GeofC

#!/usr/bin/env python2.5
# -*- coding: utf-8 -*-
#
# PyCorr - An IDS correlation system written in Python
#
# Copyright (C) 2008  Geoffroy Cécile <geocecile@gmail.com>
# Copyright (C) 2008  Julien Montois <>
# Copyright (C) 2008  Olivier Tétard <toutoune25@free.fr>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
# 02110-1301, USA.

import os
import sys
import getopt
import traceback

__version__ = "0.0.1-dev"
__svn_version__ = "$Id: pycorr-daemon.py 88 2008-02-14 14:50:10Z toutoune25 $"

try:
    from connector import *
except Exception, err:
    print err
    sys.exit(1)

from alert import *

# Debugging levels
DEBUG_ERR = 0
DEBUG_WARN = 1
DEBUG_INFO = 2

class PyCorrDaemon:
    def __init__(self, host, debug, visu):
        self.host = host
        self.debug = debug
        self.visu = visu

        self.print_debug("Enabling debbuging (level %s)" % self.debug, DEBUG_INFO)
        self.print_debug("Host to connect to: %s" % host, DEBUG_INFO)
        self.print_debug("Version: %s" % __version__, DEBUG_INFO)
        self.alert_processor = AlertProcessor(self)
        self.connector = PreludeEasyConnector(host, self.alert_processor, debug)
        self.connaaa()
        self.run()

	def connaaa(self):
		print "--------------------"

    def print_debug(self, str, log_level = DEBUG_ERR):
        '''Simply print a DEBUG line with the str message'''

        if log_level <= debug:

            if log_level == DEBUG_ERR:
                debug_level = "ERROR"
            elif log_level == DEBUG_WARN:
                debug_level = "WARNING"
            elif log_level == DEBUG_INFO:
                debug_level = "INFO"
            else:
                debug_level = "DEBUG"

            sys.stderr.write("[%s] %s\n" % (debug_level, str))
	
    def print_version(self):
        '''Print version number'''

        print __version__

    def run(self):
        try:
            while True:
                sys.stderr.write(".")
                sys.stderr.flush()
                idmef = self.connector.read_event()
                if idmef:
                    self.alert_processor.process(idmef)
                time.sleep(1)
        except KeyboardInterrupt, e:
            self.print_debug("Keyboard interruption detected: exiting", 2)
            self.exit()
        except Exception, e:
            self.print_debug("while processing alerts: %s" % e)

            if debug >= DEBUG_INFO:
                print "---------------------Traceback lines-----------------------"
                traceback.print_exc()
                print "-----------------------------------------------------------"
                self.exit()

    def exit(self):
        self.connector.disconnect_client()
        self.alert_processor.show_alert_tree()
        sys.exit(2)

def usage():
    str = u'''Usage: ./pycorr-daemon.py -H <prelude> -D -v
-h,  --help            Print this help
-H,  --hostname        Specifiy prelude-manager's address
-O,  --output 	       Specify output visualisation
-D,  --debug=[1-2]     Enable debugging, you could specify the debug level
-v,  --version         Print version number
'''
    sys.stderr.write(str)


if __name__ == "__main__":
    argv = os.sys.argv
    argc = len(argv)

    try:
        opts, args = getopt.getopt(argv[1:], "hH:vD", ["help", "hostname=", "output=", "version", "debug="])
    except getopt.GetoptError:
        usage()
        sys.exit(2)

    # Default values for parameters
    debug = DEBUG_ERR
    host = None

    # Parse parameters
    for o, a in opts:
        if o in ("-h", "--help"):
            usage()
            sys.exit(0)

        if o in ("-v", "--version"):
            print "PyCorr %s (%s)" % (__version__, __svn_version__)
            sys.exit(0)

        if o in ("-D", "--debug"):
            debug = DEBUG_WARN

            try:
                debug = int(a)
            except:
                pass
        
        if o in ("-O", "--output"):
        	visu = a

        if o in ("-H", "--hostname"):
            host = a

    if host == None:
        usage()
        sys.exit(2)

    # Finally, init PyCorr
    PyCorrDaemon(host, debug, visu)