suricata
alert-debuglog.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #include "suricata-common.h"
25 #include "suricata.h"
26 
27 #include "debug.h"
28 #include "detect.h"
29 #include "flow.h"
30 #include "conf.h"
31 #include "stream.h"
32 #include "app-layer-protos.h"
33 
34 #include "threads.h"
35 #include "threadvars.h"
36 #include "tm-threads.h"
37 
38 #include "util-print.h"
39 
40 #include "pkt-var.h"
41 
42 #include "util-unittest.h"
43 
44 #include "util-debug.h"
45 #include "util-validate.h"
46 #include "util-buffer.h"
47 
48 #include "output.h"
49 #include "alert-debuglog.h"
50 #include "util-privs.h"
51 #include "flow-var.h"
52 #include "flow-bit.h"
53 #include "util-var-name.h"
54 #include "util-optimize.h"
55 #include "util-logopenfile.h"
56 #include "util-time.h"
57 
58 #include "stream-tcp-reassemble.h"
59 
60 #define DEFAULT_LOG_FILENAME "alert-debug.log"
61 
62 #define MODULE_NAME "AlertDebugLog"
63 
64 typedef struct AlertDebugLogThread_ {
66  /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
69 
70 /**
71  * \brief Function to log the FlowVars in to alert-debug.log
72  *
73  * \param aft Pointer to AltertDebugLog Thread
74  * \param p Pointer to the packet
75  *
76  */
77 static void AlertDebugLogFlowVars(AlertDebugLogThread *aft, const Packet *p)
78 {
79  const GenericVar *gv = p->flow->flowvar;
80  uint16_t i;
81  while (gv != NULL) {
82  if (gv->type == DETECT_FLOWBITS) {
83  FlowBit *fb = (FlowBit *)gv;
84  const char *fbname = VarNameStoreLookupById(fb->idx, VAR_TYPE_FLOW_BIT);
85  if (fbname) {
86  MemBufferWriteString(aft->buffer, "FLOWBIT: %s\n",
87  fbname);
88  }
89  } else if (gv->type == DETECT_FLOWVAR || gv->type == DETECT_FLOWINT) {
90  FlowVar *fv = (FlowVar *) gv;
91 
92  if (fv->datatype == FLOWVAR_TYPE_STR) {
93  const char *fvname = VarNameStoreLookupById(fv->idx,
95  MemBufferWriteString(aft->buffer, "FLOWVAR: \"%s\" => \"",
96  fvname);
97  for (i = 0; i < fv->data.fv_str.value_len; i++) {
98  if (isprint(fv->data.fv_str.value[i])) {
99  MemBufferWriteString(aft->buffer, "%c",
100  fv->data.fv_str.value[i]);
101  } else {
102  MemBufferWriteString(aft->buffer, "\\%02X",
103  fv->data.fv_str.value[i]);
104  }
105  }
106  MemBufferWriteString(aft->buffer, "\"\n");
107  } else if (fv->datatype == FLOWVAR_TYPE_INT) {
108  const char *fvname = VarNameStoreLookupById(fv->idx,
110  MemBufferWriteString(aft->buffer, "FLOWINT: \"%s\" =>"
111  " %"PRIu32"\n", fvname, fv->data.fv_int.value);
112  }
113  }
114  gv = gv->next;
115  }
116 }
117 
118 /**
119  * \brief Function to log the PktVars in to alert-debug.log
120  *
121  * \param aft Pointer to AltertDebugLog Thread
122  * \param p Pointer to the packet
123  *
124  */
125 static void AlertDebugLogPktVars(AlertDebugLogThread *aft, const Packet *p)
126 {
127  const PktVar *pv = p->pktvar;
128 
129  while (pv != NULL) {
130  const char *varname = VarNameStoreLookupById(pv->id, VAR_TYPE_PKT_VAR);
131  MemBufferWriteString(aft->buffer, "PKTVAR: %s\n", varname);
133  pv->value, pv->value_len);
134  pv = pv->next;
135  }
136 }
137 
138 /** \todo doc
139  * assume we have aft lock */
140 static int AlertDebugPrintStreamSegmentCallback(
141  const Packet *p, TcpSegment *seg, void *data, const uint8_t *buf, uint32_t buflen)
142 {
144 
145  MemBufferWriteString(aft->buffer, "STREAM DATA LEN: %"PRIu32"\n", buflen);
146  MemBufferWriteString(aft->buffer, "STREAM DATA:\n");
147 
149  buf, buflen);
150 
151  return 1;
152 }
153 
154 static TmEcode AlertDebugLogger(ThreadVars *tv, const Packet *p, void *thread_data)
155 {
156  AlertDebugLogThread *aft = (AlertDebugLogThread *)thread_data;
157  int i;
158  char timebuf[64];
159  const char *pkt_src_str = NULL;
160 
161  if (p->alerts.cnt == 0)
162  return TM_ECODE_OK;
163 
164  MemBufferReset(aft->buffer);
165 
166  CreateTimeString(&p->ts, timebuf, sizeof(timebuf));
167 
168  MemBufferWriteString(aft->buffer, "+================\n"
169  "TIME: %s\n", timebuf);
170  if (p->pcap_cnt > 0) {
171  MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt);
172  }
173  pkt_src_str = PktSrcToString(p->pkt_src);
174  MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str);
175 
176  char srcip[46], dstip[46];
177  if (PKT_IS_IPV4(p)) {
178  PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
179  PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
180  } else {
182  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
183  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
184  }
185 
186  MemBufferWriteString(aft->buffer, "SRC IP: %s\n"
187  "DST IP: %s\n"
188  "PROTO: %" PRIu32 "\n",
189  srcip, dstip, p->proto);
190  if (PKT_IS_TCP(p) || PKT_IS_UDP(p)) {
191  MemBufferWriteString(aft->buffer, "SRC PORT: %" PRIu32 "\n"
192  "DST PORT: %" PRIu32 "\n",
193  p->sp, p->dp);
194  if (PKT_IS_TCP(p)) {
195  MemBufferWriteString(aft->buffer, "TCP SEQ: %"PRIu32"\n"
196  "TCP ACK: %"PRIu32"\n",
197  TCP_GET_SEQ(p), TCP_GET_ACK(p));
198  }
199  }
200 
201  /* flow stuff */
202  MemBufferWriteString(aft->buffer, "FLOW: to_server: %s, "
203  "to_client: %s\n",
204  p->flowflags & FLOW_PKT_TOSERVER ? "TRUE" : "FALSE",
205  p->flowflags & FLOW_PKT_TOCLIENT ? "TRUE" : "FALSE");
206 
207  if (p->flow != NULL) {
208  int applayer = 0;
209  applayer = StreamTcpAppLayerIsDisabled(p->flow);
210  CreateTimeString(&p->flow->startts, timebuf, sizeof(timebuf));
211  MemBufferWriteString(aft->buffer, "FLOW Start TS: %s\n", timebuf);
212  MemBufferWriteString(aft->buffer, "FLOW PKTS TODST: %"PRIu32"\n"
213  "FLOW PKTS TOSRC: %"PRIu32"\n"
214  "FLOW Total Bytes: %"PRIu64"\n",
215  p->flow->todstpktcnt, p->flow->tosrcpktcnt,
216  p->flow->todstbytecnt + p->flow->tosrcbytecnt);
218  "FLOW IPONLY SET: TOSERVER: %s, TOCLIENT: %s\n"
219  "FLOW ACTION: DROP: %s\n"
220  "FLOW NOINSPECTION: PACKET: %s, PAYLOAD: %s, APP_LAYER: %s\n"
221  "FLOW APP_LAYER: DETECTED: %s, PROTO %"PRIu16"\n",
222  p->flow->flags & FLOW_TOSERVER_IPONLY_SET ? "TRUE" : "FALSE",
223  p->flow->flags & FLOW_TOCLIENT_IPONLY_SET ? "TRUE" : "FALSE",
224  p->flow->flags & FLOW_ACTION_DROP ? "TRUE" : "FALSE",
225  p->flow->flags & FLOW_NOPACKET_INSPECTION ? "TRUE" : "FALSE",
226  p->flow->flags & FLOW_NOPAYLOAD_INSPECTION ? "TRUE" : "FALSE",
227  applayer ? "TRUE" : "FALSE",
228  (p->flow->alproto != ALPROTO_UNKNOWN) ? "TRUE" : "FALSE", p->flow->alproto);
229  AlertDebugLogFlowVars(aft, p);
230  }
231 
232  AlertDebugLogPktVars(aft, p);
233 
234 /* any stuff */
235 /* Sig details? */
236 
238  "PACKET LEN: %" PRIu32 "\n"
239  "PACKET:\n",
240  GET_PKT_LEN(p));
242  GET_PKT_DATA(p), GET_PKT_LEN(p));
243 
244  MemBufferWriteString(aft->buffer, "ALERT CNT: %" PRIu32 "\n",
245  p->alerts.cnt);
246 
247  for (i = 0; i < p->alerts.cnt; i++) {
248  const PacketAlert *pa = &p->alerts.alerts[i];
249  if (unlikely(pa->s == NULL)) {
250  continue;
251  }
252 
254  "ALERT MSG [%02d]: %s\n"
255  "ALERT GID [%02d]: %" PRIu32 "\n"
256  "ALERT SID [%02d]: %" PRIu32 "\n"
257  "ALERT REV [%02d]: %" PRIu32 "\n"
258  "ALERT CLASS [%02d]: %s\n"
259  "ALERT PRIO [%02d]: %" PRIu32 "\n"
260  "ALERT FOUND IN [%02d]: %s\n",
261  i, pa->s->msg,
262  i, pa->s->gid,
263  i, pa->s->id,
264  i, pa->s->rev,
265  i, pa->s->class_msg ? pa->s->class_msg : "<none>",
266  i, pa->s->prio,
267  i,
268  pa->flags & PACKET_ALERT_FLAG_STREAM_MATCH ? "STREAM" :
269  (pa->flags & PACKET_ALERT_FLAG_STATE_MATCH ? "STATE" : "PACKET"));
270  if (pa->flags & PACKET_ALERT_FLAG_TX) {
272  "ALERT IN TX [%02d]: %"PRIu64"\n", i, pa->tx_id);
273  } else {
275  "ALERT IN TX [%02d]: N/A\n", i);
276  }
277  if (p->payload_len > 0) {
279  "PAYLOAD LEN: %" PRIu32 "\n"
280  "PAYLOAD:\n",
281  p->payload_len);
283  p->payload, p->payload_len);
284  }
285  if ((pa->flags & PACKET_ALERT_FLAG_STATE_MATCH) ||
287  /* This is an app layer or stream alert */
288  int ret;
289  uint8_t flag;
290  if (!(PKT_IS_TCP(p)) || p->flow == NULL ||
291  p->flow->protoctx == NULL) {
292  return TM_ECODE_OK;
293  }
294  /* IDS mode reverse the data */
295  /** \todo improve the order selection policy */
296  if (p->flowflags & FLOW_PKT_TOSERVER) {
297  flag = STREAM_DUMP_TOCLIENT;
298  } else {
299  flag = STREAM_DUMP_TOSERVER;
300  }
301  ret = StreamSegmentForEach((const Packet *)p, flag,
302  AlertDebugPrintStreamSegmentCallback,
303  (void *)aft);
304  if (ret < 0) {
305  return TM_ECODE_FAILED;
306  }
307  }
308  }
309 
310  aft->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),
311  MEMBUFFER_OFFSET(aft->buffer), aft->file_ctx);
312 
313  return TM_ECODE_OK;
314 }
315 
316 static TmEcode AlertDebugLogDecoderEvent(ThreadVars *tv, const Packet *p, void *thread_data)
317 {
318  AlertDebugLogThread *aft = (AlertDebugLogThread *)thread_data;
319  int i;
320  char timebuf[64];
321  const char *pkt_src_str = NULL;
322 
323  if (p->alerts.cnt == 0)
324  return TM_ECODE_OK;
325 
326  MemBufferReset(aft->buffer);
327 
328  CreateTimeString(&p->ts, timebuf, sizeof(timebuf));
329 
331  "+================\n"
332  "TIME: %s\n", timebuf);
333  if (p->pcap_cnt > 0) {
335  "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt);
336  }
337  pkt_src_str = PktSrcToString(p->pkt_src);
338  MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str);
340  "ALERT CNT: %" PRIu32 "\n", p->alerts.cnt);
341 
342  for (i = 0; i < p->alerts.cnt; i++) {
343  const PacketAlert *pa = &p->alerts.alerts[i];
344  if (unlikely(pa->s == NULL)) {
345  continue;
346  }
347 
349  "ALERT MSG [%02d]: %s\n"
350  "ALERT GID [%02d]: %" PRIu32 "\n"
351  "ALERT SID [%02d]: %" PRIu32 "\n"
352  "ALERT REV [%02d]: %" PRIu32 "\n"
353  "ALERT CLASS [%02d]: %s\n"
354  "ALERT PRIO [%02d]: %" PRIu32 "\n",
355  i, pa->s->msg,
356  i, pa->s->gid,
357  i, pa->s->id,
358  i, pa->s->rev,
359  i, pa->s->class_msg,
360  i, pa->s->prio);
361  }
362 
364  "PACKET LEN: %" PRIu32 "\n"
365  "PACKET:\n",
366  GET_PKT_LEN(p));
368  GET_PKT_DATA(p), GET_PKT_LEN(p));
369 
370  aft->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),
371  MEMBUFFER_OFFSET(aft->buffer), aft->file_ctx);
372 
373  return TM_ECODE_OK;
374 }
375 
376 static TmEcode AlertDebugLogThreadInit(ThreadVars *t, const void *initdata, void **data)
377 {
379  if (unlikely(aft == NULL))
380  return TM_ECODE_FAILED;
381  memset(aft, 0, sizeof(AlertDebugLogThread));
382 
383  if(initdata == NULL)
384  {
385  SCLogDebug("Error getting context for AlertDebugLog. \"initdata\" argument NULL");
386  SCFree(aft);
387  return TM_ECODE_FAILED;
388  }
389  /** Use the Ouptut Context (file pointer and mutex) */
390  aft->file_ctx = ((OutputCtx *)initdata)->data;
391 
392  /* 1 mb seems sufficient enough */
393  aft->buffer = MemBufferCreateNew(1 * 1024 * 1024);
394  if (aft->buffer == NULL) {
395  SCFree(aft);
396  return TM_ECODE_FAILED;
397  }
398 
399  *data = (void *)aft;
400  return TM_ECODE_OK;
401 }
402 
403 static TmEcode AlertDebugLogThreadDeinit(ThreadVars *t, void *data)
404 {
406  if (aft == NULL) {
407  return TM_ECODE_OK;
408  }
409 
410  MemBufferFree(aft->buffer);
411  /* clear memory */
412  memset(aft, 0, sizeof(AlertDebugLogThread));
413 
414  SCFree(aft);
415  return TM_ECODE_OK;
416 }
417 
418 static void AlertDebugLogDeInitCtx(OutputCtx *output_ctx)
419 {
420  if (output_ctx != NULL) {
421  LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data;
422  if (logfile_ctx != NULL) {
423  LogFileFreeCtx(logfile_ctx);
424  }
425  SCFree(output_ctx);
426  }
427 }
428 
429 /**
430  * \brief Create a new LogFileCtx for alert debug logging.
431  *
432  * \param ConfNode containing configuration for this logger.
433  *
434  * \return output_ctx if succesful, NULL otherwise
435  */
436 static OutputInitResult AlertDebugLogInitCtx(ConfNode *conf)
437 {
438  OutputInitResult result = { NULL, false };
439  LogFileCtx *file_ctx = NULL;
440 
441  file_ctx = LogFileNewCtx();
442  if (file_ctx == NULL) {
443  SCLogDebug("couldn't create new file_ctx");
444  goto error;
445  }
446 
447  if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) {
448  goto error;
449  }
450 
451  OutputCtx *output_ctx = SCMalloc(sizeof(OutputCtx));
452  if (unlikely(output_ctx == NULL))
453  goto error;
454 
455  memset(output_ctx, 0x00, sizeof(OutputCtx));
456  output_ctx->data = file_ctx;
457  output_ctx->DeInit = AlertDebugLogDeInitCtx;
458 
459  SCLogDebug("Alert debug log output initialized");
460  result.ctx = output_ctx;
461  result.ok = true;
462  return result;
463 
464 error:
465  if (file_ctx != NULL) {
466  LogFileFreeCtx(file_ctx);
467  }
468 
469  return result;
470 }
471 
472 static int AlertDebugLogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
473 {
474  return (p->alerts.cnt ? TRUE : FALSE);
475 }
476 
477 static int AlertDebugLogLogger(ThreadVars *tv, void *thread_data, const Packet *p)
478 {
479  if (PKT_IS_IPV4(p) || PKT_IS_IPV6(p)) {
480  return AlertDebugLogger(tv, p, thread_data);
481  } else if (p->events.cnt > 0) {
482  return AlertDebugLogDecoderEvent(tv, p, thread_data);
483  }
484  return TM_ECODE_OK;
485 }
486 
488 {
490  AlertDebugLogInitCtx, AlertDebugLogLogger, AlertDebugLogCondition,
491  AlertDebugLogThreadInit, AlertDebugLogThreadDeinit, NULL);
492 }
PKT_IS_UDP
#define PKT_IS_UDP(p)
Definition: decode.h:256
GenericVar_::type
uint8_t type
Definition: util-var.h:49
tm-threads.h
Packet_::proto
uint8_t proto
Definition: decode.h:455
PACKET_ALERT_FLAG_STREAM_MATCH
#define PACKET_ALERT_FLAG_STREAM_MATCH
Definition: decode.h:285
PacketAlert_::s
const struct Signature_ * s
Definition: decode.h:275
AlertDebugLogThread_::buffer
MemBuffer * buffer
Definition: alert-debuglog.c:67
STREAM_DUMP_TOSERVER
#define STREAM_DUMP_TOSERVER
Definition: stream.h:32
alert-debuglog.h
PACKET_ALERT_FLAG_TX
#define PACKET_ALERT_FLAG_TX
Definition: decode.h:287
AlertDebugLogThread_
Definition: alert-debuglog.c:64
Flow_::startts
struct timeval startts
Definition: flow.h:500
PKT_IS_IPV6
#define PKT_IS_IPV6(p)
Definition: decode.h:254
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:643
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:594
StreamSegmentForEach
int StreamSegmentForEach(const Packet *p, uint8_t flag, StreamSegmentCallback CallbackFunc, void *data)
Definition: stream.c:40
Packet_::payload
uint8_t * payload
Definition: decode.h:573
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:297
FlowVarTypeStr::value_len
uint16_t value_len
Definition: flow-var.h:39
FLOWVAR_TYPE_STR
#define FLOWVAR_TYPE_STR
Definition: flow-var.h:33
threads.h
LogFileCtx_
Definition: util-logopenfile.h:64
PktVar_::next
struct PktVar_ * next
Definition: decode.h:322
FlowVar_::fv_str
FlowVarTypeStr fv_str
Definition: flow-var.h:57
FLOW_NOPAYLOAD_INSPECTION
#define FLOW_NOPAYLOAD_INSPECTION
Definition: flow.h:63
PacketAlerts_::alerts
PacketAlert * alerts
Definition: decode.h:300
flow-bit.h
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:223
util-var-name.h
util-privs.h
LogFileCtx_::Write
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:80
stream-tcp-reassemble.h
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:66
FLOWVAR_TYPE_INT
#define FLOWVAR_TYPE_INT
Definition: flow-var.h:34
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:464
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
Flow_::protoctx
void * protoctx
Definition: flow.h:451
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:574
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:222
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:588
Packet_::events
PacketEngineEvents events
Definition: decode.h:598
util-unittest.h
MemBuffer_::offset
uint32_t offset
Definition: util-buffer.h:30
OutputCtx_::data
void * data
Definition: tm-modules.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:82
PacketAlert_::tx_id
uint64_t tx_id
Definition: decode.h:276
OutputCtx_
Definition: tm-modules.h:78
SCConfLogOpenGeneric
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
Definition: util-logopenfile.c:431
Signature_::gid
uint32_t gid
Definition: detect.h:575
FlowVar_::fv_int
FlowVarTypeInt fv_int
Definition: flow-var.h:58
MODULE_NAME
#define MODULE_NAME
Definition: alert-debuglog.c:62
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:505
PKT_IS_TCP
#define PKT_IS_TCP(p)
Definition: decode.h:255
FlowVar_::data
union FlowVar_::@111 data
util-debug.h
StreamTcpAppLayerIsDisabled
int StreamTcpAppLayerIsDisabled(Flow *f)
Definition: stream-tcp-reassemble.c:447
Packet_::pktvar
PktVar * pktvar
Definition: decode.h:521
GenericVar_::next
struct GenericVar_ * next
Definition: util-var.h:52
PrintRawDataToBuffer
void PrintRawDataToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32_t dst_buf_size, const uint8_t *src_buf, uint32_t src_buf_len)
Definition: util-print.c:181
GET_IPV4_DST_ADDR_PTR
#define GET_IPV4_DST_ADDR_PTR(p)
Definition: decode.h:217
DETECT_FLOWINT
@ DETECT_FLOWINT
Definition: detect-engine-register.h:85
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:45
DETECT_FLOWVAR
@ DETECT_FLOWVAR
Definition: detect-engine-register.h:83
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:502
FlowVar_::idx
uint32_t idx
Definition: flow-var.h:52
PktVar_::value
uint8_t * value
Definition: decode.h:328
util-print.h
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:227
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:56
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:274
pkt-var.h
Packet_::sp
Port sp
Definition: decode.h:440
PktSrcToString
const char * PktSrcToString(enum PktSrcEnum pkt_src)
Definition: decode.c:739
util-time.h
OutputInitResult_::ok
bool ok
Definition: output.h:46
TRUE
#define TRUE
Definition: suricata-common.h:33
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:504
TCP_GET_SEQ
#define TCP_GET_SEQ(p)
Definition: decode-tcp.h:114
FALSE
#define FALSE
Definition: suricata-common.h:34
stream.h
TcpSegment
Definition: stream-tcp-private.h:72
Packet_
Definition: decode.h:433
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:226
conf.h
FLOW_TOSERVER_IPONLY_SET
#define FLOW_TOSERVER_IPONLY_SET
Definition: flow.h:56
TmEcode
TmEcode
Definition: tm-threads-common.h:81
CreateTimeString
void CreateTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:278
MemBuffer_
Definition: util-buffer.h:27
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:224
DEFAULT_LOG_FILENAME
#define DEFAULT_LOG_FILENAME
Definition: alert-debuglog.c:60
FlowVarTypeInt_::value
uint32_t value
Definition: flow-var.h:44
Flow_::flowvar
GenericVar * flowvar
Definition: flow.h:496
Signature_::class_msg
char * class_msg
Definition: detect.h:603
PacketAlert_::flags
uint8_t flags
Definition: decode.h:274
MemBufferReset
#define MemBufferReset(mem_buffer)
Reset the mem buffer.
Definition: util-buffer.h:42
OutputInitResult_
Definition: output.h:44
FlowVarTypeStr::value
uint8_t * value
Definition: flow-var.h:38
Packet_::flow
struct Flow_ * flow
Definition: decode.h:470
VAR_TYPE_FLOW_BIT
@ VAR_TYPE_FLOW_BIT
Definition: util-var.h:35
GET_IPV4_SRC_ADDR_PTR
#define GET_IPV4_SRC_ADDR_PTR(p)
Definition: decode.h:216
FLOW_TOCLIENT_IPONLY_SET
#define FLOW_TOCLIENT_IPONLY_SET
Definition: flow.h:58
Packet_::ts
struct timeval ts
Definition: decode.h:476
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
VarNameStoreLookupById
const char * VarNameStoreLookupById(const uint32_t id, const enum VarTypes type)
Definition: util-var-name.c:297
GenericVar_
Definition: util-var.h:48
MemBufferFree
void MemBufferFree(MemBuffer *buffer)
Definition: util-buffer.c:82
MemBufferWriteString
#define MemBufferWriteString(dst,...)
Write a string buffer to the Membuffer dst.
Definition: util-buffer.h:162
Signature_::rev
uint32_t rev
Definition: detect.h:576
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:828
LOGGER_ALERT_DEBUG
@ LOGGER_ALERT_DEBUG
Definition: suricata-common.h:476
FlowBit_::idx
uint32_t idx
Definition: flow-bit.h:33
AlertDebugLogThread_::file_ctx
LogFileCtx * file_ctx
Definition: alert-debuglog.c:65
DETECT_FLOWBITS
@ DETECT_FLOWBITS
Definition: detect-engine-register.h:88
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:31
Signature_::prio
int prio
Definition: detect.h:577
util-optimize.h
OutputRegisterPacketModule
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output module.
Definition: output.c:177
threadvars.h
util-validate.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
FlowBit_
Definition: flow-bit.h:30
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:221
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:579
ConfNode_
Definition: conf.h:32
util-logopenfile.h
Signature_::id
uint32_t id
Definition: detect.h:574
Flow_::flags
uint32_t flags
Definition: flow.h:431
STREAM_DUMP_TOCLIENT
#define STREAM_DUMP_TOCLIENT
Definition: stream.h:31
util-buffer.h
VAR_TYPE_FLOW_VAR
@ VAR_TYPE_FLOW_VAR
Definition: util-var.h:37
VAR_TYPE_FLOW_INT
@ VAR_TYPE_FLOW_INT
Definition: util-var.h:36
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
PktVar_::value_len
uint16_t value_len
Definition: decode.h:326
AlertDebugLogThread
struct AlertDebugLogThread_ AlertDebugLogThread
app-layer-protos.h
suricata.h
PacketAlert_
Definition: decode.h:271
PktVar_
Definition: decode.h:320
MemBuffer_::size
uint32_t size
Definition: util-buffer.h:29
TCP_GET_ACK
#define TCP_GET_ACK(p)
Definition: decode-tcp.h:115
FLOW_NOPACKET_INSPECTION
#define FLOW_NOPACKET_INSPECTION
Definition: flow.h:61
MEMBUFFER_BUFFER
#define MEMBUFFER_BUFFER(mem_buffer)
Get the MemBuffers underlying buffer.
Definition: util-buffer.h:50
MemBuffer_::buffer
uint8_t * buffer
Definition: util-buffer.h:28
Signature_::msg
char * msg
Definition: detect.h:600
flow.h
AlertDebugLogRegister
void AlertDebugLogRegister(void)
Definition: alert-debuglog.c:487
MEMBUFFER_OFFSET
#define MEMBUFFER_OFFSET(mem_buffer)
Get the MemBuffers current offset.
Definition: util-buffer.h:55
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:460
Packet_::dp
Port dp
Definition: decode.h:448
flow-var.h
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:253
PACKET_ALERT_FLAG_STATE_MATCH
#define PACKET_ALERT_FLAG_STATE_MATCH
Definition: decode.h:283
FlowVar_
Definition: flow-var.h:48
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
VAR_TYPE_PKT_VAR
@ VAR_TYPE_PKT_VAR
Definition: util-var.h:32
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:503
MemBufferCreateNew
MemBuffer * MemBufferCreateNew(uint32_t size)
Definition: util-buffer.c:32
debug.h
FlowVar_::datatype
uint8_t datatype
Definition: flow-var.h:50
output.h
PktVar_::id
uint32_t id
Definition: decode.h:321
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:316