Go to the documentation of this file.
59 #define DEFAULT_LOG_FILENAME "fast.log"
61 #define MODULE_NAME "AlertFastLog"
64 #define MAX_FASTLOG_ALERT_SIZE 2048
67 #define MAX_FASTLOG_BUFFER_SIZE (2 * MAX_FASTLOG_ALERT_SIZE)
72 static void AlertFastLogDeInitCtx(
OutputCtx *);
82 .ConditionFunc = AlertFastLogCondition,
85 .ThreadExitPrintStatsFunc = NULL,
115 int decoder_event = 0;
119 char srcip[46], dstip[46];
120 if (PacketIsIPv4(p)) {
123 }
else if (PacketIsIPv6(p)) {
139 const char *protoptr;
143 snprintf(
proto,
sizeof(
proto),
"PROTO:%03" PRIu32, PacketGetIPProto(p));
146 uint16_t src_port_or_icmp = p->
sp;
147 uint16_t dst_port_or_icmp = p->
dp;
148 if (PacketGetIPProto(p) == IPPROTO_ICMP || PacketGetIPProto(p) == IPPROTO_ICMPV6) {
149 src_port_or_icmp = p->
icmp_s.type;
150 dst_port_or_icmp = p->
icmp_s.code;
158 const char *action =
"";
167 if (
likely(decoder_event == 0)) {
169 "%s %s[**] [%" PRIu32
":%" PRIu32
":%"
170 PRIu32
"] %s [**] [Classification: %s] [Priority: %"PRIu32
"]"
171 " {%s} %s:%" PRIu32
" -> %s:%" PRIu32
"\n", timebuf, action,
173 protoptr, srcip, src_port_or_icmp, dstip, dst_port_or_icmp);
176 "%s %s[**] [%" PRIu32
":%" PRIu32
177 ":%" PRIu32
"] %s [**] [Classification: %s] [Priority: "
178 "%" PRIu32
"] [**] [Raw pkt: ", timebuf, action, pa->
s->
gid,
184 "] [pcap file packet: %"PRIu64
"]\n", p->
pcap_cnt);
191 AlertFastLogOutputAlert(aft, alert_buffer, size);
204 SCLogDebug(
"Error getting context for AlertFastLog. \"initdata\" argument NULL");
238 if (logfile_ctx == NULL) {
239 SCLogDebug(
"AlertFastLogInitCtx2: Could not create new LogFileCtx");
254 output_ctx->
data = logfile_ctx;
255 output_ctx->
DeInit = AlertFastLogDeInitCtx;
257 result.
ctx = output_ctx;
262 static void AlertFastLogDeInitCtx(
OutputCtx *output_ctx)
273 static int AlertFastLogTest01(
void)
275 uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n"
276 "Host: one.example.org\r\n";
278 uint16_t buflen = strlen((
char *)buf);
283 memset(&th_v, 0,
sizeof(th_v));
295 "(msg:\"FastLog test\"; content:\"GET\"; "
296 "Classtype:unknown; sid:1;)");
314 static int AlertFastLogTest02(
void)
316 uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n"
317 "Host: one.example.org\r\n";
318 uint16_t buflen = strlen((
char *)buf);
323 memset(&th_v, 0,
sizeof(th_v));
336 "(msg:\"FastLog test\"; content:\"GET\"; "
337 "Classtype:unknown; sid:1;)");
int AlertFastLogger(ThreadVars *tv, void *data, const Packet *p)
void AlertFastLogRegisterTests(void)
This function registers unit tests for AlertFastLog API.
const struct Signature_ * s
OutputInitResult AlertFastLogInitCtx(ConfNode *conf)
Create a new LogFileCtx for "fast" output style.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
struct Packet_::@27::@34 icmp_s
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
void AlertFastLogRegister(void)
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
const char * known_proto[256]
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
void SigCleanSignatures(DetectEngineCtx *de_ctx)
TmEcode AlertFastLogThreadInit(ThreadVars *, const void *, void **)
#define MAX_FASTLOG_BUFFER_SIZE
#define GET_IPV6_DST_ADDR(p)
#define DEFAULT_LOG_FILENAME
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
#define PASS
Pass the test.
#define GET_IPV4_DST_ADDR_PTR(p)
void PrintBufferRawLineHex(char *nbuf, int *offset, int max_size, const uint8_t *buf, uint32_t buflen)
print a buffer as hex on a single line
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data)
initialize thread specific detection engine context
Signature * SigInit(DetectEngineCtx *de_ctx, const char *sigstr)
Parses a signature and adds it to the Detection Engine Context.
int SigGroupCleanup(DetectEngineCtx *de_ctx)
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
#define MAX_FASTLOG_ALERT_SIZE
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
#define GET_IPV4_SRC_ADDR_PTR(p)
#define PrintBufferData(buf, buf_offset_ptr, buf_size,...)
void(* DeInit)(struct OutputCtx_ *)
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data)
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, OutputPacketLoggerFunctions *output_module_functions)
Register a packet output module.
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
struct AlertFastLogThread_ AlertFastLogThread
#define GET_IPV6_SRC_ADDR(p)
DetectEngineCtx * DetectEngineCtxInit(void)
int EngineModeIsIPS(void)
FILE * SCClassConfGenerateValidDummyClassConfigFD01(void)
Creates a dummy classification file, with all valid Classtypes, for testing purposes.
bool SCClassConfLoadClassificationConfigFile(DetectEngineCtx *de_ctx, FILE *fd)
Loads the Classtype info from the classification.config file.
TmEcode AlertFastLogThreadDeinit(ThreadVars *, void *)
void CreateTimeString(const SCTime_t ts, char *str, size_t size)
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.