aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

log/pcap: conditional logging

Browse Source 
Add an option to only write to pcap packets with alerts and flow
that have alerted.
pull/7430/head
Eric Leblond 6 years ago committed by Victor Julien
parent 0b51022337
commit 4cab5e5262
13 changed files with 51 additions and 15 deletions
Show Stats Download Patch File Download Diff File

2
src/alert-debuglog.c
Unescape Escape View File

@ -468,7 +468,7 @@ error:
return result;
}
static int AlertDebugLogCondition(ThreadVars *tv, const Packet *p)
static int AlertDebugLogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
{
return (p->alerts.cnt ? TRUE : FALSE);
}

4
src/alert-fastlog.c
Unescape Escape View File

@ -69,7 +69,7 @@ TmEcode AlertFastLogThreadDeinit(ThreadVars *, void *);
void AlertFastLogRegisterTests(void);
static void AlertFastLogDeInitCtx(OutputCtx *);
int AlertFastLogCondition(ThreadVars *tv, const Packet *p);
int AlertFastLogCondition(ThreadVars *tv, void *thread_data, const Packet *p);
int AlertFastLogger(ThreadVars *tv, void *data, const Packet *p);
void AlertFastLogRegister(void)
@ -85,7 +85,7 @@ typedef struct AlertFastLogThread_ {
LogFileCtx* file_ctx;
} AlertFastLogThread;
int AlertFastLogCondition(ThreadVars *tv, const Packet *p)
int AlertFastLogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
{
return (p->alerts.cnt ? TRUE : FALSE);
}

2
src/alert-syslog.c
Unescape Escape View File

@ -367,7 +367,7 @@ static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *da
return TM_ECODE_OK;
}
static int AlertSyslogCondition(ThreadVars *tv, const Packet *p)
static int AlertSyslogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
{
return (p->alerts.cnt > 0 ? TRUE : FALSE);
}

38
src/log-pcap.c
Unescape Escape View File

@ -75,6 +75,11 @@
#define LOGMODE_SGUIL 1
#define LOGMODE_MULTI 2
typedef enum LogModeConditionalType_ {
LOGMODE_COND_ALL,
LOGMODE_COND_ALERTS
} LogModeConditionalType;
#define RING_BUFFER_MODE_DISABLED 0
#define RING_BUFFER_MODE_ENABLED 1
@ -155,6 +160,8 @@ typedef struct PcapLogData_ {
uint64_t profile_data_size; /**< track in bytes how many bytes we wrote */
uint32_t file_cnt; /**< count of pcap files we currently have */
uint32_t max_files; /**< maximum files to use in ring buffer mode */
LogModeConditionalType
conditional; /**< log all packets or just packets and flows with alerts */
PcapLogProfileData profile_lock;
PcapLogProfileData profile_write;
@ -200,7 +207,7 @@ static TmEcode PcapLogDataDeinit(ThreadVars *, void *);
static void PcapLogFileDeInitCtx(OutputCtx *);
static OutputInitResult PcapLogInitCtx(ConfNode *);
static void PcapLogProfilingDump(PcapLogData *);
static int PcapLogCondition(ThreadVars *, const Packet *);
static int PcapLogCondition(ThreadVars *, void *, const Packet *);
void PcapLogRegister(void)
{
@ -220,14 +227,24 @@ void PcapLogRegister(void)
(prof).total += (UtilCpuGetTicks() - pcaplog_profile_ticks); \
(prof).cnt++
static int PcapLogCondition(ThreadVars *tv, const Packet *p)
static int PcapLogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
{
PcapLogThreadData *ptd = (PcapLogThreadData *)thread_data;
if (p->flags & PKT_PSEUDO_STREAM_END) {
return FALSE;
}
if (IS_TUNNEL_PKT(p) && !IS_TUNNEL_ROOT_PKT(p)) {
return FALSE;
}
/* Log alerted flow */
if (ptd->pcap_log->conditional == LOGMODE_COND_ALERTS) {
if (p->alerts.cnt || (p->flow && FlowHasAlerts(p->flow))) {
return TRUE;
} else {
return FALSE;
}
}
return TRUE;
}
@ -630,6 +647,7 @@ static PcapLogData *PcapLogDataCopy(const PcapLogData *pl)
copy->timestamp_format = pl->timestamp_format;
copy->use_stream_depth = pl->use_stream_depth;
copy->size_limit = pl->size_limit;
copy->conditional = pl->conditional;
const PcapLogCompressionData *comp = &pl->compression;
PcapLogCompressionData *copy_comp = &copy->compression;
@ -1194,6 +1212,7 @@ static OutputInitResult PcapLogInitCtx(ConfNode *conf)
pl->timestamp_format = TS_FORMAT_SEC;
pl->use_stream_depth = USE_STREAM_DEPTH_DISABLED;
pl->honor_pass_rules = HONOR_PASS_RULES_DISABLED;
pl->conditional = LOGMODE_COND_ALL;
TAILQ_INIT(&pl->pcap_file_list);
@ -1416,6 +1435,21 @@ static OutputInitResult PcapLogInitCtx(ConfNode *conf)
SCLogInfo("Selected pcap-log compression method: %s",
compression_str ? compression_str : "none");
const char *s_conditional = ConfNodeLookupChildValue(conf, "conditional");
if (s_conditional != NULL) {
if (strcasecmp(s_conditional, "alerts") == 0) {
pl->conditional = LOGMODE_COND_ALERTS;
} else if (strcasecmp(s_conditional, "all") != 0) {
FatalError(SC_ERR_INVALID_ARGUMENT,
"log-pcap: invalid conditional \"%s\". Valid options: \"all\", "
"or \"alerts\" mode ",
s_conditional);
}
}
SCLogInfo(
"Selected pcap-log conditional logging: %s", s_conditional ? s_conditional : "all");
}
if (ParseFilename(pl, filename) != 0)

2
src/output-json-alert.c
Unescape Escape View File

@ -836,7 +836,7 @@ static int JsonAlertLogger(ThreadVars *tv, void *thread_data, const Packet *p)
return 0;
}
static int JsonAlertLogCondition(ThreadVars *tv, const Packet *p)
static int JsonAlertLogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
{
if (p->alerts.cnt || (p->flags & PKT_HAS_TAG)) {
return TRUE;

2
src/output-json-anomaly.c
Unescape Escape View File

@ -280,7 +280,7 @@ static int JsonAnomalyLogger(ThreadVars *tv, void *thread_data, const Packet *p)
return AnomalyJson(tv, aft, p);
}
static int JsonAnomalyLogCondition(ThreadVars *tv, const Packet *p)
static int JsonAnomalyLogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
{
return p->events.cnt > 0 ||
(p->app_layer_events && p->app_layer_events->cnt > 0) ||

2
src/output-json-drop.c
Unescape Escape View File

@ -324,7 +324,7 @@ static int JsonDropLogger(ThreadVars *tv, void *thread_data, const Packet *p)
*
* \retval bool TRUE or FALSE
*/
static int JsonDropLogCondition(ThreadVars *tv, const Packet *p)
static int JsonDropLogCondition(ThreadVars *tv, void *data, const Packet *p)
{
if (!EngineModeIsIPS()) {
SCLogDebug("engine is not running in inline mode, so returning");

2
src/output-json-frame.c
Unescape Escape View File

@ -368,7 +368,7 @@ static int JsonFrameLogger(ThreadVars *tv, void *thread_data, const Packet *p)
return FrameJson(tv, aft, p);
}
static int JsonFrameLogCondition(ThreadVars *tv, const Packet *p)
static int JsonFrameLogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
{
if (p->flow == NULL || p->flow->alproto == ALPROTO_UNKNOWN)
return FALSE;

2
src/output-json-metadata.c
Unescape Escape View File

@ -88,7 +88,7 @@ static int JsonMetadataLogger(ThreadVars *tv, void *thread_data, const Packet *p
return MetadataJson(tv, aft, p);
}
static int JsonMetadataLogCondition(ThreadVars *tv, const Packet *p)
static int JsonMetadataLogCondition(ThreadVars *tv, void *data, const Packet *p)
{
if (p->pktvar) {
return TRUE;

4
src/output-lua.c
Unescape Escape View File

@ -230,7 +230,7 @@ not_supported:
SCReturnInt(0);
}
static int LuaPacketConditionAlerts(ThreadVars *tv, const Packet *p)
static int LuaPacketConditionAlerts(ThreadVars *tv, void *data, const Packet *p)
{
if (p->alerts.cnt > 0)
return TRUE;
@ -280,7 +280,7 @@ not_supported:
SCReturnInt(0);
}
static int LuaPacketCondition(ThreadVars *tv, const Packet *p)
static int LuaPacketCondition(ThreadVars *tv, void *data, const Packet *p)
{
return TRUE;
}

2
src/output-packet.c
Unescape Escape View File

@ -106,7 +106,7 @@ static TmEcode OutputPacketLog(ThreadVars *tv, Packet *p, void *thread_data)
while (logger && store) {
DEBUG_VALIDATE_BUG_ON(logger->LogFunc == NULL || logger->ConditionFunc == NULL);
if ((logger->ConditionFunc(tv, (const Packet *)p)) == TRUE) {
if ((logger->ConditionFunc(tv, store->thread_data, (const Packet *)p)) == TRUE) {
PACKET_PROFILING_LOGGER_START(p, logger->logger_id);
logger->LogFunc(tv, store->thread_data, (const Packet *)p);
PACKET_PROFILING_LOGGER_END(p, logger->logger_id);

2
src/output-packet.h
Unescape Escape View File

@ -35,7 +35,7 @@ typedef int (*PacketLogger)(ThreadVars *, void *thread_data, const Packet *);
/** packet logger condition function pointer type,
* must return true for packets that should be logged
*/
typedef int (*PacketLogCondition)(ThreadVars *, const Packet *);
typedef int (*PacketLogCondition)(ThreadVars *, void *thread_data, const Packet *);
int OutputRegisterPacketLogger(LoggerId logger_id, const char *name,
PacketLogger LogFunc, PacketLogCondition ConditionFunc, OutputCtx *,

2
suricata.yaml.in
Unescape Escape View File

@ -402,6 +402,8 @@ outputs:
#ts-format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec
use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets
honor-pass-rules: no # If set to "yes", flows in which a pass rule matched will stop being logged.
# Use "all" to log all packets or use "alerts" to log only alerted packets and flows
#conditional: all
# a full alert log containing much information for signature writers
# or for investigating suspected false positives.

Write Preview
Loading…
Cancel
Save