aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

You spin me right round baby, right round like a rotating packet capture right round. Oh, also log file size counters are now uint64_t

Browse Source
remotes/origin/master-1.1.x
William Metcalf 13 years ago committed by Victor Julien
parent 6bad2dbd79
commit 3b3f5816bf
7 changed files with 323 additions and 115 deletions
Show Stats Download Patch File Download Diff File

3
configure.in
Unescape Escape View File

@ -114,6 +114,9 @@ AC_INIT(configure.in)
AC_FUNC_REALLOC
AC_CHECK_FUNCS([gettimeofday memset strcasecmp strchr strdup strerror strncasecmp strtol strtoul])
# Add large file support
AC_SYS_LARGEFILE
#check for os
AC_MSG_CHECKING([host os])

6
src/alert-unified-alert.c
Unescape Escape View File

@ -322,11 +322,11 @@ OutputCtx *AlertUnifiedAlertInitCtx(ConfNode *conf)
file_ctx->prefix = SCStrdup(filename);
const char *s_limit = NULL;
uint32_t limit = DEFAULT_LIMIT;
uint64_t limit = DEFAULT_LIMIT;
if (conf != NULL) {
s_limit = ConfNodeLookupChildValue(conf, "limit");
if (s_limit != NULL) {
if (ByteExtractStringUint32(&limit, 10, 0, s_limit) == -1) {
if (ByteExtractStringUint64(&limit, 10, 0, s_limit) == -1) {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"Fail to initialize unified alert output, invalid limit: %s",
s_limit);
@ -352,7 +352,7 @@ OutputCtx *AlertUnifiedAlertInitCtx(ConfNode *conf)
output_ctx->data = file_ctx;
output_ctx->DeInit = AlertUnifiedAlertDeInitCtx;
SCLogInfo("Unified-alert initialized: filename %s, limit %"PRIu32" MB",
SCLogInfo("Unified-alert initialized: filename %s, limit %"PRIu64" MB",
filename, limit);
return output_ctx;

6
src/alert-unified2-alert.c
Unescape Escape View File

@ -863,11 +863,11 @@ OutputCtx *Unified2AlertInitCtx(ConfNode *conf)
file_ctx->prefix = SCStrdup(filename);
const char *s_limit = NULL;
uint32_t limit = DEFAULT_LIMIT;
uint64_t limit = DEFAULT_LIMIT;
if (conf != NULL) {
s_limit = ConfNodeLookupChildValue(conf, "limit");
if (s_limit != NULL) {
if (ByteExtractStringUint32(&limit, 10, 0, s_limit) == -1) {
if (ByteExtractStringUint64(&limit, 10, 0, s_limit) == -1) {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"Failed to initialize unified2 output, invalid limit: %s",
s_limit);
@ -893,7 +893,7 @@ OutputCtx *Unified2AlertInitCtx(ConfNode *conf)
output_ctx->data = file_ctx;
output_ctx->DeInit = Unified2AlertDeInitCtx;
SCLogInfo("Unified2-alert initialized: filename %s, limit %"PRIu32" MB",
SCLogInfo("Unified2-alert initialized: filename %s, limit %"PRIu64" MB",
filename, limit);
return output_ctx;

402
src/log-pcap.c
Unescape Escape View File

@ -52,22 +52,30 @@
#include "output.h"
#include "queue.h"
#define DEFAULT_LOG_FILENAME "pcaplog"
#define MODULE_NAME "PcapLog"
#define MIN_LIMIT 1
#define DEFAULT_LIMIT 100
#define DEFAULT_FILE_LIMIT 0
#define LOGMODE_NORMAL 0
#define LOGMODE_SGUIL 1
static int g_logpcap_mode = LOGMODE_NORMAL;
static char g_logpcap_sguil_base_dir[PATH_MAX] = "";
#define RING_BUFFER_MODE_DISABLED 0
#define RING_BUFFER_MODE_ENABLED 1
#define TS_FORMAT_SEC 0
#define TS_FORMAT_USEC 1
#define USE_STREAM_DEPTH_DISABLED 0
#define USE_STREAM_DEPTH_ENABLED 1
/*prototypes*/
TmEcode PcapLog (ThreadVars *, Packet *, void *, PacketQueue *, PacketQueue *);
TmEcode PcapLogThreadInit(ThreadVars *, void *, void **);
TmEcode PcapLogThreadDeinit(ThreadVars *, void *);
int PcapLogOpenFileCtx(LogFileCtx *, const char *);
TmEcode PcapLogDataInit(ThreadVars *, void *, void **);
TmEcode PcapLogDataDeinit(ThreadVars *, void *);
static void PcapLogFileDeInitCtx(OutputCtx *);
/**
@ -75,21 +83,69 @@ static void PcapLogFileDeInitCtx(OutputCtx *);
*
* Used for storing file options.
*/
typedef struct PcapLogThread_ {
LogFileCtx *file_ctx; /**< LogFileCtx pointer */
uint32_t size_current; /**< file current size */
typedef struct PcapLogData_ {
uint64_t size_current; /**< file current size */
uint64_t size_limit; /**< file size limit */
struct pcap_pkthdr *h; /**< pcap header struct */
char *filename; /**< current filename */
uint32_t file_cnt; /**< count of pcap files we currently have */
uint32_t max_files; /**< maximum files to use in ring buffer mode */
uint64_t pkt_cnt; /**< total number of packets */
int prev_day; /**< last day, for finding out when */
pcap_t *pcap_dead_handle; /**< pcap_dumper_t needs a handle */
pcap_dumper_t *pcap_dumper; /**< actually writes the packets */
struct pcap_pkthdr *h; /**< pcap header struct */
int prev_day; /**< last day, for finding out when
to rotate in sguil mode */
} PcapLogThread;
char *prefix; /**< filename prefix */
int mode; /**< normal or sguil */
int use_ringbuffer; /**< ring buffer mode enabled or disabled */
int timestamp_format; /**< timestamp format sec or usec */
int use_stream_depth; /**< use stream depth i.e. ignore packets that reach limit */
char dir[PATH_MAX]; /**< pcap log directory */
} PcapLogData;
static PcapLogData *pl; /*pcap_dumper is not thread safe*/
int PcapLogOpenFileCtx(PcapLogData *);
static SCMutex plog_lock;
typedef struct PcapFileName_ {
char *filename;
char *dirname;
TAILQ_ENTRY(PcapFileName_) next; /**< Pointer to next Pcap File for tailq. */
} PcapFileName;
/** private file list */
static TAILQ_HEAD(, PcapFileName_) pcap_file_list =
TAILQ_HEAD_INITIALIZER(pcap_file_list);
void TmModulePcapLogRegister (void) {
SCMutexInit(&plog_lock, NULL);
pl = SCMalloc(sizeof(PcapLogData));
if (pl == NULL) {
SCLogError(SC_ERR_MEM_ALLOC,
"Failed to allocate Memory for PcapLogData");
exit(EXIT_FAILURE);
}
memset(pl, 0, sizeof(PcapLogData));
pl->h = SCMalloc(sizeof(*pl->h));
if (pl->h == NULL) {
SCLogError(SC_ERR_MEM_ALLOC,
"Failed to allocate Memory for pcap header struct");
exit(EXIT_FAILURE);
}
/* Set the defaults */
pl->mode = LOGMODE_NORMAL;
pl->max_files = DEFAULT_FILE_LIMIT;
pl->use_ringbuffer = RING_BUFFER_MODE_DISABLED;
pl->timestamp_format = TS_FORMAT_SEC;
pl->use_stream_depth = USE_STREAM_DEPTH_DISABLED;
tmm_modules[TMM_PCAPLOG].name = MODULE_NAME;
tmm_modules[TMM_PCAPLOG].ThreadInit = PcapLogThreadInit;
tmm_modules[TMM_PCAPLOG].ThreadInit = PcapLogDataInit;
tmm_modules[TMM_PCAPLOG].Func = PcapLog;
tmm_modules[TMM_PCAPLOG].ThreadDeinit = PcapLogThreadDeinit;
tmm_modules[TMM_PCAPLOG].ThreadDeinit = PcapLogDataDeinit;
tmm_modules[TMM_PCAPLOG].RegisterTests = NULL;
OutputRegisterModule(MODULE_NAME, "pcap-log", PcapLogInitCtx);
@ -101,7 +157,7 @@ void TmModulePcapLogRegister (void) {
* \param t Thread Variable containing input/output queue, cpu affinity etc.
* \param pl PcapLog thread variable.
*/
int PcapLogCloseFile(ThreadVars *t, PcapLogThread *pl) {
int PcapLogCloseFile(ThreadVars *t, PcapLogData *pl) {
if (pl != NULL) {
if (pl->pcap_dumper != NULL)
pcap_dump_close(pl->pcap_dumper);
@ -124,15 +180,73 @@ int PcapLogCloseFile(ThreadVars *t, PcapLogThread *pl) {
* \retval 0 on succces
* \retval -1 on failure
*/
int PcapLogRotateFile(ThreadVars *t, PcapLogThread *pl) {
int PcapLogRotateFile(ThreadVars *t, PcapLogData *pl) {
PcapFileName *pf;
PcapFileName *pfnext;
if (PcapLogCloseFile(t,pl) < 0) {
SCLogDebug("PcapLogCloseFile failed");
return -1;
}
if (PcapLogOpenFileCtx(pl->file_ctx,pl->file_ctx->prefix) < 0) {
if (pl->use_ringbuffer == RING_BUFFER_MODE_ENABLED && pl->file_cnt >= pl->max_files) {
pf = TAILQ_FIRST(&pcap_file_list);
SCLogDebug("Removing pcap file %s\n", pf->filename);
if (remove(pf->filename) != 0) {
SCLogError(SC_ERR_PCAP_FILE_DELETE_FAILED,
"failed to remove log file %s: %s\n",
pf->filename, strerror( errno ));
TAILQ_REMOVE(&pcap_file_list, pf, next);
if (pf != NULL)
free(pf);
return -1;
}
else {
SCLogDebug("success! removed log file %s\n", pf->filename);
/* Remove directory if Sguil mode and no files left in sguil dir */
if (pl->mode == LOGMODE_SGUIL) {
pfnext = TAILQ_NEXT(pf,next);
if (strcmp(pf->dirname, pfnext->dirname) == 0) {
SCLogDebug("Current entry dir %s and next entry %s "
"are equal: not removing dir\n",
pf->dirname, pfnext->dirname);
} else {
SCLogDebug("current entry %s and %s are "
"not equal: removing dir\n",
pf->dirname, pfnext->dirname);
if (remove(pf->dirname) != 0) {
SCLogError(SC_ERR_PCAP_FILE_DELETE_FAILED,
"failed to remove sguil log %s: %s\n",
pf->dirname, strerror( errno ));
TAILQ_REMOVE(&pcap_file_list, pf, next);
if (pf != NULL)
free(pf);
return -1;
}
}
}
TAILQ_REMOVE(&pcap_file_list, pf, next);
if (pf != NULL)
free(pf);
pl->file_cnt--;
}
}
if (PcapLogOpenFileCtx(pl) < 0) {
SCLogError(SC_ERR_FOPEN, "opening new pcap log file failed");
return -1;
}
pl->file_cnt++;
return 0;
}
@ -151,26 +265,33 @@ int PcapLogRotateFile(ThreadVars *t, PcapLogThread *pl) {
TmEcode PcapLog (ThreadVars *t, Packet *p, void *data, PacketQueue *pq, PacketQueue *postpq)
{
size_t len;
PcapLogThread *pl = (PcapLogThread *)data;
int rotate = 0;
int ret = 0;
if (pl == NULL) {
return TM_ECODE_FAILED;
}
if (p->flags & PKT_PSEUDO_STREAM_END || p->flags & PKT_STREAM_NOPCAPLOG ||
if (p->flags & PKT_PSEUDO_STREAM_END ||
((p->flags & PKT_STREAM_NOPCAPLOG) && (pl->use_stream_depth == USE_STREAM_DEPTH_ENABLED)) ||
(IS_TUNNEL_PKT(p) && !IS_TUNNEL_ROOT_PKT(p)))
{
return TM_ECODE_OK;
}
SCMutexLock(&plog_lock);
pl->pkt_cnt++;
pl->h->ts.tv_sec = p->ts.tv_sec;
pl->h->ts.tv_usec = p->ts.tv_usec;
pl->h->caplen = GET_PKT_LEN(p);
pl->h->len = GET_PKT_LEN(p);
len = sizeof(*pl->h) + GET_PKT_LEN(p);
if (g_logpcap_mode == LOGMODE_SGUIL) {
if (pl->filename == NULL) {
SCLogDebug("Opening PCAP log file %s", filename);
ret = PcapLogOpenFileCtx(pl);
if (ret < 0) {
return TM_ECODE_FAILED;
}
}
if (pl->mode == LOGMODE_SGUIL) {
struct tm local_tm;
struct tm *tms = (struct tm *)localtime_r(&p->ts.tv_sec, &local_tm);
if (tms->tm_mday != pl->prev_day) {
@ -179,16 +300,14 @@ TmEcode PcapLog (ThreadVars *t, Packet *p, void *data, PacketQueue *pq, PacketQu
}
}
SCMutexLock(&pl->file_ctx->fp_mutex);
if ((pl->size_current + len) > pl->file_ctx->size_limit || rotate) {
if ((pl->size_current + len) > pl->size_limit || rotate) {
if (PcapLogRotateFile(t,pl) < 0)
{
SCMutexUnlock(&pl->file_ctx->fp_mutex);
SCMutexUnlock(&plog_lock);
SCLogDebug("rotation of pcap failed");
return TM_ECODE_FAILED;
}
}
SCMutexUnlock(&pl->file_ctx->fp_mutex);
/* XXX pcap handles, nfq, pfring, can only have one link type ipfw? we do
* this here as we don't know the link type until we get our first packet */
@ -206,44 +325,35 @@ TmEcode PcapLog (ThreadVars *t, Packet *p, void *data, PacketQueue *pq, PacketQu
* handle here */
if (pl->pcap_dumper == NULL) {
if ((pl->pcap_dumper = pcap_dump_open(pl->pcap_dead_handle,
pl->file_ctx->filename)) == NULL)
pl->filename)) == NULL)
{
SCLogInfo("Error opening dump file %s",pcap_geterr(pl->pcap_dead_handle));
SCLogInfo("Error opening dump file %s", pcap_geterr(pl->pcap_dead_handle));
return TM_ECODE_FAILED;
}
}
pcap_dump((u_char *)pl->pcap_dumper, pl->h, GET_PKT_DATA(p));
pl->size_current += len;
SCLogDebug("%u %u",pl->size_current,pl->file_ctx->size_limit);
SCLogDebug("%u %u",pl->size_current, pl->size_limit);
SCMutexUnlock(&plog_lock);
return TM_ECODE_OK;
}
TmEcode PcapLogThreadInit(ThreadVars *t, void *initdata, void **data)
TmEcode PcapLogDataInit(ThreadVars *t, void *initdata, void **data)
{
PcapLogThread *pl = SCMalloc(sizeof(PcapLogThread));
if (pl == NULL) {
return TM_ECODE_FAILED;
}
memset(pl, 0, sizeof(PcapLogThread));
pl->h = SCMalloc(sizeof(*pl->h));
if (pl->h == NULL) {
return TM_ECODE_FAILED;
}
if(initdata == NULL)
{
SCLogDebug("Error getting context for PcapLog. \"initdata\" argument NULL");
return TM_ECODE_FAILED;
}
SCMutexLock(&plog_lock);
/** Use the Ouptut Context (file pointer and mutex) */
pl->file_ctx = ((OutputCtx*)initdata)->data;
pl->pkt_cnt = 0;
pl->pcap_dead_handle = NULL;
pl->pcap_dumper = NULL;
pl->file_cnt = 1;
struct timeval ts;
memset(&ts, 0x00, sizeof(struct timeval));
@ -253,6 +363,8 @@ TmEcode PcapLogThreadInit(ThreadVars *t, void *initdata, void **data)
pl->prev_day = tms->tm_mday;
*data = (void *)pl;
SCMutexUnlock(&plog_lock);
return TM_ECODE_OK;
}
@ -265,43 +377,34 @@ TmEcode PcapLogThreadInit(ThreadVars *t, void *initdata, void **data)
* \retval TM_ECODE_FAILED on failure
*/
TmEcode PcapLogThreadDeinit(ThreadVars *t, void *data)
TmEcode PcapLogDataDeinit(ThreadVars *t, void *data)
{
PcapLogThread *pl = (PcapLogThread *)data;
SCMutexLock(&plog_lock);
if (pl == NULL) {
goto error;
}
SCLogInfo("Packets seen %" PRIu64 " at exit", pl->pkt_cnt);
/* clear memory */
memset(pl, 0, sizeof(PcapLogThread));
SCFree(pl);
memset(pl, 0, sizeof(PcapLogData));
SCMutexUnlock(&plog_lock);
return TM_ECODE_OK;
error:
/* clear memory */
if (pl != NULL) {
memset(pl, 0, sizeof(PcapLogThread));
SCFree(pl);
memset(pl, 0, sizeof(PcapLogData));
}
SCMutexUnlock(&plog_lock);
return TM_ECODE_FAILED;
}
/** \brief Create a new LogFileCtx from the provided ConfNode.
/** \brief Fill in pcap logging struct from the provided ConfNode.
* \param conf The configuration node for this output.
* \return NULL if failure, LogFileCtx* to the file_ctx if succesful
* \retval output_ctx
* */
OutputCtx *PcapLogInitCtx(ConfNode *conf)
{
int ret=0;
LogFileCtx* file_ctx=LogFileNewCtx();
if(file_ctx == NULL)
{
SCLogDebug( "PcapLogInitCtx: "
"Couldn't create new file_ctx");
return NULL;
}
SCMutexLock(&plog_lock);
const char *filename = NULL;
if (conf != NULL) { /* To faciliate unit tests. */
filename = ConfNodeLookupChildValue(conf, "filename");
@ -309,14 +412,18 @@ OutputCtx *PcapLogInitCtx(ConfNode *conf)
if (filename == NULL)
filename = DEFAULT_LOG_FILENAME;
file_ctx->prefix = SCStrdup(filename);
if ((pl->prefix = SCStrdup(filename)) == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for directory name");
return NULL;
}
uint32_t limit = DEFAULT_LIMIT;
uint64_t limit = DEFAULT_LIMIT;
if (conf != NULL) {
const char *s_limit = NULL;
s_limit = ConfNodeLookupChildValue(conf, "limit");
if (s_limit != NULL) {
if (ByteExtractStringUint32(&limit, 10, 0, s_limit) == -1) {
if (ByteExtractStringUint64(&limit, 10, 0, s_limit) == -1) {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"Fail to initialize pcap-log output, invalid limit: %s",
s_limit);
@ -330,45 +437,110 @@ OutputCtx *PcapLogInitCtx(ConfNode *conf)
}
}
}
file_ctx->size_limit = limit * 1024 * 1024;
pl->size_limit = limit * 1024 * 1024;
if (conf != NULL) {
const char *s_mode = NULL;
s_mode = ConfNodeLookupChildValue(conf, "mode");
if (s_mode != NULL) {
if (strcasecmp(s_mode, "sguil") == 0) {
g_logpcap_mode = LOGMODE_SGUIL;
pl->mode = LOGMODE_SGUIL;
} else if (strcasecmp(s_mode, "normal") != 0) {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"log-pcap you must specify \"sguil\" or \"normal\" mode "
"option to be set.");
exit(EXIT_FAILURE);
}
}
if (g_logpcap_mode == LOGMODE_SGUIL) {
const char *s_sguil_base = NULL;
s_sguil_base = ConfNodeLookupChildValue(conf, "sguil_base_dir");
if (s_sguil_base == NULL) {
const char *s_dir = NULL;
s_dir = ConfNodeLookupChildValue(conf, "dir");
if (s_dir == NULL) {
if (pl->mode == LOGMODE_SGUIL) {
SCLogError(SC_ERR_LOGPCAP_SGUIL_BASE_DIR_MISSING,
"log-pcap \"sguil\" mode requires \"sguil_base_dir\" "
"log-pcap \"sguil\" mode requires \"dir\" "
"option to be set.");
exit(EXIT_FAILURE);
} else {
char *log_dir = NULL;
if (ConfGet("default-log-dir", &log_dir) != 1)
log_dir = DEFAULT_LOG_DIR;
strlcpy(pl->dir,
log_dir, sizeof(pl->dir));
SCLogInfo("Using log dir %s", pl->dir);
}
strlcpy(g_logpcap_sguil_base_dir,
s_sguil_base, sizeof(g_logpcap_sguil_base_dir));
} else {
strlcpy(pl->dir,
s_dir, sizeof(pl->dir));
SCLogInfo("Using log dir %s", pl->dir);
}
}
SCLogInfo("using %s logging", g_logpcap_mode == LOGMODE_SGUIL ?
SCLogInfo("using %s logging", pl->mode == LOGMODE_SGUIL ?
"Sguil compatible" : "normal");
ret = PcapLogOpenFileCtx(file_ctx, filename);
if (ret < 0)
return NULL;
uint32_t max_file_limit = DEFAULT_FILE_LIMIT;
if (conf != NULL) {
const char *max_number_of_files_s = NULL;
max_number_of_files_s = ConfNodeLookupChildValue(conf, "max_files");
if (max_number_of_files_s != NULL) {
if (ByteExtractStringUint32(&max_file_limit, 10, 0, max_number_of_files_s) == -1) {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"Failed to initialize pcap-log output, invalid number of files limit: %s",
max_number_of_files_s);
exit(EXIT_FAILURE);
}
else if (max_file_limit < 1) {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"Failed to initialize pcap-log output, limit less than "
"allowed minimum.");
exit(EXIT_FAILURE);
} else {
pl->max_files = max_file_limit;
pl->use_ringbuffer = RING_BUFFER_MODE_ENABLED;
}
}
}
const char *ts_format = NULL;
if (conf != NULL) { /* To faciliate unit tests. */
ts_format = ConfNodeLookupChildValue(conf, "ts_format");
}
if (ts_format != NULL) {
if (strcasecmp(ts_format, "usec") == 0) {
pl->timestamp_format = TS_FORMAT_USEC;
} else if (strcasecmp(ts_format, "sec") != 0) {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"log-pcap ts_format specified %s is invalid must be"
" \"sec\" or \"usec\"", ts_format);
exit(EXIT_FAILURE);
}
}
const char *use_stream_depth = NULL;
if (conf != NULL) { /* To faciliate unit tests. */
use_stream_depth = ConfNodeLookupChildValue(conf, "use_stream_depth");
}
if (use_stream_depth != NULL) {
if (ConfValIsFalse(use_stream_depth)) {
pl->use_stream_depth = USE_STREAM_DEPTH_DISABLED;
} else if (ConfValIsTrue(use_stream_depth)) {
pl->use_stream_depth = USE_STREAM_DEPTH_ENABLED;
} else {
SCLogError(SC_ERR_INVALID_ARGUMENT,
"log-pcap use_stream_depth specified is invalid must be");
exit(EXIT_FAILURE);
}
}
SCMutexUnlock(&plog_lock);
OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
if (output_ctx == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for OutputCtx.");
exit(EXIT_FAILURE);
}
output_ctx->data = file_ctx;
output_ctx->data = NULL;
output_ctx->DeInit = PcapLogFileDeInitCtx;
return output_ctx;
@ -376,32 +548,36 @@ OutputCtx *PcapLogInitCtx(ConfNode *conf)
static void PcapLogFileDeInitCtx(OutputCtx *output_ctx)
{
SCMutexLock(&plog_lock);
PcapFileName *pf;
TAILQ_FOREACH(pf, &pcap_file_list, next) {
SCLogDebug("PCAP files left at exit: %s\n", pf->filename);
}
SCMutexUnlock(&plog_lock);
if (output_ctx != NULL) {
LogFileCtx *logfile_ctx = (LogFileCtx *)output_ctx->data;
if (logfile_ctx != NULL) {
LogFileFreeCtx(logfile_ctx);
}
SCFree(output_ctx);
}
}
/**
* \brief Read the config set the file pointer, open the file
*
* \param file_ctx pointer to a created LogFileCtx using LogFileNewCtx()
* \param prefix Prefix of the log file.
* \param PcapLogData.
*
* \retval -1 if failure
* \retval 0 if succesful
*/
int PcapLogOpenFileCtx(LogFileCtx *file_ctx, const char *prefix)
int PcapLogOpenFileCtx(PcapLogData *pl)
{
char *filename = NULL;
if (file_ctx->filename != NULL)
filename = file_ctx->filename;
if (pl->filename != NULL)
filename = pl->filename;
else {
filename = file_ctx->filename = SCMalloc(PATH_MAX);
filename = pl->filename = SCMalloc(PATH_MAX);
if (filename == NULL) {
return -1;
}
@ -412,11 +588,14 @@ int PcapLogOpenFileCtx(LogFileCtx *file_ctx, const char *prefix)
memset(&ts, 0x00, sizeof(struct timeval));
TimeGet(&ts);
char *log_dir;
if (ConfGet("default-log-dir", &log_dir) != 1)
log_dir = DEFAULT_LOG_DIR;
if (g_logpcap_mode == LOGMODE_SGUIL) {
/* Place to store the name of our PCAP file */
PcapFileName *pf = SCMalloc(sizeof(PcapFileName));
if (pf == NULL) {
return -1;
}
if (pl->mode == LOGMODE_SGUIL) {
struct tm local_tm;
struct tm *tms = (struct tm *)localtime_r(&ts.tv_sec, &local_tm);
@ -426,7 +605,7 @@ int PcapLogOpenFileCtx(LogFileCtx *file_ctx, const char *prefix)
tms->tm_year + 1900, tms->tm_mon + 1, tms->tm_mday);
/* create the filename to use */
snprintf(dirfull, PATH_MAX, "%s/%s", g_logpcap_sguil_base_dir, dirname);
snprintf(dirfull, PATH_MAX, "%s/%s", pl->dir, dirname);
/* if mkdir fails file open will fail, so deal with errors there */
#ifndef OS_WIN32
@ -434,16 +613,37 @@ int PcapLogOpenFileCtx(LogFileCtx *file_ctx, const char *prefix)
#else
(void)mkdir(dirfull);
#endif
if ((pf->dirname = SCStrdup(dirfull)) == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory for directory name");
return -1;
}
if (strlen(pf->dirname) == 0) {
SCFree(pf->dirname);
return -1;
}
if (pl->timestamp_format == TS_FORMAT_SEC) {
snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32, dirfull, pl->prefix, (uint32_t)ts.tv_sec);
} else {
snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32 ".%" PRIu32, dirfull, pl->prefix, (uint32_t)ts.tv_sec, (uint32_t)ts.tv_usec);
}
snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32, dirfull, prefix, (uint32_t)ts.tv_sec);
} else {
/* create the filename to use */
if (prefix[0] == '/') {
snprintf(filename, PATH_MAX, "%s.%" PRIu32, prefix, (uint32_t)ts.tv_sec);
if (pl->timestamp_format == TS_FORMAT_SEC) {
snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32, pl->dir, pl->prefix, (uint32_t)ts.tv_sec);
} else {
snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32, log_dir, prefix, (uint32_t)ts.tv_sec);
snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32 ".%" PRIu32, pl->dir, pl->prefix, (uint32_t)ts.tv_sec, (uint32_t)ts.tv_usec);
}
}
if ((pf->filename = SCStrdup(pl->filename)) == NULL) {
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating memory. For filename");
return -1;
}
SCLogDebug("Opening pcap file log %s\n", pf->filename);
TAILQ_INSERT_TAIL(&pcap_file_list, pf, next);
return 0;
}

4
src/tm-modules.h
Unescape Escape View File

@ -69,8 +69,8 @@ typedef struct LogFileCtx_ {
/** Generic size_limit and size_current
* They must be common to the threads accesing the same file */
uint32_t size_limit; /**< file size limit */
uint32_t size_current; /**< file current size */
uint64_t size_limit; /**< file size limit */
uint64_t size_current; /**< file current size */
/* Alerts on the module (not on the file) */
uint64_t alerts;

1
src/util-error.h
Unescape Escape View File

@ -221,6 +221,7 @@ typedef enum {
SC_ERR_AFP_READ,
SC_ERR_AFP_DISPATCH,
SC_ERR_NO_AF_PACKET,
SC_ERR_PCAP_FILE_DELETE_FAILED,
} SCError;
const char *SCErrorToString(SCError);

16
suricata.yaml
Unescape Escape View File

@ -81,9 +81,8 @@ outputs:
# and "sguil".
#
# In normal mode a pcap file "filename" is created in the default-log-dir,
# or if filename is an absolute path a that path. In Sguil mode "sguil_base_dir"
# indicates the base directory. In this base dir the pcaps are created in the
# directory structure Sguil expects:
# or are as specified by "dir". In Sguil mode "dir" indicates the base directory.
# In this base dir the pcaps are created in th directory structure Sguil expects:
#
# $sguil_base_dir/YYYY-MM-DD/$filename.<timestamp>
#
@ -96,10 +95,15 @@ outputs:
filename: log.pcap
# Limit in MB.
#limit: 32
limit: 1000
# If set to a value will enable ring buffer mode. Will keep Maximum of "max_files" of size "limit"
max_files: 2000
#mode: sguil # "normal" (default) or sguil.
#sguil_base_dir: /nsm_data/
mode: normal # normal or sguil.
#dir: /nsm_data/
#ts_format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec
use_stream_depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets
# a full alerts log containing much information for signature writers
# or for investigating suspected false positives.

Write Preview
Loading…
Cancel
Save