aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

flowbits: convert flowbits dumping to json builder

Browse Source
pull/5346/head
Victor Julien 6 years ago
parent 7facf5785f
commit 23c0efa2ec
1 changed files with 69 additions and 105 deletions
Show Stats Download Patch File Download Diff File

174
src/detect-flowbits.c
Unescape Escape View File

@ -399,10 +399,10 @@ struct FBAnalyze {
uint32_t toggle_sids_idx; uint32_t toggle_sids_idx;
uint32_t toggle_sids_size; uint32_t toggle_sids_size;
}; };
#ifdef PROFILING
extern int rule_engine_analysis_set;
static void DetectFlowbitsAnalyzeDump(const DetectEngineCtx *de_ctx, static void DetectFlowbitsAnalyzeDump(const DetectEngineCtx *de_ctx,
struct FBAnalyze *array, uint32_t elements); struct FBAnalyze *array, uint32_t elements);
#endif
int DetectFlowbitsAnalyze(DetectEngineCtx *de_ctx) int DetectFlowbitsAnalyze(DetectEngineCtx *de_ctx)
{ {
@ -629,9 +629,10 @@ int DetectFlowbitsAnalyze(DetectEngineCtx *de_ctx)
} }
SCFree(varname); SCFree(varname);
} }
#ifdef PROFILING
DetectFlowbitsAnalyzeDump(de_ctx, array, array_size); if (rule_engine_analysis_set) {
#endif DetectFlowbitsAnalyzeDump(de_ctx, array, array_size);
}
end: end:
for (uint32_t i = 0; i < array_size; i++) { for (uint32_t i = 0; i < array_size; i++) {
@ -646,135 +647,98 @@ end:
return 0; return 0;
} }
#ifdef PROFILING
#include "output-json.h"
#include "util-buffer.h"
SCMutex g_flowbits_dump_write_m = SCMUTEX_INITIALIZER; SCMutex g_flowbits_dump_write_m = SCMUTEX_INITIALIZER;
static void DetectFlowbitsAnalyzeDump(const DetectEngineCtx *de_ctx, static void DetectFlowbitsAnalyzeDump(const DetectEngineCtx *de_ctx,
struct FBAnalyze *array, uint32_t elements) struct FBAnalyze *array, uint32_t elements)
{ {
json_t *js = json_object(); JsonBuilder *js = jb_new_object();
if (js == NULL) if (js == NULL)
return; return;
json_t *js_array = json_array(); jb_open_array(js, "flowbits");
uint32_t x; for (uint32_t x = 0; x < elements; x++) {
for (x = 0; x < elements; x++)
{
char *varname = VarNameStoreSetupLookup(x, VAR_TYPE_FLOW_BIT); char *varname = VarNameStoreSetupLookup(x, VAR_TYPE_FLOW_BIT);
if (varname == NULL) if (varname == NULL)
continue; continue;
const struct FBAnalyze *e = &array[x]; const struct FBAnalyze *e = &array[x];
json_t *js_fb = json_object(); jb_start_object(js);
if (unlikely(js_fb != NULL)) { jb_set_string(js, "name", varname);
json_object_set_new(js_fb, "name", json_string(varname)); jb_set_uint(js, "internal_id", x);
json_object_set_new(js_fb, "internal_id", json_integer(x)); jb_set_uint(js, "set_cnt", e->cnts[DETECT_FLOWBITS_CMD_SET]);
json_object_set_new(js_fb, "set_cnt", json_integer(e->cnts[DETECT_FLOWBITS_CMD_SET])); jb_set_uint(js, "unset_cnt", e->cnts[DETECT_FLOWBITS_CMD_UNSET]);
json_object_set_new(js_fb, "unset_cnt", json_integer(e->cnts[DETECT_FLOWBITS_CMD_UNSET])); jb_set_uint(js, "toggle_cnt", e->cnts[DETECT_FLOWBITS_CMD_TOGGLE]);
json_object_set_new(js_fb, "toggle_cnt", json_integer(e->cnts[DETECT_FLOWBITS_CMD_TOGGLE])); jb_set_uint(js, "isset_cnt", e->cnts[DETECT_FLOWBITS_CMD_ISSET]);
json_object_set_new(js_fb, "isset_cnt", json_integer(e->cnts[DETECT_FLOWBITS_CMD_ISSET])); jb_set_uint(js, "isnotset_cnt", e->cnts[DETECT_FLOWBITS_CMD_ISNOTSET]);
json_object_set_new(js_fb, "isnotset_cnt", json_integer(e->cnts[DETECT_FLOWBITS_CMD_ISNOTSET]));
// sets
// sets if (e->cnts[DETECT_FLOWBITS_CMD_SET]) {
if (e->cnts[DETECT_FLOWBITS_CMD_SET]) { jb_open_array(js, "sets");
json_t *js_set_array = json_array(); for (uint32_t i = 0; i < e->set_sids_idx; i++) {
if (js_set_array) { const Signature *s = de_ctx->sig_array[e->set_sids[i]];
for(uint32_t i = 0; i < e->set_sids_idx; i++) { jb_append_uint(js, s->id);
const Signature *s = de_ctx->sig_array[e->set_sids[i]];
json_array_append_new(js_set_array, json_integer(s->id));
}
json_object_set_new(js_fb, "sets", js_set_array);
}
} }
// gets jb_close(js);
if (e->cnts[DETECT_FLOWBITS_CMD_ISSET]) { }
json_t *js_isset_array = json_array(); // gets
if (js_isset_array) { if (e->cnts[DETECT_FLOWBITS_CMD_ISSET]) {
for(uint32_t i = 0; i < e->isset_sids_idx; i++) { jb_open_array(js, "isset");
const Signature *s = de_ctx->sig_array[e->isset_sids[i]]; for (uint32_t i = 0; i < e->isset_sids_idx; i++) {
json_array_append_new(js_isset_array, json_integer(s->id)); const Signature *s = de_ctx->sig_array[e->isset_sids[i]];
} jb_append_uint(js, s->id);
json_object_set_new(js_fb, "isset", js_isset_array);
}
} }
// isnotset jb_close(js);
if (e->cnts[DETECT_FLOWBITS_CMD_ISNOTSET]) { }
json_t *js_isnotset_array = json_array(); // isnotset
if (js_isnotset_array) { if (e->cnts[DETECT_FLOWBITS_CMD_ISNOTSET]) {
for(uint32_t i = 0; i < e->isnotset_sids_idx; i++) { jb_open_array(js, "isnotset");
const Signature *s = de_ctx->sig_array[e->isnotset_sids[i]]; for (uint32_t i = 0; i < e->isnotset_sids_idx; i++) {
json_array_append_new(js_isnotset_array, json_integer(s->id)); const Signature *s = de_ctx->sig_array[e->isnotset_sids[i]];
} jb_append_uint(js, s->id);
json_object_set_new(js_fb, "isnotset", js_isnotset_array);
}
} }
// unset jb_close(js);
if (e->cnts[DETECT_FLOWBITS_CMD_UNSET]) { }
json_t *js_unset_array = json_array(); // unset
if (js_unset_array) { if (e->cnts[DETECT_FLOWBITS_CMD_UNSET]) {
for(uint32_t i = 0; i < e->unset_sids_idx; i++) { jb_open_array(js, "unset");
const Signature *s = de_ctx->sig_array[e->unset_sids[i]]; for (uint32_t i = 0; i < e->unset_sids_idx; i++) {
json_array_append_new(js_unset_array, json_integer(s->id)); const Signature *s = de_ctx->sig_array[e->unset_sids[i]];
} jb_append_uint(js, s->id);
json_object_set_new(js_fb, "unset", js_unset_array);
}
} }
// toggle jb_close(js);
if (e->cnts[DETECT_FLOWBITS_CMD_TOGGLE]) { }
json_t *js_toggle_array = json_array(); // toggle
if (js_toggle_array) { if (e->cnts[DETECT_FLOWBITS_CMD_TOGGLE]) {
for(uint32_t i = 0; i < e->toggle_sids_idx; i++) { jb_open_array(js, "toggle");
const Signature *s = de_ctx->sig_array[e->toggle_sids[i]]; for (uint32_t i = 0; i < e->toggle_sids_idx; i++) {
json_array_append_new(js_toggle_array, json_integer(s->id)); const Signature *s = de_ctx->sig_array[e->toggle_sids[i]];
} jb_append_uint(js, s->id);
json_object_set_new(js_fb, "toggle", js_toggle_array);
}
} }
jb_close(js);
json_array_append_new(js_array, js_fb);
} }
SCFree(varname); SCFree(varname);
jb_close(js);
} }
jb_close(js); // array
json_object_set_new(js, "flowbits", js_array); jb_close(js); // object
const char *filename = "flowbits.json"; const char *filename = "flowbits.json";
const char *log_dir = ConfigGetLogDirectory(); const char *log_dir = ConfigGetLogDirectory();
char log_path[PATH_MAX] = ""; char log_path[PATH_MAX] = "";
snprintf(log_path, sizeof(log_path), "%s/%s", log_dir, filename); snprintf(log_path, sizeof(log_path), "%s/%s", log_dir, filename);
MemBuffer *mbuf = NULL; SCMutexLock(&g_flowbits_dump_write_m);
mbuf = MemBufferCreateNew(4096); FILE *fp = fopen(log_path, "w");
BUG_ON(mbuf == NULL); if (fp != NULL) {
fwrite(jb_ptr(js), jb_len(js), 1, fp);
OutputJSONMemBufferWrapper wrapper = { fprintf(fp, "\n");
.buffer = &mbuf, fclose(fp);
.expand_by = 4096,
};
int r = json_dump_callback(js, OutputJSONMemBufferCallback, &wrapper,
JSON_PRESERVE_ORDER|JSON_COMPACT|JSON_ENSURE_ASCII|
JSON_ESCAPE_SLASH);
if (r != 0) {
SCLogWarning(SC_ERR_SOCKET, "unable to serialize JSON object");
} else {
MemBufferWriteString(mbuf, "\n");
SCMutexLock(&g_flowbits_dump_write_m);
FILE *fp = fopen(log_path, "w");
if (fp != NULL) {
MemBufferPrintToFPAsString(mbuf, fp);
fclose(fp);
}
SCMutexUnlock(&g_flowbits_dump_write_m);
} }
SCMutexUnlock(&g_flowbits_dump_write_m);
MemBufferFree(mbuf); jb_free(js);
json_object_clear(js);
json_decref(js);
} }
#endif /* PROFILING */
#ifdef UNITTESTS #ifdef UNITTESTS
@ -1418,4 +1382,4 @@ void FlowBitsRegisterTests(void)
UtRegisterTest("FlowBitsTestSig10", FlowBitsTestSig10); UtRegisterTest("FlowBitsTestSig10", FlowBitsTestSig10);
UtRegisterTest("FlowBitsTestSig11", FlowBitsTestSig11); UtRegisterTest("FlowBitsTestSig11", FlowBitsTestSig11);
} }
#endif /* UNITTESTS */ #endif /* UNITTESTS */

Write Preview
Loading…
Cancel
Save