home *** CD-ROM | disk | FTP | other *** search
- <?xml version='1.0' ?>
- <!-- /*//////////////////////////////////////////////////////////////////////
- //filename: log.xsl
- //copyright(c): Tiny Software corp 2002 - 2004 (http://www.tinysoftware.com)
- //author: Jozef Palocko (jpalocko@tinysoftware.com)
- //product: Tiny Firewall 6.x
- //description: Log analyzer stylesheet
- //changelog:
- // 18.8.2003 - added displaying date in local time zone
- ///////////////////////////////////////////////////////////////////////*/ -->
- <xsl:stylesheet version="1.0"
- xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
- xmlns:msxsl="urn:schemas-microsoft-com:xslt"
- xmlns:time="http://mycompany.com/mynamespace"
- xmlns:apps="http://mycompany.com/mynamespace">
-
-
- <xsl:import href="log.xsl"/>
- <!--xsl:output method="html" indent="yes" /-->
-
- <xsl:template match="/">
- <style>
- <xsl:text>
- BODY {
- font-family: "MS Sans serif", "Verdana", "Tahoma" ;
- font-size: 10px;
- background-color: #ffffff;
- color:#000000;
- }
- .clsEvent{
- background-color: #fafafa;
- text-align : left;
- margin-bottom: 10px;
- }
- .clsAllow{
- color =#2e8b57;
- font-weight : bold;
- }
- .clsPrevent{
- color =#ff0000;
- font-weight : bold;
- }
- .clsAskUser{
- color =#00ffff;
- font-weight : bold;
- }
-
-
- </xsl:text>
- </style>
-
- <table class="clsTable" style="color:black" width="100%">
- <tr>
- <th align="left">
- Count
- </th>
- <th align="left">
- Module
- </th>
- <th align="left">
- Application
- </th>
- <th align="left">
- Access
- </th>
- <th align="left">
- Object
- </th>
- <th align="left">
- Date
- </th>
- <th align="left">
- User
- </th>
- <th align="left">
- Domain
- </th>
-
-
- </tr>
- <xsl:call-template name="tplModule">
- <xsl:with-param name="Events" select="/Root/Event"/>
- </xsl:call-template>
- </table>
- </xsl:template>
-
- <!-- ///////// Object //////////// -->
- <xsl:template match="Object">
- <b>
- <!-- <xsl:value-of select="@ot"></xsl:value-of> -->
- <!--xsl:choose>
- <xsl:when test="@ot='0x00000001'">File</xsl:when>
- <xsl:when test="@ot='0x00000002'">Service</xsl:when>
- <xsl:when test="@ot='0x00000004'">Registry key</xsl:when>
- <xsl:when test="@ot='0x00000008'">Spawning object</xsl:when>
- <xsl:when test="@ot='0x00000010'">Device</xsl:when>
- <xsl:when test="@ot='0x00000020'">VBA Macro</xsl:when>
- <xsl:when test="@ot='0x00000040'">COM object</xsl:when>
- <xsl:when test="@ot='0x00000080'">System privileges</xsl:when>
- <xsl:when test="@ot='0x00000400'">Transport object</xsl:when>
- <xsl:when test="@ot='0x10000000'">Action</xsl:when>
- <xsl:when test="@ot='0x20000000'">Message</xsl:when>
- </xsl:choose-->
- </b>
- <xsl:if test="(.!='') and (.!=' ')">
- <!-- <br/>
- <I>Object : </I> -->
- <xsl:value-of select="." />
- </xsl:if>
- </xsl:template>
-
- <msxsl:script language="JScript" implements-prefix="apps">
- <![CDATA[
- function GetFileNameFromAppPath( node ) {
- if (!node)
- return node;
-
- var strPath = node.nextNode.text;
- if (! strPath)
- return strPath;
-
- // find the \ from the end and truncate everything before
- var I = 0;
- for (I=strPath.length; I>0; I--)
- {
- if ("\\" == strPath.charAt(I-1))
- break;
- }
-
- return strPath.substr(I);
- }
- ]]>
- </msxsl:script>
-
- <!-- ///////// App //////////// -->
- <xsl:template match="App">
- <xsl:element name="a">
- <xsl:attribute name="title"><xsl:value-of select="."/></xsl:attribute>
- <xsl:value-of select="apps:GetFileNameFromAppPath(.)"/>
- </xsl:element> <!-- <xsl:value-of select="." />
- <xsl:if test="@chksm">
- <B> Chksm: </B>
- <xsl:value-of select="@chksm" />
- </xsl:if> -->
- </xsl:template>
-
- <!-- ///////// Action //////////// -->
- <xsl:template match="Action">
- <!--xsl:choose>
- <xsl:when test="@ar=1">
- <span class="clsAllow"> Allow </span>
- </xsl:when>
- <xsl:when test="@ar=0">
- <span class="clsPrevent"> Prevent</span>
- </xsl:when>
- <xsl:when test="@ar=2">
- <span class="clsAskUser"> Ask User</span>
- </xsl:when>
- </xsl:choose-->
-
- <!--
- <xsl:if test="@fnc">
- <br/>
- <I>Fnc : </I>
- <xsl:variable name="ID" select="@fnc" /> <xsl:value-of select="$Def//Fnc[@id_dec=$ID]" /> (<xsl:value-of select="$ID" />)
- </xsl:if>
- -->
- <!--xsl:value-of select="." /-->
- <xsl:if test="@fncMsg"><xsl:value-of select="@fncMsg" />
- </xsl:if>
- </xsl:template>
-
- <!-- ///////// Msg //////////// -->
- <xsl:template match="Msg">
- <B>Msg: </B>
- <xsl:value-of select="." />
- <!--- ///// if App element is missing, insert empty table cell //// -->
- <!--xsl:if test="normalize-space(following-sibling::App)=''">
- <td></td>
- </xsl:if-->
- </xsl:template>
-
- <!-- ///////// InetDef //////////// -->
- <xsl:template match="InetDef">
- <B>Prot: </B>
- <xsl:value-of select="@prot" />
- <xsl:if test="@dir">
- <B> Dir: </B>
- <xsl:value-of select="@dir" />
- </xsl:if>
- <xsl:if test="@remIp">
- <B> RemIp: </B>
- <xsl:value-of select="@remIp" />
- </xsl:if>
- <xsl:if test="@locPort">
- <B> LocPort: </B>
- <xsl:value-of select="@locPort" />
- </xsl:if>
- <xsl:if test="@remPort">
- <B> RemPort: </B>
- <xsl:value-of select="@remPort" />
- </xsl:if>
- <xsl:if test="@icmpFn">
- <B> IcmpFn: </B>
- <xsl:value-of select="@icmpFn" />
- </xsl:if>
- <xsl:if test="@locIp">
- <B> LocIp: </B>
- <xsl:value-of select="@locIp" />
- </xsl:if>
- </xsl:template>
-
- <!-- ///////// Event //////////// -->
- <xsl:template match="Event">
- <xsl:param name="Total"/>
- <xsl:param name="Events"/>
-
- <xsl:if test="($Filter//cnt=0) or (position()>$Total - $Filter//cnt)">
- <tr height="30">
- <xsl:attribute name="bgcolor">
- <xsl:choose>
- <xsl:when test='.//Action="Prevented"'>#ffc9c6</xsl:when>
- <xsl:when test='.//Action="Allowed"'>#dbfeda</xsl:when>
- <xsl:otherwise>
- #ffffd7
- </xsl:otherwise>
- </xsl:choose>
- </xsl:attribute>
- <xsl:variable name="NextSiblingPos" select="position()+1"/>
- <td>
- <img>
- <xsl:attribute name="src">
- <xsl:choose>
- <xsl:when test='Action="Prevented"'>prevent.gif</xsl:when>
- <xsl:when test='Action="Allowed" and Object//@ot="Message"'>information.gif</xsl:when>
- <xsl:otherwise>monitor.gif</xsl:otherwise>
- </xsl:choose>
- </xsl:attribute>
- </img>
- <xsl:choose>
- <xsl:when test="$Filter//sort='App'">
- <xsl:variable name="thisApp" select="App"/>
- <xsl:variable name="thisUser" select="@user"/>
- <xsl:variable name="thisDomain" select="@domain"/>
- <xsl:variable name="thisModule" select="@module"/>
- <xsl:variable name="thisAction" select="Action"/>
- <xsl:variable name="thisMsg" select="Msg"/>
- <xsl:variable name="thisProt" select="InetDef/@prot"/>
- <xsl:variable name="thisDir" select="InetDef/@dir"/>
- <xsl:variable name="thisRemPort" select="InetDef/@remPort"/>
- <xsl:variable name="thisRemIp" select="InetDef/@remIp"/>
- <xsl:variable name="equalEvents" select="$Events[
- (@module=$thisModule) and
- (App=$thisApp or (count($thisApp)=0 and count(App)=0)) and
- (@user=$thisUser or (count($thisUser)=0 and count(@user)=0)) and
- (@domain=$thisDomain or (count($thisDomain)=0 and count(@domain)=0)) and
- (Action=$thisAction) and
- (not($thisModule='IDS') or $thisMsg=Msg) and
- (not($thisModule='Firewall') or ($thisProt=InetDef/@prot and
- (count($thisDir)=0 and count(InetDef/@dir)=0 or $thisDir=InetDef/@dir) and
- (count($thisRemPort)=0 and count(InetDef/@remPort)=0 or $thisRemPort=InetDef/@remPort) and
- (count($thisRemIp)=0 and count(InetDef/@remIp)=0 or $thisRemIp=InetDef/@remIp)
- )
- )
-
- ]"/>
- <a> </a>
- <xsl:value-of select="count($equalEvents)"/>
- </xsl:when>
- <xsl:otherwise>
- <xsl:if test="@count">
- <a> </a>
- <xsl:value-of select="@count" />
- </xsl:if>
- </xsl:otherwise>
- </xsl:choose>
- </td>
- <td>
-
- <xsl:value-of select="@module"/>
- </td>
-
- <td>
- <xsl:apply-templates select="App" />
- </td>
- <td>
- <xsl:apply-templates select="Action" />
- </td>
- <td>
- <xsl:apply-templates select="Object" />
- <xsl:apply-templates select="InetDef" />
- <xsl:apply-templates select="Msg" />
- </td>
-
- <td>
- <xsl:value-of select="time:LocalTime(.)"/>
- </td>
- <td>
- <xsl:if test="@user">
- [<xsl:value-of select="@user" />]
- </xsl:if>
- </td>
- <td>
- <xsl:if test="@domain">
- [<xsl:value-of select="@domain" />]
- </xsl:if>
- </td>
-
-
- <!--/div-->
- </tr>
- </xsl:if>
- </xsl:template>
-
- </xsl:stylesheet>
-