Go to the documentation of this file.
59 #define DEFAULT_LOG_FILENAME "fast.log"
61 #define MODULE_NAME "AlertFastLog"
64 #define MAX_FASTLOG_ALERT_SIZE 2048
67 #define MAX_FASTLOG_BUFFER_SIZE (2 * MAX_FASTLOG_ALERT_SIZE)
72 static void AlertFastLogDeInitCtx(
OutputCtx *);
107 int decoder_event = 0;
111 char srcip[46], dstip[46];
112 if (PacketIsIPv4(p)) {
115 }
else if (PacketIsIPv6(p)) {
131 const char *protoptr;
135 snprintf(
proto,
sizeof(
proto),
"PROTO:%03" PRIu32, PacketGetIPProto(p));
138 uint16_t src_port_or_icmp = p->
sp;
139 uint16_t dst_port_or_icmp = p->
dp;
140 if (PacketGetIPProto(p) == IPPROTO_ICMP || PacketGetIPProto(p) == IPPROTO_ICMPV6) {
141 src_port_or_icmp = p->
icmp_s.type;
142 dst_port_or_icmp = p->
icmp_s.code;
150 const char *action =
"";
159 if (
likely(decoder_event == 0)) {
161 "%s %s[**] [%" PRIu32
":%" PRIu32
":%"
162 PRIu32
"] %s [**] [Classification: %s] [Priority: %"PRIu32
"]"
163 " {%s} %s:%" PRIu32
" -> %s:%" PRIu32
"\n", timebuf, action,
165 protoptr, srcip, src_port_or_icmp, dstip, dst_port_or_icmp);
168 "%s %s[**] [%" PRIu32
":%" PRIu32
169 ":%" PRIu32
"] %s [**] [Classification: %s] [Priority: "
170 "%" PRIu32
"] [**] [Raw pkt: ", timebuf, action, pa->
s->
gid,
176 "] [pcap file packet: %"PRIu64
"]\n", p->
pcap_cnt);
183 AlertFastLogOutputAlert(aft, alert_buffer, size);
196 SCLogDebug(
"Error getting context for AlertFastLog. \"initdata\" argument NULL");
230 if (logfile_ctx == NULL) {
231 SCLogDebug(
"AlertFastLogInitCtx2: Could not create new LogFileCtx");
246 output_ctx->
data = logfile_ctx;
247 output_ctx->
DeInit = AlertFastLogDeInitCtx;
249 result.
ctx = output_ctx;
254 static void AlertFastLogDeInitCtx(
OutputCtx *output_ctx)
265 static int AlertFastLogTest01(
void)
267 uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n"
268 "Host: one.example.org\r\n";
270 uint16_t buflen = strlen((
char *)buf);
275 memset(&th_v, 0,
sizeof(th_v));
287 "(msg:\"FastLog test\"; content:\"GET\"; "
288 "Classtype:unknown; sid:1;)");
306 static int AlertFastLogTest02(
void)
308 uint8_t *buf = (uint8_t *)
"GET /one/ HTTP/1.1\r\n"
309 "Host: one.example.org\r\n";
310 uint16_t buflen = strlen((
char *)buf);
315 memset(&th_v, 0,
sizeof(th_v));
328 "(msg:\"FastLog test\"; content:\"GET\"; "
329 "Classtype:unknown; sid:1;)");
int AlertFastLogger(ThreadVars *tv, void *data, const Packet *p)
void AlertFastLogRegisterTests(void)
This function registers unit tests for AlertFastLog API.
const struct Signature_ * s
OutputInitResult AlertFastLogInitCtx(ConfNode *conf)
Create a new LogFileCtx for "fast" output style.
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
void AlertFastLogRegister(void)
main detection engine ctx
void DetectEngineCtxFree(DetectEngineCtx *)
Free a DetectEngineCtx::
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
const char * known_proto[256]
Packet * UTHBuildPacket(uint8_t *payload, uint16_t payload_len, uint8_t ipproto)
UTHBuildPacket is a wrapper that build packets with default ip and port fields.
void SigMatchSignatures(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, Packet *p)
wrapper for old tests
struct Packet_::@29::@36 icmp_s
void SigCleanSignatures(DetectEngineCtx *de_ctx)
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet output module.
TmEcode AlertFastLogThreadInit(ThreadVars *, const void *, void **)
#define MAX_FASTLOG_BUFFER_SIZE
#define GET_IPV6_DST_ADDR(p)
#define DEFAULT_LOG_FILENAME
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
#define PASS
Pass the test.
#define GET_IPV4_DST_ADDR_PTR(p)
void PrintBufferRawLineHex(char *nbuf, int *offset, int max_size, const uint8_t *buf, uint32_t buflen)
print a buffer as hex on a single line
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Signature * SigInit(DetectEngineCtx *de_ctx, const char *sigstr)
Parses a signature and adds it to the Detection Engine Context.
int SigGroupCleanup(DetectEngineCtx *de_ctx)
int SigGroupBuild(DetectEngineCtx *de_ctx)
Convert the signature list into the runtime match structure.
#define MAX_FASTLOG_ALERT_SIZE
TmEcode DetectEngineThreadCtxInit(ThreadVars *, void *, void **)
initialize thread specific detection engine context
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
#define GET_IPV4_SRC_ADDR_PTR(p)
#define PrintBufferData(buf, buf_offset_ptr, buf_size,...)
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *, void *)
void(* DeInit)(struct OutputCtx_ *)
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
struct AlertFastLogThread_ AlertFastLogThread
#define GET_IPV6_SRC_ADDR(p)
DetectEngineCtx * DetectEngineCtxInit(void)
int EngineModeIsIPS(void)
FILE * SCClassConfGenerateValidDummyClassConfigFD01(void)
Creates a dummy classification file, with all valid Classtypes, for testing purposes.
bool SCClassConfLoadClassificationConfigFile(DetectEngineCtx *de_ctx, FILE *fd)
Loads the Classtype info from the classification.config file.
TmEcode AlertFastLogThreadDeinit(ThreadVars *, void *)
void CreateTimeString(const SCTime_t ts, char *str, size_t size)
void UTHFreePackets(Packet **p, int numpkts)
UTHFreePackets: function to release the allocated data from UTHBuildPacket and the packet itself.