Pull request #4778: extractor: add context logging event for notice

Merge in SNORT/snort3 from ~ANOROKH/snort3:extr_notice_event to master

Squashed commit of the following:

commit da9709af1b8edb7090a783471a78181ad880af28
Author: anorokh <anorokh@cisco.com>
Date:   Tue Jun 10 12:59:25 2025 +0300

    extractor: add context logging event for notice

diff --git a/doc/user/extractor.txt b/doc/user/extractor.txt
index 0ac8b4d6dc12d460277c2a3147c0b6ef32124d6f..0e5db0529c9853ca68382388faa73cd7692fe15c 100644 (file)
--- a/doc/user/extractor.txt
+++ b/doc/user/extractor.txt
@@ -67,6 +67,7 @@ Services and their events:
   ** 'builtin' (internally-detected infraction is queued for further processing)
 * triggered IPS rule, whether built-in or text or SO (notice)
   ** `ips_logging` (matched rules sent to IPS logging)
+  ** `context_logging` (matched rule in an IPS logger)
 
 Common fields available for every service:
 
@@ -168,13 +169,16 @@ UDP Connection States:
 TCP Connection States:
 
 The TCP connection state tracks both client and server states, each prefixed with CLT_ (for the client) and SRV_ (for the server).
-These states follow the TCP state machine as defined by the RFC, with the addition of TCP_MID_STREAM_SENT and TCP_MID_STREAM_REC to handle mid-stream traffic and TCP_STATE_NONE.
+These states follow the TCP state machine as defined by the RFC, with the addition of TCP_MID_STREAM_SENT
+and TCP_MID_STREAM_REC to handle mid-stream traffic and TCP_STATE_NONE.
 
 OTH (Other Traffic):
 
 The OTH state is used for all non-UDP and non-TCP traffic, as well as for error cases.
 
-* `history` - a string that tracks the connection's history. It uses letters to represent events, with uppercase letters denoting client-side events and lowercase letters for server-side events. Each letter appears only once for each direction, regardless of how many times the event occurs.
+* `history` - a string that tracks the connection's history. It uses letters to represent events, with
+uppercase letters denoting client-side events and lowercase letters for server-side events.
+Each letter appears only once for each direction, regardless of how many times the event occurs.
 
 UDP Events: d: Packet with payload.
 

diff --git a/src/network_inspectors/extractor/extractor_detection.cc b/src/network_inspectors/extractor/extractor_detection.cc
index a2798ccd5c92ffc337ea90939d7822d5554edc00..2f7de21ba4849ba388f4d0597395cd865d7443d7 100644 (file)
--- a/src/network_inspectors/extractor/extractor_detection.cc
+++ b/src/network_inspectors/extractor/extractor_detection.cc
@@ -196,7 +196,7 @@ static const map<string, IpsUserExtractor::VecGetFn> vec_getters =
 
 THREAD_LOCAL const snort::Connector::ID* IpsUserExtractor::log_id = nullptr;
 
-IpsUserExtractor::IpsUserExtractor(Extractor& i, uint32_t t, const vector<string>& fields)
+IpsUserExtractor::IpsUserExtractor(Extractor& i, uint32_t t, const vector<string>& fields, bool contextual)
     : ExtractorEvent(ServiceType::IPS_USER, i, t)
 {
     for (const auto& f : fields)
@@ -215,7 +215,8 @@ IpsUserExtractor::IpsUserExtractor(Extractor& i, uint32_t t, const vector<string
             continue;
     }
 
-    DataBus::subscribe_global(de_pub_key, DetectionEventIds::IPS_LOGGING, new IpsUser(*this, S_NAME), i.get_snort_config());
+    auto event = contextual ? DetectionEventIds::CONTEXT_LOGGING : DetectionEventIds::IPS_LOGGING;
+    DataBus::subscribe_global(de_pub_key, event, new IpsUser(*this, S_NAME), i.get_snort_config());
 }
 
 void IpsUserExtractor::internal_tinit(const snort::Connector::ID* service_id)

diff --git a/src/network_inspectors/extractor/extractor_detection.h b/src/network_inspectors/extractor/extractor_detection.h
index 61ca8cfcb6e1abe03a5909eab767c554803f29c9..c1b233539e814812d38dcd6f1f05c44cb81bcff7 100644 (file)
--- a/src/network_inspectors/extractor/extractor_detection.h
+++ b/src/network_inspectors/extractor/extractor_detection.h
@@ -43,7 +43,7 @@ public:
     using VecGetFn = const std::vector<const char*>& (*) (const DataEvent*, const Flow*);
     using VecField = DataField<const std::vector<const char*>&, const DataEvent*, const Flow*>;
 
-    IpsUserExtractor(Extractor&, uint32_t tenant, const std::vector<std::string>& fields);
+    IpsUserExtractor(Extractor&, uint32_t tenant, const std::vector<std::string>& fields, bool contextual);
 
     std::vector<const char*> get_field_names() const override;
     void handle(DataEvent&, Flow*);

diff --git a/src/network_inspectors/extractor/extractor_service.cc b/src/network_inspectors/extractor/extractor_service.cc
index 15fd67ab33b6aba55a21c3d76015bc6cc4d8938b..e153f3d5dd8612aff5ad1e2d1eb4751b04bcc009 100644 (file)
--- a/src/network_inspectors/extractor/extractor_service.cc
+++ b/src/network_inspectors/extractor/extractor_service.cc
@@ -459,6 +459,7 @@ const ServiceBlueprint IpsUserExtractorService::blueprint =
     // events
     {
         "ips_logging",
+        "context_logging",
     },
     // fields
     {
@@ -481,8 +482,9 @@ IpsUserExtractorService::IpsUserExtractorService(uint32_t tenant, const std::vec
 {
     for (const auto& event : get_events())
     {
-        if (!strcmp("ips_logging", event.c_str()))
-            handlers.push_back(new IpsUserExtractor(ins, tenant_id, get_fields()));
+        bool contextual = !strcmp("context_logging", event.c_str());
+        if (contextual or !strcmp("ips_logging", event.c_str()))
+            handlers.push_back(new IpsUserExtractor(ins, tenant_id, get_fields(), contextual));
     }
 }
 

diff --git a/src/pub_sub/detection_events.h b/src/pub_sub/detection_events.h
index 33dadb897ab81f85f96319f7da45cac13d0b5e8f..ec9a74537efe5e0d4795b2b0c391d762cb39b68b 100644 (file)
--- a/src/pub_sub/detection_events.h
+++ b/src/pub_sub/detection_events.h
@@ -31,8 +31,9 @@ struct DetectionEventIds
 {
     enum : unsigned
     {
-        IPS_LOGGING,
-        BUILTIN,
+        IPS_LOGGING,     // before IPS loggers invoked
+        CONTEXT_LOGGING, // in an IPS logger
+        BUILTIN,         // built-in event added in the event queue
         MAX
     };
 };