mirror of https://github.com/OISF/suricata
first stab at pcap logging no rotating buff etc
William Metcalf
14 years ago
committed by
Victor Julien
parent
1f7e4bada1
commit
023a0f94a2
@ -0,0 +1,300 @@
|
||||
/* Copyright (c) 2009 Open Information Security Foundation */
|
||||
|
||||
/** \file
|
||||
* \author William Metcalf <William.Metcalf@gmail.com>
|
||||
*/
|
||||
#if LIBPCAP_VERSION_MAJOR == 1
|
||||
#include <pcap/pcap.h>
|
||||
#else
|
||||
#include <pcap.h>
|
||||
#endif
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "debug.h"
|
||||
#include "detect.h"
|
||||
#include "flow.h"
|
||||
#include "conf.h"
|
||||
|
||||
#include "threads.h"
|
||||
#include "threadvars.h"
|
||||
#include "tm-modules.h"
|
||||
|
||||
#include "util-unittest.h"
|
||||
#include "log-pcap.h"
|
||||
#include "decode-ipv4.h"
|
||||
|
||||
#include "util-error.h"
|
||||
#include "util-debug.h"
|
||||
#include "util-time.h"
|
||||
#include "util-byte.h"
|
||||
|
||||
#include "source-pcap.h"
|
||||
|
||||
#include "output.h"
|
||||
|
||||
#define DEFAULT_LOG_FILENAME "pcaplog"
|
||||
#define MODULE_NAME "PcapLog"
|
||||
#define MIN_LIMIT 1
|
||||
#define DEFAULT_LIMIT 100
|
||||
|
||||
/*prototypes*/
|
||||
TmEcode PcapLog (ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *);
|
||||
TmEcode PcapLogThreadInit(ThreadVars *, void *, void **);
|
||||
TmEcode PcapLogThreadDeinit(ThreadVars *, void *);
|
||||
int PcapLogOpenFileCtx(LogFileCtx *, const char *);
|
||||
static void PcapLogFileDeInitCtx(OutputCtx *);
|
||||
|
||||
/**
|
||||
* PcapLog thread vars
|
||||
*
|
||||
* Used for storing file options.
|
||||
*/
|
||||
typedef struct PcapLogThread_ {
|
||||
LogFileCtx *file_ctx; /** LogFileCtx pointer */
|
||||
uint32_t size_current; /**< file current size */
|
||||
pcap_t *pcap_dead_handle; /**< pcap_dumper_t needs a handle */
|
||||
pcap_dumper_t *pcap_dumper; /**< actually writes the packets */
|
||||
struct pcap_pkthdr *h; /**< pcap header struct */
|
||||
} PcapLogThread;
|
||||
|
||||
void TmModulePcapLogRegister (void) {
|
||||
tmm_modules[TMM_PCAPLOG].name = MODULE_NAME;
|
||||
tmm_modules[TMM_PCAPLOG].ThreadInit = PcapLogThreadInit;
|
||||
tmm_modules[TMM_PCAPLOG].Func = PcapLog;
|
||||
tmm_modules[TMM_PCAPLOG].ThreadDeinit = PcapLogThreadDeinit;
|
||||
tmm_modules[TMM_PCAPLOG].RegisterTests = NULL;
|
||||
OutputRegisterModule(MODULE_NAME, "pcap-log", PcapLogInitCtx);
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Function to close pcaplog file
|
||||
*
|
||||
* \param t Thread Variable containing input/output queue, cpu affinity etc.
|
||||
* \param pl PcapLog thread variable.
|
||||
*/
|
||||
|
||||
int PcapLogCloseFile(ThreadVars *t, PcapLogThread *pl) {
|
||||
pcap_dump_close(pl->pcap_dumper);
|
||||
pl->size_current = 0;
|
||||
pl->pcap_dumper = NULL;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Function to rotate pcaplog file
|
||||
*
|
||||
* \param t Thread Variable containing input/output queue, cpu affinity etc.
|
||||
* \param pl PcapLog thread variable.
|
||||
* \retval 0 on succces
|
||||
* \retval -1 on failure
|
||||
*/
|
||||
|
||||
int PcapLogRotateFile(ThreadVars *t, PcapLogThread *pl) {
|
||||
if (PcapLogCloseFile(t,pl) < 0) {
|
||||
SCLogInfo("Error: PcapLogCloseFile failed");
|
||||
return -1;
|
||||
}
|
||||
if (PcapLogOpenFileCtx(pl->file_ctx,pl->file_ctx->prefix) < 0) {
|
||||
SCLogInfo("Error: PcapLogOpenFileCtx, open new log file failed");
|
||||
return -1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
TmEcode PcapLog (ThreadVars *t, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
|
||||
{
|
||||
int len;
|
||||
PcapLogThread *pl = (PcapLogThread *)data;
|
||||
|
||||
pl->h->ts.tv_sec = p->ts.tv_sec;
|
||||
pl->h->ts.tv_usec = p->ts.tv_usec;
|
||||
pl->h->caplen = p->pktlen;
|
||||
pl->h->len = p->pktlen;
|
||||
len = sizeof(*pl->h) + p->pktlen;
|
||||
|
||||
SCMutexLock(&pl->file_ctx->fp_mutex);
|
||||
if ((pl->size_current + len) > pl->file_ctx->size_limit) {
|
||||
if (PcapLogRotateFile(t,pl) < 0)
|
||||
{
|
||||
SCMutexUnlock(&pl->file_ctx->fp_mutex);
|
||||
SCLogInfo("rotation of pcap failed");
|
||||
return TM_ECODE_FAILED;
|
||||
}
|
||||
}
|
||||
SCMutexUnlock(&pl->file_ctx->fp_mutex);
|
||||
|
||||
/* XXX pcap handles, nfq, pfring, can only have one link type ipfw? we do this here as we don't know the link type until we get our first packet */
|
||||
if(pl->pcap_dead_handle == NULL){
|
||||
SCLogDebug("Setting pcap-log link type to %u", p->datalink);
|
||||
if((pl->pcap_dead_handle=pcap_open_dead(p->datalink,LIBPCAP_SNAPLEN)) == NULL){
|
||||
SCLogDebug("Error opening dead pcap handle");
|
||||
return TM_ECODE_FAILED;
|
||||
}
|
||||
}
|
||||
/*XXX LogfileCtx setup currently doesn't allow thread vars so we open the handle here */
|
||||
if(pl->pcap_dumper == NULL){
|
||||
if((pl->pcap_dumper=pcap_dump_open(pl->pcap_dead_handle, pl->file_ctx->filename)) == NULL){
|
||||
SCLogInfo("Error opening dump file %s",pcap_geterr(pl->pcap_dead_handle));
|
||||
return TM_ECODE_FAILED;
|
||||
}
|
||||
}
|
||||
|
||||
pcap_dump((u_char *)pl->pcap_dumper,pl->h,p->pkt);
|
||||
pl->size_current += len;
|
||||
SCLogDebug("%u %u",pl->size_current,pl->file_ctx->size_limit);
|
||||
return TM_ECODE_OK;
|
||||
}
|
||||
|
||||
TmEcode PcapLogThreadInit(ThreadVars *t, void *initdata, void **data)
|
||||
{
|
||||
PcapLogThread *pl = malloc(sizeof(PcapLogThread));
|
||||
if (pl == NULL) {
|
||||
return TM_ECODE_FAILED;
|
||||
}
|
||||
memset(pl, 0, sizeof(PcapLogThread));
|
||||
|
||||
pl->h = malloc(sizeof(*pl->h));
|
||||
if (pl->h == NULL) {
|
||||
return TM_ECODE_FAILED;
|
||||
}
|
||||
|
||||
if(initdata == NULL)
|
||||
{
|
||||
SCLogDebug("Error getting context for PcapLog. \"initdata\" argument NULL");
|
||||
return TM_ECODE_FAILED;
|
||||
}
|
||||
|
||||
/** Use the Ouptut Context (file pointer and mutex) */
|
||||
pl->file_ctx = ((OutputCtx*)initdata)->data;
|
||||
|
||||
pl->pcap_dead_handle = NULL;
|
||||
pl->pcap_dumper = NULL;
|
||||
|
||||
*data = (void *)pl;
|
||||
return TM_ECODE_OK;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Thread deinit function.
|
||||
*
|
||||
* \param t Thread Variable containing input/output queue, cpu affinity etc.
|
||||
* \param data PcapLog thread data.
|
||||
* \retval TM_ECODE_OK on succces
|
||||
* \retval TM_ECODE_FAILED on failure
|
||||
*/
|
||||
|
||||
TmEcode PcapLogThreadDeinit(ThreadVars *t, void *data)
|
||||
{
|
||||
PcapLogThread *pl = (PcapLogThread *)data;
|
||||
if (pl == NULL) {
|
||||
goto error;
|
||||
}
|
||||
|
||||
/* clear memory */
|
||||
memset(pl, 0, sizeof(PcapLogThread));
|
||||
free(pl);
|
||||
return TM_ECODE_OK;
|
||||
|
||||
error:
|
||||
/* clear memory */
|
||||
if (pl != NULL) {
|
||||
memset(pl, 0, sizeof(PcapLogThread));
|
||||
free(pl);
|
||||
}
|
||||
return TM_ECODE_FAILED;
|
||||
}
|
||||
|
||||
/** \brief Create a new LogFileCtx from the provided ConfNode.
|
||||
* \param conf The configuration node for this output.
|
||||
* \return NULL if failure, LogFileCtx* to the file_ctx if succesful
|
||||
* */
|
||||
OutputCtx *PcapLogInitCtx(ConfNode *conf)
|
||||
{
|
||||
int ret=0;
|
||||
LogFileCtx* file_ctx=LogFileNewCtx();
|
||||
|
||||
if(file_ctx == NULL)
|
||||
{
|
||||
SCLogDebug( "PcapLogInitCtx: "
|
||||
"Couldn't create new file_ctx");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
const char *filename = NULL;
|
||||
if (conf != NULL) { /* To faciliate unit tests. */
|
||||
filename = ConfNodeLookupChildValue(conf, "filename");
|
||||
}
|
||||
if (filename == NULL)
|
||||
filename = DEFAULT_LOG_FILENAME;
|
||||
file_ctx->prefix = SCStrdup(filename);
|
||||
|
||||
const char *s_limit = NULL;
|
||||
uint32_t limit = DEFAULT_LIMIT;
|
||||
if (conf != NULL) {
|
||||
s_limit = ConfNodeLookupChildValue(conf, "limit");
|
||||
if (s_limit != NULL) {
|
||||
if (ByteExtractStringUint32(&limit, 10, 0, s_limit) == -1) {
|
||||
SCLogError(SC_ERR_INVALID_ARGUMENT,
|
||||
"Fail to initialize pcap-log output, invalid limit: %s",
|
||||
s_limit);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
if (limit < MIN_LIMIT) {
|
||||
SCLogError(SC_ERR_INVALID_ARGUMENT,
|
||||
"Fail to initialize pcap-log output, limit less than "
|
||||
"allowed minimum.");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
}
|
||||
}
|
||||
file_ctx->size_limit = limit * 1024 * 1024;
|
||||
|
||||
ret=PcapLogOpenFileCtx(file_ctx, filename);
|
||||
|
||||
if(ret < 0)
|
||||
return NULL;
|
||||
|
||||
OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
|
||||
if (output_ctx == NULL) {
|
||||
SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for OutputCtx.");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
output_ctx->data = file_ctx;
|
||||
output_ctx->DeInit = PcapLogFileDeInitCtx;
|
||||
|
||||
return output_ctx;
|
||||
}
|
||||
|
||||
static void PcapLogFileDeInitCtx(OutputCtx *output_ctx)
|
||||
{
|
||||
LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data;
|
||||
LogFileFreeCtx(logfile_ctx);
|
||||
free(output_ctx);
|
||||
}
|
||||
|
||||
/** \brief Read the config set the file pointer, open the file
|
||||
* \param file_ctx pointer to a created LogFileCtx using LogFileNewCtx()
|
||||
* \param prefix Prefix of the log file.
|
||||
* \return -1 if failure, 0 if succesful
|
||||
* */
|
||||
int PcapLogOpenFileCtx(LogFileCtx *file_ctx, const char *prefix)
|
||||
{
|
||||
char *filename = NULL;
|
||||
if (file_ctx->filename != NULL)
|
||||
filename = file_ctx->filename;
|
||||
else
|
||||
filename = file_ctx->filename = malloc(PATH_MAX); /* XXX some sane default? */
|
||||
|
||||
/** get the time so we can have a filename with seconds since epoch */
|
||||
struct timeval ts;
|
||||
memset(&ts, 0x00, sizeof(struct timeval));
|
||||
TimeGet(&ts);
|
||||
|
||||
/* create the filename to use */
|
||||
char *log_dir;
|
||||
if (ConfGet("default-log-dir", &log_dir) != 1)
|
||||
log_dir = DEFAULT_LOG_DIR;
|
||||
|
||||
snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32, log_dir, prefix, (uint32_t)ts.tv_sec);
|
||||
return 0;
|
||||
}
|
||||
@ -0,0 +1,13 @@
|
||||
/** Copyright (c) 2009 Open Information Security Foundation
|
||||
*
|
||||
* \author Breno Silva <breno.silva@gmail.com>
|
||||
*/
|
||||
|
||||
#ifndef __PCAP_LOG_ALERT_H__
|
||||
#define __PCAP_LOG_ALERT_H__
|
||||
|
||||
void TmModulePcapLogRegister (void);
|
||||
OutputCtx *PcapLogInitCtx(ConfNode *);
|
||||
|
||||
|
||||
#endif /* __PCAP_LOG_ALERT_H__ */
|
||||
Loading…
Reference in New Issue