|
|
|
@ -197,7 +197,6 @@ static TmEcode AlertSyslogThreadDeinit(ThreadVars *t, void *data)
|
|
|
|
static TmEcode AlertSyslogIPv4(ThreadVars *tv, const Packet *p, void *data)
|
|
|
|
static TmEcode AlertSyslogIPv4(ThreadVars *tv, const Packet *p, void *data)
|
|
|
|
{
|
|
|
|
{
|
|
|
|
AlertSyslogThread *ast = (AlertSyslogThread *)data;
|
|
|
|
AlertSyslogThread *ast = (AlertSyslogThread *)data;
|
|
|
|
int i;
|
|
|
|
|
|
|
|
const char *action = "";
|
|
|
|
const char *action = "";
|
|
|
|
|
|
|
|
|
|
|
|
if (p->alerts.cnt == 0)
|
|
|
|
if (p->alerts.cnt == 0)
|
|
|
|
@ -212,14 +211,13 @@ static TmEcode AlertSyslogIPv4(ThreadVars *tv, const Packet *p, void *data)
|
|
|
|
protoptr = proto;
|
|
|
|
protoptr = proto;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
for (i = 0; i < p->alerts.cnt; i++) {
|
|
|
|
for (int i = 0; i < p->alerts.cnt; i++) {
|
|
|
|
const PacketAlert *pa = &p->alerts.alerts[i];
|
|
|
|
const PacketAlert *pa = &p->alerts.alerts[i];
|
|
|
|
if (unlikely(pa->s == NULL)) {
|
|
|
|
if (unlikely(pa->s == NULL)) {
|
|
|
|
continue;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
char srcip[16], dstip[16];
|
|
|
|
char srcip[16], dstip[16];
|
|
|
|
|
|
|
|
|
|
|
|
PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
|
|
|
|
PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
|
|
|
|
PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
|
|
|
|
PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
|
|
|
|
|
|
|
|
|
|
|
|
@ -254,7 +252,6 @@ static TmEcode AlertSyslogIPv4(ThreadVars *tv, const Packet *p, void *data)
|
|
|
|
static TmEcode AlertSyslogIPv6(ThreadVars *tv, const Packet *p, void *data)
|
|
|
|
static TmEcode AlertSyslogIPv6(ThreadVars *tv, const Packet *p, void *data)
|
|
|
|
{
|
|
|
|
{
|
|
|
|
AlertSyslogThread *ast = (AlertSyslogThread *)data;
|
|
|
|
AlertSyslogThread *ast = (AlertSyslogThread *)data;
|
|
|
|
int i;
|
|
|
|
|
|
|
|
const char *action = "";
|
|
|
|
const char *action = "";
|
|
|
|
|
|
|
|
|
|
|
|
if (p->alerts.cnt == 0)
|
|
|
|
if (p->alerts.cnt == 0)
|
|
|
|
@ -269,14 +266,13 @@ static TmEcode AlertSyslogIPv6(ThreadVars *tv, const Packet *p, void *data)
|
|
|
|
protoptr = proto;
|
|
|
|
protoptr = proto;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
for (i = 0; i < p->alerts.cnt; i++) {
|
|
|
|
for (int i = 0; i < p->alerts.cnt; i++) {
|
|
|
|
const PacketAlert *pa = &p->alerts.alerts[i];
|
|
|
|
const PacketAlert *pa = &p->alerts.alerts[i];
|
|
|
|
if (unlikely(pa->s == NULL)) {
|
|
|
|
if (unlikely(pa->s == NULL)) {
|
|
|
|
continue;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
char srcip[46], dstip[46];
|
|
|
|
char srcip[46], dstip[46];
|
|
|
|
|
|
|
|
|
|
|
|
PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
|
|
|
|
PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
|
|
|
|
PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
|
|
|
|
PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
|
|
|
|
|
|
|
|
|
|
|
|
@ -311,7 +307,6 @@ static TmEcode AlertSyslogIPv6(ThreadVars *tv, const Packet *p, void *data)
|
|
|
|
static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *data)
|
|
|
|
static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *data)
|
|
|
|
{
|
|
|
|
{
|
|
|
|
AlertSyslogThread *ast = (AlertSyslogThread *)data;
|
|
|
|
AlertSyslogThread *ast = (AlertSyslogThread *)data;
|
|
|
|
int i;
|
|
|
|
|
|
|
|
const char *action = "";
|
|
|
|
const char *action = "";
|
|
|
|
|
|
|
|
|
|
|
|
if (p->alerts.cnt == 0)
|
|
|
|
if (p->alerts.cnt == 0)
|
|
|
|
@ -322,7 +317,7 @@ static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *da
|
|
|
|
char temp_buf_tail[64];
|
|
|
|
char temp_buf_tail[64];
|
|
|
|
char alert[2048] = "";
|
|
|
|
char alert[2048] = "";
|
|
|
|
|
|
|
|
|
|
|
|
for (i = 0; i < p->alerts.cnt; i++) {
|
|
|
|
for (int i = 0; i < p->alerts.cnt; i++) {
|
|
|
|
const PacketAlert *pa = &p->alerts.alerts[i];
|
|
|
|
const PacketAlert *pa = &p->alerts.alerts[i];
|
|
|
|
if (unlikely(pa->s == NULL)) {
|
|
|
|
if (unlikely(pa->s == NULL)) {
|
|
|
|
continue;
|
|
|
|
continue;
|
|
|
|
|