern_allow([^HAVE_LIBXML2$]) -m4trace:configure.ac:121: -1- AH_OUTPUT([HAVE_LIBPTHREAD], [/* Define to 1 if you have the `pthread\' library (-lpthread). */ +m4trace:configure.ac:123: -1- AC_DEFINE_TRACE_LITERAL([HAVE_LIBXML2]) +m4trace:configure.ac:123: -1- m4_pattern_allow([^HAVE_LIBXML2$]) +m4trace:configure.ac:124: -1- AH_OUTPUT([HAVE_LIBPTHREAD], [/* Define to 1 if you have the `pthread\' library (-lpthread). */ @%:@undef HAVE_LIBPTHREAD]) -m4trace:configure.ac:121: -1- AC_DEFINE_TRACE_LITERAL([HAVE_LIBPTHREAD]) -m4trace:configure.ac:121: -1- m4_pattern_allow([^HAVE_LIBPTHREAD$]) -m4trace:configure.ac:123: -1- AC_SUBST([CORR_RULES_PREFIX], ["/etc/snort/corr_rules"]) -m4trace:configure.ac:123: -1- AC_SUBST_TRACE([CORR_RULES_PREFIX]) -m4trace:configure.ac:123: -1- m4_pattern_allow([^CORR_RULES_PREFIX$]) -m4trace:configure.ac:123: -1- AC_SUBST([CORR_RULES_PREFIX], ["${prefix}/etc/corr_rules"]) -m4trace:configure.ac:123: -1- AC_SUBST_TRACE([CORR_RULES_PREFIX]) -m4trace:configure.ac:123: -1- m4_pattern_allow([^CORR_RULES_PREFIX$]) -m4trace:configure.ac:129: -1- AC_SUBST([LIBXML2_INCLUDES], ["$(pkg-config --cflags libxml-2.0 2> /dev/null)"]) -m4trace:configure.ac:129: -1- AC_SUBST_TRACE([LIBXML2_INCLUDES]) -m4trace:configure.ac:129: -1- m4_pattern_allow([^LIBXML2_INCLUDES$]) -m4trace:configure.ac:133: -1- AC_DEFINE_TRACE_LITERAL([HAVE_ALLOCA_H]) -m4trace:configure.ac:133: -1- m4_pattern_allow([^HAVE_ALLOCA_H$]) -m4trace:configure.ac:133: -1- AH_OUTPUT([HAVE_ALLOCA_H], [/* Define to 1 if you have and it should be used (not on Ultrix). +m4trace:configure.ac:124: -1- AC_DEFINE_TRACE_LITERAL([HAVE_LIBPTHREAD]) +m4trace:configure.ac:124: -1- m4_pattern_allow([^HAVE_LIBPTHREAD$]) +m4trace:configure.ac:125: -1- AH_OUTPUT([HAVE_LIBM], [/* Define to 1 if you have the `m\' library (-lm). */ +@%:@undef HAVE_LIBM]) +m4trace:configure.ac:125: -1- AC_DEFINE_TRACE_LITERAL([HAVE_LIBM]) +m4trace:configure.ac:125: -1- m4_pattern_allow([^HAVE_LIBM$]) +m4trace:configure.ac:127: -1- AC_SUBST([CORR_RULES_PREFIX], ["/etc/snort/corr_rules"]) +m4trace:configure.ac:127: -1- AC_SUBST_TRACE([CORR_RULES_PREFIX]) +m4trace:configure.ac:127: -1- m4_pattern_allow([^CORR_RULES_PREFIX$]) +m4trace:configure.ac:127: -1- AC_SUBST([CORR_RULES_PREFIX], ["${prefix}/etc/corr_rules"]) +m4trace:configure.ac:127: -1- AC_SUBST_TRACE([CORR_RULES_PREFIX]) +m4trace:configure.ac:127: -1- m4_pattern_allow([^CORR_RULES_PREFIX$]) +m4trace:configure.ac:133: -1- AC_SUBST([LIBXML2_INCLUDES], ["$(pkg-config --cflags libxml-2.0 2> /dev/null)"]) +m4trace:configure.ac:133: -1- AC_SUBST_TRACE([LIBXML2_INCLUDES]) +m4trace:configure.ac:133: -1- m4_pattern_allow([^LIBXML2_INCLUDES$]) +m4trace:configure.ac:137: -1- AC_SUBST([LIBGRAPH_INCLUDES], ["$(pkg-config --cflags libgraph 2> /dev/null)"]) +m4trace:configure.ac:137: -1- AC_SUBST_TRACE([LIBGRAPH_INCLUDES]) +m4trace:configure.ac:137: -1- m4_pattern_allow([^LIBGRAPH_INCLUDES$]) +m4trace:configure.ac:142: -1- AC_DEFINE_TRACE_LITERAL([HAVE_BOOLEAN]) +m4trace:configure.ac:142: -1- m4_pattern_allow([^HAVE_BOOLEAN$]) +m4trace:configure.ac:142: -1- AH_OUTPUT([HAVE_BOOLEAN], [/* Check if the boolean type is defined */ +@%:@undef HAVE_BOOLEAN]) +m4trace:configure.ac:145: -1- AC_DEFINE_TRACE_LITERAL([HAVE_ALLOCA_H]) +m4trace:configure.ac:145: -1- m4_pattern_allow([^HAVE_ALLOCA_H$]) +m4trace:configure.ac:145: -1- AH_OUTPUT([HAVE_ALLOCA_H], [/* Define to 1 if you have and it should be used (not on Ultrix). */ @%:@undef HAVE_ALLOCA_H]) -m4trace:configure.ac:133: -1- AC_DEFINE_TRACE_LITERAL([HAVE_ALLOCA]) -m4trace:configure.ac:133: -1- m4_pattern_allow([^HAVE_ALLOCA$]) -m4trace:configure.ac:133: -1- AH_OUTPUT([HAVE_ALLOCA], [/* Define to 1 if you have `alloca\', as a function or macro. */ +m4trace:configure.ac:145: -1- AC_DEFINE_TRACE_LITERAL([HAVE_ALLOCA]) +m4trace:configure.ac:145: -1- m4_pattern_allow([^HAVE_ALLOCA$]) +m4trace:configure.ac:145: -1- AH_OUTPUT([HAVE_ALLOCA], [/* Define to 1 if you have `alloca\', as a function or macro. */ @%:@undef HAVE_ALLOCA]) -m4trace:configure.ac:133: -1- AC_LIBSOURCE([alloca.c]) -m4trace:configure.ac:133: -1- AC_SUBST([ALLOCA], [\${LIBOBJDIR}alloca.$ac_objext]) -m4trace:configure.ac:133: -1- AC_SUBST_TRACE([ALLOCA]) -m4trace:configure.ac:133: -1- m4_pattern_allow([^ALLOCA$]) -m4trace:configure.ac:133: -1- AC_DEFINE_TRACE_LITERAL([C_ALLOCA]) -m4trace:configure.ac:133: -1- m4_pattern_allow([^C_ALLOCA$]) -m4trace:configure.ac:133: -1- AH_OUTPUT([C_ALLOCA], [/* Define to 1 if using `alloca.c\'. */ +m4trace:configure.ac:145: -1- AC_LIBSOURCE([alloca.c]) +m4trace:configure.ac:145: -1- AC_SUBST([ALLOCA], [\${LIBOBJDIR}alloca.$ac_objext]) +m4trace:configure.ac:145: -1- AC_SUBST_TRACE([ALLOCA]) +m4trace:configure.ac:145: -1- m4_pattern_allow([^ALLOCA$]) +m4trace:configure.ac:145: -1- AC_DEFINE_TRACE_LITERAL([C_ALLOCA]) +m4trace:configure.ac:145: -1- m4_pattern_allow([^C_ALLOCA$]) +m4trace:configure.ac:145: -1- AH_OUTPUT([C_ALLOCA], [/* Define to 1 if using `alloca.c\'. */ @%:@undef C_ALLOCA]) -m4trace:configure.ac:133: -1- AC_DEFINE_TRACE_LITERAL([CRAY_STACKSEG_END]) -m4trace:configure.ac:133: -1- m4_pattern_allow([^CRAY_STACKSEG_END$]) -m4trace:configure.ac:133: -1- AH_OUTPUT([CRAY_STACKSEG_END], [/* Define to one of `_getb67\', `GETB67\', `getb67\' for Cray-2 and Cray-YMP +m4trace:configure.ac:145: -1- AC_DEFINE_TRACE_LITERAL([CRAY_STACKSEG_END]) +m4trace:configure.ac:145: -1- m4_pattern_allow([^CRAY_STACKSEG_END$]) +m4trace:configure.ac:145: -1- AH_OUTPUT([CRAY_STACKSEG_END], [/* Define to one of `_getb67\', `GETB67\', `getb67\' for Cray-2 and Cray-YMP systems. This function is required for `alloca.c\' support on those systems. */ @%:@undef CRAY_STACKSEG_END]) -m4trace:configure.ac:133: -1- AH_OUTPUT([STACK_DIRECTION], [/* If using the C implementation of alloca, define if you know the +m4trace:configure.ac:145: -1- AH_OUTPUT([STACK_DIRECTION], [/* If using the C implementation of alloca, define if you know the direction of stack growth for your system; otherwise it will be automatically deduced at runtime. STACK_DIRECTION > 0 => grows toward higher addresses STACK_DIRECTION < 0 => grows toward lower addresses STACK_DIRECTION = 0 => direction of growth unknown */ @%:@undef STACK_DIRECTION]) -m4trace:configure.ac:133: -1- AC_DEFINE_TRACE_LITERAL([STACK_DIRECTION]) -m4trace:configure.ac:133: -1- m4_pattern_allow([^STACK_DIRECTION$]) -m4trace:configure.ac:134: -1- AH_OUTPUT([HAVE_INTTYPES_H], [/* Define to 1 if you have the header file. */ +m4trace:configure.ac:145: -1- AC_DEFINE_TRACE_LITERAL([STACK_DIRECTION]) +m4trace:configure.ac:145: -1- m4_pattern_allow([^STACK_DIRECTION$]) +m4trace:configure.ac:146: -1- AH_OUTPUT([HAVE_INTTYPES_H], [/* Define to 1 if you have the header file. */ @%:@undef HAVE_INTTYPES_H]) -m4trace:configure.ac:134: -1- AH_OUTPUT([HAVE_LIMITS_H], [/* Define to 1 if you have the header file. */ +m4trace:configure.ac:146: -1- AH_OUTPUT([HAVE_LIMITS_H], [/* Define to 1 if you have the header file. */ @%:@undef HAVE_LIMITS_H]) -m4trace:configure.ac:134: -1- AH_OUTPUT([HAVE_STDDEF_H], [/* Define to 1 if you have the header file. */ +m4trace:configure.ac:146: -1- AH_OUTPUT([HAVE_STDDEF_H], [/* Define to 1 if you have the header file. */ @%:@undef HAVE_STDDEF_H]) -m4trace:configure.ac:134: -1- AH_OUTPUT([HAVE_STDLIB_H], [/* Define to 1 if you have the header file. */ +m4trace:configure.ac:146: -1- AH_OUTPUT([HAVE_STDLIB_H], [/* Define to 1 if you have the header file. */ @%:@undef HAVE_STDLIB_H]) -m4trace:configure.ac:134: -1- AH_OUTPUT([HAVE_STRING_H], [/* Define to 1 if you have the header file. */ +m4trace:configure.ac:146: -1- AH_OUTPUT([HAVE_STRING_H], [/* Define to 1 if you have the header file. */ @%:@undef HAVE_STRING_H]) -m4trace:configure.ac:134: -1- AH_OUTPUT([HAVE_UNISTD_H], [/* Define to 1 if you have the header file. */ +m4trace:configure.ac:146: -1- AH_OUTPUT([HAVE_UNISTD_H], [/* Define to 1 if you have the header file. */ @%:@undef HAVE_UNISTD_H]) -m4trace:configure.ac:134: -1- AH_OUTPUT([HAVE_WCHAR_H], [/* Define to 1 if you have the header file. */ +m4trace:configure.ac:146: -1- AH_OUTPUT([HAVE_WCHAR_H], [/* Define to 1 if you have the header file. */ @%:@undef HAVE_WCHAR_H]) -m4trace:configure.ac:137: -1- AC_DEFINE_TRACE_LITERAL([HAVE_U_INT8_T]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^HAVE_U_INT8_T$]) -m4trace:configure.ac:137: -1- AH_OUTPUT([HAVE_U_INT8_T], [/* Define to 1 if the system has the type `u_int8_t\'. */ +m4trace:configure.ac:146: -1- AH_OUTPUT([HAVE_MATH_H], [/* Define to 1 if you have the header file. */ +@%:@undef HAVE_MATH_H]) +m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([HAVE_U_INT8_T]) +m4trace:configure.ac:149: -1- m4_pattern_allow([^HAVE_U_INT8_T$]) +m4trace:configure.ac:149: -1- AH_OUTPUT([HAVE_U_INT8_T], [/* Define to 1 if the system has the type `u_int8_t\'. */ @%:@undef HAVE_U_INT8_T]) -m4trace:configure.ac:137: -1- AC_DEFINE_TRACE_LITERAL([HAVE_U_INT16_T]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^HAVE_U_INT16_T$]) -m4trace:configure.ac:137: -1- AH_OUTPUT([HAVE_U_INT16_T], [/* Define to 1 if the system has the type `u_int16_t\'. */ +m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([HAVE_U_INT16_T]) +m4trace:configure.ac:149: -1- m4_pattern_allow([^HAVE_U_INT16_T$]) +m4trace:configure.ac:149: -1- AH_OUTPUT([HAVE_U_INT16_T], [/* Define to 1 if the system has the type `u_int16_t\'. */ @%:@undef HAVE_U_INT16_T]) -m4trace:configure.ac:137: -1- AC_DEFINE_TRACE_LITERAL([HAVE_U_INT32_T]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^HAVE_U_INT32_T$]) -m4trace:configure.ac:137: -1- AH_OUTPUT([HAVE_U_INT32_T], [/* Define to 1 if the system has the type `u_int32_t\'. */ +m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([HAVE_U_INT32_T]) +m4trace:configure.ac:149: -1- m4_pattern_allow([^HAVE_U_INT32_T$]) +m4trace:configure.ac:149: -1- AH_OUTPUT([HAVE_U_INT32_T], [/* Define to 1 if the system has the type `u_int32_t\'. */ @%:@undef HAVE_U_INT32_T]) -m4trace:configure.ac:137: -1- AC_DEFINE_TRACE_LITERAL([HAVE_U_INT64_T]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^HAVE_U_INT64_T$]) -m4trace:configure.ac:137: -1- AH_OUTPUT([HAVE_U_INT64_T], [/* Define to 1 if the system has the type `u_int64_t\'. */ +m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([HAVE_U_INT64_T]) +m4trace:configure.ac:149: -1- m4_pattern_allow([^HAVE_U_INT64_T$]) +m4trace:configure.ac:149: -1- AH_OUTPUT([HAVE_U_INT64_T], [/* Define to 1 if the system has the type `u_int64_t\'. */ @%:@undef HAVE_U_INT64_T]) -m4trace:configure.ac:137: -1- AC_DEFINE_TRACE_LITERAL([HAVE_UINT8_T]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^HAVE_UINT8_T$]) -m4trace:configure.ac:137: -1- AH_OUTPUT([HAVE_UINT8_T], [/* Define to 1 if the system has the type `uint8_t\'. */ +m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([HAVE_UINT8_T]) +m4trace:configure.ac:149: -1- m4_pattern_allow([^HAVE_UINT8_T$]) +m4trace:configure.ac:149: -1- AH_OUTPUT([HAVE_UINT8_T], [/* Define to 1 if the system has the type `uint8_t\'. */ @%:@undef HAVE_UINT8_T]) -m4trace:configure.ac:137: -1- AC_DEFINE_TRACE_LITERAL([HAVE_UINT16_T]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^HAVE_UINT16_T$]) -m4trace:configure.ac:137: -1- AH_OUTPUT([HAVE_UINT16_T], [/* Define to 1 if the system has the type `uint16_t\'. */ +m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([HAVE_UINT16_T]) +m4trace:configure.ac:149: -1- m4_pattern_allow([^HAVE_UINT16_T$]) +m4trace:configure.ac:149: -1- AH_OUTPUT([HAVE_UINT16_T], [/* Define to 1 if the system has the type `uint16_t\'. */ @%:@undef HAVE_UINT16_T]) -m4trace:configure.ac:137: -1- AC_DEFINE_TRACE_LITERAL([HAVE_UINT32_T]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^HAVE_UINT32_T$]) -m4trace:configure.ac:137: -1- AH_OUTPUT([HAVE_UINT32_T], [/* Define to 1 if the system has the type `uint32_t\'. */ +m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([HAVE_UINT32_T]) +m4trace:configure.ac:149: -1- m4_pattern_allow([^HAVE_UINT32_T$]) +m4trace:configure.ac:149: -1- AH_OUTPUT([HAVE_UINT32_T], [/* Define to 1 if the system has the type `uint32_t\'. */ @%:@undef HAVE_UINT32_T]) -m4trace:configure.ac:137: -1- AC_DEFINE_TRACE_LITERAL([HAVE_UINT64_T]) -m4trace:configure.ac:137: -1- m4_pattern_allow([^HAVE_UINT64_T$]) -m4trace:configure.ac:137: -1- AH_OUTPUT([HAVE_UINT64_T], [/* Define to 1 if the system has the type `uint64_t\'. */ +m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([HAVE_UINT64_T]) +m4trace:configure.ac:149: -1- m4_pattern_allow([^HAVE_UINT64_T$]) +m4trace:configure.ac:149: -1- AH_OUTPUT([HAVE_UINT64_T], [/* Define to 1 if the system has the type `uint64_t\'. */ @%:@undef HAVE_UINT64_T]) -m4trace:configure.ac:138: -1- AC_DEFINE_TRACE_LITERAL([HAVE_INT8_T]) -m4trace:configure.ac:138: -1- m4_pattern_allow([^HAVE_INT8_T$]) -m4trace:configure.ac:138: -1- AH_OUTPUT([HAVE_INT8_T], [/* Define to 1 if the system has the type `int8_t\'. */ +m4trace:configure.ac:150: -1- AC_DEFINE_TRACE_LITERAL([HAVE_INT8_T]) +m4trace:configure.ac:150: -1- m4_pattern_allow([^HAVE_INT8_T$]) +m4trace:configure.ac:150: -1- AH_OUTPUT([HAVE_INT8_T], [/* Define to 1 if the system has the type `int8_t\'. */ @%:@undef HAVE_INT8_T]) -m4trace:configure.ac:138: -1- AC_DEFINE_TRACE_LITERAL([HAVE_INT16_T]) -m4trace:configure.ac:138: -1- m4_pattern_allow([^HAVE_INT16_T$]) -m4trace:configure.ac:138: -1- AH_OUTPUT([HAVE_INT16_T], [/* Define to 1 if the system has the type `int16_t\'. */ +m4trace:configure.ac:150: -1- AC_DEFINE_TRACE_LITERAL([HAVE_INT16_T]) +m4trace:configure.ac:150: -1- m4_pattern_allow([^HAVE_INT16_T$]) +m4trace:configure.ac:150: -1- AH_OUTPUT([HAVE_INT16_T], [/* Define to 1 if the system has the type `int16_t\'. */ @%:@undef HAVE_INT16_T]) -m4trace:configure.ac:138: -1- AC_DEFINE_TRACE_LITERAL([HAVE_INT32_T]) -m4trace:configure.ac:138: -1- m4_pattern_allow([^HAVE_INT32_T$]) -m4trace:configure.ac:138: -1- AH_OUTPUT([HAVE_INT32_T], [/* Define to 1 if the system has the type `int32_t\'. */ +m4trace:configure.ac:150: -1- AC_DEFINE_TRACE_LITERAL([HAVE_INT32_T]) +m4trace:configure.ac:150: -1- m4_pattern_allow([^HAVE_INT32_T$]) +m4trace:configure.ac:150: -1- AH_OUTPUT([HAVE_INT32_T], [/* Define to 1 if the system has the type `int32_t\'. */ @%:@undef HAVE_INT32_T]) -m4trace:configure.ac:138: -1- AC_DEFINE_TRACE_LITERAL([HAVE_INT64_T]) -m4trace:configure.ac:138: -1- m4_pattern_allow([^HAVE_INT64_T$]) -m4trace:configure.ac:138: -1- AH_OUTPUT([HAVE_INT64_T], [/* Define to 1 if the system has the type `int64_t\'. */ +m4trace:configure.ac:150: -1- AC_DEFINE_TRACE_LITERAL([HAVE_INT64_T]) +m4trace:configure.ac:150: -1- m4_pattern_allow([^HAVE_INT64_T$]) +m4trace:configure.ac:150: -1- AH_OUTPUT([HAVE_INT64_T], [/* Define to 1 if the system has the type `int64_t\'. */ @%:@undef HAVE_INT64_T]) -m4trace:configure.ac:141: -1- AC_DEFINE_TRACE_LITERAL([HAVE__BOOL]) -m4trace:configure.ac:141: -1- m4_pattern_allow([^HAVE__BOOL$]) -m4trace:configure.ac:141: -1- AH_OUTPUT([HAVE__BOOL], [/* Define to 1 if the system has the type `_Bool\'. */ +m4trace:configure.ac:150: -1- AC_DEFINE_TRACE_LITERAL([HAVE_BOOLEAN]) +m4trace:configure.ac:150: -1- m4_pattern_allow([^HAVE_BOOLEAN$]) +m4trace:configure.ac:150: -1- AH_OUTPUT([HAVE_BOOLEAN], [/* Define to 1 if the system has the type `boolean\'. */ +@%:@undef HAVE_BOOLEAN]) +m4trace:configure.ac:153: -1- AC_DEFINE_TRACE_LITERAL([HAVE__BOOL]) +m4trace:configure.ac:153: -1- m4_pattern_allow([^HAVE__BOOL$]) +m4trace:configure.ac:153: -1- AH_OUTPUT([HAVE__BOOL], [/* Define to 1 if the system has the type `_Bool\'. */ @%:@undef HAVE__BOOL]) -m4trace:configure.ac:141: -1- AC_DEFINE_TRACE_LITERAL([HAVE_STDBOOL_H]) -m4trace:configure.ac:141: -1- m4_pattern_allow([^HAVE_STDBOOL_H$]) -m4trace:configure.ac:141: -1- AH_OUTPUT([HAVE_STDBOOL_H], [/* Define to 1 if stdbool.h conforms to C99. */ +m4trace:configure.ac:153: -1- AC_DEFINE_TRACE_LITERAL([HAVE_STDBOOL_H]) +m4trace:configure.ac:153: -1- m4_pattern_allow([^HAVE_STDBOOL_H$]) +m4trace:configure.ac:153: -1- AH_OUTPUT([HAVE_STDBOOL_H], [/* Define to 1 if stdbool.h conforms to C99. */ @%:@undef HAVE_STDBOOL_H]) -m4trace:configure.ac:142: -1- AC_DEFINE_TRACE_LITERAL([size_t]) -m4trace:configure.ac:142: -1- m4_pattern_allow([^size_t$]) -m4trace:configure.ac:142: -1- AH_OUTPUT([size_t], [/* Define to `unsigned int\' if does not define. */ +m4trace:configure.ac:154: -1- AC_DEFINE_TRACE_LITERAL([size_t]) +m4trace:configure.ac:154: -1- m4_pattern_allow([^size_t$]) +m4trace:configure.ac:154: -1- AH_OUTPUT([size_t], [/* Define to `unsigned int\' if does not define. */ @%:@undef size_t]) -m4trace:configure.ac:143: -1- AC_DEFINE_TRACE_LITERAL([uint16_t]) -m4trace:configure.ac:143: -1- m4_pattern_allow([^uint16_t$]) -m4trace:configure.ac:143: -1- AH_OUTPUT([uint16_t], [/* Define to the type of an unsigned integer type of width exactly 16 bits if +m4trace:configure.ac:155: -1- AC_DEFINE_TRACE_LITERAL([uint16_t]) +m4trace:configure.ac:155: -1- m4_pattern_allow([^uint16_t$]) +m4trace:configure.ac:155: -1- AH_OUTPUT([uint16_t], [/* Define to the type of an unsigned integer type of width exactly 16 bits if such a type exists and the standard includes do not define it. */ @%:@undef uint16_t]) -m4trace:configure.ac:144: -1- AC_DEFINE_TRACE_LITERAL([_UINT32_T]) -m4trace:configure.ac:144: -1- m4_pattern_allow([^_UINT32_T$]) -m4trace:configure.ac:144: -1- AH_OUTPUT([_UINT32_T], [/* Define for Solaris 2.5.1 so the uint32_t typedef from , +m4trace:configure.ac:156: -1- AC_DEFINE_TRACE_LITERAL([_UINT32_T]) +m4trace:configure.ac:156: -1- m4_pattern_allow([^_UINT32_T$]) +m4trace:configure.ac:156: -1- AH_OUTPUT([_UINT32_T], [/* Define for Solaris 2.5.1 so the uint32_t typedef from , , or is not used. If the typedef were allowed, the @%:@define below would cause a syntax error. */ @%:@undef _UINT32_T]) -m4trace:configure.ac:144: -1- AC_DEFINE_TRACE_LITERAL([uint32_t]) -m4trace:configure.ac:144: -1- m4_pattern_allow([^uint32_t$]) -m4trace:configure.ac:144: -1- AH_OUTPUT([uint32_t], [/* Define to the type of an unsigned integer type of width exactly 32 bits if +m4trace:configure.ac:156: -1- AC_DEFINE_TRACE_LITERAL([uint32_t]) +m4trace:configure.ac:156: -1- m4_pattern_allow([^uint32_t$]) +m4trace:configure.ac:156: -1- AH_OUTPUT([uint32_t], [/* Define to the type of an unsigned integer type of width exactly 32 bits if such a type exists and the standard includes do not define it. */ @%:@undef uint32_t]) -m4trace:configure.ac:145: -1- AC_DEFINE_TRACE_LITERAL([_UINT8_T]) -m4trace:configure.ac:145: -1- m4_pattern_allow([^_UINT8_T$]) -m4trace:configure.ac:145: -1- AH_OUTPUT([_UINT8_T], [/* Define for Solaris 2.5.1 so the uint8_t typedef from , +m4trace:configure.ac:157: -1- AC_DEFINE_TRACE_LITERAL([_UINT8_T]) +m4trace:configure.ac:157: -1- m4_pattern_allow([^_UINT8_T$]) +m4trace:configure.ac:157: -1- AH_OUTPUT([_UINT8_T], [/* Define for Solaris 2.5.1 so the uint8_t typedef from , , or is not used. If the typedef were allowed, the @%:@define below would cause a syntax error. */ @%:@undef _UINT8_T]) -m4trace:configure.ac:145: -1- AC_DEFINE_TRACE_LITERAL([uint8_t]) -m4trace:configure.ac:145: -1- m4_pattern_allow([^uint8_t$]) -m4trace:configure.ac:145: -1- AH_OUTPUT([uint8_t], [/* Define to the type of an unsigned integer type of width exactly 8 bits if +m4trace:configure.ac:157: -1- AC_DEFINE_TRACE_LITERAL([uint8_t]) +m4trace:configure.ac:157: -1- m4_pattern_allow([^uint8_t$]) +m4trace:configure.ac:157: -1- AH_OUTPUT([uint8_t], [/* Define to the type of an unsigned integer type of width exactly 8 bits if such a type exists and the standard includes do not define it. */ @%:@undef uint8_t]) -m4trace:configure.ac:146: -1- AC_DEFINE_TRACE_LITERAL([HAVE_PTRDIFF_T]) -m4trace:configure.ac:146: -1- m4_pattern_allow([^HAVE_PTRDIFF_T$]) -m4trace:configure.ac:146: -1- AH_OUTPUT([HAVE_PTRDIFF_T], [/* Define to 1 if the system has the type `ptrdiff_t\'. */ +m4trace:configure.ac:158: -1- AC_DEFINE_TRACE_LITERAL([HAVE_PTRDIFF_T]) +m4trace:configure.ac:158: -1- m4_pattern_allow([^HAVE_PTRDIFF_T$]) +m4trace:configure.ac:158: -1- AH_OUTPUT([HAVE_PTRDIFF_T], [/* Define to 1 if the system has the type `ptrdiff_t\'. */ @%:@undef HAVE_PTRDIFF_T]) -m4trace:configure.ac:149: -1- AH_OUTPUT([HAVE_STDLIB_H], [/* Define to 1 if you have the header file. */ +m4trace:configure.ac:161: -1- AH_OUTPUT([HAVE_STDLIB_H], [/* Define to 1 if you have the header file. */ @%:@undef HAVE_STDLIB_H]) -m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([HAVE_STDLIB_H]) -m4trace:configure.ac:149: -1- m4_pattern_allow([^HAVE_STDLIB_H$]) -m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([HAVE_MALLOC]) -m4trace:configure.ac:149: -1- m4_pattern_allow([^HAVE_MALLOC$]) -m4trace:configure.ac:149: -1- AH_OUTPUT([HAVE_MALLOC], [/* Define to 1 if your system has a GNU libc compatible `malloc\' function, and +m4trace:configure.ac:161: -1- AC_DEFINE_TRACE_LITERAL([HAVE_STDLIB_H]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^HAVE_STDLIB_H$]) +m4trace:configure.ac:161: -1- AC_DEFINE_TRACE_LITERAL([HAVE_MALLOC]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^HAVE_MALLOC$]) +m4trace:configure.ac:161: -1- AH_OUTPUT([HAVE_MALLOC], [/* Define to 1 if your system has a GNU libc compatible `malloc\' function, and to 0 otherwise. */ @%:@undef HAVE_MALLOC]) -m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([HAVE_MALLOC]) -m4trace:configure.ac:149: -1- m4_pattern_allow([^HAVE_MALLOC$]) -m4trace:configure.ac:149: -1- AC_LIBSOURCE([malloc.c]) -m4trace:configure.ac:149: -1- AC_SUBST([LIB@&t@OBJS], ["$LIB@&t@OBJS malloc.$ac_objext"]) -m4trace:configure.ac:149: -1- AC_SUBST_TRACE([LIB@&t@OBJS]) -m4trace:configure.ac:149: -1- m4_pattern_allow([^LIB@&t@OBJS$]) -m4trace:configure.ac:149: -1- AC_DEFINE_TRACE_LITERAL([malloc]) -m4trace:configure.ac:149: -1- m4_pattern_allow([^malloc$]) -m4trace:configure.ac:149: -1- AH_OUTPUT([malloc], [/* Define to rpl_malloc if the replacement function should be used. */ +m4trace:configure.ac:161: -1- AC_DEFINE_TRACE_LITERAL([HAVE_MALLOC]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^HAVE_MALLOC$]) +m4trace:configure.ac:161: -1- AC_LIBSOURCE([malloc.c]) +m4trace:configure.ac:161: -1- AC_SUBST([LIB@&t@OBJS], ["$LIB@&t@OBJS malloc.$ac_objext"]) +m4trace:configure.ac:161: -1- AC_SUBST_TRACE([LIB@&t@OBJS]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^LIB@&t@OBJS$]) +m4trace:configure.ac:161: -1- AC_DEFINE_TRACE_LITERAL([malloc]) +m4trace:configure.ac:161: -1- m4_pattern_allow([^malloc$]) +m4trace:configure.ac:161: -1- AH_OUTPUT([malloc], [/* Define to rpl_malloc if the replacement function should be used. */ @%:@undef malloc]) -m4trace:configure.ac:150: -1- AC_DEFINE_TRACE_LITERAL([TIME_WITH_SYS_TIME]) -m4trace:configure.ac:150: -1- m4_pattern_allow([^TIME_WITH_SYS_TIME$]) -m4trace:configure.ac:150: -1- AH_OUTPUT([TIME_WITH_SYS_TIME], [/* Define to 1 if you can safely include both and . */ +m4trace:configure.ac:162: -1- AC_DEFINE_TRACE_LITERAL([TIME_WITH_SYS_TIME]) +m4trace:configure.ac:162: -1- m4_pattern_allow([^TIME_WITH_SYS_TIME$]) +m4trace:configure.ac:162: -1- AH_OUTPUT([TIME_WITH_SYS_TIME], [/* Define to 1 if you can safely include both and . */ @%:@undef TIME_WITH_SYS_TIME]) -m4trace:configure.ac:150: -1- AH_OUTPUT([HAVE_SYS_TIME_H], [/* Define to 1 if you have the header file. */ +m4trace:configure.ac:162: -1- AH_OUTPUT([HAVE_SYS_TIME_H], [/* Define to 1 if you have the header file. */ @%:@undef HAVE_SYS_TIME_H]) -m4trace:configure.ac:150: -1- AH_OUTPUT([HAVE_UNISTD_H], [/* Define to 1 if you have the header file. */ +m4trace:configure.ac:162: -1- AH_OUTPUT([HAVE_UNISTD_H], [/* Define to 1 if you have the header file. */ @%:@undef HAVE_UNISTD_H]) -m4trace:configure.ac:150: -1- AH_OUTPUT([HAVE_ALARM], [/* Define to 1 if you have the `alarm\' function. */ +m4trace:configure.ac:162: -1- AH_OUTPUT([HAVE_ALARM], [/* Define to 1 if you have the `alarm\' function. */ @%:@undef HAVE_ALARM]) -m4trace:configure.ac:150: -1- AC_LIBSOURCE([mktime.c]) -m4trace:configure.ac:150: -1- AC_SUBST([LIB@&t@OBJS], ["$LIB@&t@OBJS mktime.$ac_objext"]) -m4trace:configure.ac:150: -1- AC_SUBST_TRACE([LIB@&t@OBJS]) -m4trace:configure.ac:150: -1- m4_pattern_allow([^LIB@&t@OBJS$]) -m4trace:configure.ac:151: -1- AH_OUTPUT([HAVE_STDLIB_H], [/* Define to 1 if you have the header file. */ +m4trace:configure.ac:162: -1- AC_LIBSOURCE([mktime.c]) +m4trace:configure.ac:162: -1- AC_SUBST([LIB@&t@OBJS], ["$LIB@&t@OBJS mktime.$ac_objext"]) +m4trace:configure.ac:162: -1- AC_SUBST_TRACE([LIB@&t@OBJS]) +m4trace:configure.ac:162: -1- m4_pattern_allow([^LIB@&t@OBJS$]) +m4trace:configure.ac:163: -1- AH_OUTPUT([HAVE_STDLIB_H], [/* Define to 1 if you have the header file. */ @%:@undef HAVE_STDLIB_H]) -m4trace:configure.ac:151: -1- AC_DEFINE_TRACE_LITERAL([HAVE_STDLIB_H]) -m4trace:configure.ac:151: -1- m4_pattern_allow([^HAVE_STDLIB_H$]) -m4trace:configure.ac:151: -1- AC_DEFINE_TRACE_LITERAL([HAVE_REALLOC]) -m4trace:configure.ac:151: -1- m4_pattern_allow([^HAVE_REALLOC$]) -m4trace:configure.ac:151: -1- AH_OUTPUT([HAVE_REALLOC], [/* Define to 1 if your system has a GNU libc compatible `realloc\' function, +m4trace:configure.ac:163: -1- AC_DEFINE_TRACE_LITERAL([HAVE_STDLIB_H]) +m4trace:configure.ac:163: -1- m4_pattern_allow([^HAVE_STDLIB_H$]) +m4trace:configure.ac:163: -1- AC_DEFINE_TRACE_LITERAL([HAVE_REALLOC]) +m4trace:configure.ac:163: -1- m4_pattern_allow([^HAVE_REALLOC$]) +m4trace:configure.ac:163: -1- AH_OUTPUT([HAVE_REALLOC], [/* Define to 1 if your system has a GNU libc compatible `realloc\' function, and to 0 otherwise. */ @%:@undef HAVE_REALLOC]) -m4trace:configure.ac:151: -1- AC_DEFINE_TRACE_LITERAL([HAVE_REALLOC]) -m4trace:configure.ac:151: -1- m4_pattern_allow([^HAVE_REALLOC$]) -m4trace:configure.ac:151: -1- AC_LIBSOURCE([realloc.c]) -m4trace:configure.ac:151: -1- AC_SUBST([LIB@&t@OBJS], ["$LIB@&t@OBJS realloc.$ac_objext"]) -m4trace:configure.ac:151: -1- AC_SUBST_TRACE([LIB@&t@OBJS]) -m4trace:configure.ac:151: -1- m4_pattern_allow([^LIB@&t@OBJS$]) -m4trace:configure.ac:151: -1- AC_DEFINE_TRACE_LITERAL([realloc]) -m4trace:configure.ac:151: -1- m4_pattern_allow([^realloc$]) -m4trace:configure.ac:151: -1- AH_OUTPUT([realloc], [/* Define to rpl_realloc if the replacement function should be used. */ +m4trace:configure.ac:163: -1- AC_DEFINE_TRACE_LITERAL([HAVE_REALLOC]) +m4trace:configure.ac:163: -1- m4_pattern_allow([^HAVE_REALLOC$]) +m4trace:configure.ac:163: -1- AC_LIBSOURCE([realloc.c]) +m4trace:configure.ac:163: -1- AC_SUBST([LIB@&t@OBJS], ["$LIB@&t@OBJS realloc.$ac_objext"]) +m4trace:configure.ac:163: -1- AC_SUBST_TRACE([LIB@&t@OBJS]) +m4trace:configure.ac:163: -1- m4_pattern_allow([^LIB@&t@OBJS$]) +m4trace:configure.ac:163: -1- AC_DEFINE_TRACE_LITERAL([realloc]) +m4trace:configure.ac:163: -1- m4_pattern_allow([^realloc$]) +m4trace:configure.ac:163: -1- AH_OUTPUT([realloc], [/* Define to rpl_realloc if the replacement function should be used. */ @%:@undef realloc]) -m4trace:configure.ac:152: -1- AH_OUTPUT([HAVE_MEMMOVE], [/* Define to 1 if you have the `memmove\' function. */ +m4trace:configure.ac:164: -1- AH_OUTPUT([HAVE_MEMMOVE], [/* Define to 1 if you have the `memmove\' function. */ @%:@undef HAVE_MEMMOVE]) -m4trace:configure.ac:152: -1- AH_OUTPUT([HAVE_MEMSET], [/* Define to 1 if you have the `memset\' function. */ +m4trace:configure.ac:164: -1- AH_OUTPUT([HAVE_MEMSET], [/* Define to 1 if you have the `memset\' function. */ @%:@undef HAVE_MEMSET]) -m4trace:configure.ac:152: -1- AH_OUTPUT([HAVE_REGCOMP], [/* Define to 1 if you have the `regcomp\' function. */ +m4trace:configure.ac:164: -1- AH_OUTPUT([HAVE_REGCOMP], [/* Define to 1 if you have the `regcomp\' function. */ @%:@undef HAVE_REGCOMP]) -m4trace:configure.ac:152: -1- AH_OUTPUT([HAVE_STRCASECMP], [/* Define to 1 if you have the `strcasecmp\' function. */ +m4trace:configure.ac:164: -1- AH_OUTPUT([HAVE_STRCASECMP], [/* Define to 1 if you have the `strcasecmp\' function. */ @%:@undef HAVE_STRCASECMP]) -m4trace:configure.ac:152: -1- AH_OUTPUT([HAVE_STRDUP], [/* Define to 1 if you have the `strdup\' function. */ +m4trace:configure.ac:164: -1- AH_OUTPUT([HAVE_STRDUP], [/* Define to 1 if you have the `strdup\' function. */ @%:@undef HAVE_STRDUP]) -m4trace:configure.ac:152: -1- AH_OUTPUT([HAVE_STRSTR], [/* Define to 1 if you have the `strstr\' function. */ +m4trace:configure.ac:164: -1- AH_OUTPUT([HAVE_STRSTR], [/* Define to 1 if you have the `strstr\' function. */ @%:@undef HAVE_STRSTR]) -m4trace:configure.ac:152: -1- AH_OUTPUT([HAVE_STRTOL], [/* Define to 1 if you have the `strtol\' function. */ +m4trace:configure.ac:164: -1- AH_OUTPUT([HAVE_STRTOL], [/* Define to 1 if you have the `strtol\' function. */ @%:@undef HAVE_STRTOL]) -m4trace:configure.ac:152: -1- AH_OUTPUT([HAVE_STRTOUL], [/* Define to 1 if you have the `strtoul\' function. */ +m4trace:configure.ac:164: -1- AH_OUTPUT([HAVE_STRTOUL], [/* Define to 1 if you have the `strtoul\' function. */ @%:@undef HAVE_STRTOUL]) -m4trace:configure.ac:154: -1- AC_DEFINE_TRACE_LITERAL([VERSION]) -m4trace:configure.ac:154: -1- m4_pattern_allow([^VERSION$]) -m4trace:configure.ac:154: -1- AH_OUTPUT([VERSION], [/* Module version */ +m4trace:configure.ac:166: -1- AC_DEFINE_TRACE_LITERAL([VERSION]) +m4trace:configure.ac:166: -1- m4_pattern_allow([^VERSION$]) +m4trace:configure.ac:166: -1- AH_OUTPUT([VERSION], [/* Module version */ @%:@undef VERSION]) -m4trace:configure.ac:155: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE]) -m4trace:configure.ac:155: -1- m4_pattern_allow([^PACKAGE$]) -m4trace:configure.ac:155: -1- AH_OUTPUT([PACKAGE], [/* Package name */ +m4trace:configure.ac:167: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE]) +m4trace:configure.ac:167: -1- m4_pattern_allow([^PACKAGE$]) +m4trace:configure.ac:167: -1- AH_OUTPUT([PACKAGE], [/* Package name */ @%:@undef PACKAGE]) -m4trace:configure.ac:156: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE_BUGREPORT]) -m4trace:configure.ac:156: -1- m4_pattern_allow([^PACKAGE_BUGREPORT$]) -m4trace:configure.ac:156: -1- AH_OUTPUT([PACKAGE_BUGREPORT], [/* Bug report address */ +m4trace:configure.ac:168: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE_BUGREPORT]) +m4trace:configure.ac:168: -1- m4_pattern_allow([^PACKAGE_BUGREPORT$]) +m4trace:configure.ac:168: -1- AH_OUTPUT([PACKAGE_BUGREPORT], [/* Bug report address */ @%:@undef PACKAGE_BUGREPORT]) -m4trace:configure.ac:157: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE_NAME]) -m4trace:configure.ac:157: -1- m4_pattern_allow([^PACKAGE_NAME$]) -m4trace:configure.ac:157: -1- AH_OUTPUT([PACKAGE_NAME], [/* Package full name */ +m4trace:configure.ac:169: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE_NAME]) +m4trace:configure.ac:169: -1- m4_pattern_allow([^PACKAGE_NAME$]) +m4trace:configure.ac:169: -1- AH_OUTPUT([PACKAGE_NAME], [/* Package full name */ @%:@undef PACKAGE_NAME]) -m4trace:configure.ac:158: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE_STRING]) -m4trace:configure.ac:158: -1- m4_pattern_allow([^PACKAGE_STRING$]) -m4trace:configure.ac:158: -1- AH_OUTPUT([PACKAGE_STRING], [/* Package string */ +m4trace:configure.ac:170: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE_STRING]) +m4trace:configure.ac:170: -1- m4_pattern_allow([^PACKAGE_STRING$]) +m4trace:configure.ac:170: -1- AH_OUTPUT([PACKAGE_STRING], [/* Package string */ @%:@undef PACKAGE_STRING]) -m4trace:configure.ac:159: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE_TARNAME]) -m4trace:configure.ac:159: -1- m4_pattern_allow([^PACKAGE_TARNAME$]) -m4trace:configure.ac:159: -1- AH_OUTPUT([PACKAGE_TARNAME], [/* Package tarname */ +m4trace:configure.ac:171: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE_TARNAME]) +m4trace:configure.ac:171: -1- m4_pattern_allow([^PACKAGE_TARNAME$]) +m4trace:configure.ac:171: -1- AH_OUTPUT([PACKAGE_TARNAME], [/* Package tarname */ @%:@undef PACKAGE_TARNAME]) -m4trace:configure.ac:160: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE_VERSION]) -m4trace:configure.ac:160: -1- m4_pattern_allow([^PACKAGE_VERSION$]) -m4trace:configure.ac:160: -1- AH_OUTPUT([PACKAGE_VERSION], [/* Package version */ +m4trace:configure.ac:172: -1- AC_DEFINE_TRACE_LITERAL([PACKAGE_VERSION]) +m4trace:configure.ac:172: -1- m4_pattern_allow([^PACKAGE_VERSION$]) +m4trace:configure.ac:172: -1- AH_OUTPUT([PACKAGE_VERSION], [/* Package version */ @%:@undef PACKAGE_VERSION]) -m4trace:configure.ac:161: -1- AC_DEFINE_TRACE_LITERAL([SUP_IP6]) -m4trace:configure.ac:161: -1- m4_pattern_allow([^SUP_IP6$]) -m4trace:configure.ac:161: -1- AH_OUTPUT([SUP_IP6], [/* Use SUP_IP6 */ +m4trace:configure.ac:173: -1- AC_DEFINE_TRACE_LITERAL([SUP_IP6]) +m4trace:configure.ac:173: -1- m4_pattern_allow([^SUP_IP6$]) +m4trace:configure.ac:173: -1- AH_OUTPUT([SUP_IP6], [/* Use SUP_IP6 */ @%:@undef SUP_IP6]) -m4trace:configure.ac:163: -1- AC_DEFINE_TRACE_LITERAL([HAVE_VISIBILITY]) -m4trace:configure.ac:163: -1- m4_pattern_allow([^HAVE_VISIBILITY$]) -m4trace:configure.ac:163: -1- AH_OUTPUT([HAVE_VISIBILITY], [/* Check if the compiler supports visibility */ +m4trace:configure.ac:175: -1- AC_DEFINE_TRACE_LITERAL([HAVE_VISIBILITY]) +m4trace:configure.ac:175: -1- m4_pattern_allow([^HAVE_VISIBILITY$]) +m4trace:configure.ac:175: -1- AH_OUTPUT([HAVE_VISIBILITY], [/* Check if the compiler supports visibility */ @%:@undef HAVE_VISIBILITY]) -m4trace:configure.ac:164: -1- AC_DEFINE_TRACE_LITERAL([PREFIX]) -m4trace:configure.ac:164: -1- m4_pattern_allow([^PREFIX$]) -m4trace:configure.ac:164: -1- AH_OUTPUT([PREFIX], [/* Installation prefix */ +m4trace:configure.ac:176: -1- AC_DEFINE_TRACE_LITERAL([PREFIX]) +m4trace:configure.ac:176: -1- m4_pattern_allow([^PREFIX$]) +m4trace:configure.ac:176: -1- AH_OUTPUT([PREFIX], [/* Installation prefix */ @%:@undef PREFIX]) -m4trace:configure.ac:166: -1- AC_CONFIG_FILES([Makefile]) -m4trace:configure.ac:167: -1- AC_SUBST([LIB@&t@OBJS], [$ac_libobjs]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([LIB@&t@OBJS]) -m4trace:configure.ac:167: -1- m4_pattern_allow([^LIB@&t@OBJS$]) -m4trace:configure.ac:167: -1- AC_SUBST([LTLIBOBJS], [$ac_ltlibobjs]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([LTLIBOBJS]) -m4trace:configure.ac:167: -1- m4_pattern_allow([^LTLIBOBJS$]) -m4trace:configure.ac:167: -1- AM_CONDITIONAL([am__EXEEXT], [test -n "$EXEEXT"]) -m4trace:configure.ac:167: -1- AC_SUBST([am__EXEEXT_TRUE]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([am__EXEEXT_TRUE]) -m4trace:configure.ac:167: -1- m4_pattern_allow([^am__EXEEXT_TRUE$]) -m4trace:configure.ac:167: -1- AC_SUBST([am__EXEEXT_FALSE]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([am__EXEEXT_FALSE]) -m4trace:configure.ac:167: -1- m4_pattern_allow([^am__EXEEXT_FALSE$]) -m4trace:configure.ac:167: -1- _AM_SUBST_NOTMAKE([am__EXEEXT_TRUE]) -m4trace:configure.ac:167: -1- _AM_SUBST_NOTMAKE([am__EXEEXT_FALSE]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([top_builddir]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([top_build_prefix]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([srcdir]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([abs_srcdir]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([top_srcdir]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([abs_top_srcdir]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([builddir]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([abs_builddir]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([abs_top_builddir]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([INSTALL]) -m4trace:configure.ac:167: -1- AC_SUBST_TRACE([MKDIR_P]) -m4trace:configure.ac:167: -1- AC_REQUIRE_AUX_FILE([ltmain.sh]) +m4trace:configure.ac:178: -1- AC_CONFIG_FILES([Makefile]) +m4trace:configure.ac:179: -1- AC_SUBST([LIB@&t@OBJS], [$ac_libobjs]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([LIB@&t@OBJS]) +m4trace:configure.ac:179: -1- m4_pattern_allow([^LIB@&t@OBJS$]) +m4trace:configure.ac:179: -1- AC_SUBST([LTLIBOBJS], [$ac_ltlibobjs]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([LTLIBOBJS]) +m4trace:configure.ac:179: -1- m4_pattern_allow([^LTLIBOBJS$]) +m4trace:configure.ac:179: -1- AM_CONDITIONAL([am__EXEEXT], [test -n "$EXEEXT"]) +m4trace:configure.ac:179: -1- AC_SUBST([am__EXEEXT_TRUE]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([am__EXEEXT_TRUE]) +m4trace:configure.ac:179: -1- m4_pattern_allow([^am__EXEEXT_TRUE$]) +m4trace:configure.ac:179: -1- AC_SUBST([am__EXEEXT_FALSE]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([am__EXEEXT_FALSE]) +m4trace:configure.ac:179: -1- m4_pattern_allow([^am__EXEEXT_FALSE$]) +m4trace:configure.ac:179: -1- _AM_SUBST_NOTMAKE([am__EXEEXT_TRUE]) +m4trace:configure.ac:179: -1- _AM_SUBST_NOTMAKE([am__EXEEXT_FALSE]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([top_builddir]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([top_build_prefix]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([srcdir]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([abs_srcdir]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([top_srcdir]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([abs_top_srcdir]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([builddir]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([abs_builddir]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([abs_top_builddir]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([INSTALL]) +m4trace:configure.ac:179: -1- AC_SUBST_TRACE([MKDIR_P]) +m4trace:configure.ac:179: -1- AC_REQUIRE_AUX_FILE([ltmain.sh]) diff --git a/config.h.in b/config.h.in index eb0217f..9f5e748 100644 --- a/config.h.in +++ b/config.h.in @@ -17,12 +17,6 @@ /* Define to 1 if using `alloca.c'. */ #undef C_ALLOCA -/* Define if you want to enable database support */ -#undef ENABLE_DB - -/* Define if you want to use MySQL */ -#undef ENABLE_MYSQL - /* Define if FreeBSD */ #undef FREEBSD @@ -36,6 +30,9 @@ */ #undef HAVE_ALLOCA_H +/* Define to 1 if the system has the type `boolean'. */ +#undef HAVE_BOOLEAN + /* Define to 1 if you have the header file. */ #undef HAVE_DLFCN_H @@ -54,6 +51,15 @@ /* Define to 1 if you have the header file. */ #undef HAVE_INTTYPES_H +/* Define to 1 if you have the `gvc' library (-lgvc). */ +#undef HAVE_LIBGVC + +/* Define to 1 if you have the `m' library (-lm). */ +#undef HAVE_LIBM + +/* Define to 1 if you have the `mysqlclient' library (-lmysqlclient). */ +#undef HAVE_LIBMYSQLCLIENT + /* Define to 1 if you have the `pthread' library (-lpthread). */ #undef HAVE_LIBPTHREAD @@ -67,6 +73,9 @@ to 0 otherwise. */ #undef HAVE_MALLOC +/* Define to 1 if you have the header file. */ +#undef HAVE_MATH_H + /* Define to 1 if you have the `memmove' function. */ #undef HAVE_MEMMOVE diff --git a/configure b/configure index f55037b..414474d 100755 --- a/configure +++ b/configure @@ -751,9 +751,9 @@ am__EXEEXT_TRUE LTLIBOBJS LIBOBJS ALLOCA +LIBGRAPH_INCLUDES LIBXML2_INCLUDES CORR_RULES_PREFIX -MYSQL extra_incl CPP OTOOL64 @@ -871,6 +871,7 @@ enable_dependency_tracking with_gnu_ld enable_libtool_lock with_mysql +with_graphviz ' ac_precious_vars='build_alias host_alias @@ -1517,6 +1518,8 @@ Optional Packages: both] --with-gnu-ld assume the C compiler uses GNU ld [default=no] --with-mysql Enable support for MySQL alert logs [default=no] + --without-graphviz Disable Graphviz support for rendering correlated + alerts as a PNG graph [default=yes] Some influential environment variables: CC C compiler command @@ -4582,13 +4585,13 @@ if test "${lt_cv_nm_interface+set}" = set; then : else lt_cv_nm_interface="BSD nm" echo "int some_variable = 0;" > conftest.$ac_ext - (eval echo "\"\$as_me:4585: $ac_compile\"" >&5) + (eval echo "\"\$as_me:4588: $ac_compile\"" >&5) (eval "$ac_compile" 2>conftest.err) cat conftest.err >&5 - (eval echo "\"\$as_me:4588: $NM \\\"conftest.$ac_objext\\\"\"" >&5) + (eval echo "\"\$as_me:4591: $NM \\\"conftest.$ac_objext\\\"\"" >&5) (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out) cat conftest.err >&5 - (eval echo "\"\$as_me:4591: output\"" >&5) + (eval echo "\"\$as_me:4594: output\"" >&5) cat conftest.out >&5 if $GREP 'External.*some_variable' conftest.out > /dev/null; then lt_cv_nm_interface="MS dumpbin" @@ -5794,7 +5797,7 @@ ia64-*-hpux*) ;; *-*-irix6*) # Find out which ABI we are using. - echo '#line 5797 "configure"' > conftest.$ac_ext + echo '#line 5800 "configure"' > conftest.$ac_ext if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5 (eval $ac_compile) 2>&5 ac_status=$? @@ -7319,11 +7322,11 @@ else -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:7322: $lt_compile\"" >&5) + (eval echo "\"\$as_me:7325: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:7326: \$? = $ac_status" >&5 + echo "$as_me:7329: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings other than the usual output. @@ -7658,11 +7661,11 @@ else -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:7661: $lt_compile\"" >&5) + (eval echo "\"\$as_me:7664: $lt_compile\"" >&5) (eval "$lt_compile" 2>conftest.err) ac_status=$? cat conftest.err >&5 - echo "$as_me:7665: \$? = $ac_status" >&5 + echo "$as_me:7668: \$? = $ac_status" >&5 if (exit $ac_status) && test -s "$ac_outfile"; then # The compiler can only warn and ignore the option if not recognized # So say no if there are warnings other than the usual output. @@ -7763,11 +7766,11 @@ else -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:7766: $lt_compile\"" >&5) + (eval echo "\"\$as_me:7769: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:7770: \$? = $ac_status" >&5 + echo "$as_me:7773: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -7818,11 +7821,11 @@ else -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \ -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \ -e 's:$: $lt_compiler_flag:'` - (eval echo "\"\$as_me:7821: $lt_compile\"" >&5) + (eval echo "\"\$as_me:7824: $lt_compile\"" >&5) (eval "$lt_compile" 2>out/conftest.err) ac_status=$? cat out/conftest.err >&5 - echo "$as_me:7825: \$? = $ac_status" >&5 + echo "$as_me:7828: \$? = $ac_status" >&5 if (exit $ac_status) && test -s out/conftest2.$ac_objext then # The compiler can only warn and ignore the option if not recognized @@ -10202,7 +10205,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF -#line 10205 "configure" +#line 10208 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -10298,7 +10301,7 @@ else lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2 lt_status=$lt_dlunknown cat > conftest.$ac_ext <<_LT_EOF -#line 10301 "configure" +#line 10304 "configure" #include "confdefs.h" #if HAVE_DLFCN_H @@ -11369,6 +11372,15 @@ else fi + +# Check whether --with-graphviz was given. +if test "${with_graphviz+set}" = set; then : + withval=$with_graphviz; +else + with_graphviz=yes +fi + + # Checks for libraries. if test "x$with_mysql" != xno; then : { $as_echo "$as_me:${as_lineno-$LINENO}: checking for mysql_query in -lmysqlclient" >&5 @@ -11377,7 +11389,7 @@ if test "${ac_cv_lib_mysqlclient_mysql_query+set}" = set; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS -LIBS="-lmysqlclient -lmysqlclient $LIBS" +LIBS="-lmysqlclient $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ @@ -11408,22 +11420,70 @@ fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_mysqlclient_mysql_query" >&5 $as_echo "$ac_cv_lib_mysqlclient_mysql_query" >&6; } if test "x$ac_cv_lib_mysqlclient_mysql_query" = x""yes; then : - MYSQL="-lmysqlclient" - - -$as_echo "#define ENABLE_MYSQL 1" >>confdefs.h - - -$as_echo "#define ENABLE_DB 1" >>confdefs.h + cat >>confdefs.h <<_ACEOF +#define HAVE_LIBMYSQLCLIENT 1 +_ACEOF + LIBS="-lmysqlclient $LIBS" else - if test "x$with_mysql" != xno; then - { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} -as_fn_error $? "--with-mysql option used, but libmysqlclient was not found +as_fn_error $? "--with-mysql option used, but libmysqlclient was not found - do not use --with-mysql, or, on a Debian-based system, install libmysqlclient-dev +See \`config.log' for more details" "$LINENO" 5 ; } +fi + +fi + +if test "x$with_graphviz" != xno; then : + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for agread in -lgvc" >&5 +$as_echo_n "checking for agread in -lgvc... " >&6; } +if test "${ac_cv_lib_gvc_agread+set}" = set; then : + $as_echo_n "(cached) " >&6 +else + ac_check_lib_save_LIBS=$LIBS +LIBS="-lgvc $LIBS" +cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +/* Override any GCC internal prototype to avoid an error. + Use char because int might match the return type of a GCC + builtin and then its argument prototype would still apply. */ +#ifdef __cplusplus +extern "C" +#endif +char agread (); +int +main () +{ +return agread (); + ; + return 0; +} +_ACEOF +if ac_fn_c_try_link "$LINENO"; then : + ac_cv_lib_gvc_agread=yes +else + ac_cv_lib_gvc_agread=no +fi +rm -f core conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +LIBS=$ac_check_lib_save_LIBS +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_gvc_agread" >&5 +$as_echo "$ac_cv_lib_gvc_agread" >&6; } +if test "x$ac_cv_lib_gvc_agread" = x""yes; then : + cat >>confdefs.h <<_ACEOF +#define HAVE_LIBGVC 1 +_ACEOF + + LIBS="-lgvc $LIBS" + +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libgraphviz support required but the library was not found - use --without-graphviz if you do not want to enable the support for it, or, on a Debian-based system, install libgraphviz-dev See \`config.log' for more details" "$LINENO" 5 ; } - fi fi fi @@ -11471,6 +11531,11 @@ _ACEOF LIBS="-lxml2 $LIBS" +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libxml2 not found on the system +See \`config.log' for more details" "$LINENO" 5 ; } fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pthread_create in -lpthread" >&5 @@ -11516,6 +11581,61 @@ _ACEOF LIBS="-lpthread $LIBS" +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libpthread not found on the system +See \`config.log' for more details" "$LINENO" 5 ; } +fi + +{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for sqrt in -lm" >&5 +$as_echo_n "checking for sqrt in -lm... " >&6; } +if test "${ac_cv_lib_m_sqrt+set}" = set; then : + $as_echo_n "(cached) " >&6 +else + ac_check_lib_save_LIBS=$LIBS +LIBS="-lm $LIBS" +cat confdefs.h - <<_ACEOF >conftest.$ac_ext +/* end confdefs.h. */ + +/* Override any GCC internal prototype to avoid an error. + Use char because int might match the return type of a GCC + builtin and then its argument prototype would still apply. */ +#ifdef __cplusplus +extern "C" +#endif +char sqrt (); +int +main () +{ +return sqrt (); + ; + return 0; +} +_ACEOF +if ac_fn_c_try_link "$LINENO"; then : + ac_cv_lib_m_sqrt=yes +else + ac_cv_lib_m_sqrt=no +fi +rm -f core conftest.err conftest.$ac_objext \ + conftest$ac_exeext conftest.$ac_ext +LIBS=$ac_check_lib_save_LIBS +fi +{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_m_sqrt" >&5 +$as_echo "$ac_cv_lib_m_sqrt" >&6; } +if test "x$ac_cv_lib_m_sqrt" = x""yes; then : + cat >>confdefs.h <<_ACEOF +#define HAVE_LIBM 1 +_ACEOF + + LIBS="-lm $LIBS" + +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libm not found on the system +See \`config.log' for more details" "$LINENO" 5 ; } fi @@ -11539,6 +11659,24 @@ as_fn_error $? "libxml2 not found, okr pkg-config not working See \`config.log' for more details" "$LINENO" 5 ; } fi +if test "x$with_graphviz" != xno; then : + if test ! -z "`pkg-config --cflags libgraph 2> /dev/null`"; then : + LIBGRAPH_INCLUDES="$(pkg-config --cflags libgraph 2> /dev/null)" + +else + { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 +$as_echo "$as_me: error: in \`$ac_pwd':" >&2;} +as_fn_error $? "libgraphviz support enabled, but the library was not found or pkg-config is not working +See \`config.log' for more details" "$LINENO" 5 ; } +fi +fi + +if test "x$with_graphviz" != xno; then : + +$as_echo "#define HAVE_BOOLEAN 1" >>confdefs.h + +fi + # The Ultrix 4.2 mips builtin alloca declared by alloca.h only works # for constant arguments. Useless! { $as_echo "$as_me:${as_lineno-$LINENO}: checking for working alloca.h" >&5 @@ -11728,7 +11866,7 @@ _ACEOF fi -for ac_header in inttypes.h limits.h stddef.h stdlib.h string.h unistd.h wchar.h +for ac_header in inttypes.h limits.h stddef.h stdlib.h string.h unistd.h wchar.h math.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" @@ -11853,6 +11991,15 @@ cat >>confdefs.h <<_ACEOF _ACEOF +fi +ac_fn_c_check_type "$LINENO" "boolean" "ac_cv_type_boolean" "$ac_includes_default" +if test "x$ac_cv_type_boolean" = x""yes; then : + +cat >>confdefs.h <<_ACEOF +#define HAVE_BOOLEAN 1 +_ACEOF + + fi diff --git a/configure.ac b/configure.ac index 1b97ca3..b4b666a 100644 --- a/configure.ac +++ b/configure.ac @@ -105,20 +105,24 @@ AC_ARG_WITH(mysql, [with_mysql=yes], [with_mysql=no]) +AC_ARG_WITH(graphviz, + AS_HELP_STRING([--without-graphviz], + [Disable Graphviz support for rendering correlated alerts as a PNG graph @<:@default=yes@:>@]), + [], + [with_graphviz=yes]) + # Checks for libraries. AS_IF([test "x$with_mysql" != xno], - [AC_CHECK_LIB([mysqlclient], [mysql_query], - [AC_SUBST([MYSQL], ["-lmysqlclient"]) - AC_DEFINE(ENABLE_MYSQL, 1, [Define if you want to use MySQL]) - AC_DEFINE(ENABLE_DB, 1, [Define if you want to enable database support]) - ], - [if test "x$with_mysql" != xno; then - AC_MSG_FAILURE([--with-mysql option used, but libmysqlclient was not found]) - fi], - -lmysqlclient)]) + [AC_CHECK_LIB([mysqlclient], [mysql_query],, + [AC_MSG_FAILURE([--with-mysql option used, but libmysqlclient was not found - do not use --with-mysql, or, on a Debian-based system, install libmysqlclient-dev])])]) -AC_CHECK_LIB([xml2], [xmlReaderForFile]) -AC_CHECK_LIB([pthread], [pthread_create]) +AS_IF([test "x$with_graphviz" != xno], + [AC_CHECK_LIB([gvc], [agread],, + [AC_MSG_FAILURE([libgraphviz support required but the library was not found - use --without-graphviz if you do not want to enable the support for it, or, on a Debian-based system, install libgraphviz-dev])])]) + +AC_CHECK_LIB([xml2], [xmlReaderForFile],, AC_MSG_FAILURE(libxml2 not found on the system)) +AC_CHECK_LIB([pthread], [pthread_create],, AC_MSG_FAILURE(libpthread not found on the system)) +AC_CHECK_LIB([m], [sqrt],, AC_MSG_FAILURE(libm not found on the system)) AS_IF([test "x$prefix" == x/usr], [AC_SUBST([CORR_RULES_PREFIX], ["/etc/snort/corr_rules"])], @@ -130,12 +134,20 @@ AS_IF([test ! -z "`pkg-config --cflags libxml-2.0 2> /dev/null`"], [AC_SUBST([LIBXML2_INCLUDES], ["$(pkg-config --cflags libxml-2.0 2> /dev/null)"])], [AC_MSG_FAILURE([libxml2 not found, okr pkg-config not working])]) +AS_IF([test "x$with_graphviz" != xno], + [AS_IF([test ! -z "`pkg-config --cflags libgraph 2> /dev/null`"], + [AC_SUBST([LIBGRAPH_INCLUDES], ["$(pkg-config --cflags libgraph 2> /dev/null)"])], + [AC_MSG_FAILURE([libgraphviz support enabled, but the library was not found or pkg-config is not working])])]) + +AS_IF([test "x$with_graphviz" != xno], + [AC_DEFINE([HAVE_BOOLEAN], [1], [Check if the boolean type is defined])]) + AC_FUNC_ALLOCA -AC_CHECK_HEADERS([inttypes.h limits.h stddef.h stdlib.h string.h unistd.h wchar.h],,AC_MSG_ERROR(At least one of the required headers was not found)) +AC_CHECK_HEADERS([inttypes.h limits.h stddef.h stdlib.h string.h unistd.h wchar.h math.h],,AC_MSG_ERROR(At least one of the required headers was not found)) # Check for int types AC_CHECK_TYPES([u_int8_t,u_int16_t,u_int32_t,u_int64_t,uint8_t,uint16_t,uint32_t,uint64_t]) -AC_CHECK_TYPES([int8_t,int16_t,int32_t,int64_t]) +AC_CHECK_TYPES([int8_t,int16_t,int32_t,int64_t,boolean]) # Checks for typedefs, structures, and compiler characteristics. AC_HEADER_STDBOOL diff --git a/corr_rules/1-1394-12.xml b/corr_rules/1-1394-12.xml new file mode 100644 index 0000000..77cca0f --- /dev/null +++ b/corr_rules/1-1394-12.xml @@ -0,0 +1,13 @@ + + + + + 1.1394.12 + Shellcode x86 inc ecx noop + + 
HostExists(+DST_ADDR+)
+ 
HasService(+DST_ADDR+, +DST_PORT+)
+ + HasLocalAccess(+SRC_ADDR+, +DST_ADDR+) + + diff --git a/corr_rules/1-469-4.xml b/corr_rules/1-469-4.xml index a50f5eb..3d56a42 100644 --- a/corr_rules/1-469-4.xml +++ b/corr_rules/1-469-4.xml @@ -1,8 +1,9 @@ - + 1.469.4 + ICMP PING NMAP HostExists(+DST_ADDR+) diff --git a/corr_rules/122-1-0.xml b/corr_rules/122-1-0.xml index 3af5755..a7ba04e 100644 --- a/corr_rules/122-1-0.xml +++ b/corr_rules/122-1-0.xml @@ -1,9 +1,11 @@ - + 122.1.0 + (portscan) TCP Portscan + 
HostExists(+DST_ADDR+)
- HasVulnService(+DST_ADDR+, +ANY_PORT+) + HasService(+DST_ADDR+, +ANY_PORT+) diff --git a/correlation.c b/correlation.c index be3b037..a1fbaf2 100644 --- a/correlation.c +++ b/correlation.c @@ -19,34 +19,51 @@ #include "spp_ai.h" +#include +#include +#include #include +#include +#include +#include #include #include #include +#ifdef HAVE_LIBGVC + #include +#endif + /** \defgroup correlation Module for the correlation of hyperalerts * @{ */ #ifndef LIBXML_READER_ENABLED -#error "libxml reader not enabled\n" +#error "libxml2 reader not enabled\n" #endif /** Enumeration for the types of XML tags */ enum { inHyperAlert, inSnortIdTag, inPreTag, inPostTag, TAG_NUM }; -/** Struct representing the correlation between all the couples of alerts */ +/** Key for the correlation hash table */ typedef struct { /** First alert */ AI_snort_alert *a; /** Second alert */ AI_snort_alert *b; +} AI_alert_correlation_key; + + +/** Struct representing the correlation between all the couples of alerts */ +typedef struct { + /** Hash key */ + AI_alert_correlation_key key; /** Correlation coefficient */ - double correlation; + double correlation; /** Make the struct 'hashable' */ - UT_hash_handle hh; + UT_hash_handle hh; } AI_alert_correlation; PRIVATE AI_hyperalert_info *hyperalerts = NULL; @@ -55,6 +72,195 @@ PRIVATE AI_snort_alert *alerts = NULL; PRIVATE AI_alert_correlation *correlation_table = NULL; PRIVATE BOOL lock_flag = false; +/** + * \brief Clean up the correlation hash table + */ +PRIVATE void +_AI_correlation_table_cleanup () +{ + AI_alert_correlation *current; + + while ( correlation_table ) + { + current = correlation_table; + HASH_DEL ( correlation_table, current ); + free ( current ); + } +} /* ----- end of function _AI_correlation_table_cleanup ----- */ + +/** + * \brief Recursively write a flow of correlated alerts to a .dot file, ready for being rendered as graph + * \param corr_alerts Correlated alerts + * \param fp File pointer + */ +PRIVATE void +_AI_print_correlated_alerts ( AI_alert_correlation *corr, FILE *fp ) +{ + char src_addr1[INET_ADDRSTRLEN], + dst_addr1[INET_ADDRSTRLEN], + src_addr2[INET_ADDRSTRLEN], + dst_addr2[INET_ADDRSTRLEN], + src_port1[10], + dst_port1[10], + src_port2[10], + dst_port2[10], + timestamp1[40], + timestamp2[40]; + + struct tm *t1, *t2; + + if ( !corr ) + return; + + inet_ntop ( AF_INET, &(corr->key.a->ip_src_addr), src_addr1, INET_ADDRSTRLEN ); + inet_ntop ( AF_INET, &(corr->key.a->ip_dst_addr), dst_addr1, INET_ADDRSTRLEN ); + + snprintf ( src_port1, sizeof ( src_port1 ), "%d", ntohs ( corr->key.a->tcp_src_port )); + snprintf ( dst_port1, sizeof ( dst_port1 ), "%d", ntohs ( corr->key.a->tcp_dst_port )); + + t1 = localtime ( &(corr->key.a->timestamp )); + strftime ( timestamp1, sizeof ( timestamp1 ), "%a %b %d %Y, %H:%M:%S", t1 ); + + inet_ntop ( AF_INET, &(corr->key.b->ip_src_addr), src_addr2, INET_ADDRSTRLEN ); + inet_ntop ( AF_INET, &(corr->key.b->ip_dst_addr), dst_addr2, INET_ADDRSTRLEN ); + + snprintf ( src_port2, sizeof ( src_port2 ), "%d", ntohs ( corr->key.b->tcp_src_port )); + snprintf ( dst_port2, sizeof ( dst_port2 ), "%d", ntohs ( corr->key.b->tcp_dst_port )); + + t2 = localtime ( &(corr->key.b->timestamp )); + strftime ( timestamp2, sizeof ( timestamp2 ), "%a %b %d %Y, %H:%M:%S", t2 ); + + fprintf ( fp, + "\t\"[%d.%d.%d] %s\\n" + "%s%s%s:%s%s%s -> %s%s%s:%s%s%s\\n" + "%s\\n" + "(%d alerts grouped)\" -> " + + "\"[%d.%d.%d] %s\\n" + "%s%s%s:%s%s%s -> %s%s%s:%s%s%s\\n" + "%s\\n" + "(%d alerts grouped)\";\n", + + corr->key.a->gid, corr->key.a->sid, corr->key.a->rev, corr->key.a->desc, + + ( corr->key.a->h_node[src_addr] ) ? "[" : "", + ( corr->key.a->h_node[src_addr] ) ? corr->key.a->h_node[src_addr]->label : src_addr1, + ( corr->key.a->h_node[src_addr] ) ? "]" : "", + + ( corr->key.a->h_node[src_port] ) ? "[" : "", + ( corr->key.a->h_node[src_port] ) ? corr->key.a->h_node[src_port]->label : src_port1, + ( corr->key.a->h_node[src_port] ) ? "]" : "", + + ( corr->key.a->h_node[dst_addr] ) ? "[" : "", + ( corr->key.a->h_node[dst_addr] ) ? corr->key.a->h_node[dst_addr]->label : dst_addr1, + ( corr->key.a->h_node[dst_addr] ) ? "]" : "", + + ( corr->key.a->h_node[dst_port] ) ? "[" : "", + ( corr->key.a->h_node[dst_port] ) ? corr->key.a->h_node[dst_port]->label : dst_port1, + ( corr->key.a->h_node[dst_port] ) ? "]" : "", + + timestamp1, + corr->key.a->grouped_alarms_count, + + + corr->key.b->gid, corr->key.b->sid, corr->key.b->rev, corr->key.b->desc, + + ( corr->key.b->h_node[src_addr] ) ? "[" : "", + ( corr->key.b->h_node[src_addr] ) ? corr->key.b->h_node[src_addr]->label : src_addr2, + ( corr->key.b->h_node[src_addr] ) ? "]" : "", + + ( corr->key.b->h_node[src_port] ) ? "[" : "", + ( corr->key.b->h_node[src_port] ) ? corr->key.b->h_node[src_port]->label : src_port2, + ( corr->key.b->h_node[src_port] ) ? "]" : "", + + ( corr->key.b->h_node[dst_addr] ) ? "[" : "", + ( corr->key.b->h_node[dst_addr] ) ? corr->key.b->h_node[dst_addr]->label : dst_addr2, + ( corr->key.b->h_node[dst_addr] ) ? "]" : "", + + ( corr->key.b->h_node[dst_port] ) ? "[" : "", + ( corr->key.b->h_node[dst_port] ) ? corr->key.b->h_node[dst_port]->label : dst_port2, + ( corr->key.b->h_node[dst_port] ) ? "]" : "", + + timestamp2, + corr->key.b->grouped_alarms_count + ); +} /* ----- end of function _AI_correlation_flow_to_file ----- */ + + +/** + * \brief Get the name of the function called by a pre-condition or post-condition predicate + * \param orig_stmt Statement representing a pre-condition or post-condition + * \return The name of the function called by that statement + */ +PRIVATE char* +_AI_get_function_name ( const char *orig_stmt ) +{ + int parenthesis_pos, function_name_len; + char function_name[4096]; + char *stmt = NULL; + + if ( !( stmt = (char*) alloca ( strlen ( orig_stmt )))) + return NULL; + strcpy ( stmt, orig_stmt ); + + memset ( function_name, 0, sizeof ( function_name )); + + if ( !( parenthesis_pos = (int) strstr ( stmt, "(" ))) + return NULL; + + parenthesis_pos -= (int) stmt; + function_name_len = ( parenthesis_pos < sizeof ( function_name )) ? parenthesis_pos : sizeof ( function_name ); + strncpy ( function_name, stmt, function_name_len ); + + return strdup(function_name); +} /* ----- end of function _AI_get_function_name ----- */ + + +/** + * FUNCTION: _AI_get_function_arguments + * \brief Get the arguments passed to a function predicate in a pre-condition or post-condition (comma-separated values) + * \param origstmt Statement representing a pre-condition or post-condition + * \param n_args Reference to an integer that will contain the number of arguments read + * \return An array of strings containing the arguments of the function + */ +PRIVATE char** +_AI_get_function_arguments ( char *orig_stmt, int *n_args ) +{ + char **args = NULL; + char *tok = NULL; + char *stmt = NULL; + int par_pos = 0; + *n_args = 0; + + if ( !( stmt = (char*) alloca ( strlen ( orig_stmt )))) + return NULL; + strcpy ( stmt, orig_stmt ); + + if ( !( par_pos = (int) strstr ( stmt, "(" ))) + return NULL; + + par_pos -= (int) stmt; + stmt += par_pos + 1; + + if ( stmt [ strlen(stmt) - 1 ] == ')' ) + stmt[ strlen(stmt) - 1 ] = 0; + + tok = (char*) strtok ( stmt, "," ); + + while ( tok ) { + if ( !( args = (char**) realloc ( args, (++(*n_args)) * sizeof ( char* )))) + _dpd.fatalMsg ( "AIPreproc: Fatal memory allocation error at %s:%d\n", __FILE__, __LINE__ ); + + args [ (*n_args) - 1 ] = strdup ( tok ); + tok = (char*) strtok ( NULL, " " ); + } + + if ( !(*n_args) ) + return NULL; + + return args; +} /* ----- end of function _AI_get_function_arguments ----- */ + /** * \brief Compute the correlation coefficient between two alerts, as #INTERSECTION(pre(B), post(A) / #UNION(pre(B), post(A)) * \param a Alert a @@ -62,13 +268,23 @@ PRIVATE BOOL lock_flag = false; * \return The correlation coefficient between A and B as coefficient in [0,1] */ -double +PRIVATE double _AI_correlation_coefficient ( AI_snort_alert *a, AI_snort_alert *b ) { - unsigned int i, j, + unsigned int i, j, k, n_intersection = 0, n_union = 0; + char **args1 = NULL, + **args2 = NULL, + *function_name1 = NULL, + *function_name2 = NULL, + new_stmt1[4096] = {0}, + new_stmt2[4096] = {0}; + + int n_args1 = 0, + n_args2 = 0; + if ( !a->hyperalert || !b->hyperalert ) return 0.0; @@ -84,6 +300,100 @@ _AI_correlation_coefficient ( AI_snort_alert *a, AI_snort_alert *b ) if ( !strcasecmp ( a->hyperalert->postconds[i], b->hyperalert->preconds[j] )) { n_intersection += 2; + } else { + /* Check if the predicates are the same, have the same number of arguments, and + * substitute possible occurrencies of +ANY_ADDR+ and +ANY_PORT+ */ + function_name1 = _AI_get_function_name ( a->hyperalert->postconds[i] ); + function_name2 = _AI_get_function_name ( b->hyperalert->preconds[j] ); + + if ( !strcasecmp ( function_name1, function_name2 )) + { + args1 = _AI_get_function_arguments ( a->hyperalert->postconds[i], &n_args1 ); + args2 = _AI_get_function_arguments ( b->hyperalert->preconds[j] , &n_args2 ); + + if ( args1 && args2 ) + { + if ( n_args1 == n_args2 ) + { + memset ( new_stmt1, 0, sizeof ( new_stmt1 )); + memset ( new_stmt2, 0, sizeof ( new_stmt2 )); + + for ( k=0; k < n_args1; k++ ) + { + if ( !strcasecmp ( args1[k], "+ANY_ADDR+" ) || !strcasecmp ( args1[k], "+ANY_PORT+" )) + { + free ( args1[k] ); + args1[k] = args2[k]; + } + + if ( !strcasecmp ( args2[k], "+ANY_ADDR+" ) || !strcasecmp ( args2[k], "+ANY_PORT+" )) + { + free ( args2[k] ); + args2[k] = args1[k]; + } + } + + snprintf ( new_stmt1, sizeof ( new_stmt1 ), "%s(", function_name1 ); + snprintf ( new_stmt2, sizeof ( new_stmt2 ), "%s(", function_name2 ); + + for ( k=0; k < n_args1; k++ ) + { + if ( strlen ( new_stmt1 ) + strlen ( args1[k] ) + 1 < sizeof ( new_stmt1 )) + sprintf ( new_stmt1, "%s%s%s", new_stmt1, args1[k], ( k < n_args1 - 1 ) ? "," : ")" ); + + if ( strlen ( new_stmt2 ) + strlen ( args2[k] ) + 1 < sizeof ( new_stmt2 )) + sprintf ( new_stmt2, "%s%s%s", new_stmt2, args2[k], ( k < n_args2 - 1 ) ? "," : ")" ); + } + + if ( !strcmp ( new_stmt1, new_stmt2 )) + { + n_intersection += 2; + } + } + + for ( k=0; k < n_args1; k++ ) + { + if ( args1[k] ) + { + free ( args1[k] ); + args1[k] = NULL; + } + } + + if ( args1 ) + { + free ( args1 ); + args1 = NULL; + } + + for ( k=0; k < n_args2; k++ ) + { + if ( args2[k] ) + { + /* free ( args2[k] ); */ + args2[k] = NULL; + } + } + + if ( args2 ) + { + free ( args2 ); + args2 = NULL; + } + } + } + + if ( function_name1 ) + { + free ( function_name1 ); + function_name1 = NULL; + } + + if ( function_name2 ) + { + free ( function_name2 ); + function_name2 = NULL; + } } } } @@ -91,12 +401,13 @@ _AI_correlation_coefficient ( AI_snort_alert *a, AI_snort_alert *b ) return (double) ((double) n_intersection / (double) n_union ); } /* ----- end of function _AI_correlation_coefficient ----- */ + /** * \brief Substitute the macros in hyperalert pre-conditions and post-conditions with their associated values * \param alert Reference to the hyperalert to work on */ -void +PRIVATE void _AI_macro_subst ( AI_snort_alert **alert ) { /* @@ -130,12 +441,6 @@ _AI_macro_subst ( AI_snort_alert **alert ) free ( tmp ); } - if ( strstr ( (*alert)->hyperalert->preconds[i], "+ANY_ADDR+" )) { - tmp = (*alert)->hyperalert->preconds[i]; - (*alert)->hyperalert->preconds[i] = str_replace ( (*alert)->hyperalert->preconds[i], "+ANY_ADDR+", "0.0.0.0" ); - free ( tmp ); - } - if ( strstr ( (*alert)->hyperalert->preconds[i], "+SRC_PORT+" )) { snprintf ( src_port, sizeof ( src_port ), "%d", ntohs ((*alert)->tcp_src_port) ); tmp = (*alert)->hyperalert->preconds[i]; @@ -149,12 +454,6 @@ _AI_macro_subst ( AI_snort_alert **alert ) (*alert)->hyperalert->preconds[i] = str_replace ( (*alert)->hyperalert->preconds[i], "+DST_PORT+", dst_port ); free ( tmp ); } - - if ( strstr ( (*alert)->hyperalert->preconds[i], "+ANY_PORT+" )) { - tmp = (*alert)->hyperalert->preconds[i]; - (*alert)->hyperalert->preconds[i] = str_replace ( (*alert)->hyperalert->preconds[i], "+ANY_PORT+", "0" ); - free ( tmp ); - } } for ( i=0; i < (*alert)->hyperalert->n_postconds; i++ ) @@ -178,11 +477,11 @@ _AI_macro_subst ( AI_snort_alert **alert ) free ( tmp ); } - if ( strstr ( (*alert)->hyperalert->postconds[i], "+ANY_ADDR+" )) { - tmp = (*alert)->hyperalert->postconds[i]; - (*alert)->hyperalert->postconds[i] = str_replace ( (*alert)->hyperalert->postconds[i], "+ANY_ADDR+", "0.0.0.0" ); - free ( tmp ); - } + /* if ( strstr ( (*alert)->hyperalert->postconds[i], "+ANY_ADDR+" )) { */ + /* tmp = (*alert)->hyperalert->postconds[i]; */ + /* (*alert)->hyperalert->postconds[i] = str_replace ( (*alert)->hyperalert->postconds[i], "+ANY_ADDR+", "0.0.0.0" ); */ + /* free ( tmp ); */ + /* } */ if ( strstr ( (*alert)->hyperalert->postconds[i], "+SRC_PORT+" )) { snprintf ( src_port, sizeof ( src_port ), "%d", ntohs ((*alert)->tcp_src_port) ); @@ -198,11 +497,11 @@ _AI_macro_subst ( AI_snort_alert **alert ) free ( tmp ); } - if ( strstr ( (*alert)->hyperalert->postconds[i], "+ANY_PORT+" )) { - tmp = (*alert)->hyperalert->postconds[i]; - (*alert)->hyperalert->postconds[i] = str_replace ( (*alert)->hyperalert->postconds[i], "+ANY_PORT+", "0" ); - free ( tmp ); - } + /* if ( strstr ( (*alert)->hyperalert->postconds[i], "+ANY_PORT+" )) { */ + /* tmp = (*alert)->hyperalert->postconds[i]; */ + /* (*alert)->hyperalert->postconds[i] = str_replace ( (*alert)->hyperalert->postconds[i], "+ANY_PORT+", "0" ); */ + /* free ( tmp ); */ + /* } */ } } /* ----- end of function _AI_macro_subst ----- */ @@ -277,7 +576,8 @@ _AI_hyperalert_from_XML ( AI_hyperalert_key key ) _dpd.fatalMsg ( "AIPreproc: Error in XML file '%s': 'post' tag open outside of 'hyperalert' tag\n", hyperalert_file ); else xmlFlags[inPostTag] = true; - } else { + } else if ( !strcasecmp ((const char*) tagname, "desc" )) {} + else { _dpd.fatalMsg ( "AIPreproc: Unrecognized tag '%s' in XML file '%s'\n", tagname, hyperalert_file ); } } else if ( xmlTextReaderNodeType ( xml ) == XML_READER_TYPE_END_ELEMENT ) { @@ -302,7 +602,8 @@ _AI_hyperalert_from_XML ( AI_hyperalert_key key ) _dpd.fatalMsg ( "AIPreproc: Error in XML file '%s': post tag closed but never opend\n", hyperalert_file ); else xmlFlags[inPostTag] = false; - } else { + } else if ( !strcasecmp ((const char*) tagname, "desc" )) {} + else { _dpd.fatalMsg ( "AIPreproc: Unrecognized tag '%s' in XML file '%s'\n", tagname, hyperalert_file ); } } else if ( xmlTextReaderNodeType ( xml ) == XML_READER_TYPE_TEXT ) { @@ -350,15 +651,30 @@ _AI_hyperalert_from_XML ( AI_hyperalert_key key ) void* AI_alert_correlation_thread ( void *arg ) { - int i; - struct stat st; - AI_hyperalert_key key; - AI_hyperalert_info *hyp = NULL; - AI_snort_alert *alert_iterator = NULL, - *alert_iterator2 = NULL; + int i; + struct stat st; + char corr_dot_file[4096] = { 0 }; - FILE *fp = fopen ( "/home/blacklight/LOG", "w" ); - fclose ( fp ); + double avg_correlation = 0.0, + std_deviation = 0.0, + corr_threshold = 0.0; + + FILE *fp = NULL; + + AI_alert_correlation_key corr_key; + AI_alert_correlation *corr = NULL; + + AI_hyperalert_key key; + AI_hyperalert_info *hyp = NULL; + + AI_snort_alert *alert_iterator = NULL, + *alert_iterator2 = NULL; + + #ifdef HAVE_LIBGVC + char corr_png_file[4096] = { 0 }; + GVC_t *gvc = NULL; + graph_t *g = NULL; + #endif conf = (AI_config*) arg; @@ -431,20 +747,109 @@ AI_alert_correlation_thread ( void *arg ) _AI_macro_subst ( &alert_iterator ); } + _AI_correlation_table_cleanup(); + correlation_table = NULL; + for ( alert_iterator = alerts; alert_iterator; alert_iterator = alert_iterator->next ) { for ( alert_iterator2 = alerts; alert_iterator2; alert_iterator2 = alert_iterator2->next ) { - if ( alert_iterator != alert_iterator2 ) + if ( alert_iterator != alert_iterator2 && ! ( + alert_iterator->gid == alert_iterator2->gid && + alert_iterator->sid == alert_iterator2->sid && + alert_iterator->rev == alert_iterator2->rev )) { - fp = fopen ( "/home/blacklight/LOG", "a" ); - fprintf ( fp, "alert1: (%s), alert2: (%s)\n", alert_iterator->desc, alert_iterator2->desc ); - fprintf ( fp, "correlation (alert1, alert2): %f\n\n", _AI_correlation_coefficient ( alert_iterator, alert_iterator2 )); - fclose ( fp ); + if ( !( corr = ( AI_alert_correlation* ) malloc ( sizeof ( AI_alert_correlation )))) + _dpd.fatalMsg ( "AIPreproc: Fatal memory allocation error at %s:%d\n", __FILE__, __LINE__ ); + + corr_key.a = alert_iterator; + corr_key.b = alert_iterator2; + + corr->key = corr_key; + corr->correlation = _AI_correlation_coefficient ( corr_key.a, corr_key.b ); + HASH_ADD ( hh, correlation_table, key, sizeof ( AI_alert_correlation_key ), corr ); } } } + if ( HASH_COUNT ( correlation_table ) > 0 ) + { + avg_correlation = 0.0; + std_deviation = 0.0; + + /* Compute the average correlation coefficient */ + for ( corr = correlation_table; corr; corr = ( AI_alert_correlation* ) corr->hh.next ) + { + avg_correlation += corr->correlation; + } + + avg_correlation /= (double) HASH_COUNT ( correlation_table ); + + /* Compute the standard deviation */ + for ( corr = correlation_table; corr; corr = ( AI_alert_correlation* ) corr->hh.next ) + { + std_deviation += ( corr->correlation - avg_correlation ) * ( corr->correlation - avg_correlation ); + } + + std_deviation = sqrt ( std_deviation / (double) HASH_COUNT ( correlation_table )); + corr_threshold = avg_correlation + ( conf->correlationThresholdCoefficient * std_deviation ); + snprintf ( corr_dot_file, sizeof ( corr_dot_file ), "%s/correlated_alerts.dot", conf->corr_alerts_dir ); + + if ( stat ( conf->corr_alerts_dir, &st ) < 0 ) + { + if ( mkdir ( conf->corr_alerts_dir, 0755 ) < 0 ) + { + _dpd.fatalMsg ( "AIPreproc: Unable to create directory '%s'\n", conf->corr_alerts_dir ); + } + } + + if ( !( fp = fopen ( corr_dot_file, "w" ))) + _dpd.fatalMsg ( "AIPreproc: Could not write on file '%s'\n", corr_dot_file ); + fprintf ( fp, "digraph G {\n" ); + + /* Find correlated alerts */ + for ( corr = correlation_table; corr; corr = ( AI_alert_correlation* ) corr->hh.next ) + { + if ( corr->correlation >= avg_correlation + std_deviation && + avg_correlation + std_deviation != 0.0 && + corr->key.a->timestamp <= corr->key.b->timestamp && ! ( + corr->key.a->gid == corr->key.b->gid && + corr->key.a->sid == corr->key.b->sid && + corr->key.a->rev == corr->key.b->rev )) + { + if ( !( corr->key.a->derived_alerts = ( AI_snort_alert** ) realloc ( corr->key.a->derived_alerts, (++corr->key.a->n_derived_alerts) * sizeof ( AI_snort_alert* )))) + _dpd.fatalMsg ( "AIPreproc: Fatal memory allocation error at %s:%d\n", __FILE__, __LINE__ ); + + corr->key.a->derived_alerts[ corr->key.a->n_derived_alerts - 1 ] = corr->key.b; + corr->key.b->previous_correlated = corr->key.a; + _AI_print_correlated_alerts ( corr, fp ); + } + } + + fprintf ( fp, "}\n" ); + fclose ( fp ); + + #ifdef HAVE_LIBGVC + snprintf ( corr_png_file, sizeof ( corr_png_file ), "%s/correlated_alerts.png", conf->corr_alerts_dir ); + + if ( !( gvc = gvContext() )) + continue; + + if ( !( fp = fopen ( corr_dot_file, "r" ))) + continue; + + if ( !( g = agread ( fp ))) + continue; + + gvLayout ( gvc, g, "dot" ); + gvRenderFilename ( gvc, g, "png", corr_png_file ); + + gvFreeLayout ( gvc, g ); + agclose ( g ); + fclose ( fp ); + #endif + } + lock_flag = false; } diff --git a/db.c b/db.c index 1f84741..aa35de1 100644 --- a/db.c +++ b/db.c @@ -18,7 +18,7 @@ */ #include "spp_ai.h" -#ifdef ENABLE_DB +#ifdef HAVE_LIBMYSQLCLIENT #include "db.h" diff --git a/db.h b/db.h index ca2f0d6..8aafad5 100644 --- a/db.h +++ b/db.h @@ -17,23 +17,21 @@ * ===================================================================================== */ -#ifdef ENABLE_DB +#ifdef HAVE_LIBMYSQLCLIENT #ifndef _AI_DB_H #define _AI_DB_H - #ifdef ENABLE_MYSQL - #include + #include - typedef MYSQL_RES* DB_result; - typedef MYSQL_ROW DB_row; + typedef MYSQL_RES* DB_result; + typedef MYSQL_ROW DB_row; - #define DB_init mysql_do_init - #define DB_query mysql_do_query - #define DB_num_rows mysql_num_rows - #define DB_fetch_row mysql_fetch_row - #define DB_free_result mysql_free_result - #define DB_close mysql_do_close - #endif + #define DB_init mysql_do_init + #define DB_query mysql_do_query + #define DB_num_rows mysql_num_rows + #define DB_fetch_row mysql_fetch_row + #define DB_free_result mysql_free_result + #define DB_close mysql_do_close /** Initializer for the database */ void* DB_init ( AI_config* ); diff --git a/doc/html/alert__parser_8c.html b/doc/html/alert__parser_8c.html index a14b5c1..d41aadb 100644 --- a/doc/html/alert__parser_8c.html +++ b/doc/html/alert__parser_8c.html @@ -132,7 +132,7 @@ Variables -
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/annotated.html b/doc/html/annotated.html index 07f1117..9578362 100644 --- a/doc/html/annotated.html +++ b/doc/html/annotated.html @@ -55,6 +55,7 @@ Here are the data structures with brief descriptions: + @@ -78,7 +79,7 @@ Here are the data structures with brief descriptions:
_AI_snort_alert
_hierarchy_node
AI_alert_correlation
AI_alert_correlation_key
AI_config
AI_hyperalert_info
AI_hyperalert_key
-
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/classes.html b/doc/html/classes.html index e0f7525..6084476 100644 --- a/doc/html/classes.html +++ b/doc/html/classes.html @@ -54,9 +54,9 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
A | P | _
  A  
-		AI_hyperalert_info   attribute_value   pkt_key   _AI_snort_alert   
AI_alert_correlation   AI_hyperalert_key   
  P  
+		AI_config   attribute_key   pkt_info   _AI_snort_alert   
AI_alert_correlation   AI_hyperalert_info   attribute_value   pkt_key   _hierarchy_node   
AI_alert_correlation_key   AI_hyperalert_key   
  P  
  _  
-		_hierarchy_node   
AI_config   attribute_key   pkt_info   
A | P | _
+
A | P | _
-
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/cluster_8c.html b/doc/html/cluster_8c.html index f7ab9a1..7277b05 100644 --- a/doc/html/cluster_8c.html +++ b/doc/html/cluster_8c.html @@ -112,7 +112,7 @@ Variables -
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/correlation_8c.html b/doc/html/correlation_8c.html index 1beff00..25a23d3 100644 --- a/doc/html/correlation_8c.html +++ b/doc/html/correlation_8c.html @@ -56,13 +56,20 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
#include "spp_ai.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
#include <unistd.h>
+#include <time.h>
+#include <math.h>
+#include <alloca.h>
#include <sys/stat.h>
#include <pthread.h>
#include <libxml/xmlreader.h>
+ @@ -77,10 +84,18 @@ Enumerations } - - - - + + + + + + + + + + + + @@ -108,7 +123,7 @@ Variables -
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/db_8c.html b/doc/html/db_8c.html index 86340f0..1665130 100644 --- a/doc/html/db_8c.html +++ b/doc/html/db_8c.html @@ -68,7 +68,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/db_8h.html b/doc/html/db_8h.html index e0815a0..37bd7fb 100644 --- a/doc/html/db_8h.html +++ b/doc/html/db_8h.html @@ -69,7 +69,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/db_8h_source.html b/doc/html/db_8h_source.html index 98340db..387b3f9 100644 --- a/doc/html/db_8h_source.html +++ b/doc/html/db_8h_source.html @@ -68,33 +68,31 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); 00017 * ===================================================================================== 00018 */ 00019 -00020 #ifdef ENABLE_DB +00020 #ifdef HAVE_LIBMYSQLCLIENT 00021 #ifndef _AI_DB_H 00022 #define _AI_DB_H 00023 -00024 #ifdef ENABLE_MYSQL -00025 #include <mysql/mysql.h> -00026 -00027 typedef MYSQL_RES* DB_result; -00028 typedef MYSQL_ROW DB_row; -00029 -00030 #define DB_init mysql_do_init -00031 #define DB_query mysql_do_query -00032 #define DB_num_rows mysql_num_rows -00033 #define DB_fetch_row mysql_fetch_row -00034 #define DB_free_result mysql_free_result -00035 #define DB_close mysql_do_close -00036 #endif -00037 -00039 void* DB_init ( AI_config* ); -00040 -00042 DB_result* DB_query ( const char* ); -00043 -00045 void DB_close(); -00046 -00047 #endif -00048 #endif -00049 +00024 #include <mysql/mysql.h> +00025 +00026 typedef MYSQL_RES* DB_result; +00027 typedef MYSQL_ROW DB_row; +00028 +00029 #define DB_init mysql_do_init +00030 #define DB_query mysql_do_query +00031 #define DB_num_rows mysql_num_rows +00032 #define DB_fetch_row mysql_fetch_row +00033 #define DB_free_result mysql_free_result +00034 #define DB_close mysql_do_close +00035 +00037 void* DB_init ( AI_config* ); +00038 +00040 DB_result* DB_query ( const char* ); +00041 +00043 void DB_close(); +00044 +00045 #endif +00046 #endif +00047 @@ -111,7 +109,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/files.html b/doc/html/files.html index 50ac166..a702470 100644 --- a/doc/html/files.html +++ b/doc/html/files.html @@ -78,7 +78,7 @@ Here is a list of all files with brief descriptions:

Data Structures

struct  AI_alert_correlation_key
struct  AI_alert_correlation

Enumerations

Functions

double _AI_correlation_coefficient (AI_snort_alert *a, AI_snort_alert *b)
 Compute the correlation coefficient between two alerts, as INTERSECTION(pre(B), post(A) / UNION(pre(B), post(A)).
void _AI_macro_subst (AI_snort_alert **alert)
 Substitute the macros in hyperalert pre-conditions and post-conditions with their associated values.
PRIVATE void _AI_correlation_table_cleanup ()
 Clean up the correlation hash table.
PRIVATE void _AI_print_correlated_alerts (AI_alert_correlation *corr, FILE *fp)
 Recursively write a flow of correlated alerts to a .dot file, ready for being rendered as graph.
PRIVATE char * _AI_get_function_name (const char *orig_stmt)
 Get the name of the function called by a pre-condition or post-condition predicate.
PRIVATE char ** _AI_get_function_arguments (char *orig_stmt, int *n_args)
 Get the arguments passed to a function predicate in a pre-condition or post-condition (comma-separated values).
PRIVATE double _AI_correlation_coefficient (AI_snort_alert *a, AI_snort_alert *b)
 Compute the correlation coefficient between two alerts, as INTERSECTION(pre(B), post(A) / UNION(pre(B), post(A)).
PRIVATE void _AI_macro_subst (AI_snort_alert **alert)
 Substitute the macros in hyperalert pre-conditions and post-conditions with their associated values.
PRIVATE AI_hyperalert_info * _AI_hyperalert_from_XML (AI_hyperalert_key key)
 Parse info about a hyperalert from a correlation XML file, if it exists.
void * AI_alert_correlation_thread (void *arg)
-
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/functions.html b/doc/html/functions.html index ff8c17e..292ef07 100644 --- a/doc/html/functions.html +++ b/doc/html/functions.html @@ -77,7 +77,7 @@ Here is a list of all struct and union fields with links to the structures/union

- a -

@@ -233,6 +243,9 @@ Here is a list of all struct and union fields with links to the structures/union

- n -

    +
  • n_derived_alerts +: _AI_snort_alert +
  • n_postconds : AI_hyperalert_info
    • @@ -269,6 +282,9 @@ Here is a list of all struct and union fields with links to the structures/union
  • preconds : AI_hyperalert_info
    • +
  • previous_correlated +: _AI_snort_alert +
  • priority : _AI_snort_alert
    • @@ -346,7 +362,7 @@ Here is a list of all struct and union fields with links to the structures/union -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/functions_vars.html b/doc/html/functions_vars.html index 64809be..f683a91 100644 --- a/doc/html/functions_vars.html +++ b/doc/html/functions_vars.html @@ -77,7 +77,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');

    - a -

    @@ -233,6 +243,9 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');

    - n -

      +
    • n_derived_alerts +: _AI_snort_alert +
    • n_postconds : AI_hyperalert_info
      • @@ -269,6 +282,9 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
    • preconds : AI_hyperalert_info
      • +
    • previous_correlated +: _AI_snort_alert +
    • priority : _AI_snort_alert
      • @@ -346,7 +362,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
      Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
      Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
      diff --git a/doc/html/globals.html b/doc/html/globals.html index 213f4ed..726115c 100644 --- a/doc/html/globals.html +++ b/doc/html/globals.html @@ -94,11 +94,20 @@ Here is a list of all functions, variables, defines, enums, and typedefs with li : cluster.c
    • _AI_correlation_coefficient() -: correlation.c +: correlation.c +
      • +
    • _AI_correlation_table_cleanup() +: correlation.c
    • _AI_equal_alarms() : cluster.c
      • +
    • _AI_get_function_arguments() +: correlation.c +
      • +
    • _AI_get_function_name() +: correlation.c +
    • _AI_get_min_hierarchy_node() : cluster.c
      • @@ -106,7 +115,7 @@ Here is a list of all functions, variables, defines, enums, and typedefs with li : correlation.c
    • _AI_macro_subst() -: correlation.c +: correlation.c
    • _AI_merge_alerts() : cluster.c @@ -114,6 +123,9 @@ Here is a list of all functions, variables, defines, enums, and typedefs with li
    • _AI_print_clustered_alerts() : cluster.c
      • +
    • _AI_print_correlated_alerts() +: correlation.c +
    • _AI_stream_free() : stream.c
      • @@ -247,9 +259,15 @@ Here is a list of all functions, variables, defines, enums, and typedefs with li
    • DEFAULT_CLUSTER_LOG_FILE : spp_ai.h
      • +
    • DEFAULT_CORR_ALERTS_DIR +: spp_ai.h +
    • DEFAULT_CORR_RULES_DIR : spp_ai.h
      • +
    • DEFAULT_CORR_THRESHOLD +: spp_ai.h +
    • DEFAULT_DATABASE_INTERVAL : spp_ai.h
      • @@ -424,7 +442,7 @@ Here is a list of all functions, variables, defines, enums, and typedefs with li -
      Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
      Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
      diff --git a/doc/html/globals_defs.html b/doc/html/globals_defs.html index 43e9788..ce5a454 100644 --- a/doc/html/globals_defs.html +++ b/doc/html/globals_defs.html @@ -73,9 +73,15 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
    • DEFAULT_CLUSTER_LOG_FILE : spp_ai.h
      • +
    • DEFAULT_CORR_ALERTS_DIR +: spp_ai.h +
    • DEFAULT_CORR_RULES_DIR : spp_ai.h
      • +
    • DEFAULT_CORR_THRESHOLD +: spp_ai.h +
    • DEFAULT_DATABASE_INTERVAL : spp_ai.h
      • @@ -116,7 +122,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
      Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
      Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
      diff --git a/doc/html/globals_enum.html b/doc/html/globals_enum.html index 1672b16..60d7b08 100644 --- a/doc/html/globals_enum.html +++ b/doc/html/globals_enum.html @@ -80,7 +80,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
      Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
      Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
      diff --git a/doc/html/globals_eval.html b/doc/html/globals_eval.html index a215cfc..54edfb6 100644 --- a/doc/html/globals_eval.html +++ b/doc/html/globals_eval.html @@ -113,7 +113,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
      Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
      Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
      diff --git a/doc/html/globals_func.html b/doc/html/globals_func.html index ca1f02f..f83ae1c 100644 --- a/doc/html/globals_func.html +++ b/doc/html/globals_func.html @@ -81,11 +81,20 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); : cluster.c
    • _AI_correlation_coefficient() -: correlation.c +: correlation.c +
      • +
    • _AI_correlation_table_cleanup() +: correlation.c
    • _AI_equal_alarms() : cluster.c
      • +
    • _AI_get_function_arguments() +: correlation.c +
      • +
    • _AI_get_function_name() +: correlation.c +
    • _AI_get_min_hierarchy_node() : cluster.c
      • @@ -93,7 +102,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); : correlation.c
    • _AI_macro_subst() -: correlation.c +: correlation.c
    • _AI_merge_alerts() : cluster.c @@ -101,6 +110,9 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
    • _AI_print_clustered_alerts() : cluster.c
      • +
    • _AI_print_correlated_alerts() +: correlation.c +
    • _AI_stream_free() : stream.c
      • @@ -206,7 +218,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
      Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
      Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
      diff --git a/doc/html/globals_type.html b/doc/html/globals_type.html index 96c84e6..38ae5b9 100644 --- a/doc/html/globals_type.html +++ b/doc/html/globals_type.html @@ -89,7 +89,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
      Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
      Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
      diff --git a/doc/html/globals_vars.html b/doc/html/globals_vars.html index 6ac306f..6da6e99 100644 --- a/doc/html/globals_vars.html +++ b/doc/html/globals_vars.html @@ -125,7 +125,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
      Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
      Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
      diff --git a/doc/html/group__alert__parser.html b/doc/html/group__alert__parser.html index 44c5005..2f4ef53 100644 --- a/doc/html/group__alert__parser.html +++ b/doc/html/group__alert__parser.html @@ -174,7 +174,7 @@ Functions -
      Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
      Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
      diff --git a/doc/html/group__cluster.html b/doc/html/group__cluster.html index bd73f60..9f23ecb 100644 --- a/doc/html/group__cluster.html +++ b/doc/html/group__cluster.html @@ -541,7 +541,7 @@ Variables -
      Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
      Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
      diff --git a/doc/html/group__correlation.html b/doc/html/group__correlation.html index 66b98bc..7863eb5 100644 --- a/doc/html/group__correlation.html +++ b/doc/html/group__correlation.html @@ -52,6 +52,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search');
+ @@ -66,10 +67,18 @@ Enumerations } - - - - + + + + + + + + + + + + @@ -112,12 +121,12 @@ Variables

Function Documentation

- +

Data Structures

struct  AI_alert_correlation_key
struct  AI_alert_correlation

Enumerations

Functions

double _AI_correlation_coefficient (AI_snort_alert *a, AI_snort_alert *b)
 Compute the correlation coefficient between two alerts, as INTERSECTION(pre(B), post(A) / UNION(pre(B), post(A)).
void _AI_macro_subst (AI_snort_alert **alert)
 Substitute the macros in hyperalert pre-conditions and post-conditions with their associated values.
PRIVATE void _AI_correlation_table_cleanup ()
 Clean up the correlation hash table.
PRIVATE void _AI_print_correlated_alerts (AI_alert_correlation *corr, FILE *fp)
 Recursively write a flow of correlated alerts to a .dot file, ready for being rendered as graph.
PRIVATE char * _AI_get_function_name (const char *orig_stmt)
 Get the name of the function called by a pre-condition or post-condition predicate.
PRIVATE char ** _AI_get_function_arguments (char *orig_stmt, int *n_args)
 Get the arguments passed to a function predicate in a pre-condition or post-condition (comma-separated values).
PRIVATE double _AI_correlation_coefficient (AI_snort_alert *a, AI_snort_alert *b)
 Compute the correlation coefficient between two alerts, as INTERSECTION(pre(B), post(A) / UNION(pre(B), post(A)).
PRIVATE void _AI_macro_subst (AI_snort_alert **alert)
 Substitute the macros in hyperalert pre-conditions and post-conditions with their associated values.
PRIVATE AI_hyperalert_info * _AI_hyperalert_from_XML (AI_hyperalert_key key)
 Parse info about a hyperalert from a correlation XML file, if it exists.
void * AI_alert_correlation_thread (void *arg)
- + @@ -147,6 +156,90 @@ Variables
Returns:
The correlation coefficient between A and B as coefficient in [0,1]
+ + + +
+
+
double _AI_correlation_coefficient PRIVATE double _AI_correlation_coefficient ( AI_snort_alert *  a,
+ + + + + + + +
PRIVATE void _AI_correlation_table_cleanup ( ) 
+
+
+ +

Clean up the correlation hash table.

+ +
+ + +
+
+ + + + + + + + + + + + + + + + + + +
PRIVATE char** _AI_get_function_arguments (char *  orig_stmt,
int *  n_args 
)
+
+
+ +

Get the arguments passed to a function predicate in a pre-condition or post-condition (comma-separated values).

+

FUNCTION: _AI_get_function_arguments

+
Parameters:
+ + + +
origstmt Statement representing a pre-condition or post-condition
n_args Reference to an integer that will contain the number of arguments read
+
+
+
Returns:
An array of strings containing the arguments of the function
+ +
+
+ +
+
+ + + + + + + + + +
PRIVATE char* _AI_get_function_name (const char *  orig_stmt ) 
+
+
+ +

Get the name of the function called by a pre-condition or post-condition predicate.

+
Parameters:
+ + +
orig_stmt Statement representing a pre-condition or post-condition
+
+
+
Returns:
The name of the function called by that statement
+
@@ -176,12 +269,12 @@ Variables - +
- + @@ -200,6 +293,42 @@ Variables + + + +
+
+
void _AI_macro_subst PRIVATE void _AI_macro_subst ( AI_snort_alert **  alert
+ + + + + + + + + + + + + + + + + +
PRIVATE void _AI_print_correlated_alerts (AI_alert_correlation *  corr,
FILE *  fp 
)
+
+
+ +

Recursively write a flow of correlated alerts to a .dot file, ready for being rendered as graph.

+
Parameters:
+ + + +
corr_alerts Correlated alerts
fp File pointer
+
+
+
@@ -309,7 +438,7 @@ Variables -
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/group__regex.html b/doc/html/group__regex.html index 848c7dc..15479f3 100644 --- a/doc/html/group__regex.html +++ b/doc/html/group__regex.html @@ -211,7 +211,7 @@ Functions -
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/group__spp__ai.html b/doc/html/group__spp__ai.html index b142286..e9b8f0d 100644 --- a/doc/html/group__spp__ai.html +++ b/doc/html/group__spp__ai.html @@ -215,7 +215,7 @@ Variables -
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/group__stream.html b/doc/html/group__stream.html index 79d0e3e..8b9e5c1 100644 --- a/doc/html/group__stream.html +++ b/doc/html/group__stream.html @@ -207,7 +207,7 @@ Functions -
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/index.html b/doc/html/index.html index 79433dd..45b4f01 100644 --- a/doc/html/index.html +++ b/doc/html/index.html @@ -59,7 +59,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
diff --git a/doc/html/modules.html b/doc/html/modules.html index 7d8d85c..6727fa1 100644 --- a/doc/html/modules.html +++ b/doc/html/modules.html @@ -67,7 +67,7 @@ Here is a list of all modules:
    -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/mysql_8c.html b/doc/html/mysql_8c.html index 9f25937..2587eb4 100644 --- a/doc/html/mysql_8c.html +++ b/doc/html/mysql_8c.html @@ -68,7 +68,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/regex_8c.html b/doc/html/regex_8c.html index 8fe13d8..828d33b 100644 --- a/doc/html/regex_8c.html +++ b/doc/html/regex_8c.html @@ -82,7 +82,7 @@ Functions -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/search/all_5f.html b/doc/html/search/all_5f.html index 86c8c86..296f697 100644 --- a/doc/html/search/all_5f.html +++ b/doc/html/search/all_5f.html @@ -33,89 +33,113 @@
    - _AI_correlation_coefficient + _AI_correlation_coefficient + correlation.c +
    +
    +
    +
    + _AI_correlation_table_cleanup correlation.c
    - _AI_equal_alarms + _AI_equal_alarms cluster.c
    +
    +
    + _AI_get_function_arguments + correlation.c +
    +
    +
    +
    + _AI_get_function_name + correlation.c +
    +
    - _AI_get_min_hierarchy_node + _AI_get_min_hierarchy_node cluster.c
    - _AI_hyperalert_from_XML + _AI_hyperalert_from_XML correlation.c
    - _AI_macro_subst + _AI_macro_subst correlation.c
    - _AI_merge_alerts + _AI_merge_alerts cluster.c
    - _AI_print_clustered_alerts + _AI_print_clustered_alerts cluster.c
    +
    +
    + _AI_print_correlated_alerts + correlation.c +
    +
    - _AI_snort_alert + _AI_snort_alert
    - _AI_stream_free + _AI_stream_free stream.c
    - _config + _config cluster.c
    - _dpd + _dpd spp_ai.h
    - _heuristic_func + _heuristic_func cluster.c
    - _hierarchy_node + _hierarchy_node
    - _hierarchy_node_append + _hierarchy_node_append cluster.c
    - _hierarchy_node_new + _hierarchy_node_new cluster.c
    diff --git a/doc/html/search/all_61.html b/doc/html/search/all_61.html index 6118213..057065a 100644 --- a/doc/html/search/all_61.html +++ b/doc/html/search/all_61.html @@ -9,8 +9,8 @@
    Loading...
    - a - AI_alert_correlation + a + AI_alert_correlation_key
    @@ -18,196 +18,201 @@ AI_alert_correlation
    +
    - AI_init + AI_init spp_ai.c
    - AI_parse + AI_parse spp_ai.c
    - AI_process + AI_process spp_ai.c
    - alert_fp + alert_fp alert_parser.c
    - alert_log + alert_log cluster.c
    - alertfile + alertfile AI_config
    Searching...
    diff --git a/doc/html/search/all_62.html b/doc/html/search/all_62.html index c2641d0..d50c466 100644 --- a/doc/html/search/all_62.html +++ b/doc/html/search/all_62.html @@ -9,8 +9,8 @@
    Loading...
    - b - AI_alert_correlation + b + AI_alert_correlation_key
    diff --git a/doc/html/search/all_63.html b/doc/html/search/all_63.html index 434e40d..b0eb206 100644 --- a/doc/html/search/all_63.html +++ b/doc/html/search/all_63.html @@ -48,38 +48,50 @@ correlation.c
    +
    +
    + corr_alerts_dir + AI_config +
    +
    - correlation + correlation AI_alert_correlation
    +
    - count + count attribute_value
    diff --git a/doc/html/search/all_64.html b/doc/html/search/all_64.html index 5aeb99d..8a289e7 100644 --- a/doc/html/search/all_64.html +++ b/doc/html/search/all_64.html @@ -71,54 +71,72 @@ spp_ai.h +
    +
    + DEFAULT_CORR_ALERTS_DIR + spp_ai.h +
    +
    +
    +
    + DEFAULT_CORR_THRESHOLD spp_ai.h
    +
    +
    + derived_alerts + _AI_snort_alert +
    +
    - desc + desc _AI_snort_alert
    - dst_addr + dst_addr spp_ai.h
    diff --git a/doc/html/search/all_6b.html b/doc/html/search/all_6b.html index e263d30..71ed47b 100644 --- a/doc/html/search/all_6b.html +++ b/doc/html/search/all_6b.html @@ -12,8 +12,9 @@ key
    attribute_value::key() - pkt_info::key() - AI_hyperalert_info::key() + AI_alert_correlation::key() + pkt_info::key() + AI_hyperalert_info::key()
    diff --git a/doc/html/search/all_6e.html b/doc/html/search/all_6e.html index 39f8a22..60bba1a 100644 --- a/doc/html/search/all_6e.html +++ b/doc/html/search/all_6e.html @@ -7,36 +7,42 @@
    Loading...
    +
    +
    + n_derived_alerts + _AI_snort_alert +
    +
    - n_postconds + n_postconds AI_hyperalert_info
    - n_preconds + n_preconds AI_hyperalert_info
    - nchildren + nchildren _hierarchy_node
    - none + none spp_ai.h
    diff --git a/doc/html/search/all_70.html b/doc/html/search/all_70.html index f38df16..162e987 100644 --- a/doc/html/search/all_70.html +++ b/doc/html/search/all_70.html @@ -56,15 +56,21 @@ sf_preproc_info.h
    +
    +
    + previous_correlated + _AI_snort_alert +
    +
    - priority + priority _AI_snort_alert
    - PRIVATE + PRIVATE spp_ai.h
    diff --git a/doc/html/search/classes_61.html b/doc/html/search/classes_61.html index 76bef2d..08010ad 100644 --- a/doc/html/search/classes_61.html +++ b/doc/html/search/classes_61.html @@ -12,29 +12,34 @@ AI_alert_correlation +
    Searching...
    diff --git a/doc/html/search/defines_64.html b/doc/html/search/defines_64.html index 1d3cbb6..73b92a4 100644 --- a/doc/html/search/defines_64.html +++ b/doc/html/search/defines_64.html @@ -31,33 +31,45 @@ spp_ai.h +
    +
    + DEFAULT_CORR_ALERTS_DIR + spp_ai.h +
    +
    +
    +
    + DEFAULT_CORR_THRESHOLD spp_ai.h
    diff --git a/doc/html/search/functions_5f.html b/doc/html/search/functions_5f.html index 79b8cdd..694a2c8 100644 --- a/doc/html/search/functions_5f.html +++ b/doc/html/search/functions_5f.html @@ -33,67 +33,91 @@
    - _AI_correlation_coefficient + _AI_correlation_coefficient + correlation.c +
    +
    +
    +
    + _AI_correlation_table_cleanup correlation.c
    - _AI_equal_alarms + _AI_equal_alarms cluster.c
    +
    +
    + _AI_get_function_arguments + correlation.c +
    +
    +
    +
    + _AI_get_function_name + correlation.c +
    +
    - _AI_get_min_hierarchy_node + _AI_get_min_hierarchy_node cluster.c
    - _AI_hyperalert_from_XML + _AI_hyperalert_from_XML correlation.c
    - _AI_macro_subst + _AI_macro_subst correlation.c
    - _AI_merge_alerts + _AI_merge_alerts cluster.c
    - _AI_print_clustered_alerts + _AI_print_clustered_alerts cluster.c
    +
    +
    + _AI_print_correlated_alerts + correlation.c +
    +
    - _AI_stream_free + _AI_stream_free stream.c
    - _heuristic_func + _heuristic_func cluster.c
    - _hierarchy_node_append + _hierarchy_node_append cluster.c
    - _hierarchy_node_new + _hierarchy_node_new cluster.c
    diff --git a/doc/html/search/variables_61.html b/doc/html/search/variables_61.html index b52ce77..1c594f0 100644 --- a/doc/html/search/variables_61.html +++ b/doc/html/search/variables_61.html @@ -9,8 +9,8 @@
    Loading...
    - a - AI_alert_correlation + a + AI_alert_correlation_key
    diff --git a/doc/html/search/variables_62.html b/doc/html/search/variables_62.html index b7f6752..b1a3aac 100644 --- a/doc/html/search/variables_62.html +++ b/doc/html/search/variables_62.html @@ -9,8 +9,8 @@
    Loading...
    - b - AI_alert_correlation + b + AI_alert_correlation_key
    Searching...
    diff --git a/doc/html/search/variables_63.html b/doc/html/search/variables_63.html index 1458d07..ce9d637 100644 --- a/doc/html/search/variables_63.html +++ b/doc/html/search/variables_63.html @@ -31,33 +31,45 @@ correlation.c
    +
    +
    + corr_alerts_dir + AI_config +
    +
    - correlation + correlation AI_alert_correlation
    +
    - count + count attribute_value
    diff --git a/doc/html/search/variables_64.html b/doc/html/search/variables_64.html index dc21036..c697762 100644 --- a/doc/html/search/variables_64.html +++ b/doc/html/search/variables_64.html @@ -37,15 +37,21 @@ AI_config +
    +
    + derived_alerts + _AI_snort_alert +
    +
    - desc + desc _AI_snort_alert
    - dst_port + dst_port pkt_key
    diff --git a/doc/html/search/variables_6b.html b/doc/html/search/variables_6b.html index e263d30..71ed47b 100644 --- a/doc/html/search/variables_6b.html +++ b/doc/html/search/variables_6b.html @@ -12,8 +12,9 @@ key
    attribute_value::key() - pkt_info::key() - AI_hyperalert_info::key() + AI_alert_correlation::key() + pkt_info::key() + AI_hyperalert_info::key()
    diff --git a/doc/html/search/variables_6e.html b/doc/html/search/variables_6e.html index 7cecfd9..52ae779 100644 --- a/doc/html/search/variables_6e.html +++ b/doc/html/search/variables_6e.html @@ -7,30 +7,36 @@
    Loading...
    +
    +
    + n_derived_alerts + _AI_snort_alert +
    +
    - n_postconds + n_postconds AI_hyperalert_info
    - n_preconds + n_preconds AI_hyperalert_info
    - nchildren + nchildren _hierarchy_node
    diff --git a/doc/html/search/variables_70.html b/doc/html/search/variables_70.html index 83b5a59..7b48efc 100644 --- a/doc/html/search/variables_70.html +++ b/doc/html/search/variables_70.html @@ -31,9 +31,15 @@ AI_hyperalert_info
    +
    +
    + previous_correlated + _AI_snort_alert +
    +
    - priority + priority _AI_snort_alert
    diff --git a/doc/html/sf__preproc__info_8h.html b/doc/html/sf__preproc__info_8h.html index df44d6b..6934244 100644 --- a/doc/html/sf__preproc__info_8h.html +++ b/doc/html/sf__preproc__info_8h.html @@ -149,7 +149,7 @@ Functions -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/sf__preproc__info_8h_source.html b/doc/html/sf__preproc__info_8h_source.html index fc9c0d4..831d80b 100644 --- a/doc/html/sf__preproc__info_8h_source.html +++ b/doc/html/sf__preproc__info_8h_source.html @@ -78,7 +78,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/spp__ai_8c.html b/doc/html/spp__ai_8c.html index 1e37f99..a2e0601 100644 --- a/doc/html/spp__ai_8c.html +++ b/doc/html/spp__ai_8c.html @@ -89,7 +89,7 @@ Variables -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/spp__ai_8h.html b/doc/html/spp__ai_8h.html index f8963b8..4caf302 100644 --- a/doc/html/spp__ai_8h.html +++ b/doc/html/spp__ai_8h.html @@ -83,6 +83,8 @@ Defines #define DEFAULT_ALERT_LOG_FILE   "/var/log/snort/alert" #define DEFAULT_CLUSTER_LOG_FILE   "/var/log/snort/cluster_alert" #define DEFAULT_CORR_RULES_DIR   "/etc/snort/corr_rules" +#define DEFAULT_CORR_ALERTS_DIR   "/var/log/snort/correlated_alerts" +#define DEFAULT_CORR_THRESHOLD   0.5

    Typedefs

    typedef unsigned char uint8_t @@ -193,6 +195,20 @@ Variables

    Default path to Snort's clustered alerts file

    +
    + + +
    +
    + + + + +
    #define DEFAULT_CORR_ALERTS_DIR   "/var/log/snort/correlated_alerts"
    +
    +
    +

    Default directory for placing correlated alerts information (.dot and possibly .png files)

    +
    @@ -207,6 +223,20 @@ Variables

    Default path to alert correlation rules directory

    +
    + + +
    +
    + + + + +
    #define DEFAULT_CORR_THRESHOLD   0.5
    +
    +
    +

    Default correlation threshold coefficient for correlating two hyperalerts

    +
    @@ -427,7 +457,7 @@ Variables -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/spp__ai_8h_source.html b/doc/html/spp__ai_8h_source.html index 6558be1..5dc2853 100644 --- a/doc/html/spp__ai_8h_source.html +++ b/doc/html/spp__ai_8h_source.html @@ -97,171 +97,187 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); 00053 00055 #define DEFAULT_CORR_RULES_DIR "/etc/snort/corr_rules" 00056 -00057 extern DynamicPreprocessorData _dpd; -00058 typedef unsigned char uint8_t; -00059 typedef unsigned short uint16_t; -00060 typedef unsigned int uint32_t; -00061 -00062 typedef enum { false, true } BOOL; -00063 -00064 /*****************************************************************/ -00066 typedef enum { -00067 none, src_addr, dst_addr, src_port, dst_port, CLUSTER_TYPES -00068 } cluster_type; -00069 /*****************************************************************/ -00071 struct pkt_key -00072 { -00073 uint32_t src_ip; -00074 uint16_t dst_port; -00075 }; -00076 /*****************************************************************/ -00078 struct pkt_info -00079 { -00081 struct pkt_key key; -00082 -00084 time_t timestamp; -00085 -00087 SFSnortPacket* pkt; +00058 #define DEFAULT_CORR_ALERTS_DIR "/var/log/snort/correlated_alerts" +00059 +00061 #define DEFAULT_CORR_THRESHOLD 0.5 +00062 +00063 extern DynamicPreprocessorData _dpd; +00064 typedef unsigned char uint8_t; +00065 typedef unsigned short uint16_t; +00066 typedef unsigned int uint32_t; +00067 +00068 typedef enum { false, true } BOOL; +00069 +00070 /*****************************************************************/ +00072 typedef enum { +00073 none, src_addr, dst_addr, src_port, dst_port, CLUSTER_TYPES +00074 } cluster_type; +00075 /*****************************************************************/ +00077 struct pkt_key +00078 { +00079 uint32_t src_ip; +00080 uint16_t dst_port; +00081 }; +00082 /*****************************************************************/ +00084 struct pkt_info +00085 { +00087 struct pkt_key key; 00088 -00090 struct pkt_info* next; +00090 time_t timestamp; 00091 -00093 BOOL observed; +00093 SFSnortPacket* pkt; 00094 -00096 UT_hash_handle hh; -00097 }; -00098 /*****************************************************************/ -00099 /* Data type containing the configuration of the module */ -00100 typedef struct -00101 { -00103 unsigned long hashCleanupInterval; -00104 -00106 unsigned long streamExpireInterval; -00107 -00109 unsigned long alertClusteringInterval; +00096 struct pkt_info* next; +00097 +00099 BOOL observed; +00100 +00102 UT_hash_handle hh; +00103 }; +00104 /*****************************************************************/ +00105 /* Data type containing the configuration of the module */ +00106 typedef struct +00107 { +00109 unsigned long hashCleanupInterval; 00110 -00112 unsigned long databaseParsingInterval; +00112 unsigned long streamExpireInterval; 00113 -00115 unsigned long correlationGraphInterval; +00115 unsigned long alertClusteringInterval; 00116 -00118 char alertfile[1024]; +00118 unsigned long databaseParsingInterval; 00119 -00121 char clusterfile[1024]; +00121 unsigned long correlationGraphInterval; 00122 -00124 char corr_rules_dir[1024]; -00125 -00127 char dbname[256]; -00128 -00130 char dbuser[256]; -00131 -00133 char dbpass[256]; -00134 -00136 char dbhost[256]; -00137 } AI_config; -00138 /*****************************************************************/ -00140 typedef struct _hierarchy_node -00141 { -00142 cluster_type type; -00143 char label[256]; -00144 int min_val; -00145 int max_val; -00146 int nchildren; -00147 struct _hierarchy_node *parent; -00148 struct _hierarchy_node **children; -00149 } hierarchy_node; -00150 /*****************************************************************/ -00152 typedef struct -00153 { -00154 unsigned int gid; -00155 unsigned int sid; -00156 unsigned int rev; -00157 } AI_hyperalert_key; -00158 /*****************************************************************/ -00160 typedef struct -00161 { -00163 AI_hyperalert_key key; -00164 -00166 char **preconds; -00167 -00169 unsigned int n_preconds; -00170 -00172 char **postconds; -00173 -00175 unsigned int n_postconds; -00176 -00178 UT_hash_handle hh; -00179 } AI_hyperalert_info; -00180 /*****************************************************************/ -00182 typedef struct _AI_snort_alert { -00183 /* Identifiers of the alert */ -00184 unsigned int gid; -00185 unsigned int sid; -00186 unsigned int rev; -00187 -00188 /* Snort priority, description, -00189 * classification and timestamp -00190 * of the alert */ -00191 unsigned short priority; -00192 char *desc; -00193 char *classification; -00194 time_t timestamp; +00131 double correlationThresholdCoefficient; +00132 +00134 char alertfile[1024]; +00135 +00137 char clusterfile[1024]; +00138 +00140 char corr_rules_dir[1024]; +00141 +00143 char corr_alerts_dir[1024]; +00144 +00146 char dbname[256]; +00147 +00149 char dbuser[256]; +00150 +00152 char dbpass[256]; +00153 +00155 char dbhost[256]; +00156 } AI_config; +00157 /*****************************************************************/ +00159 typedef struct _hierarchy_node +00160 { +00161 cluster_type type; +00162 char label[256]; +00163 int min_val; +00164 int max_val; +00165 int nchildren; +00166 struct _hierarchy_node *parent; +00167 struct _hierarchy_node **children; +00168 } hierarchy_node; +00169 /*****************************************************************/ +00171 typedef struct +00172 { +00173 unsigned int gid; +00174 unsigned int sid; +00175 unsigned int rev; +00176 } AI_hyperalert_key; +00177 /*****************************************************************/ +00179 typedef struct +00180 { +00182 AI_hyperalert_key key; +00183 +00185 char **preconds; +00186 +00188 unsigned int n_preconds; +00189 +00191 char **postconds; +00192 +00194 unsigned int n_postconds; 00195 -00196 /* IP header information */ -00197 uint8_t ip_tos; -00198 uint16_t ip_len; -00199 uint16_t ip_id; -00200 uint8_t ip_ttl; -00201 uint8_t ip_proto; -00202 uint32_t ip_src_addr; -00203 uint32_t ip_dst_addr; -00204 -00205 /* TCP header information */ -00206 uint16_t tcp_src_port; -00207 uint16_t tcp_dst_port; -00208 uint32_t tcp_seq; -00209 uint32_t tcp_ack; -00210 uint8_t tcp_flags; -00211 uint16_t tcp_window; -00212 uint16_t tcp_len; -00213 -00216 struct pkt_info *stream; -00217 -00220 struct _AI_snort_alert *next; -00221 -00224 hierarchy_node *h_node[CLUSTER_TYPES]; -00225 -00229 unsigned int grouped_alarms_count; -00230 -00233 AI_hyperalert_info *hyperalert; -00234 } AI_snort_alert; -00235 /*****************************************************************/ +00197 UT_hash_handle hh; +00198 } AI_hyperalert_info; +00199 /*****************************************************************/ +00201 typedef struct _AI_snort_alert { +00202 /* Identifiers of the alert */ +00203 unsigned int gid; +00204 unsigned int sid; +00205 unsigned int rev; +00206 +00207 /* Snort priority, description, +00208 * classification and timestamp +00209 * of the alert */ +00210 unsigned short priority; +00211 char *desc; +00212 char *classification; +00213 time_t timestamp; +00214 +00215 /* IP header information */ +00216 uint8_t ip_tos; +00217 uint16_t ip_len; +00218 uint16_t ip_id; +00219 uint8_t ip_ttl; +00220 uint8_t ip_proto; +00221 uint32_t ip_src_addr; +00222 uint32_t ip_dst_addr; +00223 +00224 /* TCP header information */ +00225 uint16_t tcp_src_port; +00226 uint16_t tcp_dst_port; +00227 uint32_t tcp_seq; +00228 uint32_t tcp_ack; +00229 uint8_t tcp_flags; +00230 uint16_t tcp_window; +00231 uint16_t tcp_len; +00232 +00235 struct pkt_info *stream; 00236 -00237 int preg_match ( const char*, char*, char***, int* ); -00238 char* str_replace ( char *str, char *orig, char *rep ); -00239 char* str_replace_all ( char *str, char *orig, char *rep ); +00239 struct _AI_snort_alert *next; 00240 -00241 void* AI_hashcleanup_thread ( void* ); -00242 void* AI_file_alertparser_thread ( void* ); -00243 void* AI_alert_correlation_thread ( void* ); +00243 hierarchy_node *h_node[CLUSTER_TYPES]; 00244 -00245 #ifdef ENABLE_DB -00246 AI_snort_alert* AI_db_get_alerts ( void ); -00247 void AI_db_free_alerts ( AI_snort_alert *node ); -00248 void* AI_db_alertparser_thread ( void* ); -00249 #endif -00250 -00251 void AI_pkt_enqueue ( SFSnortPacket* ); -00252 void AI_set_stream_observed ( struct pkt_key key ); -00253 void AI_hierarchies_build ( AI_config*, hierarchy_node**, int ); -00254 void AI_free_alerts ( AI_snort_alert *node ); -00255 -00256 struct pkt_info* AI_get_stream_by_key ( struct pkt_key ); -00257 AI_snort_alert* AI_get_alerts ( void ); -00258 AI_snort_alert* AI_get_clustered_alerts ( void ); -00259 -00261 AI_snort_alert* (*get_alerts)(void); -00262 -00263 #endif /* _SPP_AI_H */ -00264 +00248 unsigned int grouped_alarms_count; +00249 +00252 AI_hyperalert_info *hyperalert; +00253 +00254 /* 'Parent' correlated alert in the chain, +00255 * if any*/ +00256 struct _AI_snort_alert *previous_correlated; +00257 +00260 struct _AI_snort_alert **derived_alerts; +00261 +00263 unsigned int n_derived_alerts; +00264 } AI_snort_alert; +00265 /*****************************************************************/ +00266 +00267 int preg_match ( const char*, char*, char***, int* ); +00268 char* str_replace ( char *str, char *orig, char *rep ); +00269 char* str_replace_all ( char *str, char *orig, char *rep ); +00270 +00271 void* AI_hashcleanup_thread ( void* ); +00272 void* AI_file_alertparser_thread ( void* ); +00273 void* AI_alert_correlation_thread ( void* ); +00274 +00275 #ifdef HAVE_LIBMYSQLCLIENT +00276 AI_snort_alert* AI_db_get_alerts ( void ); +00277 void AI_db_free_alerts ( AI_snort_alert *node ); +00278 void* AI_db_alertparser_thread ( void* ); +00279 #endif +00280 +00281 void AI_pkt_enqueue ( SFSnortPacket* ); +00282 void AI_set_stream_observed ( struct pkt_key key ); +00283 void AI_hierarchies_build ( AI_config*, hierarchy_node**, int ); +00284 void AI_free_alerts ( AI_snort_alert *node ); +00285 +00286 struct pkt_info* AI_get_stream_by_key ( struct pkt_key ); +00287 AI_snort_alert* AI_get_alerts ( void ); +00288 AI_snort_alert* AI_get_clustered_alerts ( void ); +00289 +00291 AI_snort_alert* (*get_alerts)(void); +00292 +00293 #endif /* _SPP_AI_H */ +00294 @@ -278,7 +294,7 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/stream_8c.html b/doc/html/stream_8c.html index ec6e5aa..a0aff10 100644 --- a/doc/html/stream_8c.html +++ b/doc/html/stream_8c.html @@ -134,7 +134,7 @@ Variables -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/structAI__alert__correlation.html b/doc/html/structAI__alert__correlation.html index 8db8af8..dd452c0 100644 --- a/doc/html/structAI__alert__correlation.html +++ b/doc/html/structAI__alert__correlation.html @@ -59,42 +59,13 @@ var searchBox = new SearchBox("searchBox", "search",false,'Search'); - - +

    Data Fields

    AI_snort_alert * a
    AI_snort_alert * b
    AI_alert_correlation_key key
    double correlation
    UT_hash_handle hh

    Detailed Description

    Struct representing the correlation between all the couples of alerts

    Field Documentation

    - -
    -
    - - - - -
    AI_snort_alert* AI_alert_correlation::a
    -
    -
    -

    First alert

    - -
    -
    - -
    -
    - - - - -
    AI_snort_alert* AI_alert_correlation::b
    -
    -
    -

    Second alert

    - -
    -
    @@ -121,6 +92,20 @@ Data Fields

    Make the struct 'hashable'

    +
    +
    + +
    +
    + + + + +
    AI_alert_correlation_key AI_alert_correlation::key
    +
    +
    +

    Hash key

    +
    The documentation for this struct was generated from the following file:
      @@ -141,7 +126,7 @@ Data Fields
    -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/structAI__alert__correlation__key.html b/doc/html/structAI__alert__correlation__key.html new file mode 100644 index 0000000..2053ffc --- /dev/null +++ b/doc/html/structAI__alert__correlation__key.html @@ -0,0 +1,118 @@ + + + + +Snort AI preprocessor module: AI_alert_correlation_key Struct Reference + + + + + + + + + +
    +
    +Data Fields
    +
    +

    AI_alert_correlation_key Struct Reference
    + +[Module for the correlation of hyperalerts] +

    +
    +
    + + + + +

    +Data Fields

    AI_snort_alert * a
    AI_snort_alert * b
    +

    Detailed Description

    +

    Key for the correlation hash table

    +

    Field Documentation

    + +
    +
    + + + + +
    AI_snort_alert* AI_alert_correlation_key::a
    +
    +
    +

    First alert

    + +
    +
    + +
    +
    + + + + +
    AI_snort_alert* AI_alert_correlation_key::b
    +
    +
    +

    Second alert

    + +
    +
    +
    The documentation for this struct was generated from the following file: +
    + + + + +
    + +
    + +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  + +doxygen 1.7.1
    + + diff --git a/doc/html/structAI__config.html b/doc/html/structAI__config.html index b03cf4a..55531f4 100644 --- a/doc/html/structAI__config.html +++ b/doc/html/structAI__config.html @@ -63,9 +63,11 @@ Data Fields unsigned long alertClusteringInterval unsigned long databaseParsingInterval unsigned long correlationGraphInterval +double correlationThresholdCoefficient char alertfile [1024] char clusterfile [1024] char corr_rules_dir [1024] +char corr_alerts_dir [1024] char dbname [256] char dbuser [256] char dbpass [256] @@ -112,6 +114,20 @@ Data Fields

    Clustered alerts file

    +
    + + +
    +
    + + + + +
    char AI_config::corr_alerts_dir[1024]
    +
    +
    +

    Directory where the correlated alerts' information will be placed

    +
    @@ -140,6 +156,20 @@ Data Fields

    Interval in seconds for running the thread for building alert correlation graphs

    +
    + + +
    +
    + + + + +
    double AI_config::correlationThresholdCoefficient
    +
    +
    +

    Correlation threshold coefficient for correlating two hyperalerts. Two hyperalerts are 'correlated' to each other in a multi-step attack graph if and only if their correlation value is >= m + ks, where m is the average correlation coefficient, s is the standard deviation over this coefficient, and k is this threshold coefficient. Its value can be >= 0. A value in [0,1] is strongly suggested, but this value mostly depends on how accurate the correlation rules where defined. Be careful, defining a correlation coefficient > or >> 1 no correlation may occur at all!

    +
    @@ -258,7 +288,7 @@ Data Fields -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/structAI__hyperalert__info.html b/doc/html/structAI__hyperalert__info.html index 6eab09a..9c13db1 100644 --- a/doc/html/structAI__hyperalert__info.html +++ b/doc/html/structAI__hyperalert__info.html @@ -170,7 +170,7 @@ Data Fields -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/structAI__hyperalert__key.html b/doc/html/structAI__hyperalert__key.html index 71d4419..b8fefcd 100644 --- a/doc/html/structAI__hyperalert__key.html +++ b/doc/html/structAI__hyperalert__key.html @@ -122,7 +122,7 @@ Data Fields -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/struct__AI__snort__alert.html b/doc/html/struct__AI__snort__alert.html index 3bf60a1..dbbb393 100644 --- a/doc/html/struct__AI__snort__alert.html +++ b/doc/html/struct__AI__snort__alert.html @@ -84,6 +84,9 @@ Data Fields hierarchy_node * h_node [CLUSTER_TYPES] unsigned int grouped_alarms_count AI_hyperalert_info * hyperalert +struct _AI_snort_alert * previous_correlated +struct _AI_snort_alert ** derived_alerts +unsigned int n_derived_alerts

    Detailed Description

    Data type for Snort alerts

    @@ -99,6 +102,20 @@ Data Fields
    +
    + + +
    +
    + + + + +
    struct _AI_snort_alert** _AI_snort_alert::derived_alerts
    +
    +
    +

    Array of directly correlated 'derived' alerts from the current one, if any

    +
    @@ -258,6 +275,20 @@ Data Fields
    +
    + + +
    +
    + + + + +
    unsigned int _AI_snort_alert::n_derived_alerts
    +
    +
    +

    Number of derived alerts

    +
    @@ -272,6 +303,19 @@ Data Fields

    Pointer to the next alert in the log, if any

    +
    + + +
    +
    + + + + +
    struct _AI_snort_alert* _AI_snort_alert::previous_correlated
    +
    +
    +
    @@ -449,7 +493,7 @@ Data Fields -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/struct__hierarchy__node.html b/doc/html/struct__hierarchy__node.html index 4430635..ecc9c4f 100644 --- a/doc/html/struct__hierarchy__node.html +++ b/doc/html/struct__hierarchy__node.html @@ -178,7 +178,7 @@ Data Fields -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/structattribute__key.html b/doc/html/structattribute__key.html index d319b89..2387c43 100644 --- a/doc/html/structattribute__key.html +++ b/doc/html/structattribute__key.html @@ -109,7 +109,7 @@ Data Fields -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/structattribute__value.html b/doc/html/structattribute__value.html index fa515e2..935e6fe 100644 --- a/doc/html/structattribute__value.html +++ b/doc/html/structattribute__value.html @@ -137,7 +137,7 @@ Data Fields -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/structpkt__info.html b/doc/html/structpkt__info.html index cd76f93..dc809f8 100644 --- a/doc/html/structpkt__info.html +++ b/doc/html/structpkt__info.html @@ -170,7 +170,7 @@ Data Fields -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/html/structpkt__key.html b/doc/html/structpkt__key.html index 3088d2d..4c3faf5 100644 --- a/doc/html/structpkt__key.html +++ b/doc/html/structpkt__key.html @@ -108,7 +108,7 @@ Data Fields -
    Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by  +
    Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by  doxygen 1.7.1
    diff --git a/doc/latex/annotated.tex b/doc/latex/annotated.tex index 04e27ab..5850f6d 100644 --- a/doc/latex/annotated.tex +++ b/doc/latex/annotated.tex @@ -3,6 +3,7 @@ Here are the data structures with brief descriptions:\begin{DoxyCompactList} \item\contentsline{section}{\hyperlink{struct__AI__snort__alert}{\_\-AI\_\-snort\_\-alert} }{\pageref{struct__AI__snort__alert}}{} \item\contentsline{section}{\hyperlink{struct__hierarchy__node}{\_\-hierarchy\_\-node} }{\pageref{struct__hierarchy__node}}{} \item\contentsline{section}{\hyperlink{structAI__alert__correlation}{AI\_\-alert\_\-correlation} }{\pageref{structAI__alert__correlation}}{} +\item\contentsline{section}{\hyperlink{structAI__alert__correlation__key}{AI\_\-alert\_\-correlation\_\-key} }{\pageref{structAI__alert__correlation__key}}{} \item\contentsline{section}{\hyperlink{structAI__config}{AI\_\-config} }{\pageref{structAI__config}}{} \item\contentsline{section}{\hyperlink{structAI__hyperalert__info}{AI\_\-hyperalert\_\-info} }{\pageref{structAI__hyperalert__info}}{} \item\contentsline{section}{\hyperlink{structAI__hyperalert__key}{AI\_\-hyperalert\_\-key} }{\pageref{structAI__hyperalert__key}}{} diff --git a/doc/latex/correlation_8c.tex b/doc/latex/correlation_8c.tex index 8416742..36ca14f 100644 --- a/doc/latex/correlation_8c.tex +++ b/doc/latex/correlation_8c.tex @@ -3,13 +3,21 @@ \label{correlation_8c}\index{correlation.c@{correlation.c}} } {\ttfamily \#include \char`\"{}spp\_\-ai.h\char`\"{}}\par +{\ttfamily \#include $<$stdio.h$>$}\par +{\ttfamily \#include $<$stdlib.h$>$}\par +{\ttfamily \#include $<$string.h$>$}\par {\ttfamily \#include $<$unistd.h$>$}\par +{\ttfamily \#include $<$time.h$>$}\par +{\ttfamily \#include $<$math.h$>$}\par +{\ttfamily \#include $<$alloca.h$>$}\par {\ttfamily \#include $<$sys/stat.h$>$}\par {\ttfamily \#include $<$pthread.h$>$}\par {\ttfamily \#include $<$libxml/xmlreader.h$>$}\par \subsection*{Data Structures} \begin{DoxyCompactItemize} \item +struct \hyperlink{structAI__alert__correlation__key}{AI\_\-alert\_\-correlation\_\-key} +\item struct \hyperlink{structAI__alert__correlation}{AI\_\-alert\_\-correlation} \end{DoxyCompactItemize} \subsection*{Enumerations} @@ -27,9 +35,17 @@ enum \{ \par \subsection*{Functions} \begin{DoxyCompactItemize} \item -double \hyperlink{group__correlation_ga130e82017fc0abcb76b1a7740ae2f4df}{\_\-AI\_\-correlation\_\-coefficient} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$a, \hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$b) +PRIVATE void \hyperlink{group__correlation_ga9bcb94264ffe30f113f3fb7287b774e3}{\_\-AI\_\-correlation\_\-table\_\-cleanup} () +\begin{DoxyCompactList}\small\item\em Clean up the correlation hash table. \item\end{DoxyCompactList}\item +PRIVATE void \hyperlink{group__correlation_ga4267a39fa1a5ac035015823bca43288e}{\_\-AI\_\-print\_\-correlated\_\-alerts} (\hyperlink{structAI__alert__correlation}{AI\_\-alert\_\-correlation} $\ast$corr, FILE $\ast$fp) +\begin{DoxyCompactList}\small\item\em Recursively write a flow of correlated alerts to a .dot file, ready for being rendered as graph. \item\end{DoxyCompactList}\item +PRIVATE char $\ast$ \hyperlink{group__correlation_ga7a1b2d01f526f24ea91d7f08bdefd4fe}{\_\-AI\_\-get\_\-function\_\-name} (const char $\ast$orig\_\-stmt) +\begin{DoxyCompactList}\small\item\em Get the name of the function called by a pre-\/condition or post-\/condition predicate. \item\end{DoxyCompactList}\item +PRIVATE char $\ast$$\ast$ \hyperlink{group__correlation_gab716702cd226ab2ad957234a92da6e4a}{\_\-AI\_\-get\_\-function\_\-arguments} (char $\ast$orig\_\-stmt, int $\ast$n\_\-args) +\begin{DoxyCompactList}\small\item\em Get the arguments passed to a function predicate in a pre-\/condition or post-\/condition (comma-\/separated values). \item\end{DoxyCompactList}\item +PRIVATE double \hyperlink{group__correlation_ga9cb283b28a66829574add58a251b93c6}{\_\-AI\_\-correlation\_\-coefficient} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$a, \hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$b) \begin{DoxyCompactList}\small\item\em Compute the correlation coefficient between two alerts, as INTERSECTION(pre(B), post(A) / UNION(pre(B), post(A)). \item\end{DoxyCompactList}\item -void \hyperlink{group__correlation_ga0d094eae1d014d89a2de21263fa747da}{\_\-AI\_\-macro\_\-subst} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$$\ast$alert) +PRIVATE void \hyperlink{group__correlation_ga70a4aaf8b689472dad62ba7a9bbde1a6}{\_\-AI\_\-macro\_\-subst} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$$\ast$alert) \begin{DoxyCompactList}\small\item\em Substitute the macros in hyperalert pre-\/conditions and post-\/conditions with their associated values. \item\end{DoxyCompactList}\item PRIVATE \hyperlink{structAI__hyperalert__info}{AI\_\-hyperalert\_\-info} $\ast$ \hyperlink{group__correlation_ga929e5c17fdb247a998d83ed6a4ae5a65}{\_\-AI\_\-hyperalert\_\-from\_\-XML} (\hyperlink{structAI__hyperalert__key}{AI\_\-hyperalert\_\-key} key) \begin{DoxyCompactList}\small\item\em Parse info about a hyperalert from a correlation XML file, if it exists. \item\end{DoxyCompactList}\item diff --git a/doc/latex/doxygen.sty b/doc/latex/doxygen.sty index 98a04a0..9270da4 100644 --- a/doc/latex/doxygen.sty +++ b/doc/latex/doxygen.sty @@ -27,9 +27,9 @@ \fancyplain{}{\bfseries\thepage}% } \rfoot[\fancyplain{}{\bfseries\scriptsize% - Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by Doxygen }]{} + Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by Doxygen }]{} \lfoot[]{\fancyplain{}{\bfseries\scriptsize% - Generated on Sat Sep 11 2010 12:45:18 for Snort AI preprocessor module by Doxygen }} + Generated on Tue Sep 14 2010 19:23:42 for Snort AI preprocessor module by Doxygen }} \cfoot{} %---------- Internal commands used in this style file ---------------- diff --git a/doc/latex/group__correlation.tex b/doc/latex/group__correlation.tex index b490929..c16c210 100644 --- a/doc/latex/group__correlation.tex +++ b/doc/latex/group__correlation.tex @@ -5,6 +5,8 @@ \subsection*{Data Structures} \begin{DoxyCompactItemize} \item +struct \hyperlink{structAI__alert__correlation__key}{AI\_\-alert\_\-correlation\_\-key} +\item struct \hyperlink{structAI__alert__correlation}{AI\_\-alert\_\-correlation} \end{DoxyCompactItemize} \subsection*{Enumerations} @@ -22,9 +24,17 @@ enum \{ \par \subsection*{Functions} \begin{DoxyCompactItemize} \item -double \hyperlink{group__correlation_ga130e82017fc0abcb76b1a7740ae2f4df}{\_\-AI\_\-correlation\_\-coefficient} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$a, \hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$b) +PRIVATE void \hyperlink{group__correlation_ga9bcb94264ffe30f113f3fb7287b774e3}{\_\-AI\_\-correlation\_\-table\_\-cleanup} () +\begin{DoxyCompactList}\small\item\em Clean up the correlation hash table. \item\end{DoxyCompactList}\item +PRIVATE void \hyperlink{group__correlation_ga4267a39fa1a5ac035015823bca43288e}{\_\-AI\_\-print\_\-correlated\_\-alerts} (\hyperlink{structAI__alert__correlation}{AI\_\-alert\_\-correlation} $\ast$corr, FILE $\ast$fp) +\begin{DoxyCompactList}\small\item\em Recursively write a flow of correlated alerts to a .dot file, ready for being rendered as graph. \item\end{DoxyCompactList}\item +PRIVATE char $\ast$ \hyperlink{group__correlation_ga7a1b2d01f526f24ea91d7f08bdefd4fe}{\_\-AI\_\-get\_\-function\_\-name} (const char $\ast$orig\_\-stmt) +\begin{DoxyCompactList}\small\item\em Get the name of the function called by a pre-\/condition or post-\/condition predicate. \item\end{DoxyCompactList}\item +PRIVATE char $\ast$$\ast$ \hyperlink{group__correlation_gab716702cd226ab2ad957234a92da6e4a}{\_\-AI\_\-get\_\-function\_\-arguments} (char $\ast$orig\_\-stmt, int $\ast$n\_\-args) +\begin{DoxyCompactList}\small\item\em Get the arguments passed to a function predicate in a pre-\/condition or post-\/condition (comma-\/separated values). \item\end{DoxyCompactList}\item +PRIVATE double \hyperlink{group__correlation_ga9cb283b28a66829574add58a251b93c6}{\_\-AI\_\-correlation\_\-coefficient} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$a, \hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$b) \begin{DoxyCompactList}\small\item\em Compute the correlation coefficient between two alerts, as INTERSECTION(pre(B), post(A) / UNION(pre(B), post(A)). \item\end{DoxyCompactList}\item -void \hyperlink{group__correlation_ga0d094eae1d014d89a2de21263fa747da}{\_\-AI\_\-macro\_\-subst} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$$\ast$alert) +PRIVATE void \hyperlink{group__correlation_ga70a4aaf8b689472dad62ba7a9bbde1a6}{\_\-AI\_\-macro\_\-subst} (\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$$\ast$alert) \begin{DoxyCompactList}\small\item\em Substitute the macros in hyperalert pre-\/conditions and post-\/conditions with their associated values. \item\end{DoxyCompactList}\item PRIVATE \hyperlink{structAI__hyperalert__info}{AI\_\-hyperalert\_\-info} $\ast$ \hyperlink{group__correlation_ga929e5c17fdb247a998d83ed6a4ae5a65}{\_\-AI\_\-hyperalert\_\-from\_\-XML} (\hyperlink{structAI__hyperalert__key}{AI\_\-hyperalert\_\-key} key) \begin{DoxyCompactList}\small\item\em Parse info about a hyperalert from a correlation XML file, if it exists. \item\end{DoxyCompactList}\item @@ -78,16 +88,16 @@ TAG\_\-NUM} \subsection{Function Documentation} -\hypertarget{group__correlation_ga130e82017fc0abcb76b1a7740ae2f4df}{ +\hypertarget{group__correlation_ga9cb283b28a66829574add58a251b93c6}{ \index{correlation@{correlation}!\_\-AI\_\-correlation\_\-coefficient@{\_\-AI\_\-correlation\_\-coefficient}} \index{\_\-AI\_\-correlation\_\-coefficient@{\_\-AI\_\-correlation\_\-coefficient}!correlation@{correlation}} -\subsubsection[{\_\-AI\_\-correlation\_\-coefficient}]{\setlength{\rightskip}{0pt plus 5cm}double \_\-AI\_\-correlation\_\-coefficient ( +\subsubsection[{\_\-AI\_\-correlation\_\-coefficient}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE double \_\-AI\_\-correlation\_\-coefficient ( \begin{DoxyParamCaption} \item[{{\bf AI\_\-snort\_\-alert} $\ast$}]{ a, } \item[{{\bf AI\_\-snort\_\-alert} $\ast$}]{ b} \end{DoxyParamCaption} )}} -\label{group__correlation_ga130e82017fc0abcb76b1a7740ae2f4df} +\label{group__correlation_ga9cb283b28a66829574add58a251b93c6} Compute the correlation coefficient between two alerts, as INTERSECTION(pre(B), post(A) / UNION(pre(B), post(A)). @@ -98,6 +108,58 @@ Compute the correlation coefficient between two alerts, as INTERSECTION(pre(B), \begin{DoxyReturn}{Returns} The correlation coefficient between A and B as coefficient in \mbox{[}0,1\mbox{]} \end{DoxyReturn} +\hypertarget{group__correlation_ga9bcb94264ffe30f113f3fb7287b774e3}{ +\index{correlation@{correlation}!\_\-AI\_\-correlation\_\-table\_\-cleanup@{\_\-AI\_\-correlation\_\-table\_\-cleanup}} +\index{\_\-AI\_\-correlation\_\-table\_\-cleanup@{\_\-AI\_\-correlation\_\-table\_\-cleanup}!correlation@{correlation}} +\subsubsection[{\_\-AI\_\-correlation\_\-table\_\-cleanup}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE void \_\-AI\_\-correlation\_\-table\_\-cleanup ( +\begin{DoxyParamCaption} +{} +\end{DoxyParamCaption} +)}} +\label{group__correlation_ga9bcb94264ffe30f113f3fb7287b774e3} + + +Clean up the correlation hash table. + +\hypertarget{group__correlation_gab716702cd226ab2ad957234a92da6e4a}{ +\index{correlation@{correlation}!\_\-AI\_\-get\_\-function\_\-arguments@{\_\-AI\_\-get\_\-function\_\-arguments}} +\index{\_\-AI\_\-get\_\-function\_\-arguments@{\_\-AI\_\-get\_\-function\_\-arguments}!correlation@{correlation}} +\subsubsection[{\_\-AI\_\-get\_\-function\_\-arguments}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE char$\ast$$\ast$ \_\-AI\_\-get\_\-function\_\-arguments ( +\begin{DoxyParamCaption} +\item[{char $\ast$}]{ orig\_\-stmt, } +\item[{int $\ast$}]{ n\_\-args} +\end{DoxyParamCaption} +)}} +\label{group__correlation_gab716702cd226ab2ad957234a92da6e4a} + + +Get the arguments passed to a function predicate in a pre-\/condition or post-\/condition (comma-\/separated values). + +FUNCTION: \_\-AI\_\-get\_\-function\_\-arguments +\begin{DoxyParams}{Parameters} +\item[{\em origstmt}]Statement representing a pre-\/condition or post-\/condition \item[{\em n\_\-args}]Reference to an integer that will contain the number of arguments read \end{DoxyParams} +\begin{DoxyReturn}{Returns} +An array of strings containing the arguments of the function +\end{DoxyReturn} +\hypertarget{group__correlation_ga7a1b2d01f526f24ea91d7f08bdefd4fe}{ +\index{correlation@{correlation}!\_\-AI\_\-get\_\-function\_\-name@{\_\-AI\_\-get\_\-function\_\-name}} +\index{\_\-AI\_\-get\_\-function\_\-name@{\_\-AI\_\-get\_\-function\_\-name}!correlation@{correlation}} +\subsubsection[{\_\-AI\_\-get\_\-function\_\-name}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE char$\ast$ \_\-AI\_\-get\_\-function\_\-name ( +\begin{DoxyParamCaption} +\item[{const char $\ast$}]{ orig\_\-stmt} +\end{DoxyParamCaption} +)}} +\label{group__correlation_ga7a1b2d01f526f24ea91d7f08bdefd4fe} + + +Get the name of the function called by a pre-\/condition or post-\/condition predicate. + + +\begin{DoxyParams}{Parameters} +\item[{\em orig\_\-stmt}]Statement representing a pre-\/condition or post-\/condition \end{DoxyParams} +\begin{DoxyReturn}{Returns} +The name of the function called by that statement +\end{DoxyReturn} \hypertarget{group__correlation_ga929e5c17fdb247a998d83ed6a4ae5a65}{ \index{correlation@{correlation}!\_\-AI\_\-hyperalert\_\-from\_\-XML@{\_\-AI\_\-hyperalert\_\-from\_\-XML}} \index{\_\-AI\_\-hyperalert\_\-from\_\-XML@{\_\-AI\_\-hyperalert\_\-from\_\-XML}!correlation@{correlation}} @@ -117,15 +179,15 @@ Parse info about a hyperalert from a correlation XML file, if it exists. \begin{DoxyReturn}{Returns} A hyperalert structure containing the info about the current alert, if the XML file was found \end{DoxyReturn} -\hypertarget{group__correlation_ga0d094eae1d014d89a2de21263fa747da}{ +\hypertarget{group__correlation_ga70a4aaf8b689472dad62ba7a9bbde1a6}{ \index{correlation@{correlation}!\_\-AI\_\-macro\_\-subst@{\_\-AI\_\-macro\_\-subst}} \index{\_\-AI\_\-macro\_\-subst@{\_\-AI\_\-macro\_\-subst}!correlation@{correlation}} -\subsubsection[{\_\-AI\_\-macro\_\-subst}]{\setlength{\rightskip}{0pt plus 5cm}void \_\-AI\_\-macro\_\-subst ( +\subsubsection[{\_\-AI\_\-macro\_\-subst}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE void \_\-AI\_\-macro\_\-subst ( \begin{DoxyParamCaption} \item[{{\bf AI\_\-snort\_\-alert} $\ast$$\ast$}]{ alert} \end{DoxyParamCaption} )}} -\label{group__correlation_ga0d094eae1d014d89a2de21263fa747da} +\label{group__correlation_ga70a4aaf8b689472dad62ba7a9bbde1a6} Substitute the macros in hyperalert pre-\/conditions and post-\/conditions with their associated values. @@ -133,6 +195,23 @@ Substitute the macros in hyperalert pre-\/conditions and post-\/conditions with \begin{DoxyParams}{Parameters} \item[{\em alert}]Reference to the hyperalert to work on \end{DoxyParams} +\hypertarget{group__correlation_ga4267a39fa1a5ac035015823bca43288e}{ +\index{correlation@{correlation}!\_\-AI\_\-print\_\-correlated\_\-alerts@{\_\-AI\_\-print\_\-correlated\_\-alerts}} +\index{\_\-AI\_\-print\_\-correlated\_\-alerts@{\_\-AI\_\-print\_\-correlated\_\-alerts}!correlation@{correlation}} +\subsubsection[{\_\-AI\_\-print\_\-correlated\_\-alerts}]{\setlength{\rightskip}{0pt plus 5cm}PRIVATE void \_\-AI\_\-print\_\-correlated\_\-alerts ( +\begin{DoxyParamCaption} +\item[{{\bf AI\_\-alert\_\-correlation} $\ast$}]{ corr, } +\item[{FILE $\ast$}]{ fp} +\end{DoxyParamCaption} +)}} +\label{group__correlation_ga4267a39fa1a5ac035015823bca43288e} + + +Recursively write a flow of correlated alerts to a .dot file, ready for being rendered as graph. + + +\begin{DoxyParams}{Parameters} +\item[{\em corr\_\-alerts}]Correlated alerts \item[{\em fp}]File pointer \end{DoxyParams} \hypertarget{group__correlation_ga939353a4e15de7a8f4145ab986f584be}{ \index{correlation@{correlation}!AI\_\-alert\_\-correlation\_\-thread@{AI\_\-alert\_\-correlation\_\-thread}} \index{AI\_\-alert\_\-correlation\_\-thread@{AI\_\-alert\_\-correlation\_\-thread}!correlation@{correlation}} diff --git a/doc/latex/refman.tex b/doc/latex/refman.tex index dbe8904..63831a9 100644 --- a/doc/latex/refman.tex +++ b/doc/latex/refman.tex @@ -41,7 +41,7 @@ \vspace*{1cm} {\large Generated by Doxygen 1.7.1}\\ \vspace*{0.5cm} -{\small Sat Sep 11 2010 12:45:18}\\ +{\small Tue Sep 14 2010 19:23:42}\\ \end{center} \end{titlepage} \clearemptydoublepage @@ -67,6 +67,7 @@ \input{struct__AI__snort__alert} \input{struct__hierarchy__node} \input{structAI__alert__correlation} +\input{structAI__alert__correlation__key} \input{structAI__config} \input{structAI__hyperalert__info} \input{structAI__hyperalert__key} diff --git a/doc/latex/spp__ai_8h.tex b/doc/latex/spp__ai_8h.tex index 2fdf940..dfd9298 100644 --- a/doc/latex/spp__ai_8h.tex +++ b/doc/latex/spp__ai_8h.tex @@ -42,6 +42,10 @@ struct \hyperlink{struct__AI__snort__alert}{\_\-AI\_\-snort\_\-alert} \#define \hyperlink{spp__ai_8h_a803dc913297ccdace9e604dbfecda97d}{DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE}~\char`\"{}/var/log/snort/cluster\_\-alert\char`\"{} \item \#define \hyperlink{spp__ai_8h_a89448386cad5d5533992ae7ee84f4f1d}{DEFAULT\_\-CORR\_\-RULES\_\-DIR}~\char`\"{}/etc/snort/corr\_\-rules\char`\"{} +\item +\#define \hyperlink{spp__ai_8h_a7bbeccba60012abcc98db33d39294829}{DEFAULT\_\-CORR\_\-ALERTS\_\-DIR}~\char`\"{}/var/log/snort/correlated\_\-alerts\char`\"{} +\item +\#define \hyperlink{spp__ai_8h_aaedb0b7dc2bdf8d44d3fee2189a55a19}{DEFAULT\_\-CORR\_\-THRESHOLD}~0.5 \end{DoxyCompactItemize} \subsection*{Typedefs} \begin{DoxyCompactItemize} @@ -132,12 +136,22 @@ Default path to Snort's log file \hypertarget{spp__ai_8h_a803dc913297ccdace9e604 \index{DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE@{DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE}!spp_ai.h@{spp\_\-ai.h}} \subsubsection[{DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE}]{\setlength{\rightskip}{0pt plus 5cm}\#define DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE~\char`\"{}/var/log/snort/cluster\_\-alert\char`\"{}}} \label{spp__ai_8h_a803dc913297ccdace9e604dbfecda97d} -Default path to Snort's clustered alerts file \hypertarget{spp__ai_8h_a89448386cad5d5533992ae7ee84f4f1d}{ +Default path to Snort's clustered alerts file \hypertarget{spp__ai_8h_a7bbeccba60012abcc98db33d39294829}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!DEFAULT\_\-CORR\_\-ALERTS\_\-DIR@{DEFAULT\_\-CORR\_\-ALERTS\_\-DIR}} +\index{DEFAULT\_\-CORR\_\-ALERTS\_\-DIR@{DEFAULT\_\-CORR\_\-ALERTS\_\-DIR}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{DEFAULT\_\-CORR\_\-ALERTS\_\-DIR}]{\setlength{\rightskip}{0pt plus 5cm}\#define DEFAULT\_\-CORR\_\-ALERTS\_\-DIR~\char`\"{}/var/log/snort/correlated\_\-alerts\char`\"{}}} +\label{spp__ai_8h_a7bbeccba60012abcc98db33d39294829} +Default directory for placing correlated alerts information (.dot and possibly .png files) \hypertarget{spp__ai_8h_a89448386cad5d5533992ae7ee84f4f1d}{ \index{spp\_\-ai.h@{spp\_\-ai.h}!DEFAULT\_\-CORR\_\-RULES\_\-DIR@{DEFAULT\_\-CORR\_\-RULES\_\-DIR}} \index{DEFAULT\_\-CORR\_\-RULES\_\-DIR@{DEFAULT\_\-CORR\_\-RULES\_\-DIR}!spp_ai.h@{spp\_\-ai.h}} \subsubsection[{DEFAULT\_\-CORR\_\-RULES\_\-DIR}]{\setlength{\rightskip}{0pt plus 5cm}\#define DEFAULT\_\-CORR\_\-RULES\_\-DIR~\char`\"{}/etc/snort/corr\_\-rules\char`\"{}}} \label{spp__ai_8h_a89448386cad5d5533992ae7ee84f4f1d} -Default path to alert correlation rules directory \hypertarget{spp__ai_8h_a3c4984a0ee515fbc091ac6e33b05e310}{ +Default path to alert correlation rules directory \hypertarget{spp__ai_8h_aaedb0b7dc2bdf8d44d3fee2189a55a19}{ +\index{spp\_\-ai.h@{spp\_\-ai.h}!DEFAULT\_\-CORR\_\-THRESHOLD@{DEFAULT\_\-CORR\_\-THRESHOLD}} +\index{DEFAULT\_\-CORR\_\-THRESHOLD@{DEFAULT\_\-CORR\_\-THRESHOLD}!spp_ai.h@{spp\_\-ai.h}} +\subsubsection[{DEFAULT\_\-CORR\_\-THRESHOLD}]{\setlength{\rightskip}{0pt plus 5cm}\#define DEFAULT\_\-CORR\_\-THRESHOLD~0.5}} +\label{spp__ai_8h_aaedb0b7dc2bdf8d44d3fee2189a55a19} +Default correlation threshold coefficient for correlating two hyperalerts \hypertarget{spp__ai_8h_a3c4984a0ee515fbc091ac6e33b05e310}{ \index{spp\_\-ai.h@{spp\_\-ai.h}!DEFAULT\_\-DATABASE\_\-INTERVAL@{DEFAULT\_\-DATABASE\_\-INTERVAL}} \index{DEFAULT\_\-DATABASE\_\-INTERVAL@{DEFAULT\_\-DATABASE\_\-INTERVAL}!spp_ai.h@{spp\_\-ai.h}} \subsubsection[{DEFAULT\_\-DATABASE\_\-INTERVAL}]{\setlength{\rightskip}{0pt plus 5cm}\#define DEFAULT\_\-DATABASE\_\-INTERVAL~30}} diff --git a/doc/latex/structAI__alert__correlation.tex b/doc/latex/structAI__alert__correlation.tex index a210236..4b7ea52 100644 --- a/doc/latex/structAI__alert__correlation.tex +++ b/doc/latex/structAI__alert__correlation.tex @@ -5,9 +5,7 @@ \subsection*{Data Fields} \begin{DoxyCompactItemize} \item -\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$ \hyperlink{structAI__alert__correlation_a8737f171e1c1b2305c8fe77101d6aeb7}{a} -\item -\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$ \hyperlink{structAI__alert__correlation_a478f1a6f18f9c083b203efdf776379cd}{b} +\hyperlink{structAI__alert__correlation__key}{AI\_\-alert\_\-correlation\_\-key} \hyperlink{structAI__alert__correlation_a4e27da4922a1d44497634c8e5968d870}{key} \item double \hyperlink{structAI__alert__correlation_aad417b2126ae26d7576f006a3dbcdc81}{correlation} \item @@ -19,17 +17,7 @@ UT\_\-hash\_\-handle \hyperlink{structAI__alert__correlation_ad3020a87936a2193a9 Struct representing the correlation between all the couples of alerts \subsection{Field Documentation} -\hypertarget{structAI__alert__correlation_a8737f171e1c1b2305c8fe77101d6aeb7}{ -\index{AI\_\-alert\_\-correlation@{AI\_\-alert\_\-correlation}!a@{a}} -\index{a@{a}!AI_alert_correlation@{AI\_\-alert\_\-correlation}} -\subsubsection[{a}]{\setlength{\rightskip}{0pt plus 5cm}{\bf AI\_\-snort\_\-alert}$\ast$ {\bf AI\_\-alert\_\-correlation::a}}} -\label{structAI__alert__correlation_a8737f171e1c1b2305c8fe77101d6aeb7} -First alert \hypertarget{structAI__alert__correlation_a478f1a6f18f9c083b203efdf776379cd}{ -\index{AI\_\-alert\_\-correlation@{AI\_\-alert\_\-correlation}!b@{b}} -\index{b@{b}!AI_alert_correlation@{AI\_\-alert\_\-correlation}} -\subsubsection[{b}]{\setlength{\rightskip}{0pt plus 5cm}{\bf AI\_\-snort\_\-alert}$\ast$ {\bf AI\_\-alert\_\-correlation::b}}} -\label{structAI__alert__correlation_a478f1a6f18f9c083b203efdf776379cd} -Second alert \hypertarget{structAI__alert__correlation_aad417b2126ae26d7576f006a3dbcdc81}{ +\hypertarget{structAI__alert__correlation_aad417b2126ae26d7576f006a3dbcdc81}{ \index{AI\_\-alert\_\-correlation@{AI\_\-alert\_\-correlation}!correlation@{correlation}} \index{correlation@{correlation}!AI_alert_correlation@{AI\_\-alert\_\-correlation}} \subsubsection[{correlation}]{\setlength{\rightskip}{0pt plus 5cm}double {\bf AI\_\-alert\_\-correlation::correlation}}} @@ -39,7 +27,12 @@ Correlation coefficient \hypertarget{structAI__alert__correlation_ad3020a87936a2 \index{hh@{hh}!AI_alert_correlation@{AI\_\-alert\_\-correlation}} \subsubsection[{hh}]{\setlength{\rightskip}{0pt plus 5cm}UT\_\-hash\_\-handle {\bf AI\_\-alert\_\-correlation::hh}}} \label{structAI__alert__correlation_ad3020a87936a2193a92f09331401ad42} -Make the struct 'hashable' +Make the struct 'hashable' \hypertarget{structAI__alert__correlation_a4e27da4922a1d44497634c8e5968d870}{ +\index{AI\_\-alert\_\-correlation@{AI\_\-alert\_\-correlation}!key@{key}} +\index{key@{key}!AI_alert_correlation@{AI\_\-alert\_\-correlation}} +\subsubsection[{key}]{\setlength{\rightskip}{0pt plus 5cm}{\bf AI\_\-alert\_\-correlation\_\-key} {\bf AI\_\-alert\_\-correlation::key}}} +\label{structAI__alert__correlation_a4e27da4922a1d44497634c8e5968d870} +Hash key The documentation for this struct was generated from the following file:\begin{DoxyCompactItemize} \item diff --git a/doc/latex/structAI__alert__correlation__key.tex b/doc/latex/structAI__alert__correlation__key.tex new file mode 100644 index 0000000..b9d1ccf --- /dev/null +++ b/doc/latex/structAI__alert__correlation__key.tex @@ -0,0 +1,32 @@ +\hypertarget{structAI__alert__correlation__key}{ +\section{AI\_\-alert\_\-correlation\_\-key Struct Reference} +\label{structAI__alert__correlation__key}\index{AI\_\-alert\_\-correlation\_\-key@{AI\_\-alert\_\-correlation\_\-key}} +} +\subsection*{Data Fields} +\begin{DoxyCompactItemize} +\item +\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$ \hyperlink{structAI__alert__correlation__key_a774daec9332da25835a0904d853acadb}{a} +\item +\hyperlink{struct__AI__snort__alert}{AI\_\-snort\_\-alert} $\ast$ \hyperlink{structAI__alert__correlation__key_a5805dec6499a83b818091b4f21c715dc}{b} +\end{DoxyCompactItemize} + + +\subsection{Detailed Description} +Key for the correlation hash table + +\subsection{Field Documentation} +\hypertarget{structAI__alert__correlation__key_a774daec9332da25835a0904d853acadb}{ +\index{AI\_\-alert\_\-correlation\_\-key@{AI\_\-alert\_\-correlation\_\-key}!a@{a}} +\index{a@{a}!AI_alert_correlation_key@{AI\_\-alert\_\-correlation\_\-key}} +\subsubsection[{a}]{\setlength{\rightskip}{0pt plus 5cm}{\bf AI\_\-snort\_\-alert}$\ast$ {\bf AI\_\-alert\_\-correlation\_\-key::a}}} +\label{structAI__alert__correlation__key_a774daec9332da25835a0904d853acadb} +First alert \hypertarget{structAI__alert__correlation__key_a5805dec6499a83b818091b4f21c715dc}{ +\index{AI\_\-alert\_\-correlation\_\-key@{AI\_\-alert\_\-correlation\_\-key}!b@{b}} +\index{b@{b}!AI_alert_correlation_key@{AI\_\-alert\_\-correlation\_\-key}} +\subsubsection[{b}]{\setlength{\rightskip}{0pt plus 5cm}{\bf AI\_\-snort\_\-alert}$\ast$ {\bf AI\_\-alert\_\-correlation\_\-key::b}}} +\label{structAI__alert__correlation__key_a5805dec6499a83b818091b4f21c715dc} +Second alert + +The documentation for this struct was generated from the following file:\begin{DoxyCompactItemize} +\item +\hyperlink{correlation_8c}{correlation.c}\end{DoxyCompactItemize} diff --git a/doc/latex/structAI__config.tex b/doc/latex/structAI__config.tex index 18a0e55..82f978f 100644 --- a/doc/latex/structAI__config.tex +++ b/doc/latex/structAI__config.tex @@ -19,12 +19,16 @@ unsigned long \hyperlink{structAI__config_ae6ca715cab1d90b70c3aad443133c263}{dat \item unsigned long \hyperlink{structAI__config_aa736375e57a59936e2e782b7cd200e41}{correlationGraphInterval} \item +double \hyperlink{structAI__config_adf6ef0faedfb4dea0a1353e781b14883}{correlationThresholdCoefficient} +\item char \hyperlink{structAI__config_a2efa9590d7eea6dce8b5dd9aa76ed8ca}{alertfile} \mbox{[}1024\mbox{]} \item char \hyperlink{structAI__config_a6da02a3f7116fd3810a41b738e8883a3}{clusterfile} \mbox{[}1024\mbox{]} \item char \hyperlink{structAI__config_ab7ea93bbe72b85c4019b4f5656ad62fc}{corr\_\-rules\_\-dir} \mbox{[}1024\mbox{]} \item +char \hyperlink{structAI__config_ae68f5489e2ec9ea1408f98fe36d050c9}{corr\_\-alerts\_\-dir} \mbox{[}1024\mbox{]} +\item char \hyperlink{structAI__config_ac8a93607f12106e2f5c9b43af27107da}{dbname} \mbox{[}256\mbox{]} \item char \hyperlink{structAI__config_aa004adebfdafb6d14092aecd7f4912b0}{dbuser} \mbox{[}256\mbox{]} @@ -51,7 +55,12 @@ Alert file \hypertarget{structAI__config_a6da02a3f7116fd3810a41b738e8883a3}{ \index{clusterfile@{clusterfile}!AI_config@{AI\_\-config}} \subsubsection[{clusterfile}]{\setlength{\rightskip}{0pt plus 5cm}char {\bf AI\_\-config::clusterfile}\mbox{[}1024\mbox{]}}} \label{structAI__config_a6da02a3f7116fd3810a41b738e8883a3} -Clustered alerts file \hypertarget{structAI__config_ab7ea93bbe72b85c4019b4f5656ad62fc}{ +Clustered alerts file \hypertarget{structAI__config_ae68f5489e2ec9ea1408f98fe36d050c9}{ +\index{AI\_\-config@{AI\_\-config}!corr\_\-alerts\_\-dir@{corr\_\-alerts\_\-dir}} +\index{corr\_\-alerts\_\-dir@{corr\_\-alerts\_\-dir}!AI_config@{AI\_\-config}} +\subsubsection[{corr\_\-alerts\_\-dir}]{\setlength{\rightskip}{0pt plus 5cm}char {\bf AI\_\-config::corr\_\-alerts\_\-dir}\mbox{[}1024\mbox{]}}} +\label{structAI__config_ae68f5489e2ec9ea1408f98fe36d050c9} +Directory where the correlated alerts' information will be placed \hypertarget{structAI__config_ab7ea93bbe72b85c4019b4f5656ad62fc}{ \index{AI\_\-config@{AI\_\-config}!corr\_\-rules\_\-dir@{corr\_\-rules\_\-dir}} \index{corr\_\-rules\_\-dir@{corr\_\-rules\_\-dir}!AI_config@{AI\_\-config}} \subsubsection[{corr\_\-rules\_\-dir}]{\setlength{\rightskip}{0pt plus 5cm}char {\bf AI\_\-config::corr\_\-rules\_\-dir}\mbox{[}1024\mbox{]}}} @@ -61,7 +70,12 @@ Correlation rules path \hypertarget{structAI__config_aa736375e57a59936e2e782b7cd \index{correlationGraphInterval@{correlationGraphInterval}!AI_config@{AI\_\-config}} \subsubsection[{correlationGraphInterval}]{\setlength{\rightskip}{0pt plus 5cm}unsigned long {\bf AI\_\-config::correlationGraphInterval}}} \label{structAI__config_aa736375e57a59936e2e782b7cd200e41} -Interval in seconds for running the thread for building alert correlation graphs \hypertarget{structAI__config_ae6ca715cab1d90b70c3aad443133c263}{ +Interval in seconds for running the thread for building alert correlation graphs \hypertarget{structAI__config_adf6ef0faedfb4dea0a1353e781b14883}{ +\index{AI\_\-config@{AI\_\-config}!correlationThresholdCoefficient@{correlationThresholdCoefficient}} +\index{correlationThresholdCoefficient@{correlationThresholdCoefficient}!AI_config@{AI\_\-config}} +\subsubsection[{correlationThresholdCoefficient}]{\setlength{\rightskip}{0pt plus 5cm}double {\bf AI\_\-config::correlationThresholdCoefficient}}} +\label{structAI__config_adf6ef0faedfb4dea0a1353e781b14883} +Correlation threshold coefficient for correlating two hyperalerts. Two hyperalerts are 'correlated' to each other in a multi-\/step attack graph if and only if their correlation value is $>$= m + ks, where m is the average correlation coefficient, s is the standard deviation over this coefficient, and k is this threshold coefficient. Its value can be $>$= 0. A value in \mbox{[}0,1\mbox{]} is strongly suggested, but this value mostly depends on how accurate the correlation rules where defined. Be careful, defining a correlation coefficient $>$ or $>$$>$ 1 no correlation may occur at all! \hypertarget{structAI__config_ae6ca715cab1d90b70c3aad443133c263}{ \index{AI\_\-config@{AI\_\-config}!databaseParsingInterval@{databaseParsingInterval}} \index{databaseParsingInterval@{databaseParsingInterval}!AI_config@{AI\_\-config}} \subsubsection[{databaseParsingInterval}]{\setlength{\rightskip}{0pt plus 5cm}unsigned long {\bf AI\_\-config::databaseParsingInterval}}} diff --git a/doc/latex/struct__AI__snort__alert.tex b/doc/latex/struct__AI__snort__alert.tex index 1f775d3..904583d 100644 --- a/doc/latex/struct__AI__snort__alert.tex +++ b/doc/latex/struct__AI__snort__alert.tex @@ -60,6 +60,12 @@ struct \hyperlink{struct__AI__snort__alert}{\_\-AI\_\-snort\_\-alert} $\ast$ \hy unsigned int \hyperlink{struct__AI__snort__alert_a285aff12d6bac03c316ccc5305d28e53}{grouped\_\-alarms\_\-count} \item \hyperlink{structAI__hyperalert__info}{AI\_\-hyperalert\_\-info} $\ast$ \hyperlink{struct__AI__snort__alert_ac101de15b4f9451f235b82122f77b62a}{hyperalert} +\item +struct \hyperlink{struct__AI__snort__alert}{\_\-AI\_\-snort\_\-alert} $\ast$ \hyperlink{struct__AI__snort__alert_a55a5488c7ee7706ded4c16b1235fd9c7}{previous\_\-correlated} +\item +struct \hyperlink{struct__AI__snort__alert}{\_\-AI\_\-snort\_\-alert} $\ast$$\ast$ \hyperlink{struct__AI__snort__alert_aac5e4078600ed17532db1f3d78165390}{derived\_\-alerts} +\item +unsigned int \hyperlink{struct__AI__snort__alert_a1f2d5e8cfd0e6321b977173d1e90cb68}{n\_\-derived\_\-alerts} \end{DoxyCompactItemize} @@ -72,7 +78,12 @@ Data type for Snort alerts \index{classification@{classification}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} \subsubsection[{classification}]{\setlength{\rightskip}{0pt plus 5cm}char$\ast$ {\bf \_\-AI\_\-snort\_\-alert::classification}}} \label{struct__AI__snort__alert_aa89585e14acb2c4e684a1552d322632f} -\hypertarget{struct__AI__snort__alert_ac0902d7c756ec675fb06347ce4706135}{ +\hypertarget{struct__AI__snort__alert_aac5e4078600ed17532db1f3d78165390}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!derived\_\-alerts@{derived\_\-alerts}} +\index{derived\_\-alerts@{derived\_\-alerts}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{derived\_\-alerts}]{\setlength{\rightskip}{0pt plus 5cm}struct {\bf \_\-AI\_\-snort\_\-alert}$\ast$$\ast$ {\bf \_\-AI\_\-snort\_\-alert::derived\_\-alerts}}} +\label{struct__AI__snort__alert_aac5e4078600ed17532db1f3d78165390} +Array of directly correlated 'derived' alerts from the current one, if any \hypertarget{struct__AI__snort__alert_ac0902d7c756ec675fb06347ce4706135}{ \index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!desc@{desc}} \index{desc@{desc}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} \subsubsection[{desc}]{\setlength{\rightskip}{0pt plus 5cm}char$\ast$ {\bf \_\-AI\_\-snort\_\-alert::desc}}} @@ -132,12 +143,22 @@ Hyperalert information, pre-\/conditions and post-\/conditions \hypertarget{stru \index{ip\_\-ttl@{ip\_\-ttl}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} \subsubsection[{ip\_\-ttl}]{\setlength{\rightskip}{0pt plus 5cm}{\bf uint8\_\-t} {\bf \_\-AI\_\-snort\_\-alert::ip\_\-ttl}}} \label{struct__AI__snort__alert_a3c9bbe84ec696cd58668a45799a66600} -\hypertarget{struct__AI__snort__alert_aa8336d4b3359015ed8ea312ca1fd1173}{ +\hypertarget{struct__AI__snort__alert_a1f2d5e8cfd0e6321b977173d1e90cb68}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!n\_\-derived\_\-alerts@{n\_\-derived\_\-alerts}} +\index{n\_\-derived\_\-alerts@{n\_\-derived\_\-alerts}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{n\_\-derived\_\-alerts}]{\setlength{\rightskip}{0pt plus 5cm}unsigned int {\bf \_\-AI\_\-snort\_\-alert::n\_\-derived\_\-alerts}}} +\label{struct__AI__snort__alert_a1f2d5e8cfd0e6321b977173d1e90cb68} +Number of derived alerts \hypertarget{struct__AI__snort__alert_aa8336d4b3359015ed8ea312ca1fd1173}{ \index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!next@{next}} \index{next@{next}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} \subsubsection[{next}]{\setlength{\rightskip}{0pt plus 5cm}struct {\bf \_\-AI\_\-snort\_\-alert}$\ast$ {\bf \_\-AI\_\-snort\_\-alert::next}}} \label{struct__AI__snort__alert_aa8336d4b3359015ed8ea312ca1fd1173} -Pointer to the next alert in the log, if any \hypertarget{struct__AI__snort__alert_a25661fa4e212c5e30af5e6a892985ec9}{ +Pointer to the next alert in the log, if any \hypertarget{struct__AI__snort__alert_a55a5488c7ee7706ded4c16b1235fd9c7}{ +\index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!previous\_\-correlated@{previous\_\-correlated}} +\index{previous\_\-correlated@{previous\_\-correlated}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} +\subsubsection[{previous\_\-correlated}]{\setlength{\rightskip}{0pt plus 5cm}struct {\bf \_\-AI\_\-snort\_\-alert}$\ast$ {\bf \_\-AI\_\-snort\_\-alert::previous\_\-correlated}}} +\label{struct__AI__snort__alert_a55a5488c7ee7706ded4c16b1235fd9c7} +\hypertarget{struct__AI__snort__alert_a25661fa4e212c5e30af5e6a892985ec9}{ \index{\_\-AI\_\-snort\_\-alert@{\_\-AI\_\-snort\_\-alert}!priority@{priority}} \index{priority@{priority}!_AI_snort_alert@{\_\-AI\_\-snort\_\-alert}} \subsubsection[{priority}]{\setlength{\rightskip}{0pt plus 5cm}unsigned short {\bf \_\-AI\_\-snort\_\-alert::priority}}} diff --git a/include/sfrt_trie.h b/include/sfrt_trie.h index 3b4063e..bad0506 100644 --- a/include/sfrt_trie.h +++ b/include/sfrt_trie.h @@ -68,7 +68,7 @@ typedef unsigned long word; /* The trie is represented by an array and each node in the trie is compactly represented using only 32 bits: 5 + 5 + 22 = branch + skip + adr */ -typedef word node_t; +typedef word trie_node_t; #define NOPRE -1 /* an empty prefix pointer */ @@ -137,7 +137,7 @@ typedef struct { /* compact version of above */ typedef struct routtablerec *routtable_t; struct routtablerec { - node_t *trie; /* the main trie search structure */ + trie_node_t *trie; /* the main trie search structure */ int triesize; comp_base_t *base; /* the base vector */ int basesize; diff --git a/mysql.c b/mysql.c index 6eca31d..0ff1e60 100644 --- a/mysql.c +++ b/mysql.c @@ -18,7 +18,7 @@ */ #include "spp_ai.h" -#ifdef ENABLE_MYSQL +#ifdef HAVE_LIBMYSQLCLIENT #include diff --git a/spp_ai.c b/spp_ai.c index 2187e46..6b5ed08 100644 --- a/spp_ai.c +++ b/spp_ai.c @@ -133,22 +133,24 @@ static AI_config * AI_parse(char *args) { char *arg; char *match; - char alertfile[1024] = { 0 }; - char clusterfile[1024] = { 0 }; - char corr_rules_dir[1024] = { 0 }; + char alertfile[1024] = { 0 }; + char clusterfile[1024] = { 0 }; + char corr_rules_dir[1024] = { 0 }; + char corr_alerts_dir[1024] = { 0 }; char **matches = NULL; int nmatches = 0; - int i; - int offset; - int len; + int i; + int offset; + int len; + double corr_threshold_coefficient = DEFAULT_CORR_THRESHOLD; uint32_t netmask; - int min_val; - int max_val; - char label[256]; - cluster_type type; + int min_val; + int max_val; + char label[256]; + cluster_type type; hierarchy_node **hierarchy_nodes = NULL; int n_hierarchy_nodes = 0; @@ -158,21 +160,23 @@ static AI_config * AI_parse(char *args) alertfile_len = 0, clusterfile_len = 0, corr_rules_dir_len = 0, + corr_alerts_dir_len = 0, alert_clustering_interval = 0, database_parsing_interval = 0, correlation_graph_interval = 0; - BOOL has_cleanup_interval = false, - has_stream_expire_interval = false, - has_correlation_interval = false, - has_database_interval = false, - has_alertfile = false, - has_clusterfile = false, - has_corr_rules_dir = false, - has_clustering = false, - has_database_log = false; + BOOL has_cleanup_interval = false, + has_stream_expire_interval = false, + has_correlation_interval = false, + has_corr_alerts_dir = false, + has_database_interval = false, + has_alertfile = false, + has_clusterfile = false, + has_corr_rules_dir = false, + has_clustering = false, + has_database_log = false; - AI_config *config = NULL; + AI_config *config = NULL; if ( !( config = ( AI_config* ) malloc ( sizeof( AI_config )) )) _dpd.fatalMsg("Could not allocate configuration struct.\n"); @@ -276,6 +280,27 @@ static AI_config * AI_parse(char *args) _dpd.logMsg(" Correlation graph thread interval: %d\n", config->correlationGraphInterval); } + /* Parsing the correlation_threshold_coefficient option */ + if (( arg = (char*) strcasestr( args, "correlation_threshold_coefficient" ) )) + { + /* has_stream_expire_interval = true; */ + + for ( arg += strlen("correlation_threshold_coefficient"); + *arg && (*arg < '0' || *arg > '9'); + arg++ ); + + if ( !(*arg) ) + { + _dpd.fatalMsg("AIPreproc: correlation_threshold_coefficient option used but " + "no value specified\n"); + } + + corr_threshold_coefficient = strtod ( arg, NULL ); + _dpd.logMsg( " Correlation threshold coefficient: %d\n", corr_threshold_coefficient ); + } + + config->correlationThresholdCoefficient = corr_threshold_coefficient; + /* Parsing the alertfile option */ if (( arg = (char*) strcasestr( args, "alertfile" ) )) { @@ -373,6 +398,38 @@ static AI_config * AI_parse(char *args) } } + /* Parsing the correlated_alerts_dir option */ + if (( arg = (char*) strcasestr( args, "correlated_alerts_dir" ) )) + { + for ( arg += strlen("correlated_alerts_dir"); + *arg && *arg != '"'; + arg++ ); + + if ( !(*(arg++)) ) + { + _dpd.fatalMsg("AIPreproc: correlated_alerts_dir option used but no filename specified\n"); + } + + for ( corr_alerts_dir[ (++corr_alerts_dir_len)-1 ] = *arg; + *arg && *arg != '"' && corr_alerts_dir_len < 1024; + arg++, corr_alerts_dir[ (++corr_alerts_dir_len)-1 ] = *arg ); + + if ( corr_alerts_dir[0] == 0 || corr_alerts_dir_len <= 1 ) { + has_corr_alerts_dir = false; + } else { + if ( corr_alerts_dir_len >= 1024 ) { + _dpd.fatalMsg("AIPreproc: correlated_alerts_dir path too long ( >= 1024 )\n"); + } else if ( strlen( corr_alerts_dir ) == 0 ) { + has_corr_alerts_dir = false; + } else { + has_corr_alerts_dir = true; + corr_alerts_dir[ corr_alerts_dir_len-1 ] = 0; + strncpy ( config->corr_alerts_dir, corr_alerts_dir, corr_alerts_dir_len ); + _dpd.logMsg(" correlated_alerts_dir: %s\n", config->corr_alerts_dir); + } + } + } + /* Parsing database option */ if ( preg_match ( "\\s*database\\s*\\(\\s*([^\\)]+)\\)", args, &matches, &nmatches ) > 0 ) { @@ -699,8 +756,8 @@ static AI_config * AI_parse(char *args) } else if ( has_database_log ) { has_alertfile = false; - #ifdef ENABLE_DB - alertparser_thread = AI_db_alertparser_thread; + #ifdef HAVE_LIBMYSQLCLIENT + alertparser_thread = AI_db_alertparser_thread; #else _dpd.fatalMsg ( "AIPreproc: database logging enabled in config file, but the module was not compiled " "with database support (recompile, i.e., with ./configure --with-mysql)\n" ); @@ -745,9 +802,16 @@ static AI_config * AI_parse(char *args) _dpd.logMsg ( "Using correlation rules from directory %s\n", config->corr_rules_dir ); + if ( ! has_corr_alerts_dir ) + { + strncpy ( config->corr_alerts_dir, DEFAULT_CORR_ALERTS_DIR, sizeof ( DEFAULT_CORR_ALERTS_DIR )); + } + + _dpd.logMsg ( "Saving correlated alerts information in %s\n", config->corr_alerts_dir ); + if ( has_database_log ) { - #ifdef ENABLE_DB + #ifdef HAVE_LIBMYSQLCLIENT get_alerts = AI_db_get_alerts; #else _dpd.fatalMsg ( "AIPreproc: Using database alert log, but the module was not compiled with database support\n" ); diff --git a/spp_ai.h b/spp_ai.h index a28549a..7b81467 100644 --- a/spp_ai.h +++ b/spp_ai.h @@ -54,6 +54,12 @@ /** Default path to alert correlation rules directory */ #define DEFAULT_CORR_RULES_DIR "/etc/snort/corr_rules" +/** Default directory for placing correlated alerts information (.dot and possibly .png files) */ +#define DEFAULT_CORR_ALERTS_DIR "/var/log/snort/correlated_alerts" + +/** Default correlation threshold coefficient for correlating two hyperalerts */ +#define DEFAULT_CORR_THRESHOLD 0.5 + extern DynamicPreprocessorData _dpd; typedef unsigned char uint8_t; typedef unsigned short uint16_t; @@ -114,6 +120,16 @@ typedef struct /** Interval in seconds for running the thread for building alert correlation graphs */ unsigned long correlationGraphInterval; + /** Correlation threshold coefficient for correlating two hyperalerts. Two hyperalerts + * are 'correlated' to each other in a multi-step attack graph if and only if their + * correlation value is >= m + ks, where m is the average correlation coefficient, + * s is the standard deviation over this coefficient, and k is this threshold + * coefficient. Its value can be >= 0. A value in [0,1] is strongly suggested, + * but this value mostly depends on how accurate the correlation rules where + * defined. Be careful, defining a correlation coefficient > or >> 1 no correlation + * may occur at all! */ + double correlationThresholdCoefficient; + /** Alert file */ char alertfile[1024]; @@ -123,6 +139,9 @@ typedef struct /** Correlation rules path */ char corr_rules_dir[1024]; + /** Directory where the correlated alerts' information will be placed */ + char corr_alerts_dir[1024]; + /** Database name, if database logging is used */ char dbname[256]; @@ -231,6 +250,17 @@ typedef struct _AI_snort_alert { /** Hyperalert information, pre-conditions * and post-conditions*/ AI_hyperalert_info *hyperalert; + + /* 'Parent' correlated alert in the chain, + * if any*/ + struct _AI_snort_alert *previous_correlated; + + /** Array of directly correlated 'derived' + * alerts from the current one, if any */ + struct _AI_snort_alert **derived_alerts; + + /** Number of derived alerts */ + unsigned int n_derived_alerts; } AI_snort_alert; /*****************************************************************/ @@ -242,7 +272,7 @@ void* AI_hashcleanup_thread ( void* ); void* AI_file_alertparser_thread ( void* ); void* AI_alert_correlation_thread ( void* ); -#ifdef ENABLE_DB +#ifdef HAVE_LIBMYSQLCLIENT AI_snort_alert* AI_db_get_alerts ( void ); void AI_db_free_alerts ( AI_snort_alert *node ); void* AI_db_alertparser_thread ( void* );