suricata
output-file.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * AppLayer File Logger Output registration functions
24  */
25 
26 #include "suricata-common.h"
27 #include "output.h"
28 #include "output-file.h"
29 #if 0
30 #include "app-layer.h"
31 #endif
32 #include "app-layer-parser.h" // FileApplyTxFlags
33 #include "detect-filemagic.h"
34 #include "util-file.h"
35 #include "util-magic.h"
36 #include "util-profiling.h"
37 #include "util-validate.h"
38 
39 bool g_file_logger_enabled = false;
40 
41 /* logger instance, a module + a output ctx,
42  * it's perfectly valid that have multiple instances of the same
43  * log module (e.g. http.log) with different output ctx'. */
44 typedef struct OutputFileLogger_ {
48  const char *name;
54 
55 static OutputFileLogger *list = NULL;
56 
61 {
62  OutputFileLogger *op = SCCalloc(1, sizeof(*op));
63  if (op == NULL)
64  return -1;
65 
66  op->LogFunc = LogFunc;
67  op->output_ctx = output_ctx;
68  op->name = name;
69  op->logger_id = id;
70  op->ThreadInit = ThreadInit;
73 
74  if (list == NULL)
75  list = op;
76  else {
77  OutputFileLogger *t = list;
78  while (t->next)
79  t = t->next;
80  t->next = op;
81  }
82 
83  SCLogDebug("OutputRegisterFileLogger happy");
84 
85  g_file_logger_enabled = true;
86  return 0;
87 }
88 
89 static void CloseFile(const Packet *p, Flow *f, AppLayerTxData *txd, File *file)
90 {
91  DEBUG_VALIDATE_BUG_ON((file->flags & FILE_LOGGED) != 0);
92  DEBUG_VALIDATE_BUG_ON(f->alproto == ALPROTO_SMB && txd->files_logged != 0);
93  DEBUG_VALIDATE_BUG_ON(f->alproto == ALPROTO_FTPDATA && txd->files_logged != 0);
94  txd->files_logged++;
95  DEBUG_VALIDATE_BUG_ON(txd->files_logged > txd->files_opened);
96  file->flags |= FILE_LOGGED;
97  SCLogDebug("ff %p FILE_LOGGED", file);
98 }
99 
101  FileContainer *ffc, void *txv, const uint64_t tx_id, AppLayerTxData *txd,
102  const bool file_close, const bool file_trunc, uint8_t dir)
103 {
104  if (ffc->head == NULL)
105  return;
106 
107  SCLogDebug("ffc %p ffc->head %p file_close %d file_trunc %d dir %s", ffc,
108  ffc ? ffc->head : NULL, file_close, file_trunc, dir == STREAM_TOSERVER ? "ts" : "tc");
109  File *ff;
110  for (ff = ffc->head; ff != NULL; ff = ff->next) {
111  SCLogDebug("ff %p pre-FILE_LOGGED", ff);
112  if (ff->flags & FILE_LOGGED)
113  continue;
114 
115  FileApplyTxFlags(txd, dir, ff);
116 
117  SCLogDebug("ff %p state %u post-FILE_LOGGED", ff, ff->state);
118 
119  if (file_trunc && ff->state < FILE_STATE_CLOSED) {
120  SCLogDebug("file_trunc %d ff->state %u => FILE_STATE_TRUNCATED", file_trunc, ff->state);
122  }
123 
124  if (file_close && ff->state < FILE_STATE_CLOSED) {
125  SCLogDebug("file_close %d ff->state %u => FILE_STATE_TRUNCATED", file_close, ff->state);
127  }
128 
129  SCLogDebug("ff %p state %u", ff, ff->state);
130 
131  if (ff->state > FILE_STATE_OPENED) {
132  SCLogDebug("FILE LOGGING");
133  bool file_logged = false;
134 #ifdef HAVE_MAGIC
135  if (FileForceMagic() && ff->magic == NULL) {
136  FilemagicThreadLookup(&op_thread_data->magic_ctx, ff);
137  }
138 #endif
139  const OutputFileLogger *logger = list;
140  const OutputLoggerThreadStore *store = op_thread_data->store;
141  while (logger && store) {
142  DEBUG_VALIDATE_BUG_ON(logger->LogFunc == NULL);
143 
144  SCLogDebug("logger %p", logger);
146  logger->LogFunc(tv, store->thread_data, (const Packet *)p, (const File *)ff, txv,
147  tx_id, dir);
149  file_logged = true;
150 
151  logger = logger->next;
152  store = store->next;
153 
154  DEBUG_VALIDATE_BUG_ON(logger == NULL && store != NULL);
155  DEBUG_VALIDATE_BUG_ON(logger != NULL && store == NULL);
156  }
157 
158  if (file_logged) {
159  CloseFile(p, p->flow, txd, ff);
160  }
161  }
162  }
163 }
164 
165 /** \brief thread init for the file logger
166  * This will run the thread init functions for the individual registered
167  * loggers */
169 {
170  OutputFileLoggerThreadData *td = SCCalloc(1, sizeof(*td));
171  if (td == NULL)
172  return TM_ECODE_FAILED;
173  *data = td;
174 
175 #ifdef HAVE_MAGIC
176  td->magic_ctx = MagicInitContext();
177  if (td->magic_ctx == NULL) {
178  SCFree(td);
179  return TM_ECODE_FAILED;
180  }
181 #endif
182 
183  SCLogDebug("OutputFileLogThreadInit happy (*data %p)", *data);
184 
185  OutputFileLogger *logger = list;
186  while (logger) {
187  if (logger->ThreadInit) {
188  void *retptr = NULL;
189  if (logger->ThreadInit(tv, (void *)logger->output_ctx, &retptr) == TM_ECODE_OK) {
190  OutputLoggerThreadStore *ts = SCCalloc(1, sizeof(*ts));
191  /* todo */ BUG_ON(ts == NULL);
192 
193  /* store thread handle */
194  ts->thread_data = retptr;
195 
196  if (td->store == NULL) {
197  td->store = ts;
198  } else {
199  OutputLoggerThreadStore *tmp = td->store;
200  while (tmp->next != NULL)
201  tmp = tmp->next;
202  tmp->next = ts;
203  }
204 
205  SCLogDebug("%s is now set up", logger->name);
206  }
207  }
208 
209  logger = logger->next;
210  }
211 
212  return TM_ECODE_OK;
213 }
214 
216 {
217  OutputLoggerThreadStore *store = op_thread_data->store;
218  OutputFileLogger *logger = list;
219 
220  while (logger && store) {
221  if (logger->ThreadDeinit) {
222  logger->ThreadDeinit(tv, store->thread_data);
223  }
224 
225  OutputLoggerThreadStore *next_store = store->next;
226  SCFree(store);
227  store = next_store;
228  logger = logger->next;
229  }
230 
231 #ifdef HAVE_MAGIC
232  MagicDeinitContext(op_thread_data->magic_ctx);
233 #endif
234 
235  SCFree(op_thread_data);
236  return TM_ECODE_OK;
237 }
238 
240 {
241 }
242 
244 {
245  OutputFileLogger *logger = list;
246  while (logger) {
247  OutputFileLogger *next_logger = logger->next;
248  SCFree(logger);
249  logger = next_logger;
250  }
251 
252  list = NULL;
253 }
FileContainer_
Definition: util-file.h:113
ts
uint64_t ts
Definition: source-erf-file.c:55
OutputLoggerThreadStore_
Definition: output.h:33
OutputFileLoggerThreadData_
Definition: output-file.h:33
OutputFileLogger_::logger_id
LoggerId logger_id
Definition: output-file.c:49
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
OutputFileLoggerRegister
void OutputFileLoggerRegister(void)
Definition: output-file.c:239
OutputRegisterFileLogger
int OutputRegisterFileLogger(LoggerId id, const char *name, FileLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-file.c:57
OutputFileLogger
struct OutputFileLogger_ OutputFileLogger
FILE_STATE_OPENED
@ FILE_STATE_OPENED
Definition: util-file.h:70
Flow_
Flow data structure.
Definition: flow.h:356
File_::state
FileState state
Definition: util-file.h:82
LoggerId
LoggerId
Definition: suricata-common.h:460
OutputFileLogger_::next
struct OutputFileLogger_ * next
Definition: output-file.c:47
OutputLoggerThreadStore_::next
struct OutputLoggerThreadStore_ * next
Definition: output.h:35
FILE_STATE_TRUNCATED
@ FILE_STATE_TRUNCATED
Definition: util-file.h:73
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
OutputCtx_
Definition: tm-modules.h:85
OutputLoggerThreadStore_::thread_data
void * thread_data
Definition: output.h:34
FileApplyTxFlags
void FileApplyTxFlags(const AppLayerTxData *txd, const uint8_t direction, File *file)
Definition: util-file.c:295
FileLogger
int(* FileLogger)(ThreadVars *, void *thread_data, const Packet *, const File *, void *tx, const uint64_t tx_id, uint8_t direction)
Definition: output-file.h:48
FileForceMagic
int FileForceMagic(void)
Definition: util-file.c:141
OutputFileLogger_::LogFunc
FileLogger LogFunc
Definition: output-file.c:45
OutputFileLogThreadDeinit
TmEcode OutputFileLogThreadDeinit(ThreadVars *tv, OutputFileLoggerThreadData *op_thread_data)
Definition: output-file.c:215
output-file.h
detect-filemagic.h
FileContainer_::head
File * head
Definition: util-file.h:114
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
ThreadInitFunc
TmEcode(* ThreadInitFunc)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:40
OutputFileLogger_::ThreadExitPrintStats
ThreadExitPrintStatsFunc ThreadExitPrintStats
Definition: output-file.c:52
app-layer-parser.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
util-profiling.h
OutputFileLogger_
Definition: output-file.c:44
Packet_
Definition: decode.h:482
OutputFileShutdown
void OutputFileShutdown(void)
Definition: output-file.c:243
util-magic.h
TmEcode
TmEcode
Definition: tm-threads-common.h:83
File_::flags
uint16_t flags
Definition: util-file.h:80
util-file.h
PACKET_PROFILING_LOGGER_END
#define PACKET_PROFILING_LOGGER_END(p, id)
Definition: util-profiling.h:241
FILE_STATE_CLOSED
@ FILE_STATE_CLOSED
Definition: util-file.h:71
File_
Definition: util-file.h:79
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1370
Packet_::flow
struct Flow_ * flow
Definition: decode.h:521
suricata-common.h
ThreadExitPrintStatsFunc
void(* ThreadExitPrintStatsFunc)(ThreadVars *, void *)
Definition: tm-modules.h:42
File_::next
struct File_ * next
Definition: util-file.h:92
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:47
OutputFileLogFfc
void OutputFileLogFfc(ThreadVars *tv, OutputFileLoggerThreadData *op_thread_data, Packet *p, FileContainer *ffc, void *txv, const uint64_t tx_id, AppLayerTxData *txd, const bool file_close, const bool file_trunc, uint8_t dir)
Definition: output-file.c:100
OutputFileLogger_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output-file.c:51
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
OutputFileLogThreadInit
TmEcode OutputFileLogThreadInit(ThreadVars *tv, OutputFileLoggerThreadData **data)
thread init for the file logger This will run the thread init functions for the individual registered...
Definition: output-file.c:168
util-validate.h
FILE_LOGGED
#define FILE_LOGGED
Definition: util-file.h:53
SCFree
#define SCFree(p)
Definition: util-mem.h:61
OutputFileLogger_::output_ctx
OutputCtx * output_ctx
Definition: output-file.c:46
PACKET_PROFILING_LOGGER_START
#define PACKET_PROFILING_LOGGER_START(p, id)
Definition: util-profiling.h:234
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:37
g_file_logger_enabled
bool g_file_logger_enabled
Definition: output-file.c:39
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:455
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
OutputFileLogger_::name
const char * name
Definition: output-file.c:48
OutputFileLogger_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output-file.c:50
output.h
OutputFileLoggerThreadData_::store
OutputLoggerThreadStore * store
Definition: output-file.h:34
ThreadDeinitFunc
TmEcode(* ThreadDeinitFunc)(ThreadVars *, void *)
Definition: tm-modules.h:41
app-layer.h