suricata
alert-debuglog.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "suricata-common.h"
25 #include "suricata.h"
26 
27 #include "debug.h"
28 #include "detect.h"
29 #include "flow.h"
30 #include "conf.h"
31 #include "stream.h"
32 #include "app-layer-protos.h"
33 
34 #include "threads.h"
35 #include "threadvars.h"
36 #include "tm-threads.h"
37 
38 #include "util-print.h"
39 
40 #include "pkt-var.h"
41 
42 #include "util-unittest.h"
43 
44 #include "util-debug.h"
45 #include "util-buffer.h"
46 
47 #include "output.h"
48 #include "alert-debuglog.h"
49 #include "util-privs.h"
50 #include "flow-var.h"
51 #include "flow-bit.h"
52 #include "util-var-name.h"
53 #include "util-optimize.h"
54 #include "util-logopenfile.h"
55 #include "util-time.h"
56 
57 #include "stream-tcp-reassemble.h"
58 
59 #define DEFAULT_LOG_FILENAME "alert-debug.log"
60 
61 #define MODULE_NAME "AlertDebugLog"
62 
63 typedef struct AlertDebugLogThread_ {
65  /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
68 
69 /**
70  * \brief Function to log the FlowVars in to alert-debug.log
71  *
72  * \param aft Pointer to AltertDebugLog Thread
73  * \param p Pointer to the packet
74  *
75  */
76 static void AlertDebugLogFlowVars(AlertDebugLogThread *aft, const Packet *p)
77 {
78  const GenericVar *gv = p->flow->flowvar;
79  uint16_t i;
80  while (gv != NULL) {
81  if (gv->type == DETECT_FLOWBITS) {
82  FlowBit *fb = (FlowBit *)gv;
83  const char *fbname = VarNameStoreLookupById(fb->idx, VAR_TYPE_FLOW_BIT);
84  if (fbname) {
85  MemBufferWriteString(aft->buffer, "FLOWBIT: %s\n",
86  fbname);
87  }
88  } else if (gv->type == DETECT_FLOWVAR || gv->type == DETECT_FLOWINT) {
89  FlowVar *fv = (FlowVar *) gv;
90 
91  if (fv->datatype == FLOWVAR_TYPE_STR) {
92  const char *fvname = VarNameStoreLookupById(fv->idx,
94  MemBufferWriteString(aft->buffer, "FLOWVAR: \"%s\" => \"",
95  fvname);
96  for (i = 0; i < fv->data.fv_str.value_len; i++) {
97  if (isprint(fv->data.fv_str.value[i])) {
98  MemBufferWriteString(aft->buffer, "%c",
99  fv->data.fv_str.value[i]);
100  } else {
101  MemBufferWriteString(aft->buffer, "\\%02X",
102  fv->data.fv_str.value[i]);
103  }
104  }
105  MemBufferWriteString(aft->buffer, "\"\n");
106  } else if (fv->datatype == FLOWVAR_TYPE_INT) {
107  const char *fvname = VarNameStoreLookupById(fv->idx,
109  MemBufferWriteString(aft->buffer, "FLOWINT: \"%s\" =>"
110  " %"PRIu32"\n", fvname, fv->data.fv_int.value);
111  }
112  }
113  gv = gv->next;
114  }
115 }
116 
117 /**
118  * \brief Function to log the PktVars in to alert-debug.log
119  *
120  * \param aft Pointer to AltertDebugLog Thread
121  * \param p Pointer to the packet
122  *
123  */
124 static void AlertDebugLogPktVars(AlertDebugLogThread *aft, const Packet *p)
125 {
126  const PktVar *pv = p->pktvar;
127 
128  while (pv != NULL) {
129  const char *varname = VarNameStoreLookupById(pv->id, VAR_TYPE_PKT_VAR);
130  MemBufferWriteString(aft->buffer, "PKTVAR: %s\n", varname);
132  pv->value, pv->value_len);
133  pv = pv->next;
134  }
135 }
136 
137 /** \todo doc
138  * assume we have aft lock */
139 static int AlertDebugPrintStreamSegmentCallback(const Packet *p, void *data, const uint8_t *buf, uint32_t buflen)
140 {
142 
143  MemBufferWriteString(aft->buffer, "STREAM DATA LEN: %"PRIu32"\n", buflen);
144  MemBufferWriteString(aft->buffer, "STREAM DATA:\n");
145 
147  buf, buflen);
148 
149  return 1;
150 }
151 
152 static TmEcode AlertDebugLogger(ThreadVars *tv, const Packet *p, void *thread_data)
153 {
154  AlertDebugLogThread *aft = (AlertDebugLogThread *)thread_data;
155  int i;
156  char timebuf[64];
157  const char *pkt_src_str = NULL;
158 
159  if (p->alerts.cnt == 0)
160  return TM_ECODE_OK;
161 
162  MemBufferReset(aft->buffer);
163 
164  CreateTimeString(&p->ts, timebuf, sizeof(timebuf));
165 
166  MemBufferWriteString(aft->buffer, "+================\n"
167  "TIME: %s\n", timebuf);
168  if (p->pcap_cnt > 0) {
169  MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt);
170  }
171  pkt_src_str = PktSrcToString(p->pkt_src);
172  MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str);
173 
174  char srcip[46], dstip[46];
175  if (PKT_IS_IPV4(p)) {
176  PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
177  PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
178  } else if (PKT_IS_IPV6(p)) {
179  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
180  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
181  }
182 
183  MemBufferWriteString(aft->buffer, "SRC IP: %s\n"
184  "DST IP: %s\n"
185  "PROTO: %" PRIu32 "\n",
186  srcip, dstip, p->proto);
187  if (PKT_IS_TCP(p) || PKT_IS_UDP(p)) {
188  MemBufferWriteString(aft->buffer, "SRC PORT: %" PRIu32 "\n"
189  "DST PORT: %" PRIu32 "\n",
190  p->sp, p->dp);
191  if (PKT_IS_TCP(p)) {
192  MemBufferWriteString(aft->buffer, "TCP SEQ: %"PRIu32"\n"
193  "TCP ACK: %"PRIu32"\n",
194  TCP_GET_SEQ(p), TCP_GET_ACK(p));
195  }
196  }
197 
198  /* flow stuff */
199  MemBufferWriteString(aft->buffer, "FLOW: to_server: %s, "
200  "to_client: %s\n",
201  p->flowflags & FLOW_PKT_TOSERVER ? "TRUE" : "FALSE",
202  p->flowflags & FLOW_PKT_TOCLIENT ? "TRUE" : "FALSE");
203 
204  if (p->flow != NULL) {
205  int applayer = 0;
206  applayer = StreamTcpAppLayerIsDisabled(p->flow);
207  CreateTimeString(&p->flow->startts, timebuf, sizeof(timebuf));
208  MemBufferWriteString(aft->buffer, "FLOW Start TS: %s\n", timebuf);
209  MemBufferWriteString(aft->buffer, "FLOW PKTS TODST: %"PRIu32"\n"
210  "FLOW PKTS TOSRC: %"PRIu32"\n"
211  "FLOW Total Bytes: %"PRIu64"\n",
212  p->flow->todstpktcnt, p->flow->tosrcpktcnt,
213  p->flow->todstbytecnt + p->flow->tosrcbytecnt);
215  "FLOW IPONLY SET: TOSERVER: %s, TOCLIENT: %s\n"
216  "FLOW ACTION: DROP: %s\n"
217  "FLOW NOINSPECTION: PACKET: %s, PAYLOAD: %s, APP_LAYER: %s\n"
218  "FLOW APP_LAYER: DETECTED: %s, PROTO %"PRIu16"\n",
219  p->flow->flags & FLOW_TOSERVER_IPONLY_SET ? "TRUE" : "FALSE",
220  p->flow->flags & FLOW_TOCLIENT_IPONLY_SET ? "TRUE" : "FALSE",
221  p->flow->flags & FLOW_ACTION_DROP ? "TRUE" : "FALSE",
222  p->flow->flags & FLOW_NOPACKET_INSPECTION ? "TRUE" : "FALSE",
223  p->flow->flags & FLOW_NOPAYLOAD_INSPECTION ? "TRUE" : "FALSE",
224  applayer ? "TRUE" : "FALSE",
225  (p->flow->alproto != ALPROTO_UNKNOWN) ? "TRUE" : "FALSE", p->flow->alproto);
226  AlertDebugLogFlowVars(aft, p);
227  }
228 
229  AlertDebugLogPktVars(aft, p);
230 
231 /* any stuff */
232 /* Sig details? */
233 
235  "PACKET LEN: %" PRIu32 "\n"
236  "PACKET:\n",
237  GET_PKT_LEN(p));
239  GET_PKT_DATA(p), GET_PKT_LEN(p));
240 
241  MemBufferWriteString(aft->buffer, "ALERT CNT: %" PRIu32 "\n",
242  p->alerts.cnt);
243 
244  for (i = 0; i < p->alerts.cnt; i++) {
245  const PacketAlert *pa = &p->alerts.alerts[i];
246  if (unlikely(pa->s == NULL)) {
247  continue;
248  }
249 
251  "ALERT MSG [%02d]: %s\n"
252  "ALERT GID [%02d]: %" PRIu32 "\n"
253  "ALERT SID [%02d]: %" PRIu32 "\n"
254  "ALERT REV [%02d]: %" PRIu32 "\n"
255  "ALERT CLASS [%02d]: %s\n"
256  "ALERT PRIO [%02d]: %" PRIu32 "\n"
257  "ALERT FOUND IN [%02d]: %s\n",
258  i, pa->s->msg,
259  i, pa->s->gid,
260  i, pa->s->id,
261  i, pa->s->rev,
262  i, pa->s->class_msg ? pa->s->class_msg : "<none>",
263  i, pa->s->prio,
264  i,
265  pa->flags & PACKET_ALERT_FLAG_STREAM_MATCH ? "STREAM" :
266  (pa->flags & PACKET_ALERT_FLAG_STATE_MATCH ? "STATE" : "PACKET"));
267  if (pa->flags & PACKET_ALERT_FLAG_TX) {
269  "ALERT IN TX [%02d]: %"PRIu64"\n", i, pa->tx_id);
270  } else {
272  "ALERT IN TX [%02d]: N/A\n", i);
273  }
274  if (p->payload_len > 0) {
276  "PAYLOAD LEN: %" PRIu32 "\n"
277  "PAYLOAD:\n",
278  p->payload_len);
280  p->payload, p->payload_len);
281  }
282  if ((pa->flags & PACKET_ALERT_FLAG_STATE_MATCH) ||
284  /* This is an app layer or stream alert */
285  int ret;
286  uint8_t flag;
287  if (!(PKT_IS_TCP(p)) || p->flow == NULL ||
288  p->flow->protoctx == NULL) {
289  return TM_ECODE_OK;
290  }
291  /* IDS mode reverse the data */
292  /** \todo improve the order selection policy */
293  if (p->flowflags & FLOW_PKT_TOSERVER) {
294  flag = FLOW_PKT_TOCLIENT;
295  } else {
296  flag = FLOW_PKT_TOSERVER;
297  }
298  ret = StreamSegmentForEach((const Packet *)p, flag,
299  AlertDebugPrintStreamSegmentCallback,
300  (void *)aft);
301  if (ret < 0) {
302  return TM_ECODE_FAILED;
303  }
304  }
305  }
306 
307  aft->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),
308  MEMBUFFER_OFFSET(aft->buffer), aft->file_ctx);
309 
310  return TM_ECODE_OK;
311 }
312 
313 static TmEcode AlertDebugLogDecoderEvent(ThreadVars *tv, const Packet *p, void *thread_data)
314 {
315  AlertDebugLogThread *aft = (AlertDebugLogThread *)thread_data;
316  int i;
317  char timebuf[64];
318  const char *pkt_src_str = NULL;
319 
320  if (p->alerts.cnt == 0)
321  return TM_ECODE_OK;
322 
323  MemBufferReset(aft->buffer);
324 
325  CreateTimeString(&p->ts, timebuf, sizeof(timebuf));
326 
328  "+================\n"
329  "TIME: %s\n", timebuf);
330  if (p->pcap_cnt > 0) {
332  "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt);
333  }
334  pkt_src_str = PktSrcToString(p->pkt_src);
335  MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str);
337  "ALERT CNT: %" PRIu32 "\n", p->alerts.cnt);
338 
339  for (i = 0; i < p->alerts.cnt; i++) {
340  const PacketAlert *pa = &p->alerts.alerts[i];
341  if (unlikely(pa->s == NULL)) {
342  continue;
343  }
344 
346  "ALERT MSG [%02d]: %s\n"
347  "ALERT GID [%02d]: %" PRIu32 "\n"
348  "ALERT SID [%02d]: %" PRIu32 "\n"
349  "ALERT REV [%02d]: %" PRIu32 "\n"
350  "ALERT CLASS [%02d]: %s\n"
351  "ALERT PRIO [%02d]: %" PRIu32 "\n",
352  i, pa->s->msg,
353  i, pa->s->gid,
354  i, pa->s->id,
355  i, pa->s->rev,
356  i, pa->s->class_msg,
357  i, pa->s->prio);
358  }
359 
361  "PACKET LEN: %" PRIu32 "\n"
362  "PACKET:\n",
363  GET_PKT_LEN(p));
365  GET_PKT_DATA(p), GET_PKT_LEN(p));
366 
367  aft->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),
368  MEMBUFFER_OFFSET(aft->buffer), aft->file_ctx);
369 
370  return TM_ECODE_OK;
371 }
372 
373 static TmEcode AlertDebugLogThreadInit(ThreadVars *t, const void *initdata, void **data)
374 {
376  if (unlikely(aft == NULL))
377  return TM_ECODE_FAILED;
378  memset(aft, 0, sizeof(AlertDebugLogThread));
379 
380  if(initdata == NULL)
381  {
382  SCLogDebug("Error getting context for AlertDebugLog. \"initdata\" argument NULL");
383  SCFree(aft);
384  return TM_ECODE_FAILED;
385  }
386  /** Use the Ouptut Context (file pointer and mutex) */
387  aft->file_ctx = ((OutputCtx *)initdata)->data;
388 
389  /* 1 mb seems sufficient enough */
390  aft->buffer = MemBufferCreateNew(1 * 1024 * 1024);
391  if (aft->buffer == NULL) {
392  SCFree(aft);
393  return TM_ECODE_FAILED;
394  }
395 
396  *data = (void *)aft;
397  return TM_ECODE_OK;
398 }
399 
400 static TmEcode AlertDebugLogThreadDeinit(ThreadVars *t, void *data)
401 {
403  if (aft == NULL) {
404  return TM_ECODE_OK;
405  }
406 
407  MemBufferFree(aft->buffer);
408  /* clear memory */
409  memset(aft, 0, sizeof(AlertDebugLogThread));
410 
411  SCFree(aft);
412  return TM_ECODE_OK;
413 }
414 
415 static void AlertDebugLogDeInitCtx(OutputCtx *output_ctx)
416 {
417  if (output_ctx != NULL) {
418  LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data;
419  if (logfile_ctx != NULL) {
420  LogFileFreeCtx(logfile_ctx);
421  }
422  SCFree(output_ctx);
423  }
424 }
425 
426 /**
427  * \brief Create a new LogFileCtx for alert debug logging.
428  *
429  * \param ConfNode containing configuration for this logger.
430  *
431  * \return output_ctx if succesful, NULL otherwise
432  */
433 static OutputInitResult AlertDebugLogInitCtx(ConfNode *conf)
434 {
435  OutputInitResult result = { NULL, false };
436  LogFileCtx *file_ctx = NULL;
437 
438  file_ctx = LogFileNewCtx();
439  if (file_ctx == NULL) {
440  SCLogDebug("couldn't create new file_ctx");
441  goto error;
442  }
443 
444  if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) {
445  goto error;
446  }
447 
448  OutputCtx *output_ctx = SCMalloc(sizeof(OutputCtx));
449  if (unlikely(output_ctx == NULL))
450  goto error;
451 
452  memset(output_ctx, 0x00, sizeof(OutputCtx));
453  output_ctx->data = file_ctx;
454  output_ctx->DeInit = AlertDebugLogDeInitCtx;
455 
456  SCLogDebug("Alert debug log output initialized");
457  result.ctx = output_ctx;
458  result.ok = true;
459  return result;
460 
461 error:
462  if (file_ctx != NULL) {
463  LogFileFreeCtx(file_ctx);
464  }
465 
466  return result;
467 }
468 
469 static int AlertDebugLogCondition(ThreadVars *tv, const Packet *p)
470 {
471  return (p->alerts.cnt ? TRUE : FALSE);
472 }
473 
474 static int AlertDebugLogLogger(ThreadVars *tv, void *thread_data, const Packet *p)
475 {
476  if (PKT_IS_IPV4(p) || PKT_IS_IPV6(p)) {
477  return AlertDebugLogger(tv, p, thread_data);
478  } else if (p->events.cnt > 0) {
479  return AlertDebugLogDecoderEvent(tv, p, thread_data);
480  }
481  return TM_ECODE_OK;
482 }
483 
485 {
487  AlertDebugLogInitCtx, AlertDebugLogLogger, AlertDebugLogCondition,
488  AlertDebugLogThreadInit, AlertDebugLogThreadDeinit, NULL);
489 }
#define PACKET_ALERT_FLAG_STREAM_MATCH
Definition: decode.h:285
MemBuffer * MemBufferCreateNew(uint32_t size)
Definition: util-buffer.c:32
#define GET_IPV4_SRC_ADDR_PTR(p)
Definition: decode.h:215
int StreamSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data)
Run callback for all segments.
Definition: stream.c:39
uint8_t type
Definition: util-var.h:49
#define FLOWVAR_TYPE_STR
Definition: flow-var.h:33
#define SCLogDebug(...)
Definition: util-debug.h:335
uint32_t idx
Definition: flow-var.h:52
int StreamTcpAppLayerIsDisabled(Flow *f)
uint16_t value_len
Definition: flow-var.h:39
struct Flow_ * flow
Definition: decode.h:446
struct PktVar_ * next
Definition: decode.h:313
LogFileCtx * file_ctx
#define MemBufferWriteString(dst,...)
Write a string buffer to the Membuffer dst.
Definition: util-buffer.h:162
#define PACKET_ALERT_FLAG_TX
Definition: decode.h:287
uint64_t todstbytecnt
Definition: flow.h:462
char * msg
Definition: detect.h:580
uint32_t id
Definition: detect.h:555
#define FALSE
#define unlikely(expr)
Definition: util-optimize.h:35
#define GET_IPV4_DST_ADDR_PTR(p)
Definition: decode.h:216
Port sp
Definition: decode.h:416
#define FLOW_TOCLIENT_IPONLY_SET
Definition: flow.h:56
void PrintRawDataToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32_t dst_buf_size, const uint8_t *src_buf, uint32_t src_buf_len)
Definition: util-print.c:175
#define MemBufferReset(mem_buffer)
Reset the mem buffer.
Definition: util-buffer.h:42
int prio
Definition: detect.h:558
Port dp
Definition: decode.h:424
#define FLOW_ACTION_DROP
Definition: flow.h:64
#define PKT_IS_IPV6(p)
Definition: decode.h:253
struct AlertDebugLogThread_ AlertDebugLogThread
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
struct timeval startts
Definition: flow.h:458
uint64_t pcap_cnt
Definition: decode.h:562
#define FLOW_TOSERVER_IPONLY_SET
Definition: flow.h:54
uint32_t todstpktcnt
Definition: flow.h:460
#define TRUE
#define PKT_IS_IPV4(p)
Definition: decode.h:252
void * protoctx
Definition: flow.h:400
FlowVarTypeStr fv_str
Definition: flow-var.h:57
uint8_t datatype
Definition: flow-var.h:50
PacketAlert alerts[PACKET_ALERT_MAX]
Definition: decode.h:295
const struct Signature_ * s
Definition: decode.h:274
struct GenericVar_ * next
Definition: util-var.h:52
PktVar * pktvar
Definition: decode.h:491
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:59
uint64_t tosrcbytecnt
Definition: flow.h:463
#define TCP_GET_SEQ(p)
Definition: decode-tcp.h:113
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output module.
Definition: output.c:163
uint16_t value_len
Definition: decode.h:317
uint8_t proto
Definition: decode.h:431
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:221
uint32_t size
Definition: util-buffer.h:29
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:61
uint32_t value
Definition: flow-var.h:44
uint32_t idx
Definition: flow-bit.h:33
uint8_t flowflags
Definition: decode.h:440
union FlowVar_::@117 data
#define MODULE_NAME
PacketEngineEvents events
Definition: decode.h:566
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
uint8_t * buffer
Definition: util-buffer.h:28
#define FLOW_PKT_TOSERVER
Definition: flow.h:201
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:267
uint32_t gid
Definition: detect.h:556
uint8_t pkt_src
Definition: decode.h:547
uint64_t tx_id
Definition: decode.h:275
GenericVar * flowvar
Definition: flow.h:448
#define MEMBUFFER_BUFFER(mem_buffer)
Get the MemBuffers underlying buffer.
Definition: util-buffer.h:50
FlowVarTypeInt fv_int
Definition: flow-var.h:58
char * class_msg
Definition: detect.h:583
uint8_t * value
Definition: flow-var.h:38
uint32_t id
Definition: decode.h:312
Definition: conf.h:32
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
OutputCtx * ctx
Definition: output.h:42
#define DEFAULT_LOG_FILENAME
#define SCMalloc(a)
Definition: util-mem.h:222
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:220
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
#define SCFree(a)
Definition: util-mem.h:322
#define PKT_IS_TCP(p)
Definition: decode.h:254
uint8_t * value
Definition: decode.h:319
uint8_t flags
Definition: decode.h:273
#define MEMBUFFER_OFFSET(mem_buffer)
Get the MemBuffers current offset.
Definition: util-buffer.h:55
const char * VarNameStoreLookupById(const uint32_t id, const enum VarTypes type)
void * data
Definition: tm-modules.h:81
const char * PktSrcToString(enum PktSrcEnum pkt_src)
Definition: decode.c:665
uint32_t rev
Definition: detect.h:557
PacketAlerts alerts
Definition: decode.h:556
#define GET_PKT_DATA(p)
Definition: decode.h:226
void AlertDebugLogRegister(void)
#define PACKET_ALERT_FLAG_STATE_MATCH
Definition: decode.h:283
uint16_t cnt
Definition: decode.h:294
#define PKT_IS_UDP(p)
Definition: decode.h:255
Per thread variable structure.
Definition: threadvars.h:57
struct timeval ts
Definition: decode.h:452
#define FLOW_PKT_TOCLIENT
Definition: flow.h:202
AppProto alproto
application level protocol
Definition: flow.h:409
#define GET_PKT_LEN(p)
Definition: decode.h:225
#define FLOWVAR_TYPE_INT
Definition: flow-var.h:34
#define TCP_GET_ACK(p)
Definition: decode-tcp.h:114
uint16_t payload_len
Definition: decode.h:542
uint32_t offset
Definition: util-buffer.h:30
uint8_t * payload
Definition: decode.h:541
uint32_t flags
Definition: flow.h:379
void MemBufferFree(MemBuffer *buffer)
Definition: util-buffer.c:82
void CreateTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:245
uint32_t tosrcpktcnt
Definition: flow.h:461