suricata
alert-syslog.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
22  *
23  * Logs alerts in a line based text format into syslog.
24  *
25  */
26 
27 #include "suricata-common.h"
28 #include "flow.h"
29 #include "conf.h"
30 
31 #include "threads.h"
32 #include "tm-threads.h"
33 #include "threadvars.h"
34 
35 #include "detect.h"
36 #include "detect-parse.h"
37 #include "detect-engine.h"
38 #include "detect-engine-mpm.h"
39 #include "detect-reference.h"
40 
41 #include "output.h"
42 #include "alert-syslog.h"
43 
45 #include "util-debug.h"
46 #include "util-print.h"
47 #include "util-proto-name.h"
48 #include "util-syslog.h"
49 #include "util-optimize.h"
50 #include "util-logopenfile.h"
51 #include "action-globals.h"
52 
53 #ifndef OS_WIN32
54 
55 #define MODULE_NAME "AlertSyslog"
56 
57 static int alert_syslog_level = DEFAULT_ALERT_SYSLOG_LEVEL;
58 
59 typedef struct AlertSyslogThread_ {
60  /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
63 
64 /**
65  * \brief Function to clear the memory of the output context and closes the
66  * syslog interface
67  *
68  * \param output_ctx pointer to the output context to be cleared
69  */
70 static void AlertSyslogDeInitCtx(OutputCtx *output_ctx)
71 {
72  if (output_ctx != NULL) {
73  LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data;
74  if (logfile_ctx != NULL) {
75  LogFileFreeCtx(logfile_ctx);
76  }
77  SCFree(output_ctx);
78  }
79  closelog();
80 }
81 
82 /**
83  * \brief Create a new LogFileCtx for "syslog" output style.
84  *
85  * \param conf The configuration node for this output.
86  * \return A OutputCtx pointer on success, NULL on failure.
87  */
88 static OutputInitResult AlertSyslogInitCtx(ConfNode *conf)
89 {
90  OutputInitResult result = { NULL, false };
91  const char *facility_s = ConfNodeLookupChildValue(conf, "facility");
92  if (facility_s == NULL) {
94  }
95 
96  LogFileCtx *logfile_ctx = LogFileNewCtx();
97  if (logfile_ctx == NULL) {
98  SCLogDebug("AlertSyslogInitCtx: Could not create new LogFileCtx");
99  return result;
100  }
101 
102  int facility = SCMapEnumNameToValue(facility_s, SCSyslogGetFacilityMap());
103  if (facility == -1) {
104  SCLogWarning("Invalid syslog facility: \"%s\","
105  " now using \"%s\" as syslog facility",
108  }
109 
110  const char *level_s = ConfNodeLookupChildValue(conf, "level");
111  if (level_s != NULL) {
112  int level = SCMapEnumNameToValue(level_s, SCSyslogGetLogLevelMap());
113  if (level != -1) {
114  alert_syslog_level = level;
115  }
116  }
117 
118  const char *ident = ConfNodeLookupChildValue(conf, "identity");
119  /* if null we just pass that to openlog, which will then
120  * figure it out by itself. */
121 
122  openlog(ident, LOG_PID|LOG_NDELAY, facility);
123 
124  OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
125  if (unlikely(output_ctx == NULL)) {
126  SCLogDebug("could not create new OutputCtx");
127  LogFileFreeCtx(logfile_ctx);
128  return result;
129  }
130 
131  output_ctx->data = logfile_ctx;
132  output_ctx->DeInit = AlertSyslogDeInitCtx;
133 
134  SCLogInfo("Syslog output initialized");
135 
136  result.ctx = output_ctx;
137  result.ok = true;
138  return result;
139 }
140 
141 /**
142  * \brief Function to initialize the AlertSyslogThread and sets the output
143  * context pointer
144  *
145  * \param tv Pointer to the threadvars
146  * \param initdata Pointer to the output context
147  * \param data pointer to pointer to point to the AlertSyslogThread
148  */
149 static TmEcode AlertSyslogThreadInit(ThreadVars *t, const void *initdata, void **data)
150 {
151  if(initdata == NULL) {
152  SCLogDebug("Error getting context for AlertSyslog. \"initdata\" "
153  "argument NULL");
154  return TM_ECODE_FAILED;
155  }
156 
157  AlertSyslogThread *ast = SCCalloc(1, sizeof(AlertSyslogThread));
158  if (unlikely(ast == NULL))
159  return TM_ECODE_FAILED;
160 
161  /** Use the Output Context (file pointer and mutex) */
162  ast->file_ctx = ((OutputCtx *)initdata)->data;
163 
164  *data = (void *)ast;
165  return TM_ECODE_OK;
166 }
167 
168 /**
169  * \brief Function to deinitialize the AlertSyslogThread
170  *
171  * \param tv Pointer to the threadvars
172  * \param data pointer to the AlertSyslogThread to be cleared
173  */
174 static TmEcode AlertSyslogThreadDeinit(ThreadVars *t, void *data)
175 {
176  AlertSyslogThread *ast = (AlertSyslogThread *)data;
177  if (ast == NULL) {
178  return TM_ECODE_OK;
179  }
180 
181  /* clear memory */
182  memset(ast, 0, sizeof(AlertSyslogThread));
183 
184  SCFree(ast);
185  return TM_ECODE_OK;
186 }
187 
188 /**
189  * \brief Function which is called to print the IPv4 alerts to the syslog
190  *
191  * \param tv Pointer to the threadvars
192  * \param p Pointer to the packet
193  * \param data pointer to the AlertSyslogThread
194  *
195  * \return On succes return TM_ECODE_OK
196  */
197 static TmEcode AlertSyslogIPv4(ThreadVars *tv, const Packet *p, void *data)
198 {
199  AlertSyslogThread *ast = (AlertSyslogThread *)data;
200  const char *action = "";
201 
202  if (p->alerts.cnt == 0)
203  return TM_ECODE_OK;
204 
205  char proto[16] = "";
206  const char *protoptr;
207  const IPV4Hdr *ipv4h = PacketGetIPv4(p);
208  const uint8_t ipproto = IPV4_GET_RAW_IPPROTO(ipv4h);
209  if (SCProtoNameValid(ipproto)) {
210  protoptr = known_proto[ipproto];
211  } else {
212  snprintf(proto, sizeof(proto), "PROTO:%03" PRIu8, ipproto);
213  protoptr = proto;
214  }
215 
216  char srcip[16], dstip[16];
217  PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
218  PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
219 
220  for (int i = 0; i < p->alerts.cnt; i++) {
221  const PacketAlert *pa = &p->alerts.alerts[i];
222  if (unlikely(pa->s == NULL)) {
223  continue;
224  }
225 
226  if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) {
227  action = "[Drop] ";
228  } else if (pa->action & ACTION_DROP) {
229  action = "[wDrop] ";
230  }
231 
232  /* Not sure if this mutex is needed around calls to syslog. */
233  SCMutexLock(&ast->file_ctx->fp_mutex);
234  syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"
235  PRIu32 "] %s [Classification: %s] [Priority: %"PRIu32"]"
236  " {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "", action, pa->s->gid,
237  pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio,
238  protoptr, srcip, p->sp, dstip, p->dp);
240  }
241 
242  return TM_ECODE_OK;
243 }
244 
245 /**
246  * \brief Function which is called to print the IPv6 alerts to the syslog
247  *
248  * \param tv Pointer to the threadvars
249  * \param p Pointer to the packet
250  * \param data pointer to the AlertSyslogThread
251  *
252  * \return On succes return TM_ECODE_OK
253  */
254 static TmEcode AlertSyslogIPv6(ThreadVars *tv, const Packet *p, void *data)
255 {
256  AlertSyslogThread *ast = (AlertSyslogThread *)data;
257  const char *action = "";
258 
259  if (p->alerts.cnt == 0)
260  return TM_ECODE_OK;
261 
262  char proto[16] = "";
263  const char *protoptr;
264  const uint8_t ipproto = IPV6_GET_L4PROTO(p);
265  if (SCProtoNameValid(ipproto)) {
266  protoptr = known_proto[ipproto];
267  } else {
268  snprintf(proto, sizeof(proto), "PROTO:03%" PRIu8, ipproto);
269  protoptr = proto;
270  }
271 
272  char srcip[46], dstip[46];
273  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
274  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
275 
276  for (int i = 0; i < p->alerts.cnt; i++) {
277  const PacketAlert *pa = &p->alerts.alerts[i];
278  if (unlikely(pa->s == NULL)) {
279  continue;
280  }
281 
282  if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) {
283  action = "[Drop] ";
284  } else if (pa->action & ACTION_DROP) {
285  action = "[wDrop] ";
286  }
287 
288  SCMutexLock(&ast->file_ctx->fp_mutex);
289  syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"
290  "" PRIu32 "] %s [Classification: %s] [Priority: %"
291  "" PRIu32 "] {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "",
292  action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg,
293  pa->s->prio, protoptr, srcip, p->sp,
294  dstip, p->dp);
296  }
297 
298  return TM_ECODE_OK;
299 }
300 
301 /**
302  * \brief Function which is called to print the decode alerts to the syslog
303  *
304  * \param tv Pointer to the threadvars
305  * \param p Pointer to the packet
306  * \param data pointer to the AlertSyslogThread
307  *
308  * \return On succes return TM_ECODE_OK
309  */
310 static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *data)
311 {
312  AlertSyslogThread *ast = (AlertSyslogThread *)data;
313  const char *action = "";
314 
315  if (p->alerts.cnt == 0)
316  return TM_ECODE_OK;
317 
318  char temp_buf_hdr[512];
319  char temp_buf_pkt[65] = "";
320  char temp_buf_tail[64];
321  char alert[2048] = "";
322 
323  for (int i = 0; i < p->alerts.cnt; i++) {
324  const PacketAlert *pa = &p->alerts.alerts[i];
325  if (unlikely(pa->s == NULL)) {
326  continue;
327  }
328 
329  if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) {
330  action = "[Drop] ";
331  } else if (pa->action & ACTION_DROP) {
332  action = "[wDrop] ";
333  }
334 
335  snprintf(temp_buf_hdr, sizeof(temp_buf_hdr), "%s[%" PRIu32 ":%" PRIu32
336  ":%" PRIu32 "] %s [Classification: %s] [Priority: %" PRIu32
337  "] [**] [Raw pkt: ", action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg,
338  pa->s->class_msg, pa->s->prio);
339  strlcpy(alert, temp_buf_hdr, sizeof(alert));
340 
341  PrintRawLineHexBuf(temp_buf_pkt, sizeof(temp_buf_pkt), GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32);
342  strlcat(alert, temp_buf_pkt, sizeof(alert));
343 
344  if (p->pcap_cnt != 0) {
345  snprintf(temp_buf_tail, sizeof(temp_buf_tail), "] [pcap file packet: %"PRIu64"]",
346  p->pcap_cnt);
347  } else {
348  temp_buf_tail[0] = ']';
349  temp_buf_tail[1] = '\0';
350  }
351  strlcat(alert, temp_buf_tail, sizeof(alert));
352 
353  SCMutexLock(&ast->file_ctx->fp_mutex);
354  syslog(alert_syslog_level, "%s", alert);
356  }
357 
358  return TM_ECODE_OK;
359 }
360 
361 static bool AlertSyslogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
362 {
363  return (p->alerts.cnt > 0);
364 }
365 
366 static int AlertSyslogLogger(ThreadVars *tv, void *thread_data, const Packet *p)
367 {
368  if (PacketIsIPv4(p)) {
369  return AlertSyslogIPv4(tv, p, thread_data);
370  } else if (PacketIsIPv6(p)) {
371  return AlertSyslogIPv6(tv, p, thread_data);
372  } else if (p->events.cnt > 0) {
373  return AlertSyslogDecoderEvent(tv, p, thread_data);
374  }
375 
376  return TM_ECODE_OK;
377 }
378 
379 #endif /* !OS_WIN32 */
380 
381 /** \brief Function to register the AlertSyslog module */
383 {
384 #ifndef OS_WIN32
386  AlertSyslogInitCtx, AlertSyslogLogger, AlertSyslogCondition,
387  AlertSyslogThreadInit, AlertSyslogThreadDeinit, NULL);
388 #endif /* !OS_WIN32 */
389 }
tm-threads.h
detect-engine.h
PacketAlert_::s
const struct Signature_ * s
Definition: decode.h:252
syslog
#define syslog(__pri, __fmt, __param)
Definition: win32-syslog.h:78
IPV4_GET_RAW_IPPROTO
#define IPV4_GET_RAW_IPPROTO(ip4h)
Definition: decode-ipv4.h:103
LogFileCtx_::fp_mutex
SCMutex fp_mutex
Definition: util-logopenfile.h:98
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
LOGGER_ALERT_SYSLOG
@ LOGGER_ALERT_SYSLOG
Definition: suricata-common.h:478
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:659
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:618
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:274
action-globals.h
threads.h
util-syslog.h
LogFileCtx_
Definition: util-logopenfile.h:76
PacketAlerts_::alerts
PacketAlert * alerts
Definition: decode.h:277
SCProtoNameValid
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
Definition: util-proto-name.c:454
AlertSyslogRegister
void AlertSyslogRegister(void)
Function to register the AlertSyslog module.
Definition: alert-syslog.c:382
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:75
known_proto
const char * known_proto[256]
Definition: util-proto-name.c:40
proto
uint8_t proto
Definition: decode-template.h:0
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:209
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:612
alert-syslog.h
Packet_::events
PacketEngineEvents events
Definition: decode.h:622
OutputCtx_::data
void * data
Definition: tm-modules.h:88
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
closelog
#define closelog()
Definition: win32-syslog.h:75
OutputCtx_
Definition: tm-modules.h:85
DEFAULT_ALERT_SYSLOG_FACILITY
#define DEFAULT_ALERT_SYSLOG_FACILITY
Definition: util-syslog.h:35
PacketAlert_::action
uint8_t action
Definition: decode.h:250
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
detect-reference.h
Signature_::gid
uint32_t gid
Definition: detect.h:632
DEFAULT_ALERT_SYSLOG_LEVEL
#define DEFAULT_ALERT_SYSLOG_LEVEL
Definition: util-syslog.h:36
util-debug.h
GET_IPV4_DST_ADDR_PTR
#define GET_IPV4_DST_ADDR_PTR(p)
Definition: decode.h:204
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:47
strlcat
size_t strlcat(char *, const char *src, size_t siz)
Definition: util-strlcatu.c:45
SCSyslogGetFacilityMap
SCEnumCharMap * SCSyslogGetFacilityMap(void)
returns the syslog facility enum map
Definition: util-syslog.c:57
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
DEFAULT_ALERT_SYSLOG_FACILITY_STR
#define DEFAULT_ALERT_SYSLOG_FACILITY_STR
Definition: util-syslog.h:34
util-print.h
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:214
detect-engine-mpm.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:241
Packet_::sp
Port sp
Definition: decode.h:498
OutputInitResult_::ok
bool ok
Definition: output.h:48
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
Packet_
Definition: decode.h:491
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:213
conf.h
TmEcode
TmEcode
Definition: tm-threads-common.h:83
SCSyslogGetLogLevelMap
SCEnumCharMap * SCSyslogGetLogLevelMap(void)
returns the syslog facility enum map
Definition: util-syslog.c:75
util-proto-name.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
Signature_::class_msg
char * class_msg
Definition: detect.h:657
IPV4Hdr_
Definition: decode-ipv4.h:72
OutputInitResult_
Definition: output.h:46
GET_IPV4_SRC_ADDR_PTR
#define GET_IPV4_SRC_ADDR_PTR(p)
Definition: decode.h:203
SCMapEnumNameToValue
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
Definition: util-enum.c:40
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:91
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
Signature_::rev
uint32_t rev
Definition: detect.h:633
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:868
util-classification-config.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
Signature_::prio
int prio
Definition: detect.h:634
util-optimize.h
OutputRegisterPacketModule
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output module.
Definition: output.c:170
threadvars.h
AlertSyslogThread_
Definition: alert-syslog.c:59
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:208
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
util-logopenfile.h
Signature_::id
uint32_t id
Definition: detect.h:631
detect-parse.h
AlertSyslogThread_::file_ctx
LogFileCtx * file_ctx
Definition: alert-syslog.c:61
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:231
PacketAlert_
Definition: decode.h:248
MODULE_NAME
#define MODULE_NAME
Definition: alert-syslog.c:55
AlertSyslogThread
struct AlertSyslogThread_ AlertSyslogThread
Signature_::msg
char * msg
Definition: detect.h:654
flow.h
openlog
#define openlog(__ident, __option, __facility)
Definition: win32-syslog.h:76
Packet_::dp
Port dp
Definition: decode.h:506
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
PrintRawLineHexBuf
void PrintRawLineHexBuf(char *retbuf, uint32_t retbuflen, const uint8_t *buf, uint32_t buflen)
print a buffer as hex on a single line into retbuf buffer
Definition: util-print.c:61
output.h
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:293
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:814