suricata
output-file.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * AppLayer File Logger Output registration functions
24  */
25 
26 #include "suricata-common.h"
27 #include "output.h"
28 #include "output-file.h"
29 #if 0
30 #include "app-layer.h"
31 #endif
32 #include "app-layer-parser.h" // FileApplyTxFlags
33 #include "detect-filemagic.h"
34 #include "util-file.h"
35 #include "util-magic.h"
36 #include "util-profiling.h"
37 #include "util-validate.h"
38 
39 bool g_file_logger_enabled = false;
40 
41 /* logger instance, a module + a output ctx,
42  * it's perfectly valid that have multiple instances of the same
43  * log module (e.g. http.log) with different output ctx'. */
44 typedef struct OutputFileLogger_ {
48  const char *name;
54 
55 static OutputFileLogger *list = NULL;
56 
61 {
62  OutputFileLogger *op = SCMalloc(sizeof(*op));
63  if (op == NULL)
64  return -1;
65  memset(op, 0x00, sizeof(*op));
66 
67  op->LogFunc = LogFunc;
68  op->output_ctx = output_ctx;
69  op->name = name;
70  op->logger_id = id;
71  op->ThreadInit = ThreadInit;
74 
75  if (list == NULL)
76  list = op;
77  else {
78  OutputFileLogger *t = list;
79  while (t->next)
80  t = t->next;
81  t->next = op;
82  }
83 
84  SCLogDebug("OutputRegisterFileLogger happy");
85 
86  g_file_logger_enabled = true;
87  return 0;
88 }
89 
90 static void CloseFile(const Packet *p, Flow *f, AppLayerTxData *txd, File *file)
91 {
92  DEBUG_VALIDATE_BUG_ON((file->flags & FILE_LOGGED) != 0);
93  DEBUG_VALIDATE_BUG_ON(f->alproto == ALPROTO_SMB && txd->files_logged != 0);
94  DEBUG_VALIDATE_BUG_ON(f->alproto == ALPROTO_FTPDATA && txd->files_logged != 0);
95  txd->files_logged++;
96  DEBUG_VALIDATE_BUG_ON(txd->files_logged > txd->files_opened);
97  file->flags |= FILE_LOGGED;
98  SCLogDebug("ff %p FILE_LOGGED", file);
99 }
100 
102  FileContainer *ffc, void *txv, const uint64_t tx_id, AppLayerTxData *txd,
103  const bool file_close, const bool file_trunc, uint8_t dir)
104 {
105  if (ffc->head == NULL)
106  return;
107 
108  SCLogDebug("ffc %p ffc->head %p file_close %d file_trunc %d dir %s", ffc,
109  ffc ? ffc->head : NULL, file_close, file_trunc, dir == STREAM_TOSERVER ? "ts" : "tc");
110  File *ff;
111  for (ff = ffc->head; ff != NULL; ff = ff->next) {
112  SCLogDebug("ff %p pre-FILE_LOGGED", ff);
113  if (ff->flags & FILE_LOGGED)
114  continue;
115 
116  FileApplyTxFlags(txd, dir, ff);
117 
118  SCLogDebug("ff %p state %u post-FILE_LOGGED", ff, ff->state);
119 
120  if (file_trunc && ff->state < FILE_STATE_CLOSED) {
121  SCLogDebug("file_trunc %d ff->state %u => FILE_STATE_TRUNCATED", file_trunc, ff->state);
123  }
124 
125  if (file_close && ff->state < FILE_STATE_CLOSED) {
126  SCLogDebug("file_close %d ff->state %u => FILE_STATE_TRUNCATED", file_close, ff->state);
128  }
129 
130  SCLogDebug("ff %p state %u", ff, ff->state);
131 
132  if (ff->state > FILE_STATE_OPENED) {
133  SCLogDebug("FILE LOGGING");
134  bool file_logged = false;
135 #ifdef HAVE_MAGIC
136  if (FileForceMagic() && ff->magic == NULL) {
137  FilemagicThreadLookup(&op_thread_data->magic_ctx, ff);
138  }
139 #endif
140  const OutputFileLogger *logger = list;
141  const OutputLoggerThreadStore *store = op_thread_data->store;
142  while (logger && store) {
143  DEBUG_VALIDATE_BUG_ON(logger->LogFunc == NULL);
144 
145  SCLogDebug("logger %p", logger);
147  logger->LogFunc(tv, store->thread_data, (const Packet *)p, (const File *)ff, txv,
148  tx_id, dir);
150  file_logged = true;
151 
152  logger = logger->next;
153  store = store->next;
154 
155  DEBUG_VALIDATE_BUG_ON(logger == NULL && store != NULL);
156  DEBUG_VALIDATE_BUG_ON(logger != NULL && store == NULL);
157  }
158 
159  if (file_logged) {
160  CloseFile(p, p->flow, txd, ff);
161  }
162  }
163  }
164 }
165 
166 /** \brief thread init for the file logger
167  * This will run the thread init functions for the individual registered
168  * loggers */
170 {
171  OutputFileLoggerThreadData *td = SCCalloc(1, sizeof(*td));
172  if (td == NULL)
173  return TM_ECODE_FAILED;
174  *data = td;
175 
176 #ifdef HAVE_MAGIC
177  td->magic_ctx = MagicInitContext();
178  if (td->magic_ctx == NULL) {
179  SCFree(td);
180  return TM_ECODE_FAILED;
181  }
182 #endif
183 
184  SCLogDebug("OutputFileLogThreadInit happy (*data %p)", *data);
185 
186  OutputFileLogger *logger = list;
187  while (logger) {
188  if (logger->ThreadInit) {
189  void *retptr = NULL;
190  if (logger->ThreadInit(tv, (void *)logger->output_ctx, &retptr) == TM_ECODE_OK) {
191  OutputLoggerThreadStore *ts = SCMalloc(sizeof(*ts));
192 /* todo */ BUG_ON(ts == NULL);
193  memset(ts, 0x00, sizeof(*ts));
194 
195  /* store thread handle */
196  ts->thread_data = retptr;
197 
198  if (td->store == NULL) {
199  td->store = ts;
200  } else {
201  OutputLoggerThreadStore *tmp = td->store;
202  while (tmp->next != NULL)
203  tmp = tmp->next;
204  tmp->next = ts;
205  }
206 
207  SCLogDebug("%s is now set up", logger->name);
208  }
209  }
210 
211  logger = logger->next;
212  }
213 
214  return TM_ECODE_OK;
215 }
216 
218 {
219  OutputLoggerThreadStore *store = op_thread_data->store;
220  OutputFileLogger *logger = list;
221 
222  while (logger && store) {
223  if (logger->ThreadDeinit) {
224  logger->ThreadDeinit(tv, store->thread_data);
225  }
226 
227  OutputLoggerThreadStore *next_store = store->next;
228  SCFree(store);
229  store = next_store;
230  logger = logger->next;
231  }
232 
233 #ifdef HAVE_MAGIC
234  MagicDeinitContext(op_thread_data->magic_ctx);
235 #endif
236 
237  SCFree(op_thread_data);
238  return TM_ECODE_OK;
239 }
240 
242 {
243 }
244 
246 {
247  OutputFileLogger *logger = list;
248  while (logger) {
249  OutputFileLogger *next_logger = logger->next;
250  SCFree(logger);
251  logger = next_logger;
252  }
253 
254  list = NULL;
255 }
FileContainer_
Definition: util-file.h:113
ts
uint64_t ts
Definition: source-erf-file.c:55
OutputLoggerThreadStore_
Definition: output.h:33
OutputFileLoggerThreadData_
Definition: output-file.h:33
OutputFileLogger_::logger_id
LoggerId logger_id
Definition: output-file.c:49
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
OutputFileLoggerRegister
void OutputFileLoggerRegister(void)
Definition: output-file.c:241
OutputRegisterFileLogger
int OutputRegisterFileLogger(LoggerId id, const char *name, FileLogger LogFunc, OutputCtx *output_ctx, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output-file.c:57
OutputFileLogger
struct OutputFileLogger_ OutputFileLogger
FILE_STATE_OPENED
@ FILE_STATE_OPENED
Definition: util-file.h:70
Flow_
Flow data structure.
Definition: flow.h:357
File_::state
FileState state
Definition: util-file.h:82
LoggerId
LoggerId
Definition: suricata-common.h:449
OutputFileLogger_::next
struct OutputFileLogger_ * next
Definition: output-file.c:47
OutputLoggerThreadStore_::next
struct OutputLoggerThreadStore_ * next
Definition: output.h:35
FILE_STATE_TRUNCATED
@ FILE_STATE_TRUNCATED
Definition: util-file.h:73
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
OutputCtx_
Definition: tm-modules.h:78
OutputLoggerThreadStore_::thread_data
void * thread_data
Definition: output.h:34
FileApplyTxFlags
void FileApplyTxFlags(const AppLayerTxData *txd, const uint8_t direction, File *file)
Definition: util-file.c:292
FileLogger
int(* FileLogger)(ThreadVars *, void *thread_data, const Packet *, const File *, void *tx, const uint64_t tx_id, uint8_t direction)
Definition: output-file.h:48
FileForceMagic
int FileForceMagic(void)
Definition: util-file.c:141
OutputFileLogger_::LogFunc
FileLogger LogFunc
Definition: output-file.c:45
OutputFileLogThreadDeinit
TmEcode OutputFileLogThreadDeinit(ThreadVars *tv, OutputFileLoggerThreadData *op_thread_data)
Definition: output-file.c:217
output-file.h
detect-filemagic.h
FileContainer_::head
File * head
Definition: util-file.h:114
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
ThreadInitFunc
TmEcode(* ThreadInitFunc)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:39
OutputFileLogger_::ThreadExitPrintStats
ThreadExitPrintStatsFunc ThreadExitPrintStats
Definition: output-file.c:52
app-layer-parser.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:289
util-profiling.h
OutputFileLogger_
Definition: output-file.c:44
Packet_
Definition: decode.h:428
OutputFileShutdown
void OutputFileShutdown(void)
Definition: output-file.c:245
util-magic.h
TmEcode
TmEcode
Definition: tm-threads-common.h:83
File_::flags
uint16_t flags
Definition: util-file.h:80
util-file.h
PACKET_PROFILING_LOGGER_END
#define PACKET_PROFILING_LOGGER_END(p, id)
Definition: util-profiling.h:261
FILE_STATE_CLOSED
@ FILE_STATE_CLOSED
Definition: util-file.h:71
File_
Definition: util-file.h:79
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1303
Packet_::flow
struct Flow_ * flow
Definition: decode.h:465
suricata-common.h
ThreadExitPrintStatsFunc
void(* ThreadExitPrintStatsFunc)(ThreadVars *, void *)
Definition: tm-modules.h:41
File_::next
struct File_ * next
Definition: util-file.h:92
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:47
OutputFileLogFfc
void OutputFileLogFfc(ThreadVars *tv, OutputFileLoggerThreadData *op_thread_data, Packet *p, FileContainer *ffc, void *txv, const uint64_t tx_id, AppLayerTxData *txd, const bool file_close, const bool file_trunc, uint8_t dir)
Definition: output-file.c:101
OutputFileLogger_::ThreadDeinit
ThreadDeinitFunc ThreadDeinit
Definition: output-file.c:51
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
OutputFileLogThreadInit
TmEcode OutputFileLogThreadInit(ThreadVars *tv, OutputFileLoggerThreadData **data)
thread init for the file logger This will run the thread init functions for the individual registered...
Definition: output-file.c:169
util-validate.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
FILE_LOGGED
#define FILE_LOGGED
Definition: util-file.h:53
SCFree
#define SCFree(p)
Definition: util-mem.h:61
OutputFileLogger_::output_ctx
OutputCtx * output_ctx
Definition: output-file.c:46
PACKET_PROFILING_LOGGER_START
#define PACKET_PROFILING_LOGGER_START(p, id)
Definition: util-profiling.h:254
ALPROTO_SMB
@ ALPROTO_SMB
Definition: app-layer-protos.h:37
g_file_logger_enabled
bool g_file_logger_enabled
Definition: output-file.c:39
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:464
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
OutputFileLogger_::name
const char * name
Definition: output-file.c:48
OutputFileLogger_::ThreadInit
ThreadInitFunc ThreadInit
Definition: output-file.c:50
output.h
OutputFileLoggerThreadData_::store
OutputLoggerThreadStore * store
Definition: output-file.h:34
ThreadDeinitFunc
TmEcode(* ThreadDeinitFunc)(ThreadVars *, void *)
Definition: tm-modules.h:40
app-layer.h