suricata
alert-syslog.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
22  *
23  * Logs alerts in a line based text format in to syslog.
24  *
25  */
26 
27 #include "suricata-common.h"
28 #include "debug.h"
29 #include "flow.h"
30 #include "conf.h"
31 
32 #include "threads.h"
33 #include "tm-threads.h"
34 #include "threadvars.h"
35 
36 #include "detect.h"
37 #include "detect-parse.h"
38 #include "detect-engine.h"
39 #include "detect-engine-mpm.h"
40 #include "detect-reference.h"
41 
42 #include "output.h"
43 #include "alert-syslog.h"
44 
46 #include "util-debug.h"
47 #include "util-print.h"
48 #include "util-proto-name.h"
49 #include "util-syslog.h"
50 #include "util-optimize.h"
51 #include "util-logopenfile.h"
52 
53 #ifndef OS_WIN32
54 
55 #define DEFAULT_ALERT_SYSLOG_FACILITY_STR "local0"
56 #define DEFAULT_ALERT_SYSLOG_FACILITY LOG_LOCAL0
57 #define DEFAULT_ALERT_SYSLOG_LEVEL LOG_ERR
58 #define MODULE_NAME "AlertSyslog"
59 
60 static int alert_syslog_level = DEFAULT_ALERT_SYSLOG_LEVEL;
61 
62 typedef struct AlertSyslogThread_ {
63  /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
66 
67 /**
68  * \brief Function to clear the memory of the output context and closes the
69  * syslog interface
70  *
71  * \param output_ctx pointer to the output context to be cleared
72  */
73 static void AlertSyslogDeInitCtx(OutputCtx *output_ctx)
74 {
75  if (output_ctx != NULL) {
76  LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data;
77  if (logfile_ctx != NULL) {
78  LogFileFreeCtx(logfile_ctx);
79  }
80  SCFree(output_ctx);
81  }
82  closelog();
83 }
84 
85 /**
86  * \brief Create a new LogFileCtx for "syslog" output style.
87  *
88  * \param conf The configuration node for this output.
89  * \return A OutputCtx pointer on success, NULL on failure.
90  */
91 static OutputInitResult AlertSyslogInitCtx(ConfNode *conf)
92 {
93  OutputInitResult result = { NULL, false };
94  const char *facility_s = ConfNodeLookupChildValue(conf, "facility");
95  if (facility_s == NULL) {
97  }
98 
99  LogFileCtx *logfile_ctx = LogFileNewCtx();
100  if (logfile_ctx == NULL) {
101  SCLogDebug("AlertSyslogInitCtx: Could not create new LogFileCtx");
102  return result;
103  }
104 
105  int facility = SCMapEnumNameToValue(facility_s, SCSyslogGetFacilityMap());
106  if (facility == -1) {
107  SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Invalid syslog facility: \"%s\","
108  " now using \"%s\" as syslog facility", facility_s,
111  }
112 
113  const char *level_s = ConfNodeLookupChildValue(conf, "level");
114  if (level_s != NULL) {
115  int level = SCMapEnumNameToValue(level_s, SCSyslogGetLogLevelMap());
116  if (level != -1) {
117  alert_syslog_level = level;
118  }
119  }
120 
121  const char *ident = ConfNodeLookupChildValue(conf, "identity");
122  /* if null we just pass that to openlog, which will then
123  * figure it out by itself. */
124 
125  openlog(ident, LOG_PID|LOG_NDELAY, facility);
126 
127  OutputCtx *output_ctx = SCMalloc(sizeof(OutputCtx));
128  if (unlikely(output_ctx == NULL)) {
129  SCLogDebug("could not create new OutputCtx");
130  LogFileFreeCtx(logfile_ctx);
131  return result;
132  }
133  memset(output_ctx, 0x00, sizeof(OutputCtx));
134 
135  output_ctx->data = logfile_ctx;
136  output_ctx->DeInit = AlertSyslogDeInitCtx;
137 
138  SCLogInfo("Syslog output initialized");
139 
140  result.ctx = output_ctx;
141  result.ok = true;
142  return result;
143 }
144 
145 /**
146  * \brief Function to initialize the AlertSystlogThread and sets the output
147  * context pointer
148  *
149  * \param tv Pointer to the threadvars
150  * \param initdata Pointer to the output context
151  * \param data pointer to pointer to point to the AlertSyslogThread
152  */
153 static TmEcode AlertSyslogThreadInit(ThreadVars *t, const void *initdata, void **data)
154 {
155  if(initdata == NULL) {
156  SCLogDebug("Error getting context for AlertSyslog. \"initdata\" "
157  "argument NULL");
158  return TM_ECODE_FAILED;
159  }
160 
162  if (unlikely(ast == NULL))
163  return TM_ECODE_FAILED;
164 
165  memset(ast, 0, sizeof(AlertSyslogThread));
166 
167  /** Use the Ouptut Context (file pointer and mutex) */
168  ast->file_ctx = ((OutputCtx *)initdata)->data;
169 
170  *data = (void *)ast;
171  return TM_ECODE_OK;
172 }
173 
174 /**
175  * \brief Function to deinitialize the AlertSystlogThread
176  *
177  * \param tv Pointer to the threadvars
178  * \param data pointer to the AlertSyslogThread to be cleared
179  */
180 static TmEcode AlertSyslogThreadDeinit(ThreadVars *t, void *data)
181 {
182  AlertSyslogThread *ast = (AlertSyslogThread *)data;
183  if (ast == NULL) {
184  return TM_ECODE_OK;
185  }
186 
187  /* clear memory */
188  memset(ast, 0, sizeof(AlertSyslogThread));
189 
190  SCFree(ast);
191  return TM_ECODE_OK;
192 }
193 
194 /**
195  * \brief Function which is called to print the IPv4 alerts to the syslog
196  *
197  * \param tv Pointer to the threadvars
198  * \param p Pointer to the packet
199  * \param data pointer to the AlertSyslogThread
200  *
201  * \return On succes return TM_ECODE_OK
202  */
203 static TmEcode AlertSyslogIPv4(ThreadVars *tv, const Packet *p, void *data)
204 {
205  AlertSyslogThread *ast = (AlertSyslogThread *)data;
206  int i;
207  const char *action = "";
208 
209  if (p->alerts.cnt == 0)
210  return TM_ECODE_OK;
211 
212  char proto[16] = "";
213  char *protoptr;
215  protoptr = known_proto[IPV4_GET_IPPROTO(p)];
216  } else {
217  snprintf(proto, sizeof(proto), "PROTO:%03" PRIu32, IPV4_GET_IPPROTO(p));
218  protoptr = proto;
219  }
220 
221  /* Not sure if this mutex is needed around calls to syslog. */
222  SCMutexLock(&ast->file_ctx->fp_mutex);
223 
224  for (i = 0; i < p->alerts.cnt; i++) {
225  const PacketAlert *pa = &p->alerts.alerts[i];
226  if (unlikely(pa->s == NULL)) {
227  continue;
228  }
229 
230  char srcip[16], dstip[16];
231 
232  PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
233  PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
234 
235  if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) {
236  action = "[Drop] ";
237  } else if (pa->action & ACTION_DROP) {
238  action = "[wDrop] ";
239  }
240 
241  syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"
242  PRIu32 "] %s [Classification: %s] [Priority: %"PRIu32"]"
243  " {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "", action, pa->s->gid,
244  pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio,
245  protoptr, srcip, p->sp, dstip, p->dp);
246  }
248 
249  return TM_ECODE_OK;
250 }
251 
252 /**
253  * \brief Function which is called to print the IPv6 alerts to the syslog
254  *
255  * \param tv Pointer to the threadvars
256  * \param p Pointer to the packet
257  * \param data pointer to the AlertSyslogThread
258  *
259  * \return On succes return TM_ECODE_OK
260  */
261 static TmEcode AlertSyslogIPv6(ThreadVars *tv, const Packet *p, void *data)
262 {
263  AlertSyslogThread *ast = (AlertSyslogThread *)data;
264  int i;
265  const char *action = "";
266 
267  if (p->alerts.cnt == 0)
268  return TM_ECODE_OK;
269 
270  char proto[16] = "";
271  char *protoptr;
273  protoptr = known_proto[IPV6_GET_L4PROTO(p)];
274  } else {
275  snprintf(proto, sizeof(proto), "PROTO:03%" PRIu32, IPV6_GET_L4PROTO(p));
276  protoptr = proto;
277  }
278 
279  SCMutexLock(&ast->file_ctx->fp_mutex);
280 
281  for (i = 0; i < p->alerts.cnt; i++) {
282  const PacketAlert *pa = &p->alerts.alerts[i];
283  if (unlikely(pa->s == NULL)) {
284  continue;
285  }
286 
287  char srcip[46], dstip[46];
288 
289  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
290  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
291 
292  if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) {
293  action = "[Drop] ";
294  } else if (pa->action & ACTION_DROP) {
295  action = "[wDrop] ";
296  }
297 
298  syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"
299  "" PRIu32 "] %s [Classification: %s] [Priority: %"
300  "" PRIu32 "] {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "",
301  action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg,
302  pa->s->prio, protoptr, srcip, p->sp,
303  dstip, p->dp);
304 
305  }
307 
308  return TM_ECODE_OK;
309 }
310 
311 /**
312  * \brief Function which is called to print the decode alerts to the syslog
313  *
314  * \param tv Pointer to the threadvars
315  * \param p Pointer to the packet
316  * \param data pointer to the AlertSyslogThread
317  *
318  * \return On succes return TM_ECODE_OK
319  */
320 static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *data)
321 {
322  AlertSyslogThread *ast = (AlertSyslogThread *)data;
323  int i;
324  const char *action = "";
325 
326  if (p->alerts.cnt == 0)
327  return TM_ECODE_OK;
328 
329  SCMutexLock(&ast->file_ctx->fp_mutex);
330 
331  char temp_buf_hdr[512];
332  char temp_buf_pkt[65] = "";
333  char temp_buf_tail[32];
334  char alert[2048] = "";
335 
336  for (i = 0; i < p->alerts.cnt; i++) {
337  const PacketAlert *pa = &p->alerts.alerts[i];
338  if (unlikely(pa->s == NULL)) {
339  continue;
340  }
341 
342  if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) {
343  action = "[Drop] ";
344  } else if (pa->action & ACTION_DROP) {
345  action = "[wDrop] ";
346  }
347 
348  snprintf(temp_buf_hdr, sizeof(temp_buf_hdr), "%s[%" PRIu32 ":%" PRIu32
349  ":%" PRIu32 "] %s [Classification: %s] [Priority: %" PRIu32
350  "] [**] [Raw pkt: ", action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg,
351  pa->s->class_msg, pa->s->prio);
352  strlcpy(alert, temp_buf_hdr, sizeof(alert));
353 
354  PrintRawLineHexBuf(temp_buf_pkt, sizeof(temp_buf_pkt), GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32);
355  strlcat(alert, temp_buf_pkt, sizeof(alert));
356 
357  if (p->pcap_cnt != 0) {
358  snprintf(temp_buf_tail, sizeof(temp_buf_tail), "] [pcap file packet: %"PRIu64"]",
359  p->pcap_cnt);
360  } else {
361  temp_buf_tail[0] = ']';
362  temp_buf_tail[1] = '\0';
363  }
364  strlcat(alert, temp_buf_tail, sizeof(alert));
365 
366  syslog(alert_syslog_level, "%s", alert);
367  }
369 
370  return TM_ECODE_OK;
371 }
372 
373 static int AlertSyslogCondition(ThreadVars *tv, const Packet *p)
374 {
375  return (p->alerts.cnt > 0 ? TRUE : FALSE);
376 }
377 
378 static int AlertSyslogLogger(ThreadVars *tv, void *thread_data, const Packet *p)
379 {
380  if (PKT_IS_IPV4(p)) {
381  return AlertSyslogIPv4(tv, p, thread_data);
382  } else if (PKT_IS_IPV6(p)) {
383  return AlertSyslogIPv6(tv, p, thread_data);
384  } else if (p->events.cnt > 0) {
385  return AlertSyslogDecoderEvent(tv, p, thread_data);
386  }
387 
388  return TM_ECODE_OK;
389 }
390 
391 #endif /* !OS_WIN32 */
392 
393 /** \brief Function to register the AlertSyslog module */
395 {
396 #ifndef OS_WIN32
398  AlertSyslogInitCtx, AlertSyslogLogger, AlertSyslogCondition,
399  AlertSyslogThreadInit, AlertSyslogThreadDeinit, NULL);
400 #endif /* !OS_WIN32 */
401 }
tm-threads.h
detect-engine.h
PacketAlert_::s
const struct Signature_ * s
Definition: decode.h:279
syslog
#define syslog(__pri, __fmt, __param)
Definition: win32-syslog.h:78
PKT_IS_IPV6
#define PKT_IS_IPV6(p)
Definition: decode.h:258
LogFileCtx_::fp_mutex
SCMutex fp_mutex
Definition: util-logopenfile.h:85
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
LOGGER_ALERT_SYSLOG
@ LOGGER_ALERT_SYSLOG
Definition: suricata-common.h:476
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:640
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:570
PacketAlerts_::alerts
PacketAlert alerts[PACKET_ALERT_MAX]
Definition: decode.h:300
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:299
threads.h
util-syslog.h
LogFileCtx_
Definition: util-logopenfile.h:60
SCProtoNameValid
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
Definition: util-proto-name.c:98
AlertSyslogRegister
void AlertSyslogRegister(void)
Function to register the AlertSyslog module.
Definition: alert-syslog.c:394
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:93
proto
uint8_t proto
Definition: decode-template.h:0
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:226
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:564
alert-syslog.h
Packet_::events
PacketEngineEvents events
Definition: decode.h:574
OutputCtx_::data
void * data
Definition: tm-modules.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
closelog
#define closelog()
Definition: win32-syslog.h:75
OutputCtx_
Definition: tm-modules.h:78
PacketAlert_::action
uint8_t action
Definition: decode.h:277
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
detect-reference.h
Signature_::gid
uint32_t gid
Definition: detect.h:562
IPV4_GET_IPPROTO
#define IPV4_GET_IPPROTO(p)
Definition: decode-ipv4.h:148
util-debug.h
GET_IPV4_DST_ADDR_PTR
#define GET_IPV4_DST_ADDR_PTR(p)
Definition: decode.h:221
DEFAULT_ALERT_SYSLOG_LEVEL
#define DEFAULT_ALERT_SYSLOG_LEVEL
Definition: alert-syslog.c:57
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:44
strlcat
size_t strlcat(char *, const char *src, size_t siz)
Definition: util-strlcatu.c:45
SCSyslogGetFacilityMap
SCEnumCharMap * SCSyslogGetFacilityMap(void)
returns the syslog facility enum map
Definition: util-syslog.c:57
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
util-print.h
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:231
detect-engine-mpm.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:271
Packet_::sp
Port sp
Definition: decode.h:421
DEFAULT_ALERT_SYSLOG_FACILITY_STR
#define DEFAULT_ALERT_SYSLOG_FACILITY_STR
Definition: alert-syslog.c:55
OutputInitResult_::ok
bool ok
Definition: output.h:45
SC_ERR_INVALID_ARGUMENT
@ SC_ERR_INVALID_ARGUMENT
Definition: util-error.h:43
TRUE
#define TRUE
Definition: suricata-common.h:33
FALSE
#define FALSE
Definition: suricata-common.h:34
Packet_
Definition: decode.h:414
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:230
conf.h
TmEcode
TmEcode
Definition: tm-threads-common.h:79
SCSyslogGetLogLevelMap
SCEnumCharMap * SCSyslogGetLogLevelMap(void)
returns the syslog facility enum map
Definition: util-syslog.c:75
util-proto-name.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
Signature_::class_msg
char * class_msg
Definition: detect.h:589
OutputInitResult_
Definition: output.h:43
GET_IPV4_SRC_ADDR_PTR
#define GET_IPV4_SRC_ADDR_PTR(p)
Definition: decode.h:220
SCMapEnumNameToValue
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
Definition: util-enum.c:40
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
Signature_::rev
uint32_t rev
Definition: detect.h:563
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:813
util-classification-config.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
Signature_::prio
int prio
Definition: detect.h:564
util-optimize.h
OutputRegisterPacketModule
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output module.
Definition: output.c:174
threadvars.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
AlertSyslogThread_
Definition: alert-syslog.c:62
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:225
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
util-logopenfile.h
Signature_::id
uint32_t id
Definition: detect.h:561
detect-parse.h
AlertSyslogThread_::file_ctx
LogFileCtx * file_ctx
Definition: alert-syslog.c:64
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:244
PacketAlert_
Definition: decode.h:275
known_proto
char * known_proto[256]
Definition: util-proto-name.c:33
MODULE_NAME
#define MODULE_NAME
Definition: alert-syslog.c:58
AlertSyslogThread
struct AlertSyslogThread_ AlertSyslogThread
DEFAULT_ALERT_SYSLOG_FACILITY
#define DEFAULT_ALERT_SYSLOG_FACILITY
Definition: alert-syslog.c:56
Signature_::msg
char * msg
Definition: detect.h:586
flow.h
openlog
#define openlog(__ident, __option, __facility)
Definition: win32-syslog.h:76
Packet_::dp
Port dp
Definition: decode.h:429
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:257
PrintRawLineHexBuf
void PrintRawLineHexBuf(char *retbuf, uint32_t retbuflen, const uint8_t *buf, uint32_t buflen)
print a buffer as hex on a single line in to retbuf buffer
Definition: util-print.c:61
debug.h
output.h
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:312
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:842