Merge pull request #3077 in SNORT/snort3 from ~ROOBS/snort3:packet_tracer_config...

Squashed commit of the following:

commit 0a1add665730f5f1f5fcfb35e76fc20d539d1bc7
Author: roopa <roobs@cisco.com>
Date:   Thu Sep 23 08:47:46 2021 -0400

    file: Added file policy id and other config data as part of packet tracer command under File phase.

diff --git a/src/file_api/file_flows.cc b/src/file_api/file_flows.cc
index 9f1c24ff1823a58411728feb27c91c14d29aad97..df7ad70ec484d979bece40185c8dba8cfb91e464 100644 (file)
--- a/src/file_api/file_flows.cc
+++ b/src/file_api/file_flows.cc
@@ -75,14 +75,18 @@ static void populate_trace_data(FileContext* context)
     context->print_file_name(ss);
     std::string file_name = ss.str();
 
-    PacketTracer::daq_log("file+%" PRId64"++File Type[%s]/File ID[%lu] with name[%s] and size[%lu] detected."
-                "File SHA is [%s], with verdict[%s]$",
+    PacketTracer::daq_log("file+%" PRId64"+Matched policy id %u, identification %s, signature %s, capture %s+"
+                "File with ID %lu, name %s, type %s, size %lu, SHA %s detected. Verdict %s.$",
                 TO_NSECS(pt_timer->get()),
-                file_type_name(context->get_file_type()).c_str(),
+                context->get_policy_id(),
+                ((context->is_file_type_enabled() || context->get_file_type() || context->get_file_sig_sha256()) ? "<on>" : "<off>"),
+                ((context->is_file_signature_enabled() || context->get_file_sig_sha256()) ? "<on>" : "<off>"),
+                (context->is_file_capture_enabled() ? "<on>" : "<off>"),
                 context->get_file_id(),
-                file_name.c_str(),
+                (file_name.empty() ? "<empty>" : file_name.c_str()),
+                file_type_name(context->get_file_type()).c_str(),
                 context->get_file_size(),
-                (context->get_file_sig_sha256() ? context->sha_to_string(context->get_file_sig_sha256()).c_str(): "null"),
+                (context->get_file_sig_sha256() ? context->sha_to_string(context->get_file_sig_sha256()).c_str(): "<empty>"),
                 VerdictName[context->verdict].c_str());
 }
 

diff --git a/src/file_api/file_lib.cc b/src/file_api/file_lib.cc
index 9ea1d1e775620cb8e78b484bcf2a8731044edc51..68395bb06161fa4c20839ba16539b980f4fb826c 100644 (file)
--- a/src/file_api/file_lib.cc
+++ b/src/file_api/file_lib.cc
@@ -259,6 +259,16 @@ bool FileInfo::is_file_capture_enabled()
     return file_capture_enabled;
 }
 
+void FileInfo::set_policy_id(uint32_t id)
+{
+    policy_id = id;
+}
+
+uint32_t FileInfo::get_policy_id()
+{
+    return policy_id;
+}
+
 FileCaptureState FileInfo::reserve_file(FileCapture*& dest)
 {
     if (!file_capture)

diff --git a/src/file_api/file_lib.h b/src/file_api/file_lib.h
index d57824a93c67fe39661131a04b88477ba7b3e4dc..c24b3ea466eb2239cdde7bcf4759f62f554be6bc 100644 (file)
--- a/src/file_api/file_lib.h
+++ b/src/file_api/file_lib.h
@@ -77,6 +77,8 @@ public:
     bool is_file_signature_enabled();
     void config_file_capture(bool enabled);
     bool is_file_capture_enabled();
+    void set_policy_id(uint32_t id);
+    uint32_t get_policy_id();
 
     // Preserve the file in memory until it is released
     // The file reserved will be returned and it will be detached from file context/session
@@ -104,6 +106,7 @@ protected:
     bool file_signature_enabled = false;
     bool file_capture_enabled = false;
     FileState file_state = { FILE_CAPTURE_SUCCESS, FILE_SIG_PROCESSING };
+    uint32_t policy_id = 0;
 
 private:
     void copy(const FileInfo& other);

diff --git a/src/file_api/file_policy.cc b/src/file_api/file_policy.cc
index 86d93957ddb3918622d934cdaca768a98089798b..af81d0bba28f978eab315f8a76615991a60062d9 100644 (file)
--- a/src/file_api/file_policy.cc
+++ b/src/file_api/file_policy.cc
@@ -172,6 +172,7 @@ void FilePolicy::policy_check(Flow*, FileInfo* file)
     file->config_file_type(type_enabled);
     file->config_file_signature(signature_enabled);
     file->config_file_capture(capture_enabled);
+    file->set_policy_id(0);
 }
 
 FileVerdict FilePolicy::type_lookup(Packet*, FileInfo* file)