22550237931

Committed 01 Mar 2026 06:56PM UTC coverage: 64.812% (-8.9%) from 73.687%

Build # 22550237931

Build Type

Pull #14920

github

Committed by

web-flow

Commit Message

Merge e05854a6d into 90823fa90

Pull Request Pull Request #14920: draft: rust based configuration file parser and loader - v4

Coverage Stats

561 of 789 new or added lines in 4 files covered. (71.1%)

23225 existing lines in 498 files now uncovered.

131605 of 203055 relevant lines covered (64.81%)

2328818.84 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

3.94

/src/alert-debuglog.c

/* Copyright (C) 2007-2014 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \file
 *
 * \author Victor Julien <victor@inliniac.net>
 */

#include "suricata-common.h"
#include "suricata.h"

#include "action-globals.h"
#include "detect.h"
#include "flow.h"
#include "conf.h"
#include "stream.h"
#include "app-layer-protos.h"

#include "threads.h"
#include "threadvars.h"
#include "tm-threads.h"

#include "util-print.h"

#include "pkt-var.h"

#include "util-unittest.h"

#include "util-debug.h"
#include "util-validate.h"
#include "util-buffer.h"

#include "output.h"
#include "alert-debuglog.h"
#include "util-privs.h"
#include "flow-var.h"
#include "flow-bit.h"
#include "util-var-name.h"
#include "util-optimize.h"
#include "util-logopenfile.h"
#include "util-time.h"

#include "stream-tcp-reassemble.h"

#define DEFAULT_LOG_FILENAME "alert-debug.log"

#define MODULE_NAME "AlertDebugLog"

typedef struct AlertDebugLogThread_ {
    LogFileCtx *file_ctx;
    /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
    MemBuffer *buffer;
} AlertDebugLogThread;

/**
 *  \brief Function to log the FlowVars into alert-debug.log
 *
 *  \param aft Pointer to AlertDebugLog Thread
 *  \param p Pointer to the packet
 *
 */
static void AlertDebugLogFlowVars(AlertDebugLogThread *aft, const Packet *p)
{
    const GenericVar *gv = p->flow->flowvar;
    uint16_t i;
    while (gv != NULL) {
        if (gv->type == DETECT_FLOWBITS) {
            FlowBit *fb = (FlowBit *)gv;
            const char *fbname = VarNameStoreLookupById(fb->idx, VAR_TYPE_FLOW_BIT);
            if (fbname) {
                MemBufferWriteString(aft->buffer, "FLOWBIT:           %s\n",
                        fbname);
            }
        } else if (gv->type == DETECT_FLOWVAR || gv->type == DETECT_FLOWINT) {
            FlowVar *fv = (FlowVar *) gv;

            if (fv->datatype == FLOWVAR_TYPE_STR) {
                const char *fvname = VarNameStoreLookupById(fv->idx,
                        VAR_TYPE_FLOW_VAR);
                MemBufferWriteString(aft->buffer, "FLOWVAR:           \"%s\" => \"",
                                     fvname);
                for (i = 0; i < fv->data.fv_str.value_len; i++) {
                    if (isprint(fv->data.fv_str.value[i])) {
                        MemBufferWriteString(aft->buffer, "%c",
                                             fv->data.fv_str.value[i]);
                    } else {
                        MemBufferWriteString(aft->buffer, "\\%02X",
                                             fv->data.fv_str.value[i]);
                    }
                }
                MemBufferWriteString(aft->buffer, "\"\n");
            } else if (fv->datatype == FLOWVAR_TYPE_INT) {
                const char *fvname = VarNameStoreLookupById(fv->idx,
                        VAR_TYPE_FLOW_INT);
                MemBufferWriteString(aft->buffer, "FLOWINT:           \"%s\" =>"
                        " %"PRIu32"\n", fvname, fv->data.fv_int.value);
            }
        }
        gv = gv->next;
    }
}

/**
 *  \brief Function to log the PktVars into alert-debug.log
 *
 *  \param aft Pointer to AlertDebugLog Thread
 *  \param p Pointer to the packet
 *
 */
static void AlertDebugLogPktVars(AlertDebugLogThread *aft, const Packet *p)
{
    const PktVar *pv = p->pktvar;

    while (pv != NULL) {
        const char *varname = VarNameStoreLookupById(pv->id, VAR_TYPE_PKT_VAR);
        MemBufferWriteString(aft->buffer, "PKTVAR:            %s\n", varname);
        PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
                             pv->value, pv->value_len);
        pv = pv->next;
    }
}

/** \todo doc
 * assume we have aft lock */
static int AlertDebugPrintStreamSegmentCallback(
        const Packet *p, TcpSegment *seg, void *data, const uint8_t *buf, uint32_t buflen)
{
    AlertDebugLogThread *aft = (AlertDebugLogThread *)data;

    MemBufferWriteString(aft->buffer, "STREAM DATA LEN:     %"PRIu32"\n", buflen);
    MemBufferWriteString(aft->buffer, "STREAM DATA:\n");

    PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
                         buf, buflen);

    return 1;
}

static TmEcode AlertDebugLogger(ThreadVars *tv, const Packet *p, void *thread_data)
{
    AlertDebugLogThread *aft = (AlertDebugLogThread *)thread_data;
    int i;
    char timebuf[64];
    const char *pkt_src_str = NULL;

    if (p->alerts.cnt == 0)
        return TM_ECODE_OK;

    MemBufferReset(aft->buffer);

    CreateTimeString(p->ts, timebuf, sizeof(timebuf));

    MemBufferWriteString(aft->buffer, "+================\n"
                         "TIME:              %s\n", timebuf);
    uint64_t pcap_cnt = PcapPacketCntGet(p);
    if (pcap_cnt > 0) {
        MemBufferWriteString(aft->buffer, "PCAP PKT NUM:      %" PRIu64 "\n", pcap_cnt);
    }
    pkt_src_str = PktSrcToString(p->pkt_src);
    MemBufferWriteString(aft->buffer, "PKT SRC:           %s\n", pkt_src_str);

    char srcip[46], dstip[46];
    if (PacketIsIPv4(p)) {
        PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
        PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
    } else {
        DEBUG_VALIDATE_BUG_ON(!(PacketIsIPv6(p)));
        PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
        PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
    }

    MemBufferWriteString(aft->buffer, "SRC IP:            %s\n"
                         "DST IP:            %s\n"
                         "PROTO:             %" PRIu32 "\n",
                         srcip, dstip, p->proto);
    if (PacketIsTCP(p) || PacketIsUDP(p)) {
        MemBufferWriteString(aft->buffer, "SRC PORT:          %" PRIu32 "\n"
                             "DST PORT:          %" PRIu32 "\n",
                             p->sp, p->dp);
        if (PacketIsTCP(p)) {
            const TCPHdr *tcph = PacketGetTCP(p);
            MemBufferWriteString(aft->buffer,
                    "TCP SEQ:           %" PRIu32 "\n"
                    "TCP ACK:           %" PRIu32 "\n",
                    TCP_GET_RAW_SEQ(tcph), TCP_GET_RAW_ACK(tcph));
        }
    }

    /* flow stuff */
    MemBufferWriteString(aft->buffer, "FLOW:              to_server: %s, "
                         "to_client: %s\n",
                         p->flowflags & FLOW_PKT_TOSERVER ? "TRUE" : "FALSE",
                         p->flowflags & FLOW_PKT_TOCLIENT ? "TRUE" : "FALSE");

    if (p->flow != NULL) {
        int applayer = 0;
        applayer = StreamTcpAppLayerIsDisabled(p->flow);
        CreateTimeString(p->flow->startts, timebuf, sizeof(timebuf));
        MemBufferWriteString(aft->buffer, "FLOW Start TS:     %s\n", timebuf);
        MemBufferWriteString(aft->buffer, "FLOW PKTS TODST:   %"PRIu32"\n"
                             "FLOW PKTS TOSRC:   %"PRIu32"\n"
                             "FLOW Total Bytes:  %"PRIu64"\n",
                             p->flow->todstpktcnt, p->flow->tosrcpktcnt,
                             p->flow->todstbytecnt + p->flow->tosrcbytecnt);
        MemBufferWriteString(aft->buffer,
                "FLOW ACTION:       DROP: %s\n"
                "FLOW PAYLOAD: %s, APP_LAYER: %s\n"
                "FLOW APP_LAYER:    DETECTED: %s, PROTO %" PRIu16 "\n",
                p->flow->flags & FLOW_ACTION_DROP ? "TRUE" : "FALSE",
                p->flow->flags & FLOW_NOPAYLOAD_INSPECTION ? "TRUE" : "FALSE",
                applayer ? "TRUE" : "FALSE",
                (p->flow->alproto != ALPROTO_UNKNOWN) ? "TRUE" : "FALSE", p->flow->alproto);
        AlertDebugLogFlowVars(aft, p);
    }

    AlertDebugLogPktVars(aft, p);

/* any stuff */
/* Sig details? */

    MemBufferWriteString(aft->buffer,
                         "PACKET LEN:        %" PRIu32 "\n"
                         "PACKET:\n",
                         GET_PKT_LEN(p));
    PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
                         GET_PKT_DATA(p), GET_PKT_LEN(p));

    MemBufferWriteString(aft->buffer, "ALERT CNT:           %" PRIu32 "\n",
                         p->alerts.cnt);

    for (i = 0; i < p->alerts.cnt; i++) {
        const PacketAlert *pa = &p->alerts.alerts[i];
        if (unlikely(pa->s == NULL || (pa->action & ACTION_ALERT) == 0)) {
            continue;
        }

        MemBufferWriteString(aft->buffer,
                             "ALERT MSG [%02d]:      %s\n"
                             "ALERT GID [%02d]:      %" PRIu32 "\n"
                             "ALERT SID [%02d]:      %" PRIu32 "\n"
                             "ALERT REV [%02d]:      %" PRIu32 "\n"
                             "ALERT CLASS [%02d]:    %s\n"
                             "ALERT PRIO [%02d]:     %" PRIu32 "\n"
                             "ALERT FOUND IN [%02d]: %s\n",
                             i, pa->s->msg,
                             i, pa->s->gid,
                             i, pa->s->id,
                             i, pa->s->rev,
                             i, pa->s->class_msg ? pa->s->class_msg : "<none>",
                             i, pa->s->prio,
                             i,
                             pa->flags & PACKET_ALERT_FLAG_STREAM_MATCH  ? "STREAM" :
                             (pa->flags & PACKET_ALERT_FLAG_STATE_MATCH ? "STATE" : "PACKET"));
        if (pa->flags & PACKET_ALERT_FLAG_TX) {
            MemBufferWriteString(aft->buffer,
                    "ALERT IN TX [%02d]:    %"PRIu64"\n", i, pa->tx_id);
        } else {
            MemBufferWriteString(aft->buffer,
                    "ALERT IN TX [%02d]:    N/A\n", i);
        }
        if (p->payload_len > 0) {
            MemBufferWriteString(aft->buffer,
                                 "PAYLOAD LEN:         %" PRIu32 "\n"
                                 "PAYLOAD:\n",
                                 p->payload_len);
            PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
                                 p->payload, p->payload_len);
        }
        if ((pa->flags & PACKET_ALERT_FLAG_STATE_MATCH) ||
            (pa->flags & PACKET_ALERT_FLAG_STREAM_MATCH)) {
            /* This is an app layer or stream alert */
            int ret;
            uint8_t flag;
            if (!(PacketIsTCP(p)) || p->flow == NULL || p->flow->protoctx == NULL) {
                continue;
            }
            /* IDS mode reverse the data */
            /** \todo improve the order selection policy */
            if (p->flowflags & FLOW_PKT_TOSERVER) {
                flag = STREAM_DUMP_TOCLIENT;
            } else {
                flag = STREAM_DUMP_TOSERVER;
            }
            ret = StreamSegmentForEach((const Packet *)p, flag,
                                 AlertDebugPrintStreamSegmentCallback,
                                 (void *)aft);
            if (ret < 0) {
                return TM_ECODE_FAILED;
            }
        }
    }

    aft->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),
        MEMBUFFER_OFFSET(aft->buffer), aft->file_ctx);

    return TM_ECODE_OK;
}

static TmEcode AlertDebugLogDecoderEvent(ThreadVars *tv, const Packet *p, void *thread_data)
{
    AlertDebugLogThread *aft = (AlertDebugLogThread *)thread_data;
    int i;
    char timebuf[64];
    const char *pkt_src_str = NULL;

    if (p->alerts.cnt == 0)
        return TM_ECODE_OK;

    MemBufferReset(aft->buffer);

    CreateTimeString(p->ts, timebuf, sizeof(timebuf));

    MemBufferWriteString(aft->buffer,
                         "+================\n"
                         "TIME:              %s\n", timebuf);
    uint64_t pcap_cnt = PcapPacketCntGet(p);
    if (pcap_cnt > 0) {
        MemBufferWriteString(aft->buffer, "PCAP PKT NUM:      %" PRIu64 "\n", pcap_cnt);
    }
    pkt_src_str = PktSrcToString(p->pkt_src);
    MemBufferWriteString(aft->buffer, "PKT SRC:           %s\n", pkt_src_str);
    MemBufferWriteString(aft->buffer,
                         "ALERT CNT:         %" PRIu32 "\n", p->alerts.cnt);

    for (i = 0; i < p->alerts.cnt; i++) {
        const PacketAlert *pa = &p->alerts.alerts[i];
        if (unlikely(pa->s == NULL || (pa->action & ACTION_ALERT) == 0)) {
            continue;
        }

        MemBufferWriteString(aft->buffer,
                             "ALERT MSG [%02d]:    %s\n"
                             "ALERT GID [%02d]:    %" PRIu32 "\n"
                             "ALERT SID [%02d]:    %" PRIu32 "\n"
                             "ALERT REV [%02d]:    %" PRIu32 "\n"
                             "ALERT CLASS [%02d]:  %s\n"
                             "ALERT PRIO [%02d]:   %" PRIu32 "\n",
                             i, pa->s->msg,
                             i, pa->s->gid,
                             i, pa->s->id,
                             i, pa->s->rev,
                             i, pa->s->class_msg,
                             i, pa->s->prio);
    }

    MemBufferWriteString(aft->buffer,
                         "PACKET LEN:        %" PRIu32 "\n"
                         "PACKET:\n",
                         GET_PKT_LEN(p));
    PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
                         GET_PKT_DATA(p), GET_PKT_LEN(p));

    aft->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),
        MEMBUFFER_OFFSET(aft->buffer), aft->file_ctx);

    return TM_ECODE_OK;
}

static TmEcode AlertDebugLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
    AlertDebugLogThread *aft = SCCalloc(1, sizeof(AlertDebugLogThread));
    if (unlikely(aft == NULL))
        return TM_ECODE_FAILED;

    if(initdata == NULL)
    {
        SCLogDebug("Error getting context for AlertDebugLog.  \"initdata\" argument NULL");
        SCFree(aft);
        return TM_ECODE_FAILED;
    }
    /** Use the Output Context (file pointer and mutex) */
    aft->file_ctx = ((OutputCtx *)initdata)->data;

    /* 1 mb seems sufficient enough */
    aft->buffer = MemBufferCreateNew(1 * 1024 * 1024);
    if (aft->buffer == NULL) {
        SCFree(aft);
        return TM_ECODE_FAILED;
    }

    *data = (void *)aft;
    return TM_ECODE_OK;
}

static TmEcode AlertDebugLogThreadDeinit(ThreadVars *t, void *data)
{
    AlertDebugLogThread *aft = (AlertDebugLogThread *)data;
    if (aft == NULL) {
        return TM_ECODE_OK;
    }

    MemBufferFree(aft->buffer);
    /* clear memory */
    memset(aft, 0, sizeof(AlertDebugLogThread));

    SCFree(aft);
    return TM_ECODE_OK;
}

static void AlertDebugLogDeInitCtx(OutputCtx *output_ctx)
{
    if (output_ctx != NULL) {
        LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data;
        if (logfile_ctx != NULL) {
            LogFileFreeCtx(logfile_ctx);
        }
        SCFree(output_ctx);
    }
}

/**
 *  \brief Create a new LogFileCtx for alert debug logging.
 *
 *  \param SCConfNode containing configuration for this logger.
 *
 *  \return output_ctx if succesful, NULL otherwise
 */
static OutputInitResult AlertDebugLogInitCtx(SCConfNode *conf)
{
    OutputInitResult result = { NULL, false };
    LogFileCtx *file_ctx = NULL;

    file_ctx = LogFileNewCtx();
    if (file_ctx == NULL) {
        SCLogDebug("couldn't create new file_ctx");
        goto error;
    }

    if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) {
        goto error;
    }

    OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
    if (unlikely(output_ctx == NULL))
        goto error;

    output_ctx->data = file_ctx;
    output_ctx->DeInit = AlertDebugLogDeInitCtx;

    SCLogDebug("Alert debug log output initialized");
    result.ctx = output_ctx;
    result.ok = true;
    return result;

error:
    if (file_ctx != NULL) {
        LogFileFreeCtx(file_ctx);
    }

    return result;
}

static bool AlertDebugLogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
{
    return (p->alerts.cnt > 0);
}

static int AlertDebugLogLogger(ThreadVars *tv, void *thread_data, const Packet *p)
{
    if (PacketIsIPv4(p) || PacketIsIPv6(p)) {
        return AlertDebugLogger(tv, p, thread_data);
    } else if (p->events.cnt > 0) {
        return AlertDebugLogDecoderEvent(tv, p, thread_data);
    }
    return TM_ECODE_OK;
}

void AlertDebugLogRegister(void)
{
    OutputPacketLoggerFunctions output_logger_functions = {
        .LogFunc = AlertDebugLogLogger,
        .FlushFunc = NULL,
        .ConditionFunc = AlertDebugLogCondition,
        .ThreadInitFunc = AlertDebugLogThreadInit,
        .ThreadDeinitFunc = AlertDebugLogThreadDeinit,
        .ThreadExitPrintStatsFunc = NULL,
    };

    OutputRegisterPacketModule(LOGGER_ALERT_DEBUG, MODULE_NAME, "alert-debug", AlertDebugLogInitCtx,
            &output_logger_functions);
}

1	/* Copyright (C) 2007-2014 Open Information Security Foundation
2	*
3	* You can copy, redistribute or modify this Program under the terms of
4	* the GNU General Public License version 2 as published by the Free
5	* Software Foundation.
6	*
7	* This program is distributed in the hope that it will be useful,
8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10	* GNU General Public License for more details.
11	*
12	* You should have received a copy of the GNU General Public License
13	* version 2 along with this program; if not, write to the Free Software
14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15	* 02110-1301, USA.
16	*/
17
18	/**
19	* \file
20	*
21	* \author Victor Julien <victor@inliniac.net>
22	*/
23
24	#include "suricata-common.h"
25	#include "suricata.h"
26
27	#include "action-globals.h"
28	#include "detect.h"
29	#include "flow.h"
30	#include "conf.h"
31	#include "stream.h"
32	#include "app-layer-protos.h"
33
34	#include "threads.h"
35	#include "threadvars.h"
36	#include "tm-threads.h"
37
38	#include "util-print.h"
39
40	#include "pkt-var.h"
41
42	#include "util-unittest.h"
43
44	#include "util-debug.h"
45	#include "util-validate.h"
46	#include "util-buffer.h"
47
48	#include "output.h"
49	#include "alert-debuglog.h"
50	#include "util-privs.h"
51	#include "flow-var.h"
52	#include "flow-bit.h"
53	#include "util-var-name.h"
54	#include "util-optimize.h"
55	#include "util-logopenfile.h"
56	#include "util-time.h"
57
58	#include "stream-tcp-reassemble.h"
59
UNCOV 60	#define DEFAULT_LOG_FILENAME "alert-debug.log"	×
61
62	#define MODULE_NAME "AlertDebugLog"	29✔
63
64	typedef struct AlertDebugLogThread_ {
65	LogFileCtx *file_ctx;
66	/** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
67	MemBuffer *buffer;
68	} AlertDebugLogThread;
69
70	/**
71	* \brief Function to log the FlowVars into alert-debug.log
72	*
73	* \param aft Pointer to AlertDebugLog Thread
74	* \param p Pointer to the packet
75	*
76	*/
77	static void AlertDebugLogFlowVars(AlertDebugLogThread aft, const Packet p)
UNCOV 78	{	×
UNCOV 79	const GenericVar *gv = p->flow->flowvar;	×
UNCOV 80	uint16_t i;	×
UNCOV 81	while (gv != NULL) {	×
82	if (gv->type == DETECT_FLOWBITS) {	×
83	FlowBit fb = (FlowBit )gv;	×
84	const char *fbname = VarNameStoreLookupById(fb->idx, VAR_TYPE_FLOW_BIT);	×
85	if (fbname) {	×
86	MemBufferWriteString(aft->buffer, "FLOWBIT: %s\n",	×
87	fbname);	×
88	}	×
89	} else if (gv->type == DETECT_FLOWVAR \|\| gv->type == DETECT_FLOWINT) {	×
90	FlowVar fv = (FlowVar ) gv;	×
91
92	if (fv->datatype == FLOWVAR_TYPE_STR) {	×
93	const char *fvname = VarNameStoreLookupById(fv->idx,	×
94	VAR_TYPE_FLOW_VAR);	×
95	MemBufferWriteString(aft->buffer, "FLOWVAR: \"%s\" => \"",	×
96	fvname);	×
97	for (i = 0; i < fv->data.fv_str.value_len; i++) {	×
98	if (isprint(fv->data.fv_str.value[i])) {	×
99	MemBufferWriteString(aft->buffer, "%c",	×
100	fv->data.fv_str.value[i]);	×
101	} else {	×
102	MemBufferWriteString(aft->buffer, "\\%02X",	×
103	fv->data.fv_str.value[i]);	×
104	}	×
105	}	×
106	MemBufferWriteString(aft->buffer, "\"\n");	×
107	} else if (fv->datatype == FLOWVAR_TYPE_INT) {	×
108	const char *fvname = VarNameStoreLookupById(fv->idx,	×
109	VAR_TYPE_FLOW_INT);	×
110	MemBufferWriteString(aft->buffer, "FLOWINT: \"%s\" =>"	×
111	" %"PRIu32"\n", fvname, fv->data.fv_int.value);	×
112	}	×
113	}	×
114	gv = gv->next;	×
115	}	×
UNCOV 116	}	×
117
118	/**
119	* \brief Function to log the PktVars into alert-debug.log
120	*
121	* \param aft Pointer to AlertDebugLog Thread
122	* \param p Pointer to the packet
123	*
124	*/
125	static void AlertDebugLogPktVars(AlertDebugLogThread aft, const Packet p)
UNCOV 126	{	×
UNCOV 127	const PktVar *pv = p->pktvar;	×
128
UNCOV 129	while (pv != NULL) {	×
130	const char *varname = VarNameStoreLookupById(pv->id, VAR_TYPE_PKT_VAR);	×
131	MemBufferWriteString(aft->buffer, "PKTVAR: %s\n", varname);	×
132	PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,	×
133	pv->value, pv->value_len);	×
134	pv = pv->next;	×
135	}	×
UNCOV 136	}	×
137
138	/** \todo doc
139	* assume we have aft lock */
140	static int AlertDebugPrintStreamSegmentCallback(
141	const Packet p, TcpSegment seg, void data, const uint8_t buf, uint32_t buflen)
142	{	×
143	AlertDebugLogThread aft = (AlertDebugLogThread )data;	×
144
145	MemBufferWriteString(aft->buffer, "STREAM DATA LEN: %"PRIu32"\n", buflen);	×
146	MemBufferWriteString(aft->buffer, "STREAM DATA:\n");	×
147
148	PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,	×
149	buf, buflen);	×
150
151	return 1;	×
152	}	×
153
154	static TmEcode AlertDebugLogger(ThreadVars tv, const Packet p, void *thread_data)
UNCOV 155	{	×
UNCOV 156	AlertDebugLogThread aft = (AlertDebugLogThread )thread_data;	×
UNCOV 157	int i;	×
UNCOV 158	char timebuf[64];	×
UNCOV 159	const char *pkt_src_str = NULL;	×
160
UNCOV 161	if (p->alerts.cnt == 0)	×
162	return TM_ECODE_OK;	×
163
UNCOV 164	MemBufferReset(aft->buffer);	×
165
UNCOV 166	CreateTimeString(p->ts, timebuf, sizeof(timebuf));	×
167
UNCOV 168	MemBufferWriteString(aft->buffer, "+================\n"	×
UNCOV 169	"TIME: %s\n", timebuf);	×
UNCOV 170	uint64_t pcap_cnt = PcapPacketCntGet(p);	×
UNCOV 171	if (pcap_cnt > 0) {	×
UNCOV 172	MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %" PRIu64 "\n", pcap_cnt);	×
UNCOV 173	}	×
UNCOV 174	pkt_src_str = PktSrcToString(p->pkt_src);	×
UNCOV 175	MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str);	×
176
UNCOV 177	char srcip[46], dstip[46];	×
UNCOV 178	if (PacketIsIPv4(p)) {	×
UNCOV 179	PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));	×
UNCOV 180	PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));	×
UNCOV 181	} else {	×
182	DEBUG_VALIDATE_BUG_ON(!(PacketIsIPv6(p)));	×
183	PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));	×
184	PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));	×
185	}	×
186
UNCOV 187	MemBufferWriteString(aft->buffer, "SRC IP: %s\n"	×
UNCOV 188	"DST IP: %s\n"	×
UNCOV 189	"PROTO: %" PRIu32 "\n",	×
UNCOV 190	srcip, dstip, p->proto);	×
UNCOV 191	if (PacketIsTCP(p) \|\| PacketIsUDP(p)) {	×
UNCOV 192	MemBufferWriteString(aft->buffer, "SRC PORT: %" PRIu32 "\n"	×
UNCOV 193	"DST PORT: %" PRIu32 "\n",	×
UNCOV 194	p->sp, p->dp);	×
UNCOV 195	if (PacketIsTCP(p)) {	×
196	const TCPHdr *tcph = PacketGetTCP(p);	×
197	MemBufferWriteString(aft->buffer,	×
198	"TCP SEQ: %" PRIu32 "\n"	×
199	"TCP ACK: %" PRIu32 "\n",	×
200	TCP_GET_RAW_SEQ(tcph), TCP_GET_RAW_ACK(tcph));	×
201	}	×
UNCOV 202	}	×
203
204	/* flow stuff */
UNCOV 205	MemBufferWriteString(aft->buffer, "FLOW: to_server: %s, "	×
UNCOV 206	"to_client: %s\n",	×
UNCOV 207	p->flowflags & FLOW_PKT_TOSERVER ? "TRUE" : "FALSE",	×
UNCOV 208	p->flowflags & FLOW_PKT_TOCLIENT ? "TRUE" : "FALSE");	×
209
UNCOV 210	if (p->flow != NULL) {	×
UNCOV 211	int applayer = 0;	×
UNCOV 212	applayer = StreamTcpAppLayerIsDisabled(p->flow);	×
UNCOV 213	CreateTimeString(p->flow->startts, timebuf, sizeof(timebuf));	×
UNCOV 214	MemBufferWriteString(aft->buffer, "FLOW Start TS: %s\n", timebuf);	×
UNCOV 215	MemBufferWriteString(aft->buffer, "FLOW PKTS TODST: %"PRIu32"\n"	×
UNCOV 216	"FLOW PKTS TOSRC: %"PRIu32"\n"	×
UNCOV 217	"FLOW Total Bytes: %"PRIu64"\n",	×
UNCOV 218	p->flow->todstpktcnt, p->flow->tosrcpktcnt,	×
UNCOV 219	p->flow->todstbytecnt + p->flow->tosrcbytecnt);	×
UNCOV 220	MemBufferWriteString(aft->buffer,	×
UNCOV 221	"FLOW ACTION: DROP: %s\n"	×
UNCOV 222	"FLOW PAYLOAD: %s, APP_LAYER: %s\n"	×
UNCOV 223	"FLOW APP_LAYER: DETECTED: %s, PROTO %" PRIu16 "\n",	×
UNCOV 224	p->flow->flags & FLOW_ACTION_DROP ? "TRUE" : "FALSE",	×
UNCOV 225	p->flow->flags & FLOW_NOPAYLOAD_INSPECTION ? "TRUE" : "FALSE",	×
UNCOV 226	applayer ? "TRUE" : "FALSE",	×
UNCOV 227	(p->flow->alproto != ALPROTO_UNKNOWN) ? "TRUE" : "FALSE", p->flow->alproto);	×
UNCOV 228	AlertDebugLogFlowVars(aft, p);	×
UNCOV 229	}	×
230
UNCOV 231	AlertDebugLogPktVars(aft, p);	×
232
233	/* any stuff */
234	/* Sig details? */
235
UNCOV 236	MemBufferWriteString(aft->buffer,	×
UNCOV 237	"PACKET LEN: %" PRIu32 "\n"	×
UNCOV 238	"PACKET:\n",	×
UNCOV 239	GET_PKT_LEN(p));	×
UNCOV 240	PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,	×
UNCOV 241	GET_PKT_DATA(p), GET_PKT_LEN(p));	×
242
UNCOV 243	MemBufferWriteString(aft->buffer, "ALERT CNT: %" PRIu32 "\n",	×
UNCOV 244	p->alerts.cnt);	×
245
UNCOV 246	for (i = 0; i < p->alerts.cnt; i++) {	×
UNCOV 247	const PacketAlert *pa = &p->alerts.alerts[i];	×
UNCOV 248	if (unlikely(pa->s == NULL \|\| (pa->action & ACTION_ALERT) == 0)) {	×
249	continue;	×
250	}	×
251
UNCOV 252	MemBufferWriteString(aft->buffer,	×
UNCOV 253	"ALERT MSG [%02d]: %s\n"	×
UNCOV 254	"ALERT GID [%02d]: %" PRIu32 "\n"	×
UNCOV 255	"ALERT SID [%02d]: %" PRIu32 "\n"	×
UNCOV 256	"ALERT REV [%02d]: %" PRIu32 "\n"	×
UNCOV 257	"ALERT CLASS [%02d]: %s\n"	×
UNCOV 258	"ALERT PRIO [%02d]: %" PRIu32 "\n"	×
UNCOV 259	"ALERT FOUND IN [%02d]: %s\n",	×
UNCOV 260	i, pa->s->msg,	×
UNCOV 261	i, pa->s->gid,	×
UNCOV 262	i, pa->s->id,	×
UNCOV 263	i, pa->s->rev,	×
UNCOV 264	i, pa->s->class_msg ? pa->s->class_msg : "<none>",	×
UNCOV 265	i, pa->s->prio,	×
UNCOV 266	i,	×
UNCOV 267	pa->flags & PACKET_ALERT_FLAG_STREAM_MATCH ? "STREAM" :	×
UNCOV 268	(pa->flags & PACKET_ALERT_FLAG_STATE_MATCH ? "STATE" : "PACKET"));	×
UNCOV 269	if (pa->flags & PACKET_ALERT_FLAG_TX) {	×
UNCOV 270	MemBufferWriteString(aft->buffer,	×
UNCOV 271	"ALERT IN TX [%02d]: %"PRIu64"\n", i, pa->tx_id);	×
UNCOV 272	} else {	×
273	MemBufferWriteString(aft->buffer,	×
274	"ALERT IN TX [%02d]: N/A\n", i);	×
275	}	×
UNCOV 276	if (p->payload_len > 0) {	×
UNCOV 277	MemBufferWriteString(aft->buffer,	×
UNCOV 278	"PAYLOAD LEN: %" PRIu32 "\n"	×
UNCOV 279	"PAYLOAD:\n",	×
UNCOV 280	p->payload_len);	×
UNCOV 281	PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,	×
UNCOV 282	p->payload, p->payload_len);	×
UNCOV 283	}	×
UNCOV 284	if ((pa->flags & PACKET_ALERT_FLAG_STATE_MATCH) \|\|	×
UNCOV 285	(pa->flags & PACKET_ALERT_FLAG_STREAM_MATCH)) {	×
286	/* This is an app layer or stream alert */
UNCOV 287	int ret;	×
UNCOV 288	uint8_t flag;	×
UNCOV 289	if (!(PacketIsTCP(p)) \|\| p->flow == NULL \|\| p->flow->protoctx == NULL) {	×
UNCOV 290	continue;	×
UNCOV 291	}	×
292	/* IDS mode reverse the data */
293	/** \todo improve the order selection policy */
294	if (p->flowflags & FLOW_PKT_TOSERVER) {	×
295	flag = STREAM_DUMP_TOCLIENT;	×
296	} else {	×
297	flag = STREAM_DUMP_TOSERVER;	×
298	}	×
299	ret = StreamSegmentForEach((const Packet *)p, flag,	×
300	AlertDebugPrintStreamSegmentCallback,	×
301	(void *)aft);	×
302	if (ret < 0) {	×
303	return TM_ECODE_FAILED;	×
304	}	×
305	}	×
UNCOV 306	}	×
307
UNCOV 308	aft->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),	×
UNCOV 309	MEMBUFFER_OFFSET(aft->buffer), aft->file_ctx);	×
310
UNCOV 311	return TM_ECODE_OK;	×
UNCOV 312	}	×
313
314	static TmEcode AlertDebugLogDecoderEvent(ThreadVars tv, const Packet p, void *thread_data)
315	{	×
316	AlertDebugLogThread aft = (AlertDebugLogThread )thread_data;	×
317	int i;	×
318	char timebuf[64];	×
319	const char *pkt_src_str = NULL;	×
320
321	if (p->alerts.cnt == 0)	×
322	return TM_ECODE_OK;	×
323
324	MemBufferReset(aft->buffer);	×
325
326	CreateTimeString(p->ts, timebuf, sizeof(timebuf));	×
327
328	MemBufferWriteString(aft->buffer,	×
329	"+================\n"	×
330	"TIME: %s\n", timebuf);	×
331	uint64_t pcap_cnt = PcapPacketCntGet(p);	×
332	if (pcap_cnt > 0) {	×
333	MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %" PRIu64 "\n", pcap_cnt);	×
334	}	×
335	pkt_src_str = PktSrcToString(p->pkt_src);	×
336	MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str);	×
337	MemBufferWriteString(aft->buffer,	×
338	"ALERT CNT: %" PRIu32 "\n", p->alerts.cnt);	×
339
340	for (i = 0; i < p->alerts.cnt; i++) {	×
341	const PacketAlert *pa = &p->alerts.alerts[i];	×
342	if (unlikely(pa->s == NULL \|\| (pa->action & ACTION_ALERT) == 0)) {	×
343	continue;	×
344	}	×
345
346	MemBufferWriteString(aft->buffer,	×
347	"ALERT MSG [%02d]: %s\n"	×
348	"ALERT GID [%02d]: %" PRIu32 "\n"	×
349	"ALERT SID [%02d]: %" PRIu32 "\n"	×
350	"ALERT REV [%02d]: %" PRIu32 "\n"	×
351	"ALERT CLASS [%02d]: %s\n"	×
352	"ALERT PRIO [%02d]: %" PRIu32 "\n",	×
353	i, pa->s->msg,	×
354	i, pa->s->gid,	×
355	i, pa->s->id,	×
356	i, pa->s->rev,	×
357	i, pa->s->class_msg,	×
358	i, pa->s->prio);	×
359	}	×
360
361	MemBufferWriteString(aft->buffer,	×
362	"PACKET LEN: %" PRIu32 "\n"	×
363	"PACKET:\n",	×
364	GET_PKT_LEN(p));	×
365	PrintRawDataToBuffer(aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,	×
366	GET_PKT_DATA(p), GET_PKT_LEN(p));	×
367
368	aft->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),	×
369	MEMBUFFER_OFFSET(aft->buffer), aft->file_ctx);	×
370
371	return TM_ECODE_OK;	×
372	}	×
373
374	static TmEcode AlertDebugLogThreadInit(ThreadVars t, const void initdata, void **data)
UNCOV 375	{	×
UNCOV 376	AlertDebugLogThread *aft = SCCalloc(1, sizeof(AlertDebugLogThread));	×
UNCOV 377	if (unlikely(aft == NULL))	×
378	return TM_ECODE_FAILED;	×
379
UNCOV 380	if(initdata == NULL)	×
381	{	×
382	SCLogDebug("Error getting context for AlertDebugLog. \"initdata\" argument NULL");	×
383	SCFree(aft);	×
384	return TM_ECODE_FAILED;	×
385	}	×
386	/** Use the Output Context (file pointer and mutex) */
UNCOV 387	aft->file_ctx = ((OutputCtx *)initdata)->data;	×
388
389	/* 1 mb seems sufficient enough */
UNCOV 390	aft->buffer = MemBufferCreateNew(1 * 1024 * 1024);	×
UNCOV 391	if (aft->buffer == NULL) {	×
392	SCFree(aft);	×
393	return TM_ECODE_FAILED;	×
394	}	×
395
UNCOV 396	data = (void )aft;	×
UNCOV 397	return TM_ECODE_OK;	×
UNCOV 398	}	×
399
400	static TmEcode AlertDebugLogThreadDeinit(ThreadVars t, void data)
UNCOV 401	{	×
UNCOV 402	AlertDebugLogThread aft = (AlertDebugLogThread )data;	×
UNCOV 403	if (aft == NULL) {	×
404	return TM_ECODE_OK;	×
405	}	×
406
UNCOV 407	MemBufferFree(aft->buffer);	×
408	/* clear memory */
UNCOV 409	memset(aft, 0, sizeof(AlertDebugLogThread));	×
410
UNCOV 411	SCFree(aft);	×
UNCOV 412	return TM_ECODE_OK;	×
UNCOV 413	}	×
414
415	static void AlertDebugLogDeInitCtx(OutputCtx *output_ctx)
UNCOV 416	{	×
UNCOV 417	if (output_ctx != NULL) {	×
UNCOV 418	LogFileCtx logfile_ctx = (LogFileCtx )output_ctx->data;	×
UNCOV 419	if (logfile_ctx != NULL) {	×
UNCOV 420	LogFileFreeCtx(logfile_ctx);	×
UNCOV 421	}	×
UNCOV 422	SCFree(output_ctx);	×
UNCOV 423	}	×
UNCOV 424	}	×
425
426	/**
427	* \brief Create a new LogFileCtx for alert debug logging.
428	*
429	* \param SCConfNode containing configuration for this logger.
430	*
431	* \return output_ctx if succesful, NULL otherwise
432	*/
433	static OutputInitResult AlertDebugLogInitCtx(SCConfNode *conf)
UNCOV 434	{	×
UNCOV 435	OutputInitResult result = { NULL, false };	×
UNCOV 436	LogFileCtx *file_ctx = NULL;	×
437
UNCOV 438	file_ctx = LogFileNewCtx();	×
UNCOV 439	if (file_ctx == NULL) {	×
440	SCLogDebug("couldn't create new file_ctx");	×
441	goto error;	×
442	}	×
443
UNCOV 444	if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) {	×
445	goto error;	×
446	}	×
447
UNCOV 448	OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));	×
UNCOV 449	if (unlikely(output_ctx == NULL))	×
450	goto error;	×
451
UNCOV 452	output_ctx->data = file_ctx;	×
UNCOV 453	output_ctx->DeInit = AlertDebugLogDeInitCtx;	×
454
UNCOV 455	SCLogDebug("Alert debug log output initialized");	×
UNCOV 456	result.ctx = output_ctx;	×
UNCOV 457	result.ok = true;	×
UNCOV 458	return result;	×
459
460	error:	×
461	if (file_ctx != NULL) {	×
462	LogFileFreeCtx(file_ctx);	×
463	}	×
464
465	return result;	×
UNCOV 466	}	×
467
468	static bool AlertDebugLogCondition(ThreadVars tv, void thread_data, const Packet *p)
UNCOV 469	{	×
UNCOV 470	return (p->alerts.cnt > 0);	×
UNCOV 471	}	×
472
473	static int AlertDebugLogLogger(ThreadVars tv, void thread_data, const Packet *p)
UNCOV 474	{	×
UNCOV 475	if (PacketIsIPv4(p) \|\| PacketIsIPv6(p)) {	×
UNCOV 476	return AlertDebugLogger(tv, p, thread_data);	×
UNCOV 477	} else if (p->events.cnt > 0) {	×
478	return AlertDebugLogDecoderEvent(tv, p, thread_data);	×
479	}	×
480	return TM_ECODE_OK;	×
UNCOV 481	}	×
482
483	void AlertDebugLogRegister(void)
484	{	29✔
485	OutputPacketLoggerFunctions output_logger_functions = {	29✔
486	.LogFunc = AlertDebugLogLogger,	29✔
487	.FlushFunc = NULL,	29✔
488	.ConditionFunc = AlertDebugLogCondition,	29✔
489	.ThreadInitFunc = AlertDebugLogThreadInit,	29✔
490	.ThreadDeinitFunc = AlertDebugLogThreadDeinit,	29✔
491	.ThreadExitPrintStatsFunc = NULL,	29✔
492	};	29✔
493
494	OutputRegisterPacketModule(LOGGER_ALERT_DEBUG, MODULE_NAME, "alert-debug", AlertDebugLogInitCtx,	29✔
495	&output_logger_functions);	29✔
496	}	29✔

OISF / suricata / 22550237931

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous