log-surfnet
{
	server 	"127.0.0.1"; // must be ip
	user	"user";
	pass	"pass";
	db	"idsserver";
	
	options ""; // sslmode=required for example if you want to use ssl 



	/* mode: 
	 *	* any means log accepted connections on _all_ ports
	 * 	* list means, use the port list 
	 */
	 
	mode 	"any"; 
	

        ports   (
                "21",
		"25",
                "42",
                "80",
                "110",
                "135",
                "139",
                "143",
                "220",
                "445",
                "465",
                "993",
                "995",
                "1023",
                "1025",
                "1434",
                "2103",
                "2105",
                "2107",
                "2745",
                "3127",
                "3140",
                "5000",
                "5554",
                "6129",
                "10000",
                "17300",
                "27347");

};


/*

don't forget to create these fn's in your surfnet ids database.


CREATE PROCEDURAL LANGUAGE plpgsql;

CREATE FUNCTION surfnet_attack_add(integer, inet, integer, inet, integer, macaddr, inet) RETURNS integer
    AS $_$DECLARE
	p_severity	ALIAS FOR $1; 
	p_attackerip	ALIAS FOR $2;
	p_attackerport	ALIAS FOR $3;
	p_decoyip	ALIAS FOR $4;
	p_decoyport	ALIAS FOR $5;
	p_hwa		ALIAS FOR $6;
	p_localhost	ALIAS FOR $7;
	m_attackid INTEGER;
	m_sensorid INTEGER;
BEGIN

	SELECT INTO m_sensorid surfnet_sensorid_get(p_localhost);
	SELECT INTO m_attackid surfnet_attack_add_by_id(p_severity,
		p_attackerip, p_attackerport, p_decoyip,
		p_decoyport, p_hwa, m_sensorid);

	return m_attackid;
END$_$
    LANGUAGE plpgsql;


CREATE FUNCTION surfnet_attack_add_by_id(integer, inet, integer, inet, integer, macaddr, integer) RETURNS integer
    AS $_$DECLARE
	p_severity	ALIAS FOR $1; 
	p_attackerip	ALIAS FOR $2;
	p_attackerport	ALIAS FOR $3;
	p_decoyip	ALIAS FOR $4;
	p_decoyport	ALIAS FOR $5;
	p_hwa		ALIAS FOR $6;
	p_sensorid	ALIAS FOR $7;
	m_attackid	INTEGER;
BEGIN
	INSERT INTO attacks
		(severity,
		 timestamp,
		 dest,
		 dport,
		 source,
		 sport,
		 sensorid,
		 src_mac)
	VALUES
		(p_severity,
		 extract(epoch from current_timestamp(0))::integer,
		 p_attackerip,
		 p_attackerport,
	         p_decoyip,
		 p_decoyport,
		 p_sensorid,
		 p_hwa);

	SELECT INTO m_attackid currval('attacks_id_seq');
	return m_attackid;
END$_$
    LANGUAGE plpgsql;



CREATE FUNCTION surfnet_attack_update_severity(integer, integer) RETURNS void
    AS $_$DECLARE
	p_attackid ALIAS FOR $1;
	p_severity ALIAS FOR $2;
BEGIN
	UPDATE attacks SET severity = p_severity WHERE id = p_attackid;
	return;
END;$_$
    LANGUAGE plpgsql;


CREATE FUNCTION surfnet_detail_add(integer, inet, integer, character varying) RETURNS void
    AS $_$DECLARE
	p_attackid ALIAS FOR $1;
	p_localhost ALIAS FOR $2;
	p_type ALIAS FOR $3;
	p_data ALIAS FOR $4;

	m_sensorid INTEGER;
BEGIN
	SELECT INTO m_sensorid surfnet_sensorid_get(p_localhost);

	INSERT INTO details
		(attackid,sensorid,type,text)
	VALUES
		(p_attackid,m_sensorid,p_type,p_data);
END$_$
    LANGUAGE plpgsql;


CREATE FUNCTION surfnet_detail_add_by_id(integer, integer, integer, character varying) RETURNS void
    AS $_$DECLARE
	p_attackid ALIAS FOR $1;
	m_sensorid ALIAS FOR $2;
	p_type ALIAS FOR $3;
	p_data ALIAS FOR $4;
BEGIN
	INSERT INTO details
		(attackid,sensorid,type,text)
	VALUES
		(p_attackid,m_sensorid,p_type,p_data);
END$_$
    LANGUAGE plpgsql;


CREATE FUNCTION surfnet_detail_add_download(inet, inet, character varying, character varying) RETURNS void
    AS $_$DECLARE
	p_remotehost ALIAS FOR $1;
	p_localhost ALIAS FOR $2;
	p_url ALIAS FOR $3;
	p_hash ALIAS FOR $4;

	m_sensorid INTEGER;
	m_attackid INTEGER;
BEGIN
	SELECT INTO m_sensorid surfnet_sensorid_get(p_localhost);
	SELECT INTO m_attackid surfnet_attack_add_by_id(32,p_remotehost, 0,
		p_localhost, 0,
		NULL,m_sensorid);

	PERFORM surfnet_detail_add_by_id(m_attackid,
				m_sensorid,4,p_url);
	PERFORM surfnet_detail_add_by_id(m_attackid,
				m_sensorid,8,p_hash);

	return;
END;	$_$
    LANGUAGE plpgsql;


CREATE FUNCTION surfnet_detail_add_offer(inet, inet, character varying) RETURNS void
    AS $_$DECLARE
	p_remotehost ALIAS FOR $1;
	p_localhost ALIAS FOR $2;
	p_url ALIAS FOR $3;

	m_sensorid INTEGER;
	m_attackid INTEGER;
BEGIN
	SELECT INTO m_sensorid surfnet_sensorid_get(p_localhost);
	SELECT INTO m_attackid surfnet_attack_add_by_id(16,p_remotehost, 0,
		p_localhost, 0,
		NULL,m_sensorid);

	PERFORM surfnet_detail_add_by_id(m_attackid,
				m_sensorid,4,p_url);
	return;
END;	$_$
    LANGUAGE plpgsql;


CREATE FUNCTION surfnet_sensorid_get(inet) RETURNS integer
    AS $_$DECLARE
  p_localhost ALIAS FOR $1;
  m_sensorid  INTEGER;
BEGIN
	SELECT INTO m_sensorid id FROM sensors WHERE tapip = p_localhost;
	return m_sensorid;
END
$_$
    LANGUAGE plpgsql;


*/
