suricata
alert-syslog.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
22  *
23  * Logs alerts in a line based text format in to syslog.
24  *
25  */
26 
27 #include "suricata-common.h"
28 #include "debug.h"
29 #include "flow.h"
30 #include "conf.h"
31 
32 #include "threads.h"
33 #include "tm-threads.h"
34 #include "threadvars.h"
35 
36 #include "detect.h"
37 #include "detect-parse.h"
38 #include "detect-engine.h"
39 #include "detect-engine-mpm.h"
40 #include "detect-reference.h"
41 
42 #include "output.h"
43 #include "alert-syslog.h"
44 
46 #include "util-debug.h"
47 #include "util-print.h"
48 #include "util-proto-name.h"
49 #include "util-syslog.h"
50 #include "util-optimize.h"
51 #include "util-logopenfile.h"
52 
53 #ifndef OS_WIN32
54 
55 #define MODULE_NAME "AlertSyslog"
56 
57 static int alert_syslog_level = DEFAULT_ALERT_SYSLOG_LEVEL;
58 
59 typedef struct AlertSyslogThread_ {
60  /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
63 
64 /**
65  * \brief Function to clear the memory of the output context and closes the
66  * syslog interface
67  *
68  * \param output_ctx pointer to the output context to be cleared
69  */
70 static void AlertSyslogDeInitCtx(OutputCtx *output_ctx)
71 {
72  if (output_ctx != NULL) {
73  LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data;
74  if (logfile_ctx != NULL) {
75  LogFileFreeCtx(logfile_ctx);
76  }
77  SCFree(output_ctx);
78  }
79  closelog();
80 }
81 
82 /**
83  * \brief Create a new LogFileCtx for "syslog" output style.
84  *
85  * \param conf The configuration node for this output.
86  * \return A OutputCtx pointer on success, NULL on failure.
87  */
88 static OutputInitResult AlertSyslogInitCtx(ConfNode *conf)
89 {
90  OutputInitResult result = { NULL, false };
91  const char *facility_s = ConfNodeLookupChildValue(conf, "facility");
92  if (facility_s == NULL) {
94  }
95 
96  LogFileCtx *logfile_ctx = LogFileNewCtx();
97  if (logfile_ctx == NULL) {
98  SCLogDebug("AlertSyslogInitCtx: Could not create new LogFileCtx");
99  return result;
100  }
101 
102  int facility = SCMapEnumNameToValue(facility_s, SCSyslogGetFacilityMap());
103  if (facility == -1) {
104  SCLogWarning(SC_ERR_INVALID_ARGUMENT, "Invalid syslog facility: \"%s\","
105  " now using \"%s\" as syslog facility", facility_s,
108  }
109 
110  const char *level_s = ConfNodeLookupChildValue(conf, "level");
111  if (level_s != NULL) {
112  int level = SCMapEnumNameToValue(level_s, SCSyslogGetLogLevelMap());
113  if (level != -1) {
114  alert_syslog_level = level;
115  }
116  }
117 
118  const char *ident = ConfNodeLookupChildValue(conf, "identity");
119  /* if null we just pass that to openlog, which will then
120  * figure it out by itself. */
121 
122  openlog(ident, LOG_PID|LOG_NDELAY, facility);
123 
124  OutputCtx *output_ctx = SCMalloc(sizeof(OutputCtx));
125  if (unlikely(output_ctx == NULL)) {
126  SCLogDebug("could not create new OutputCtx");
127  LogFileFreeCtx(logfile_ctx);
128  return result;
129  }
130  memset(output_ctx, 0x00, sizeof(OutputCtx));
131 
132  output_ctx->data = logfile_ctx;
133  output_ctx->DeInit = AlertSyslogDeInitCtx;
134 
135  SCLogInfo("Syslog output initialized");
136 
137  result.ctx = output_ctx;
138  result.ok = true;
139  return result;
140 }
141 
142 /**
143  * \brief Function to initialize the AlertSystlogThread and sets the output
144  * context pointer
145  *
146  * \param tv Pointer to the threadvars
147  * \param initdata Pointer to the output context
148  * \param data pointer to pointer to point to the AlertSyslogThread
149  */
150 static TmEcode AlertSyslogThreadInit(ThreadVars *t, const void *initdata, void **data)
151 {
152  if(initdata == NULL) {
153  SCLogDebug("Error getting context for AlertSyslog. \"initdata\" "
154  "argument NULL");
155  return TM_ECODE_FAILED;
156  }
157 
159  if (unlikely(ast == NULL))
160  return TM_ECODE_FAILED;
161 
162  memset(ast, 0, sizeof(AlertSyslogThread));
163 
164  /** Use the Ouptut Context (file pointer and mutex) */
165  ast->file_ctx = ((OutputCtx *)initdata)->data;
166 
167  *data = (void *)ast;
168  return TM_ECODE_OK;
169 }
170 
171 /**
172  * \brief Function to deinitialize the AlertSystlogThread
173  *
174  * \param tv Pointer to the threadvars
175  * \param data pointer to the AlertSyslogThread to be cleared
176  */
177 static TmEcode AlertSyslogThreadDeinit(ThreadVars *t, void *data)
178 {
179  AlertSyslogThread *ast = (AlertSyslogThread *)data;
180  if (ast == NULL) {
181  return TM_ECODE_OK;
182  }
183 
184  /* clear memory */
185  memset(ast, 0, sizeof(AlertSyslogThread));
186 
187  SCFree(ast);
188  return TM_ECODE_OK;
189 }
190 
191 /**
192  * \brief Function which is called to print the IPv4 alerts to the syslog
193  *
194  * \param tv Pointer to the threadvars
195  * \param p Pointer to the packet
196  * \param data pointer to the AlertSyslogThread
197  *
198  * \return On succes return TM_ECODE_OK
199  */
200 static TmEcode AlertSyslogIPv4(ThreadVars *tv, const Packet *p, void *data)
201 {
202  AlertSyslogThread *ast = (AlertSyslogThread *)data;
203  int i;
204  const char *action = "";
205 
206  if (p->alerts.cnt == 0)
207  return TM_ECODE_OK;
208 
209  char proto[16] = "";
210  const char *protoptr;
212  protoptr = known_proto[IPV4_GET_IPPROTO(p)];
213  } else {
214  snprintf(proto, sizeof(proto), "PROTO:%03" PRIu32, IPV4_GET_IPPROTO(p));
215  protoptr = proto;
216  }
217 
218  /* Not sure if this mutex is needed around calls to syslog. */
219  SCMutexLock(&ast->file_ctx->fp_mutex);
220 
221  for (i = 0; i < p->alerts.cnt; i++) {
222  const PacketAlert *pa = &p->alerts.alerts[i];
223  if (unlikely(pa->s == NULL)) {
224  continue;
225  }
226 
227  char srcip[16], dstip[16];
228 
229  PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
230  PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
231 
232  if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) {
233  action = "[Drop] ";
234  } else if (pa->action & ACTION_DROP) {
235  action = "[wDrop] ";
236  }
237 
238  syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"
239  PRIu32 "] %s [Classification: %s] [Priority: %"PRIu32"]"
240  " {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "", action, pa->s->gid,
241  pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio,
242  protoptr, srcip, p->sp, dstip, p->dp);
243  }
245 
246  return TM_ECODE_OK;
247 }
248 
249 /**
250  * \brief Function which is called to print the IPv6 alerts to the syslog
251  *
252  * \param tv Pointer to the threadvars
253  * \param p Pointer to the packet
254  * \param data pointer to the AlertSyslogThread
255  *
256  * \return On succes return TM_ECODE_OK
257  */
258 static TmEcode AlertSyslogIPv6(ThreadVars *tv, const Packet *p, void *data)
259 {
260  AlertSyslogThread *ast = (AlertSyslogThread *)data;
261  int i;
262  const char *action = "";
263 
264  if (p->alerts.cnt == 0)
265  return TM_ECODE_OK;
266 
267  char proto[16] = "";
268  const char *protoptr;
270  protoptr = known_proto[IPV6_GET_L4PROTO(p)];
271  } else {
272  snprintf(proto, sizeof(proto), "PROTO:03%" PRIu32, IPV6_GET_L4PROTO(p));
273  protoptr = proto;
274  }
275 
276  SCMutexLock(&ast->file_ctx->fp_mutex);
277 
278  for (i = 0; i < p->alerts.cnt; i++) {
279  const PacketAlert *pa = &p->alerts.alerts[i];
280  if (unlikely(pa->s == NULL)) {
281  continue;
282  }
283 
284  char srcip[46], dstip[46];
285 
286  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
287  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
288 
289  if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) {
290  action = "[Drop] ";
291  } else if (pa->action & ACTION_DROP) {
292  action = "[wDrop] ";
293  }
294 
295  syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"
296  "" PRIu32 "] %s [Classification: %s] [Priority: %"
297  "" PRIu32 "] {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "",
298  action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg,
299  pa->s->prio, protoptr, srcip, p->sp,
300  dstip, p->dp);
301 
302  }
304 
305  return TM_ECODE_OK;
306 }
307 
308 /**
309  * \brief Function which is called to print the decode alerts to the syslog
310  *
311  * \param tv Pointer to the threadvars
312  * \param p Pointer to the packet
313  * \param data pointer to the AlertSyslogThread
314  *
315  * \return On succes return TM_ECODE_OK
316  */
317 static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *data)
318 {
319  AlertSyslogThread *ast = (AlertSyslogThread *)data;
320  int i;
321  const char *action = "";
322 
323  if (p->alerts.cnt == 0)
324  return TM_ECODE_OK;
325 
326  SCMutexLock(&ast->file_ctx->fp_mutex);
327 
328  char temp_buf_hdr[512];
329  char temp_buf_pkt[65] = "";
330  char temp_buf_tail[64];
331  char alert[2048] = "";
332 
333  for (i = 0; i < p->alerts.cnt; i++) {
334  const PacketAlert *pa = &p->alerts.alerts[i];
335  if (unlikely(pa->s == NULL)) {
336  continue;
337  }
338 
339  if ((pa->action & ACTION_DROP) && EngineModeIsIPS()) {
340  action = "[Drop] ";
341  } else if (pa->action & ACTION_DROP) {
342  action = "[wDrop] ";
343  }
344 
345  snprintf(temp_buf_hdr, sizeof(temp_buf_hdr), "%s[%" PRIu32 ":%" PRIu32
346  ":%" PRIu32 "] %s [Classification: %s] [Priority: %" PRIu32
347  "] [**] [Raw pkt: ", action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg,
348  pa->s->class_msg, pa->s->prio);
349  strlcpy(alert, temp_buf_hdr, sizeof(alert));
350 
351  PrintRawLineHexBuf(temp_buf_pkt, sizeof(temp_buf_pkt), GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32);
352  strlcat(alert, temp_buf_pkt, sizeof(alert));
353 
354  if (p->pcap_cnt != 0) {
355  snprintf(temp_buf_tail, sizeof(temp_buf_tail), "] [pcap file packet: %"PRIu64"]",
356  p->pcap_cnt);
357  } else {
358  temp_buf_tail[0] = ']';
359  temp_buf_tail[1] = '\0';
360  }
361  strlcat(alert, temp_buf_tail, sizeof(alert));
362 
363  syslog(alert_syslog_level, "%s", alert);
364  }
366 
367  return TM_ECODE_OK;
368 }
369 
370 static int AlertSyslogCondition(ThreadVars *tv, const Packet *p)
371 {
372  return (p->alerts.cnt > 0 ? TRUE : FALSE);
373 }
374 
375 static int AlertSyslogLogger(ThreadVars *tv, void *thread_data, const Packet *p)
376 {
377  if (PKT_IS_IPV4(p)) {
378  return AlertSyslogIPv4(tv, p, thread_data);
379  } else if (PKT_IS_IPV6(p)) {
380  return AlertSyslogIPv6(tv, p, thread_data);
381  } else if (p->events.cnt > 0) {
382  return AlertSyslogDecoderEvent(tv, p, thread_data);
383  }
384 
385  return TM_ECODE_OK;
386 }
387 
388 #endif /* !OS_WIN32 */
389 
390 /** \brief Function to register the AlertSyslog module */
392 {
393 #ifndef OS_WIN32
395  AlertSyslogInitCtx, AlertSyslogLogger, AlertSyslogCondition,
396  AlertSyslogThreadInit, AlertSyslogThreadDeinit, NULL);
397 #endif /* !OS_WIN32 */
398 }
tm-threads.h
detect-engine.h
PacketAlert_::s
const struct Signature_ * s
Definition: decode.h:281
syslog
#define syslog(__pri, __fmt, __param)
Definition: win32-syslog.h:78
PKT_IS_IPV6
#define PKT_IS_IPV6(p)
Definition: decode.h:260
LogFileCtx_::fp_mutex
SCMutex fp_mutex
Definition: util-logopenfile.h:87
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
LOGGER_ALERT_SYSLOG
@ LOGGER_ALERT_SYSLOG
Definition: suricata-common.h:475
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:637
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:572
PacketAlerts_::alerts
PacketAlert alerts[PACKET_ALERT_MAX]
Definition: decode.h:300
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:299
threads.h
util-syslog.h
LogFileCtx_
Definition: util-logopenfile.h:64
SCProtoNameValid
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
Definition: util-proto-name.c:195
AlertSyslogRegister
void AlertSyslogRegister(void)
Function to register the AlertSyslog module.
Definition: alert-syslog.c:391
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:93
known_proto
const char * known_proto[256]
Definition: util-proto-name.c:34
proto
uint8_t proto
Definition: decode-template.h:0
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:228
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:566
alert-syslog.h
Packet_::events
PacketEngineEvents events
Definition: decode.h:576
OutputCtx_::data
void * data
Definition: tm-modules.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
closelog
#define closelog()
Definition: win32-syslog.h:75
OutputCtx_
Definition: tm-modules.h:78
DEFAULT_ALERT_SYSLOG_FACILITY
#define DEFAULT_ALERT_SYSLOG_FACILITY
Definition: util-syslog.h:33
PacketAlert_::action
uint8_t action
Definition: decode.h:279
strlcpy
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: util-strlcpyu.c:43
detect-reference.h
Signature_::gid
uint32_t gid
Definition: detect.h:552
DEFAULT_ALERT_SYSLOG_LEVEL
#define DEFAULT_ALERT_SYSLOG_LEVEL
Definition: util-syslog.h:34
IPV4_GET_IPPROTO
#define IPV4_GET_IPPROTO(p)
Definition: decode-ipv4.h:148
util-debug.h
GET_IPV4_DST_ADDR_PTR
#define GET_IPV4_DST_ADDR_PTR(p)
Definition: decode.h:223
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:44
strlcat
size_t strlcat(char *, const char *src, size_t siz)
Definition: util-strlcatu.c:45
SCSyslogGetFacilityMap
SCEnumCharMap * SCSyslogGetFacilityMap(void)
returns the syslog facility enum map
Definition: util-syslog.c:57
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
DEFAULT_ALERT_SYSLOG_FACILITY_STR
#define DEFAULT_ALERT_SYSLOG_FACILITY_STR
Definition: util-syslog.h:32
util-print.h
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:233
detect-engine-mpm.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:271
Packet_::sp
Port sp
Definition: decode.h:421
OutputInitResult_::ok
bool ok
Definition: output.h:45
SC_ERR_INVALID_ARGUMENT
@ SC_ERR_INVALID_ARGUMENT
Definition: util-error.h:43
TRUE
#define TRUE
Definition: suricata-common.h:33
FALSE
#define FALSE
Definition: suricata-common.h:34
Packet_
Definition: decode.h:414
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:232
conf.h
TmEcode
TmEcode
Definition: tm-threads-common.h:79
SCSyslogGetLogLevelMap
SCEnumCharMap * SCSyslogGetLogLevelMap(void)
returns the syslog facility enum map
Definition: util-syslog.c:75
util-proto-name.h
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
Signature_::class_msg
char * class_msg
Definition: detect.h:579
OutputInitResult_
Definition: output.h:43
GET_IPV4_SRC_ADDR_PTR
#define GET_IPV4_SRC_ADDR_PTR(p)
Definition: decode.h:222
SCMapEnumNameToValue
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
Definition: util-enum.c:40
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
Signature_::rev
uint32_t rev
Definition: detect.h:553
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:817
util-classification-config.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
Signature_::prio
int prio
Definition: detect.h:554
util-optimize.h
OutputRegisterPacketModule
void OutputRegisterPacketModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output module.
Definition: output.c:174
threadvars.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
AlertSyslogThread_
Definition: alert-syslog.c:59
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:227
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
util-logopenfile.h
Signature_::id
uint32_t id
Definition: detect.h:551
detect-parse.h
AlertSyslogThread_::file_ctx
LogFileCtx * file_ctx
Definition: alert-syslog.c:61
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:244
PacketAlert_
Definition: decode.h:277
MODULE_NAME
#define MODULE_NAME
Definition: alert-syslog.c:55
AlertSyslogThread
struct AlertSyslogThread_ AlertSyslogThread
Signature_::msg
char * msg
Definition: detect.h:576
flow.h
openlog
#define openlog(__ident, __option, __facility)
Definition: win32-syslog.h:76
Packet_::dp
Port dp
Definition: decode.h:429
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:259
PrintRawLineHexBuf
void PrintRawLineHexBuf(char *retbuf, uint32_t retbuflen, const uint8_t *buf, uint32_t buflen)
print a buffer as hex on a single line in to retbuf buffer
Definition: util-print.c:61
debug.h
output.h
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:312
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:842