aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

dhcp: standardize output code

Browse Source 
To prepare to add metadata in alerts

Ticket: 6091
pull/15185/head
Philippe Antoine 4 months ago committed by Victor Julien
parent d14af54b3b
commit db980daf5f
2 changed files with 163 additions and 199 deletions
Show Stats Download Patch File Download Diff File

101
rust/src/dhcp/logger.rs
Unescape Escape View File

@ -17,26 +17,12 @@
use std;
use suricata_sys::sys::SCConfNode;
use crate::conf::ConfNode;
use crate::dhcp::dhcp::*;
use crate::dhcp::parser::{DHCPOptGeneric, DHCPOptionWrapper};
use crate::dns::log::dns_print_addr;
use crate::jsonbuilder::{JsonBuilder, JsonError};
pub struct DHCPLogger {
extended: bool,
}
impl DHCPLogger {
pub fn new(conf: ConfNode) -> Self {
return Self {
extended: conf.get_child_bool("extended"),
};
}
fn get_type(&self, tx: &DHCPTransaction) -> Option<u8> {
fn get_type(tx: &DHCPTransaction) -> Option<u8> {
let options = &tx.message.options;
for option in options {
let code = option.code;
@ -58,16 +44,16 @@ impl DHCPLogger {
}
}
return None;
}
}
pub fn do_log(&self, tx: &DHCPTransaction) -> bool {
if !self.extended {
return matches!(self.get_type(tx), Some(DHCP_TYPE_ACK));
fn do_log(extended: bool, tx: &DHCPTransaction) -> bool {
if !extended {
return matches!(get_type(tx), Some(DHCP_TYPE_ACK));
}
return true;
}
}
pub fn log(&self, tx: &DHCPTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
fn log(extended: bool, tx: &DHCPTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
let header = &tx.message.header;
let options = &tx.message.options;
@ -89,7 +75,7 @@ impl DHCPLogger {
js.set_string("client_mac", &format_addr_hex(&header.clienthw))?;
js.set_string("assigned_ip", &dns_print_addr(&header.yourip))?;
if self.extended {
if extended {
js.set_string("client_ip", &dns_print_addr(&header.clientip))?;
if header.opcode == BOOTP_REPLY {
js.set_string("relay_ip", &dns_print_addr(&header.giaddr))?;
@ -105,12 +91,12 @@ impl DHCPLogger {
}
DHCPOptionWrapper::TimeValue(ref time_value) => match code {
DHCP_OPT_ADDRESS_TIME => {
if self.extended {
if extended {
js.set_uint("lease_time", time_value.seconds as u64)?;
}
}
DHCP_OPT_REBINDING_TIME => {
if self.extended {
if extended {
js.set_uint("rebinding_time", time_value.seconds as u64)?;
}
}
@ -121,7 +107,7 @@ impl DHCPLogger {
},
DHCPOptionWrapper::Generic(ref option) => match code {
DHCP_OPT_SUBNET_MASK => {
if self.extended {
if extended {
js.set_string("subnet_mask", &dns_print_addr(&option.data))?;
}
}
@ -131,30 +117,30 @@ impl DHCPLogger {
}
}
DHCP_OPT_TYPE => {
self.log_opt_type(js, option)?;
log_opt_type(js, option)?;
}
DHCP_OPT_REQUESTED_IP => {
if self.extended {
if extended {
js.set_string("requested_ip", &dns_print_addr(&option.data))?;
}
}
DHCP_OPT_PARAMETER_LIST => {
if self.extended {
self.log_opt_parameters(js, option)?;
if extended {
log_opt_parameters(js, option)?;
}
}
DHCP_OPT_DNS_SERVER => {
if self.extended {
self.log_opt_dns_server(js, option)?;
if extended {
log_opt_dns_server(js, option)?;
}
}
DHCP_OPT_ROUTERS => {
if self.extended {
self.log_opt_routers(js, option)?;
if extended {
log_opt_routers(js, option)?;
}
}
DHCP_OPT_VENDOR_CLASS_ID => {
if self.extended && !option.data.is_empty() {
if extended && !option.data.is_empty() {
js.set_string_from_bytes("vendor_class_identifier", &option.data)?;
}
}
@ -167,9 +153,9 @@ impl DHCPLogger {
js.close()?;
return Ok(());
}
}
fn log_opt_type(&self, js: &mut JsonBuilder, option: &DHCPOptGeneric) -> Result<(), JsonError> {
fn log_opt_type(js: &mut JsonBuilder, option: &DHCPOptGeneric) -> Result<(), JsonError> {
if !option.data.is_empty() {
let dhcp_type = match option.data[0] {
DHCP_TYPE_DISCOVER => "discover",
@ -185,11 +171,9 @@ impl DHCPLogger {
js.set_string("dhcp_type", dhcp_type)?;
}
Ok(())
}
}
fn log_opt_parameters(
&self, js: &mut JsonBuilder, option: &DHCPOptGeneric,
) -> Result<(), JsonError> {
fn log_opt_parameters(js: &mut JsonBuilder, option: &DHCPOptGeneric) -> Result<(), JsonError> {
js.open_array("params")?;
for i in &option.data {
let param = match *i {
@ -209,11 +193,9 @@ impl DHCPLogger {
}
js.close()?;
Ok(())
}
}
fn log_opt_dns_server(
&self, js: &mut JsonBuilder, option: &DHCPOptGeneric,
) -> Result<(), JsonError> {
fn log_opt_dns_server(js: &mut JsonBuilder, option: &DHCPOptGeneric) -> Result<(), JsonError> {
js.open_array("dns_servers")?;
for i in 0..(option.data.len() / 4) {
let val = dns_print_addr(&option.data[(i * 4)..(i * 4) + 4]);
@ -221,11 +203,9 @@ impl DHCPLogger {
}
js.close()?;
Ok(())
}
}
fn log_opt_routers(
&self, js: &mut JsonBuilder, option: &DHCPOptGeneric,
) -> Result<(), JsonError> {
fn log_opt_routers(js: &mut JsonBuilder, option: &DHCPOptGeneric) -> Result<(), JsonError> {
js.open_array("routers")?;
for i in 0..(option.data.len() / 4) {
let val = dns_print_addr(&option.data[(i * 4)..(i * 4) + 4]);
@ -233,7 +213,6 @@ impl DHCPLogger {
}
js.close()?;
Ok(())
}
}
fn format_addr_hex(input: &[u8]) -> String {
@ -241,32 +220,16 @@ fn format_addr_hex(input: &[u8]) -> String {
return parts.join(":");
}
#[no_mangle]
pub extern "C" fn SCDhcpLoggerNew(conf: *const SCConfNode) -> *mut std::os::raw::c_void {
let conf = ConfNode::wrap(conf);
let boxed = Box::new(DHCPLogger::new(conf));
return Box::into_raw(boxed) as *mut _;
}
#[no_mangle]
pub unsafe extern "C" fn SCDhcpLoggerFree(logger: *mut std::os::raw::c_void) {
std::mem::drop(Box::from_raw(logger as *mut DHCPLogger));
}
#[no_mangle]
pub unsafe extern "C" fn SCDhcpLoggerLog(
logger: *mut std::os::raw::c_void, tx: *mut std::os::raw::c_void, js: &mut JsonBuilder,
extended: bool, tx: *mut std::os::raw::c_void, js: &mut JsonBuilder,
) -> bool {
let logger = cast_pointer!(logger, DHCPLogger);
let tx = cast_pointer!(tx, DHCPTransaction);
logger.log(tx, js).is_ok()
log(extended, tx, js).is_ok()
}
#[no_mangle]
pub unsafe extern "C" fn SCDhcpLoggerDoLog(
logger: *mut std::os::raw::c_void, tx: *mut std::os::raw::c_void,
) -> bool {
let logger = cast_pointer!(logger, DHCPLogger);
pub unsafe extern "C" fn SCDhcpLoggerDoLog(extended: bool, tx: *mut std::os::raw::c_void) -> bool {
let tx = cast_pointer!(tx, DHCPTransaction);
logger.do_log(tx)
do_log(extended, tx)
}

11
src/output-json-dhcp.c
Unescape Escape View File

@ -46,7 +46,7 @@
typedef struct LogDHCPFileCtx_ {
void *rs_logger;
bool extended;
OutputJsonCtx *eve_ctx;
} LogDHCPFileCtx;
@ -61,7 +61,7 @@ static int JsonDHCPLogger(ThreadVars *tv, void *thread_data,
LogDHCPLogThread *thread = thread_data;
LogDHCPFileCtx *ctx = thread->dhcplog_ctx;
if (!SCDhcpLoggerDoLog(ctx->rs_logger, tx)) {
if (!SCDhcpLoggerDoLog(ctx->extended, tx)) {
return TM_ECODE_OK;
}
@ -70,7 +70,7 @@ static int JsonDHCPLogger(ThreadVars *tv, void *thread_data,
return TM_ECODE_FAILED;
}
SCDhcpLoggerLog(ctx->rs_logger, tx, js);
SCDhcpLoggerLog(ctx->extended, tx, js);
OutputJsonBuilderBuffer(tv, p, p->flow, js, thread->thread);
SCJbFree(js);
@ -81,7 +81,6 @@ static int JsonDHCPLogger(ThreadVars *tv, void *thread_data,
static void OutputDHCPLogDeInitCtxSub(OutputCtx *output_ctx)
{
LogDHCPFileCtx *dhcplog_ctx = (LogDHCPFileCtx *)output_ctx->data;
SCDhcpLoggerFree(dhcplog_ctx->rs_logger);
SCFree(dhcplog_ctx);
SCFree(output_ctx);
}
@ -104,7 +103,9 @@ static OutputInitResult OutputDHCPLogInitSub(SCConfNode *conf, OutputCtx *parent
output_ctx->data = dhcplog_ctx;
output_ctx->DeInit = OutputDHCPLogDeInitCtxSub;
dhcplog_ctx->rs_logger = SCDhcpLoggerNew(conf);
int extended = 0;
(void)SCConfGetChildValueBool(conf, "extended", &extended);
dhcplog_ctx->extended = extended;
SCAppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_DHCP);

Write Preview
Loading…
Cancel
Save