diff -Nru specter-1.4.orig/plugins/Makefile.in specter-1.4/plugins/Makefile.in --- specter-1.4.orig/plugins/Makefile.in 2005-07-03 13:58:17.000000000 +0200 +++ specter-1.4/plugins/Makefile.in 2009-09-25 16:20:57.000000000 +0200 @@ -9,6 +9,7 @@ specter_LOCAL.so \ specter_LOGEMU.so \ specter_OPRINT.so \ + specter_HTTPRINT.so \ specter_PWSNIFF.so \ specter_SYSLOG.so diff -Nru specter-1.4.orig/plugins/specter_HTTPRINT.c specter-1.4/plugins/specter_HTTPRINT.c --- specter-1.4.orig/plugins/specter_HTTPRINT.c 1970-01-01 01:00:00.000000000 +0100 +++ specter-1.4/plugins/specter_HTTPRINT.c 2009-09-25 16:23:53.000000000 +0200 @@ -0,0 +1,236 @@ +/* specter_HTTPRINT.c + * + * specter output target for logging HTTP to a file + * + * (C) 2000-2001 by Harald Welte + * + * 24 Sep 2009, Piotr Michalczyk : + * Created from specter_OPRINT.c for printing HTTP packets. + */ + +/* + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 + * as published by the Free Software Foundation + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + + +#include +#include +#include +#include +#include +#include +#include +#include +#include "lret.h" + + +#ifndef HTTPRINT_DEFAULT +#define HTTPRINT_DEFAULT "/var/log/specter.httprint" +#endif + +#define HIPQUAD(addr) \ + ((unsigned char *)&addr)[3], \ + ((unsigned char *)&addr)[2], \ + ((unsigned char *)&addr)[1], \ + ((unsigned char *)&addr)[0] + + +static config_entry_t my_config[] = { + { .key = "logfile", .type = CONFIG_TYPE_STRING, .options = CONFIG_OPT_NONE, + .u = { .string = HTTPRINT_DEFAULT } }, +}; + +struct my_data { + FILE *of; +}; + +static specter_local_ret_t local_ret[] = { + { "*", NULL } +}; + +static void *init_httprint(config_entry_t *ce) +{ + struct my_data *data; + + if (fill_local_ret(local_ret, 1) == -1) + return NULL; + + if ((data = malloc(sizeof(struct my_data))) == NULL) { + specter_log(SPECTER_FATAL, "Couldn't allocate data: %s.\n", + strerror(errno)); + return NULL; + } + + /* open logfile */ + if (!strcmp(GET_CE(ce,0)->u.string, "stdout")) { + data->of = stdout; + } + else if (!strcmp(GET_CE(ce,0)->u.string, "stderr")) { + data->of = stderr; + } + else { + data->of = fopen(GET_CE(ce,0)->u.string, "a"); + if (!data->of) { + specter_log(SPECTER_FATAL, "Couldn't open \"%s\": %s.\n", + GET_CE(ce,0)->u.string, strerror(errno)); + return NULL; + } + } + + return data; +} + +static void fini_httprint(config_entry_t *ce, void *data) +{ + struct my_data *md = data; + + if (md->of != stdout && md->of != stderr) { + fclose(md->of); + } + + free(data); +} + +static void print_iret(struct my_data *md, char* name, specter_iret_t *ret) +{ + if (!IS_VALID(ret)) { + fprintf(md->of, "%s= ", name); + return; + } + + if (name != NULL) + fprintf(md->of,"%s=", name); + + switch (ret->type) { + case SPECTER_IRET_STRING: + fprintf(md->of, "%s ", (char *) ret->value.ptr); + break; + case SPECTER_IRET_BOOL: + case SPECTER_IRET_INT8: + case SPECTER_IRET_INT16: + case SPECTER_IRET_INT32: + fprintf(md->of, "%d ", ret->value.i32); + break; + case SPECTER_IRET_UINT8: + case SPECTER_IRET_UINT16: + case SPECTER_IRET_UINT32: + fprintf(md->of, "%u ", ret->value.ui32); + break; + case SPECTER_IRET_IPADDR: + fprintf(md->of, "%u.%u.%u.%u ", + HIPQUAD(ret->value.ui32)); + break; + case SPECTER_IRET_NONE: + fprintf(md->of, ""); + break; + default: + fprintf(md->of, " "); + break; + } + +} + +static int output_httprint(config_entry_t *ce, void *data) +{ + specter_iret_t *ret; + struct my_data *md = data; + time_t now; + char *timestr, *tmp; + + ret = find_iret("http.method"); + if ((ret == NULL) || !IS_VALID(ret)) + return 0; + + ret = find_iret("local.time"); + if (ret != NULL) { + if (IS_VALID(ret)) { + now = (time_t)ret->value.ui32; + timestr = ctime(&now); + if ((tmp = strchr(timestr, '\n'))) + *tmp = '\0'; + fprintf(md->of, "%s ", timestr); + } + } + + ret = find_iret("ip.saddr"); + if (ret != NULL) + print_iret(md, "SRC", ret); + + ret = find_iret("ip.daddr"); + if (ret != NULL) + print_iret(md, "DST", ret); + + ret = find_iret("http.host"); + if (ret != NULL) + print_iret(md, "HOST", ret); + + ret = find_iret("http.url"); + if (ret != NULL) + print_iret(md, "URL", ret); + + ret = find_iret("http.referer"); + if (ret != NULL) + print_iret(md, "REFERER", ret); + + fprintf(md->of, "\n"); + + fflush(md->of); + return 0; +} + +static int sighup_handler(config_entry_t *ce, void *data, int signal) +{ + struct my_data *md = data; + + switch (signal) { + case SIGHUP: + specter_log(SPECTER_INFO, "Reopening logfile.\n"); + + if (md->of == stderr || md->of == stdout) + break; + + fclose(md->of); + md->of = fopen(GET_CE(ce,0)->u.string, "a"); + if (!md->of) { + specter_log(SPECTER_FATAL, "Couldn't open \"%s\": %s.\n", + GET_CE(ce,0)->u.string, strerror(errno)); + return -1; + } + break; + default: + break; + } + + return 0; +} + +static specter_output_t httprint_op = { + .name = "httprint", + .ce_base = my_config, + .ce_num = 1, + .init = &init_httprint, + .fini = &fini_httprint, + .output = &output_httprint, + .signal = &sighup_handler +}; + + +void _init(void) +{ + if (register_output(&httprint_op, 0) == -1) { + specter_log(SPECTER_FATAL, "Couldn't register.\n"); + exit(EXIT_FAILURE); + } +} + diff -Nru specter-1.4.orig/sample.conf.in specter-1.4/sample.conf.in --- specter-1.4.orig/sample.conf.in 2005-07-03 13:58:17.000000000 +0200 +++ specter-1.4/sample.conf.in 2009-09-25 16:18:32.000000000 +0200 @@ -39,6 +39,7 @@ PWSNIFF @libdir@/specter_PWSNIFF.so OPRINT @libdir@/specter_OPRINT.so + HTTPRINT @libdir@/specter_HTTPRINT.so PCAP @libdir@/specter_PCAP.so LOGEMU @libdir@/specter_LOGEMU.so MYSQL @libdir@/specter_MYSQL.so @@ -123,3 +124,12 @@ level info } +# nlgroup 6, log HTTP requests +6 { + :BASE + :LOCAL + :HTTP + + :HTTPRINT + logfile /var/log/specter.httprint +} diff -Nru specter-1.4.orig/specter.logrotate specter-1.4/specter.logrotate --- specter-1.4.orig/specter.logrotate 2005-07-03 13:58:17.000000000 +0200 +++ specter-1.4/specter.logrotate 2009-09-25 16:19:40.000000000 +0200 @@ -1,4 +1,4 @@ -/var/log/specter.log /var/log/specter.logemu /var/log/specter.oprint /var/log/specter.pcap { +/var/log/specter.log /var/log/specter.logemu /var/log/specter.oprint /var/log/specter.pcap /var/log/specter.httprint { missingok sharedscripts postrotate diff -Nru specter-1.4.orig/specter.spec specter-1.4/specter.spec --- specter-1.4.orig/specter.spec 2005-07-03 13:58:17.000000000 +0200 +++ specter-1.4/specter.spec 2009-09-25 16:19:09.000000000 +0200 @@ -57,6 +57,7 @@ %{_libdir}/specter/specter_LOGEMU.so %{_libdir}/specter/specter_MYSQL.so %{_libdir}/specter/specter_OPRINT.so +%{_libdir}/specter/specter_HTTPRINT.so %{_libdir}/specter/specter_PCAP.so %{_libdir}/specter/specter_PGSQL.so %{_libdir}/specter/specter_SYSLOG.so