aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

log-file log-dir option added, meta file created, fixes.

Browse Source
remotes/origin/master-1.2.x
Victor Julien 15 years ago
parent a6b7a560f1
commit 32fb9f375d
2 changed files with 115 additions and 27 deletions
Show Stats Download Patch File Download Diff File

48
src/app-layer-htp.c
Unescape Escape View File

@ -71,6 +71,8 @@
#include "util-memcmp.h"
//#define PRINT
/** Need a linked list in order to keep track of these */
typedef struct HTPCfgRec_ {
htp_cfg_t *cfg;
@ -617,7 +619,7 @@ static int HTPCallbackRequestUriNormalize(htp_connp_t *c)
static int HTTPParseContentDispositionHeader(uint8_t *name, size_t name_len,
uint8_t *data, size_t len, uint8_t **retptr, size_t *retlen)
{
#if 0
#ifdef PRINT
printf("DATA START: \n");
PrintRawDataFp(stdout, data, len);
printf("DATA END: \n");
@ -636,7 +638,7 @@ static int HTTPParseContentDispositionHeader(uint8_t *name, size_t name_len,
uint8_t *line = data+x;
size_t line_len = len-x;
size_t offset = 0;
#if 0
#ifdef PRINT
printf("LINE START: \n");
PrintRawDataFp(stdout, line, line_len);
printf("LINE END: \n");
@ -661,7 +663,7 @@ static int HTTPParseContentDispositionHeader(uint8_t *name, size_t name_len,
x++;
offset++;
}
#if 0
#ifdef PRINT
printf("TOKEN START: \n");
PrintRawDataFp(stdout, token, token_len);
printf("TOKEN END: \n");
@ -678,7 +680,7 @@ static int HTTPParseContentDispositionHeader(uint8_t *name, size_t name_len,
if (value[value_len-1] == '\"') {
value_len--;
}
#if 0
#ifdef PRINT
printf("VALUE START: \n");
PrintRawDataFp(stdout, value, value_len);
printf("VALUE END: \n");
@ -702,7 +704,7 @@ static int HTTPParseContentTypeHeader(uint8_t *name, size_t name_len,
uint8_t *data, size_t len, uint8_t **retptr, size_t *retlen)
{
SCEnter();
#if 0
#ifdef PRINT
printf("DATA START: \n");
PrintRawDataFp(stdout, data, len);
printf("DATA END: \n");
@ -722,7 +724,7 @@ static int HTTPParseContentTypeHeader(uint8_t *name, size_t name_len,
uint8_t *line = data+x;
size_t line_len = len-x;
size_t offset = 0;
#if 0
#ifdef PRINT
printf("LINE START: \n");
PrintRawDataFp(stdout, line, line_len);
printf("LINE END: \n");
@ -747,7 +749,7 @@ static int HTTPParseContentTypeHeader(uint8_t *name, size_t name_len,
x++;
offset++;
}
#if 0
#ifdef PRINT
printf("TOKEN START: \n");
PrintRawDataFp(stdout, token, token_len);
printf("TOKEN END: \n");
@ -764,7 +766,7 @@ static int HTTPParseContentTypeHeader(uint8_t *name, size_t name_len,
if (value[value_len-1] == '\"') {
value_len--;
}
#if 0
#ifdef PRINT
printf("VALUE START: \n");
PrintRawDataFp(stdout, value, value_len);
printf("VALUE END: \n");
@ -830,7 +832,7 @@ int HTPCallbackRequestBodyData(htp_tx_data_t *d)
(uint8_t *) bstr_ptr(h->value), bstr_len(h->value),
&boundary, &boundary_len);
if (r == 1) {
#if 0
#ifdef PRINT
printf("BOUNDARY START: \n");
PrintRawDataFp(stdout, boundary, boundary_len);
printf("BOUNDARY END: \n");
@ -921,7 +923,7 @@ int HTPCallbackRequestBodyData(htp_tx_data_t *d)
goto end;
}
#if 0
#ifdef PRINT
printf("CHUNK START: \n");
PrintRawDataFp(stdout, chunks_buffer, chunks_buffer_len);
printf("CHUNK END: \n");
@ -974,7 +976,7 @@ int HTPCallbackRequestBodyData(htp_tx_data_t *d)
}
BUG_ON(filedata_len > chunks_buffer_len);
#if 0
#ifdef PRINT
printf("FILEDATA (final chunk) START: \n");
PrintRawDataFp(stdout, filedata, filedata_len);
printf("FILEDATA (final chunk) END: \n");
@ -993,7 +995,7 @@ int HTPCallbackRequestBodyData(htp_tx_data_t *d)
if (chunks_buffer_len > expected_boundary_end_len) {
uint8_t *filedata = chunks_buffer;
uint32_t filedata_len = chunks_buffer_len - expected_boundary_len;
#if 0
#ifdef PRINT
printf("FILEDATA (part) START: \n");
PrintRawDataFp(stdout, filedata, filedata_len);
printf("FILEDATA (part) END: \n");
@ -1027,7 +1029,7 @@ int HTPCallbackRequestBodyData(htp_tx_data_t *d)
uint8_t *header = header_start + (expected_boundary_len + 2); // + for 0d 0a
header_len -= (expected_boundary_len + 2);
#if 0
#ifdef PRINT
printf("HEADER START: \n");
PrintRawDataFp(stdout, header, header_len);
printf("HEADER END: \n");
@ -1043,6 +1045,11 @@ int HTPCallbackRequestBodyData(htp_tx_data_t *d)
line_len = next_line - header;
}
#ifdef PRINT
printf("LINE START: \n");
PrintRawDataFp(stdout, line, line_len);
printf("LINE END: \n");
#endif
if (line_len >= C_D_HDR_LEN &&
SCMemcmpLowercase(C_D_HDR, line, C_D_HDR_LEN) == 0) {
uint8_t *value = line + C_D_HDR_LEN;
@ -1070,7 +1077,7 @@ int HTPCallbackRequestBodyData(htp_tx_data_t *d)
header = next_line + 2;
} /* while (header_len > 0) */
if (filename != NULL) {
if (filename != NULL && filename_len > 0) {
uint8_t *filedata = NULL;
uint32_t filedata_len = 0;
@ -1078,13 +1085,24 @@ int HTPCallbackRequestBodyData(htp_tx_data_t *d)
htud->flags |= HTP_FILENAME_SET;
SCLogDebug("header_end %p", header_end);
SCLogDebug("form_end %p", form_end);
/* everything until the final boundary is the file */
if (form_end != NULL) {
filedata = header_end + 4;
filedata_len = form_end - (header_end + 4 + 2);
/* or is it? */
uint8_t *header_next = Bs2bmSearch(filedata, filedata_len,
expected_boundary, expected_boundary_len);
if (header_next != NULL) {
filedata_len -= (form_end - header_next);
}
SCLogDebug("filedata_len %"PRIuMAX, (uintmax_t)filedata_len);
#if 0
#ifdef PRINT
printf("FILEDATA START: \n");
PrintRawDataFp(stdout, filedata, filedata_len);
printf("FILEDATA END: \n");

94
src/log-file.c
Unescape Escape View File

@ -37,6 +37,7 @@
#include "util-unittest.h"
#include "util-privs.h"
#include "util-debug.h"
#include "util-atomic.h"
#include "output.h"
@ -70,9 +71,13 @@ void TmModuleLogFileLogRegister (void) {
typedef struct LogFileLogThread_ {
LogFileCtx *file_ctx;
/** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
uint32_t uri_cnt;
uint32_t file_cnt;
} LogFileLogThread;
/*
SC_ATOMIC_DECL_AND_INIT(unsigned int, file_id);
static char g_logfile_base_dir[PATH_MAX] = "/tmp";
static void CreateTimeString (const struct timeval *ts, char *str, size_t size) {
time_t time = ts->tv_sec;
struct tm local_tm;
@ -82,11 +87,11 @@ static void CreateTimeString (const struct timeval *ts, char *str, size_t size)
t->tm_mon + 1, t->tm_mday, t->tm_year + 1900, t->tm_hour,
t->tm_min, t->tm_sec, (uint32_t) ts->tv_usec);
}
*/
TmEcode LogFileLogIPv4(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
{
SCEnter();
//LogFileLogThread *aft = (LogFileLogThread *)data;
LogFileLogThread *aft = (LogFileLogThread *)data;
/* no flow, no htp state */
if (p->flow == NULL) {
@ -111,13 +116,50 @@ TmEcode LogFileLogIPv4(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq, P
if (ff->fd == -1) {
SCLogDebug("trying to open file");
char filename[PATH_MAX] = "/tmp/file.";
snprintf(filename, sizeof(filename), "/tmp/file.%p", ff);
char filename[PATH_MAX] = "";
snprintf(filename, sizeof(filename), "%s/file.%u",
g_logfile_base_dir, SC_ATOMIC_GET(file_id));
SC_ATOMIC_ADD(file_id, 1);
ff->fd = open(filename, O_CREAT | O_TRUNC | O_NOFOLLOW | O_WRONLY, 0644);
if (ff->fd == -1) {
SCLogDebug("failed to open file");
continue;
}
/* create a .meta file that contains time, src/dst/sp/dp/proto */
char metafilename[PATH_MAX] = "";
snprintf(metafilename, sizeof(metafilename), "%s.meta", filename);
FILE *fp = fopen(metafilename, "w+");
if (fp != NULL) {
char timebuf[64];
CreateTimeString(&p->ts, timebuf, sizeof(timebuf));
fprintf(fp, "TIME: %s\n", timebuf);
if (p->pcap_cnt > 0) {
fprintf(fp, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt);
}
char srcip[16], dstip[16];
inet_ntop(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
inet_ntop(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
fprintf(fp, "SRC IP: %s\n", srcip);
fprintf(fp, "DST IP: %s\n", dstip);
fprintf(fp, "PROTO: %" PRIu32 "\n", IPV4_GET_IPPROTO(p));
if (PKT_IS_TCP(p) || PKT_IS_UDP(p)) {
fprintf(fp, "SRC PORT: %" PRIu32 "\n", p->sp);
fprintf(fp, "DST PORT: %" PRIu32 "\n", p->dp);
}
fprintf(fp, "FILENAME: ");
PrintRawUriFp(fp, ff->name, ff->name_len);
fprintf(fp, "\n");
fclose(fp);
}
aft->file_cnt++;
} else {
SCLogDebug("already open file %d", ff->fd);
}
@ -189,17 +231,25 @@ TmEcode LogFileLogThreadInit(ThreadVars *t, void *initdata, void **data)
return TM_ECODE_FAILED;
memset(aft, 0, sizeof(LogFileLogThread));
if(initdata == NULL)
if (initdata == NULL)
{
SCLogDebug("Error getting context for HTTPLog. \"initdata\" argument NULL");
SCLogDebug("Error getting context for LogFile. \"initdata\" argument NULL");
SCFree(aft);
return TM_ECODE_FAILED;
}
/* Use the Ouptut Context (file pointer and mutex) */
aft->file_ctx= ((OutputCtx *)initdata)->data;
aft->file_ctx = ((OutputCtx *)initdata)->data;
/* enable the logger for the app layer */
//AppLayerRegisterLogger(ALPROTO_HTTP);
SCLogInfo("storing files in %s", g_logfile_base_dir);
struct stat stat_buf;
if (stat(g_logfile_base_dir, &stat_buf) != 0) {
SCLogError(SC_ERR_LOGDIR_CONFIG, "The file drop directory \"%s\" "
"supplied doesn't exist. Shutting down the engine",
g_logfile_base_dir);
exit(EXIT_FAILURE);
}
*data = (void *)aft;
return TM_ECODE_OK;
@ -225,7 +275,7 @@ void LogFileLogExitPrintStats(ThreadVars *tv, void *data) {
return;
}
SCLogInfo("(%s) HTTP requests %" PRIu32 "", tv->name, aft->uri_cnt);
SCLogInfo("(%s) Files extracted %" PRIu32 "", tv->name, aft->file_cnt);
}
/** \brief Create a new http log LogFileCtx.
@ -237,9 +287,29 @@ OutputCtx *LogFileLogInitCtx(ConfNode *conf)
OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
if (output_ctx == NULL)
return NULL;
output_ctx->data = NULL;
output_ctx->DeInit = LogFileLogDeInitCtx;
char *s_default_log_dir = NULL;
if (ConfGet("default-log-dir", &s_default_log_dir) != 1)
s_default_log_dir = DEFAULT_LOG_DIR;
const char *s_base_dir = NULL;
s_base_dir = ConfNodeLookupChildValue(conf, "log-dir");
if (s_base_dir == NULL) {
strlcpy(g_logfile_base_dir,
s_default_log_dir, sizeof(g_logfile_base_dir));
} else {
if (s_base_dir[0] == '/') {
strlcpy(g_logfile_base_dir,
s_base_dir, sizeof(g_logfile_base_dir));
} else {
snprintf(g_logfile_base_dir, sizeof(g_logfile_base_dir),
"%s/%s", s_default_log_dir, s_base_dir);
}
}
SCReturnPtr(output_ctx, "OutputCtx");
}

Write Preview
Loading…
Cancel
Save