~ubuntu-branches/ubuntu/utopic/suricata/utopic

Committer: Package Import Robot
Author(s): Pierre Chifflier
Date: 2011-11-17 23:20:51 UTC
mfrom: (1.1.10)
Revision ID: package-import@ubuntu.com-20111117232051-wlo0g2fyinx0zi25

Tags: 1.1-1

* Imported Upstream version 1.1
* Add instructions on getting new rules using oinkmaster
* Add Recommends on oinkmaster
* Move snort-rules-default to Recommends

files added:
qa

qa/Makefile.am

qa/Makefile.in

qa/coccinelle

qa/coccinelle/Makefile.am

qa/coccinelle/Makefile.in

qa/coccinelle/access-pkt-packet.cocci

qa/coccinelle/banned-functions.cocci

qa/coccinelle/direct-packet.cocci

qa/coccinelle/pktnotset-packet.cocci

qa/coccinelle/run_check.sh

qa/wirefuzz.pl

reference.config

rules

rules/decoder-events.rules

rules/stream-events.rules

src/alert-pcapinfo.c

src/alert-pcapinfo.h

src/alert-syslog.c

src/alert-syslog.h

src/app-layer-protos.c

src/app-layer-smtp.c

src/app-layer-smtp.h

src/cuda-ptxdump.h

src/decode-sctp.c

src/decode-sctp.h

src/detect-byte-extract.c

src/detect-byte-extract.h

src/detect-engine-event.c

src/detect-engine-event.h

src/detect-engine-hcbd.c

src/detect-engine-hcbd.h

src/detect-engine-hcd.c

src/detect-engine-hcd.h

src/detect-engine-hhd.c

src/detect-engine-hhd.h

src/detect-engine-hmd.c

src/detect-engine-hmd.h

src/detect-engine-hrhd.c

src/detect-engine-hrhd.h

src/detect-engine-hrud.c

src/detect-engine-hrud.h

src/detect-http-raw-header.c

src/detect-http-raw-header.h

src/detect-http-raw-uri.c

src/detect-http-raw-uri.h

src/detect-http-stat-code.c

src/detect-http-stat-code.h

src/detect-http-stat-msg.c

src/detect-http-stat-msg.h

src/detect-mark.c

src/detect-mark.h

src/detect-replace.c

src/detect-replace.h

src/detect-ssl-state.c

src/detect-ssl-state.h

src/detect-ssl-version.c

src/detect-ssl-version.h

src/flow-manager.c

src/flow-manager.h

src/flow-timeout.c

src/flow-timeout.h

src/log-droplog.c

src/log-droplog.h

src/log-pcap.c

src/log-pcap.h

src/runmode-af-packet.c

src/runmode-af-packet.h

src/runmode-erf-dag.c

src/runmode-erf-dag.h

src/runmode-erf-file.c

src/runmode-erf-file.h

src/runmode-ipfw.c

src/runmode-ipfw.h

src/runmode-nfq.c

src/runmode-nfq.h

src/runmode-pcap-file.c

src/runmode-pcap-file.h

src/runmode-pcap.c

src/runmode-pcap.h

src/runmode-pfring.c

src/runmode-pfring.h

src/source-af-packet.c

src/source-af-packet.h

src/stream-tcp-inline.c

src/stream-tcp-inline.h

src/stream-tcp-sack.c

src/stream-tcp-sack.h

src/stream-tcp-util.c

src/stream-tcp-util.h

src/tm-threads-common.h

src/util-affinity.c

src/util-affinity.h

src/util-checksum.c

src/util-checksum.h

src/util-device.c

src/util-device.h

src/util-ioctl.c

src/util-ioctl.h

src/util-memcmp.c

src/util-memcmp.h

src/util-mpm-ac-gfbs.c

src/util-mpm-ac-gfbs.h

src/util-mpm-ac.c

src/util-mpm-ac.h

src/util-mpm-b2gc.c

src/util-mpm-b2gc.h

src/util-mpm-b2gm.c

src/util-mpm-b2gm.h

src/util-optimize.h

src/util-proto-name.c

src/util-proto-name.h

src/util-reference-config.c

src/util-reference-config.h

src/util-runmodes.c

src/util-runmodes.h

src/util-syslog.c

src/util-syslog.h

src/util-vector.h

files removed:
src/alert-unified-alert.c

src/alert-unified-alert.h

src/alert-unified-log.c

src/alert-unified-log.h

src/app-layer-tls.c

src/app-layer-tls.h

src/detect-decode-event.c

src/detect-decode-event.h

files modified:
ChangeLog

Makefile.am

Makefile.in

aclocal.m4

config.guess

config.h.in

config.sub

configure

configure.in

debian/README.Debian

debian/changelog

debian/control

doc/INSTALL

doc/INSTALL.PF_RING

doc/INSTALL.WINDOWS

libhtp/Makefile.in

libhtp/aclocal.m4

libhtp/configure

libhtp/htp/Makefile.am

libhtp/htp/Makefile.in

libhtp/htp/bstr.c

libhtp/htp/bstr.h

libhtp/htp/dslib.c

libhtp/htp/hooks.c

libhtp/htp/hooks.h

libhtp/htp/htp.c

libhtp/htp/htp.h

libhtp/htp/htp_config.c

libhtp/htp/htp_connection.c

libhtp/htp/htp_connection_parser.c

libhtp/htp/htp_decompressors.c

libhtp/htp/htp_decompressors.h

libhtp/htp/htp_parsers.c

libhtp/htp/htp_request.c

libhtp/htp/htp_request_apache_2_2.c

libhtp/htp/htp_request_generic.c

libhtp/htp/htp_request_parsers.c

libhtp/htp/htp_response.c

libhtp/htp/htp_response_generic.c

libhtp/htp/htp_transaction.c

libhtp/htp/htp_util.c

libhtp/htp/utf8_decoder.h

libhtp/test/Makefile.am

libhtp/test/Makefile.in

libhtp/test/main.c

libhtp/test/test.c

ltmain.sh

m4/libtool.m4

m4/ltoptions.m4

m4/ltversion.m4

m4/lt~obsolete.m4

src/Makefile.am

src/Makefile.in

src/action-globals.h

src/alert-debuglog.c

src/alert-fastlog.c

src/alert-fastlog.h

src/alert-prelude.c

src/alert-unified2-alert.c

src/app-layer-dcerpc-common.h

src/app-layer-dcerpc-udp.c

src/app-layer-dcerpc.c

src/app-layer-detect-proto.c

src/app-layer-detect-proto.h

src/app-layer-ftp.c

src/app-layer-ftp.h

src/app-layer-htp.c

src/app-layer-htp.h

src/app-layer-parser.c

src/app-layer-parser.h

src/app-layer-protos.h

src/app-layer-smb.c

src/app-layer-smb.h

src/app-layer-smb2.c

src/app-layer-ssh.c

src/app-layer-ssh.h

src/app-layer-ssl.c

src/app-layer-ssl.h

src/app-layer.c

src/app-layer.h

src/conf-yaml-loader.c

src/conf-yaml-loader.h

src/conf.c

src/conf.h

src/counters.c

src/counters.h

src/cuda-packet-batcher.c

src/cuda-packet-batcher.h

src/data-queue.h

src/decode-ethernet.c

src/decode-events.h

src/decode-gre.c

src/decode-icmpv4.c

src/decode-icmpv4.h

src/decode-icmpv6.c

src/decode-icmpv6.h

src/decode-ipv4.c

src/decode-ipv4.h

src/decode-ipv6.c

src/decode-ipv6.h

src/decode-ppp.c

src/decode-pppoe.c

src/decode-raw.c

src/decode-sll.c

src/decode-tcp.c

src/decode-tcp.h

src/decode-udp.c

src/decode-vlan.c

src/decode.c

src/decode.h

src/defrag.c

src/defrag.h

src/detect-ack.c

src/detect-asn1.c

src/detect-bytejump.c

src/detect-bytejump.h

src/detect-bytetest.c

src/detect-bytetest.h

src/detect-content.c

src/detect-content.h

src/detect-csum.c

src/detect-dce-iface.c

src/detect-dce-opnum.c

src/detect-dce-stub-data.c

src/detect-depth.c

src/detect-detection-filter.c

src/detect-distance.c

src/detect-dsize.c

src/detect-engine-address-ipv4.c

src/detect-engine-address-ipv6.c

src/detect-engine-address.c

src/detect-engine-address.h

src/detect-engine-alert.c

src/detect-engine-alert.h

src/detect-engine-dcepayload.c

src/detect-engine-iponly.c

src/detect-engine-iponly.h

src/detect-engine-mpm.c

src/detect-engine-mpm.h

src/detect-engine-payload.c

src/detect-engine-port.c

src/detect-engine-proto.c

src/detect-engine-siggroup.c

src/detect-engine-sigorder.c

src/detect-engine-state.c

src/detect-engine-state.h

src/detect-engine-tag.c

src/detect-engine-threshold.c

src/detect-engine-threshold.h

src/detect-engine-uri.c

src/detect-engine.c

src/detect-engine.h

src/detect-fast-pattern.c

src/detect-fast-pattern.h

src/detect-flags.c

src/detect-flow.c

src/detect-flowbits.c

src/detect-flowint.c

src/detect-flowvar.c

src/detect-fragbits.c

src/detect-fragoffset.c

src/detect-ftpbounce.c

src/detect-gid.h

src/detect-http-client-body.c

src/detect-http-client-body.h

src/detect-http-cookie.c

src/detect-http-cookie.h

src/detect-http-header.c

src/detect-http-header.h

src/detect-http-method.c

src/detect-http-method.h

src/detect-http-uri.c

src/detect-icmp-id.c

src/detect-icmp-seq.c

src/detect-icode.c

src/detect-id.c

src/detect-ipopts.c

src/detect-ipproto.c

src/detect-ipproto.h

src/detect-isdataat.c

src/detect-isdataat.h

src/detect-itype.c

src/detect-msg.c

src/detect-nocase.c

src/detect-offset.c

src/detect-parse.c

src/detect-parse.h

src/detect-pcre.c

src/detect-pcre.h

src/detect-pktvar.c

src/detect-priority.c

src/detect-rawbytes.c

src/detect-reference.c

src/detect-reference.h

src/detect-rev.c

src/detect-rpc.c

src/detect-sameip.c

src/detect-seq.c

src/detect-sid.c

src/detect-ssh-proto-version.c

src/detect-ssh-software-version.c

src/detect-stream_size.c

src/detect-tag.c

src/detect-tag.h

src/detect-threshold.c

src/detect-threshold.h

src/detect-tls-version.c

src/detect-ttl.c

src/detect-uricontent.c

src/detect-uricontent.h

src/detect-urilen.c

src/detect-window.c

src/detect-within.c

src/detect.c

src/detect.h

src/flow-hash.c

src/flow-private.h

src/flow-queue.c

src/flow-queue.h

src/flow-util.c

src/flow-util.h

src/flow.c

src/flow.h

src/log-httplog.c

src/output.c

src/output.h

src/queue.h

src/respond-reject-libnet11.c

src/respond-reject.c

src/respond-reject.h

src/runmodes.c

src/runmodes.h

src/source-erf-dag.c

src/source-erf-file.c

src/source-ipfw.c

src/source-nfq.c

src/source-nfq.h

src/source-pcap-file.c

src/source-pcap.c

src/source-pcap.h

src/source-pfring.c

src/source-pfring.h

src/stream-tcp-private.h

src/stream-tcp-reassemble.c

src/stream-tcp-reassemble.h

src/stream-tcp.c

src/stream-tcp.h

src/stream.c

src/stream.h

src/suricata-common.h

src/suricata.c

src/suricata.h

src/threads.c

src/threads.h

src/threadvars.h

src/tm-modules.c

src/tm-modules.h

src/tm-queues.c

src/tm-threads.c

src/tm-threads.h

src/tmqh-flow.c

src/tmqh-packetpool.c

src/tmqh-packetpool.h

src/tmqh-ringbuffer.c

src/tmqh-simple.c

src/util-atomic.h

src/util-bloomfilter-counting.c

src/util-bloomfilter.h

src/util-byte.c

src/util-byte.h

src/util-classification-config.c

src/util-cpu.c

src/util-cuda-handlers.c

src/util-cuda-handlers.h

src/util-cuda.c

src/util-cuda.h

src/util-daemon.c

src/util-debug-filters.c

src/util-debug.c

src/util-debug.h

src/util-decode-asn1.c

src/util-error.c

src/util-error.h

src/util-fmemopen.c

src/util-fmemopen.h

src/util-hash.c

src/util-hashlist.c

src/util-mem.h

src/util-mpm-b2g-cuda.c

src/util-mpm-b2g-cuda.h

src/util-mpm-b2g.c

src/util-mpm-b2g.h

src/util-mpm-b3g.c

src/util-mpm-b3g.h

src/util-mpm-wumanber.c

src/util-mpm.c

src/util-mpm.h

src/util-pool.c

src/util-print.c

src/util-print.h

src/util-privs.c

src/util-profiling.c

src/util-profiling.h

src/util-radix-tree.c

src/util-radix-tree.h

src/util-ringbuffer.h

src/util-spm-bm.c

src/util-spm-bs.c

src/util-spm-bs2bm.c

src/util-spm.c

src/util-threshold-config.c

src/util-unittest-helper.c

src/util-unittest-helper.h

src/util-unittest.c

src/util-unittest.h

src/util-validate.h

src/util-var-name.c

src/win32-misc.c

src/win32-misc.h

src/win32-service.c

suricata.yaml

Show diffs side-by-side

added added

removed removed

src/alert-syslog.c

* You can copy, redistribute or modify this Program under the terms of

* the GNU General Public License version 2 as published by the Free

* Software Foundation.

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

* You should have received a copy of the GNU General Public License

* version 2 along with this program; if not, write to the Free Software

* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

* 02110-1301, USA.

/**

* \file

* \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>

* Logs alerts in a line based text format in to syslog.

#include "suricata-common.h"

#include "debug.h"

#include "flow.h"

#include "conf.h"

#include "threads.h"

#include "tm-threads.h"

#include "threadvars.h"

#include "detect.h"

#include "detect-parse.h"

#include "detect-engine.h"

#include "detect-engine-mpm.h"

#include "detect-reference.h"

#include "output.h"

#include "alert-syslog.h"

#include "util-classification-config.h"

#include "util-debug.h"

#include "util-print.h"

#include "util-proto-name.h"

#include "util-syslog.h"

#include "util-optimize.h"

#define DEFAULT_ALERT_SYSLOG_FACILITY_STR "local0"

#define DEFAULT_ALERT_SYSLOG_FACILITY LOG_LOCAL0

#define DEFAULT_ALERT_SYSLOG_LEVEL LOG_ERR

#define MODULE_NAME "AlertSyslog"

extern uint8_t engine_mode;

#ifndef OS_WIN32

static int alert_syslog_level = DEFAULT_ALERT_SYSLOG_LEVEL;

#endif /* OS_WIN32 */

typedef struct AlertSyslogThread_ {

/** LogFileCtx has the pointer to the file and a mutex to allow multithreading */

LogFileCtx* file_ctx;

} AlertSyslogThread;

TmEcode AlertSyslog (ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *);

TmEcode AlertSyslogIPv4(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *);

TmEcode AlertSyslogIPv6(ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *);

TmEcode AlertSyslogThreadInit(ThreadVars *, void *, void **);

TmEcode AlertSyslogThreadDeinit(ThreadVars *, void *);

void AlertSyslogExitPrintStats(ThreadVars *, void *);

void AlertSyslogRegisterTests(void);

OutputCtx *AlertSyslogInitCtx(ConfNode *);

#ifndef OS_WIN32

static void AlertSyslogDeInitCtx(OutputCtx *);

#endif /* OS_WIN32 */

/** \brief Function to register the AlertSyslog module */

void TmModuleAlertSyslogRegister (void) {

#ifndef OS_WIN32

tmm_modules[TMM_ALERTSYSLOG].name = MODULE_NAME;

tmm_modules[TMM_ALERTSYSLOG].ThreadInit = AlertSyslogThreadInit;

tmm_modules[TMM_ALERTSYSLOG].Func = AlertSyslog;

tmm_modules[TMM_ALERTSYSLOG].ThreadExitPrintStats = AlertSyslogExitPrintStats;

tmm_modules[TMM_ALERTSYSLOG].ThreadDeinit = AlertSyslogThreadDeinit;

tmm_modules[TMM_ALERTSYSLOG].RegisterTests = NULL;

tmm_modules[TMM_ALERTSYSLOG].cap_flags = 0;

OutputRegisterModule(MODULE_NAME, "syslog", AlertSyslogInitCtx);

#endif /* !OS_WIN32 */

}

/** \brief Function to register the AlertSyslog module for IPv4 */

void TmModuleAlertSyslogIPv4Register (void) {

#ifndef OS_WIN32

tmm_modules[TMM_ALERTSYSLOG4].name = "AlertSyslogIPv4";

tmm_modules[TMM_ALERTSYSLOG4].ThreadInit = AlertSyslogThreadInit;

tmm_modules[TMM_ALERTSYSLOG4].Func = AlertSyslogIPv4;

100

tmm_modules[TMM_ALERTSYSLOG4].ThreadExitPrintStats = AlertSyslogExitPrintStats;

101

tmm_modules[TMM_ALERTSYSLOG4].ThreadDeinit = AlertSyslogThreadDeinit;

102

tmm_modules[TMM_ALERTSYSLOG4].RegisterTests = NULL;

103

#endif /* !OS_WIN32 */

104

}

105

106

/** \brief Function to register the AlertSyslog module for IPv6 */

107

void TmModuleAlertSyslogIPv6Register (void) {

108

#ifndef OS_WIN32

109

tmm_modules[TMM_ALERTSYSLOG6].name = "AlertSyslogIPv6";

110

tmm_modules[TMM_ALERTSYSLOG6].ThreadInit = AlertSyslogThreadInit;

111

tmm_modules[TMM_ALERTSYSLOG6].Func = AlertSyslogIPv6;

112

tmm_modules[TMM_ALERTSYSLOG6].ThreadExitPrintStats = AlertSyslogExitPrintStats;

113

tmm_modules[TMM_ALERTSYSLOG6].ThreadDeinit = AlertSyslogThreadDeinit;

114

tmm_modules[TMM_ALERTSYSLOG6].RegisterTests = NULL;

115

#endif /* !OS_WIN32 */

116

}

117

118

#ifndef OS_WIN32

119

/**

120

* \brief Create a new LogFileCtx for "syslog" output style.

121

122

* \param conf The configuration node for this output.

123

* \return A OutputCtx pointer on success, NULL on failure.

124

125

OutputCtx *AlertSyslogInitCtx(ConfNode *conf)

126

{

127

const char *facility_s = ConfNodeLookupChildValue(conf, "facility");

128

if (facility_s == NULL) {

129

facility_s = DEFAULT_ALERT_SYSLOG_FACILITY_STR;

130

}

131

132

LogFileCtx *logfile_ctx = LogFileNewCtx();

133

if (logfile_ctx == NULL) {

134

SCLogDebug("AlertSyslogInitCtx: Could not create new LogFileCtx");

135

return NULL;

136

}

137

138

int facility = SCMapEnumNameToValue(facility_s, SCSyslogGetFacilityMap());

139

if (facility == -1) {

140

SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Invalid syslog facility: \"%s\","

141

" now using \"%s\" as syslog facility", facility_s,

142

DEFAULT_ALERT_SYSLOG_FACILITY_STR);

143

facility = DEFAULT_ALERT_SYSLOG_FACILITY;

144

}

145

146

const char *level_s = ConfNodeLookupChildValue(conf, "level");

147

if (level_s != NULL) {

148

int level = SCMapEnumNameToValue(level_s, SCSyslogGetLogLevelMap());

149

if (level != -1) {

150

alert_syslog_level = level;

151

}

152

}

153

154

const char *ident = ConfNodeLookupChildValue(conf, "identity");

155

/* if null we just pass that to openlog, which will then

156

* figure it out by itself. */

157

158

openlog(ident, LOG_PID|LOG_NDELAY, facility);

159

160

OutputCtx *output_ctx = SCMalloc(sizeof(OutputCtx));

161

if (output_ctx == NULL) {

162

SCLogDebug("AlertSyslogInitCtx: Could not create new OutputCtx");

163

return NULL;

164

}

165

memset(output_ctx, 0x00, sizeof(OutputCtx));

166

167

output_ctx->data = logfile_ctx;

168

output_ctx->DeInit = AlertSyslogDeInitCtx;

169

170

SCLogInfo("Syslog output initialized");

171

172

return output_ctx;

173

}

174

175

/**

176

* \brief Function to clear the memory of the output context and closes the

177

* syslog interface

178

179

* \param output_ctx pointer to the output context to be cleared

180

181

static void AlertSyslogDeInitCtx(OutputCtx *output_ctx)

182

{

183

if (output_ctx != NULL) {

184

LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data;

185

if (logfile_ctx != NULL) {

186

LogFileFreeCtx(logfile_ctx);

187

}

188

SCFree(output_ctx);

189

}

190

closelog();

191

}

192

193

/**

194

* \brief Function to initialize the AlertSystlogThread and sets the output

195

* context pointer

196

197

* \param tv Pointer to the threadvars

198

* \param initdata Pointer to the output context

199

* \param data pointer to pointer to point to the AlertSyslogThread

200

201

TmEcode AlertSyslogThreadInit(ThreadVars *t, void *initdata, void **data)

202

{

203

if(initdata == NULL) {

204

SCLogDebug("Error getting context for AlertSyslog. \"initdata\" "

205

"argument NULL");

206

return TM_ECODE_FAILED;

207

}

208

209

AlertSyslogThread *ast = SCMalloc(sizeof(AlertSyslogThread));

210

if (ast == NULL)

211

return TM_ECODE_FAILED;

212

213

memset(ast, 0, sizeof(AlertSyslogThread));

214

215

/** Use the Ouptut Context (file pointer and mutex) */

216

ast->file_ctx = ((OutputCtx *)initdata)->data;

217

218

*data = (void *)ast;

219

return TM_ECODE_OK;

220

}

221

222

/**

223

* \brief Function to deinitialize the AlertSystlogThread

224

225

* \param tv Pointer to the threadvars

226

* \param data pointer to the AlertSyslogThread to be cleared

227

228

TmEcode AlertSyslogThreadDeinit(ThreadVars *t, void *data)

229

{

230

AlertSyslogThread *ast = (AlertSyslogThread *)data;

231

if (ast == NULL) {

232

return TM_ECODE_OK;

233

}

234

235

/* clear memory */

236

memset(ast, 0, sizeof(AlertSyslogThread));

237

238

SCFree(ast);

239

return TM_ECODE_OK;

240

}

241

242

/**

243

* \brief Function which is called to print the IPv4 alerts to the syslog

244

245

* \param tv Pointer to the threadvars

246

* \param p Pointer to the packet

247

* \param data pointer to the AlertSyslogThread

248

* \param pq pointer the to packet queue

249

* \param postpq pointer to the post processed packet queue

250

251

* \return On succes return TM_ECODE_OK

252

253

TmEcode AlertSyslogIPv4(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq,

254

PacketQueue *postpq)

255

{

256

AlertSyslogThread *ast = (AlertSyslogThread *)data;

257

int i;

258

char *action = "";

259

260

if (p->alerts.cnt == 0)

261

return TM_ECODE_OK;

262

263

SCMutexLock(&ast->file_ctx->fp_mutex);

264

265

ast->file_ctx->alerts += p->alerts.cnt;

266

267

for (i = 0; i < p->alerts.cnt; i++) {

268

PacketAlert *pa = &p->alerts.alerts[i];

269

if (unlikely(pa->s == NULL)) {

270

continue;

271

}

272

273

char srcip[16], dstip[16];

274

275

PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));

276

PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));

277

278

if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {

279

action = "[Drop] ";

280

} else if (pa->action == ACTION_DROP) {

281

action = "[wDrop] ";

282

}

283

284

if (SCProtoNameValid(IPV4_GET_IPPROTO(p)) == TRUE) {

285

syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"

286

PRIu32 "] %s [Classification: %s] [Priority: %"PRIu32"]"

287

" {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "", action, pa->s->gid,

288

pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio,

289

known_proto[IPV4_GET_IPPROTO(p)], srcip, p->sp, dstip, p->dp);

290

} else {

291

syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"

292

PRIu32 "] %s [Classification: %s] [Priority: %"PRIu32"]"

293

" {PROTO:%03" PRIu32 "} %s:%" PRIu32 " -> %s:%" PRIu32 "",

294

action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg,

295

pa->s->prio, IPV4_GET_IPPROTO(p), srcip, p->sp, dstip, p->dp);

296

}

297

}

298

SCMutexUnlock(&ast->file_ctx->fp_mutex);

299

300

return TM_ECODE_OK;

301

}

302

303

/**

304

* \brief Function which is called to print the IPv6 alerts to the syslog

305

306

* \param tv Pointer to the threadvars

307

* \param p Pointer to the packet

308

* \param data pointer to the AlertSyslogThread

309

* \param pq pointer the to packet queue

310

* \param postpq pointer to the post processed packet queue

311

312

* \return On succes return TM_ECODE_OK

313

314

TmEcode AlertSyslogIPv6(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq,

315

PacketQueue *postpq)

316

{

317

AlertSyslogThread *ast = (AlertSyslogThread *)data;

318

int i;

319

char *action = "";

320

321

if (p->alerts.cnt == 0)

322

return TM_ECODE_OK;

323

324

SCMutexLock(&ast->file_ctx->fp_mutex);

325

326

ast->file_ctx->alerts += p->alerts.cnt;

327

328

for (i = 0; i < p->alerts.cnt; i++) {

329

PacketAlert *pa = &p->alerts.alerts[i];

330

if (unlikely(pa->s == NULL)) {

331

continue;

332

}

333

334

char srcip[46], dstip[46];

335

336

PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));

337

PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));

338

339

if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {

340

action = "[Drop] ";

341

} else if (pa->action == ACTION_DROP) {

342

action = "[wDrop] ";

343

}

344

345

if (SCProtoNameValid(IPV6_GET_L4PROTO(p)) == TRUE) {

346

syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"

347

"" PRIu32 "] %s [Classification: %s] [Priority: %"

348

"" PRIu32 "] {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "",

349

action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg,

350

pa->s->prio, known_proto[IPV6_GET_L4PROTO(p)], srcip, p->sp,

351

dstip, p->dp);

352

353

} else {

354

syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"

355

"" PRIu32 "] %s [Classification: %s] [Priority: %"

356

"" PRIu32 "] {PROTO:%03" PRIu32 "} %s:%" PRIu32 " -> %s:%" PRIu32 "",

357

action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg,

358

pa->s->prio, IPV6_GET_L4PROTO(p), srcip, p->sp, dstip, p->dp);

359

}

360

361

}

362

SCMutexUnlock(&ast->file_ctx->fp_mutex);

363

364

return TM_ECODE_OK;

365

}

366

367

/**

368

* \brief Function which is called to print the decode alerts to the syslog

369

370

* \param tv Pointer to the threadvars

371

* \param p Pointer to the packet

372

* \param data pointer to the AlertSyslogThread

373

* \param pq pointer the to packet queue

374

* \param postpq pointer to the post processed packet queue

375

376

* \return On succes return TM_ECODE_OK

377

378

TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, Packet *p, void *data,

379

PacketQueue *pq, PacketQueue *postpq)

380

{

381

AlertSyslogThread *ast = (AlertSyslogThread *)data;

382

int i;

383

char *action = "";

384

385

if (p->alerts.cnt == 0)

386

return TM_ECODE_OK;

387

388

SCMutexLock(&ast->file_ctx->fp_mutex);

389

390

ast->file_ctx->alerts += p->alerts.cnt;

391

char temp_buf_hdr[512];

392

char temp_buf_pkt[65] = "";

393

char temp_buf_tail[32];

394

char alert[2048] = "";

395

396

for (i = 0; i < p->alerts.cnt; i++) {

397

PacketAlert *pa = &p->alerts.alerts[i];

398

if (unlikely(pa->s == NULL)) {

399

continue;

400

}

401

402

if (pa->action == ACTION_DROP && IS_ENGINE_MODE_IPS(engine_mode)) {

403

action = "[Drop] ";

404

} else if (pa->action == ACTION_DROP) {

405

action = "[wDrop] ";

406

}

407

408

snprintf(temp_buf_hdr, sizeof(temp_buf_hdr), "%s[%" PRIu32 ":%" PRIu32

409

":%" PRIu32 "] %s [Classification: %s] [Priority: %" PRIu32

410

"] [**] [Raw pkt: ", action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg,

411

pa->s->class_msg, pa->s->prio);

412

strlcpy(alert, temp_buf_hdr, sizeof(alert));

413

414

PrintRawLineHexBuf(temp_buf_pkt, sizeof(temp_buf_pkt), GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32);

415

strlcat(alert, temp_buf_pkt, sizeof(alert));

416

417

if (p->pcap_cnt != 0) {

418

snprintf(temp_buf_tail, sizeof(temp_buf_tail), "] [pcap file packet: %"PRIu64"]",

419

p->pcap_cnt);

420

} else {

421

temp_buf_tail[0] = ']';

422

temp_buf_tail[1] = '\0';

423

}

424

strlcat(alert, temp_buf_tail, sizeof(alert));

425

426

syslog(alert_syslog_level, "%s", alert);

427

}

428

SCMutexUnlock(&ast->file_ctx->fp_mutex);

429

430

return TM_ECODE_OK;

431

}

432

433

/**

434

* \brief Function which is called to print the alerts to the syslog

435

436

* \param tv Pointer to the threadvars

437

* \param p Pointer to the packet

438

* \param data pointer to the AlertSyslogThread

439

* \param pq pointer the to packet queue

440

* \param postpq pointer to the post processed packet queue

441

442

* \return On succes return TM_ECODE_OK

443

444

TmEcode AlertSyslog (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq,

445

PacketQueue *postpq)

446

{

447

if (PKT_IS_IPV4(p)) {

448

return AlertSyslogIPv4(tv, p, data, pq, NULL);

449

} else if (PKT_IS_IPV6(p)) {

450

return AlertSyslogIPv6(tv, p, data, pq, NULL);

451

} else if (p->events.cnt > 0) {

452

return AlertSyslogDecoderEvent(tv, p, data, pq, NULL);

453

}

454

455

return TM_ECODE_OK;

456

}

457

458

/**

459

* \brief Function to print the total alert while closing the engine

460

461

* \param tv Pointer to the output threadvars

462

* \param data Pointer to the AlertSyslogThread data

463

464

void AlertSyslogExitPrintStats(ThreadVars *tv, void *data) {

465

AlertSyslogThread *ast = (AlertSyslogThread *)data;

466

if (ast == NULL) {

467

return;

468

}

469

470

SCLogInfo("(%s) Alerts %" PRIu64 "", tv->name, ast->file_ctx->alerts);

471

}

472

#endif /* !OS_WIN32 */

473

Older »