]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
alert/syslog: only hold lock for syslog call
authorVictor Julien <vjulien@oisf.net>
Fri, 22 Mar 2024 10:11:40 +0000 (11:11 +0100)
committerVictor Julien <victor@inliniac.net>
Fri, 12 Apr 2024 09:45:44 +0000 (11:45 +0200)
src/alert-syslog.c

index fd1742adb01f46d1a85110555704ee98e1896782..61accfd8e7f599fe2d207c9c941d49a1646c64c0 100644 (file)
@@ -212,9 +212,6 @@ static TmEcode AlertSyslogIPv4(ThreadVars *tv, const Packet *p, void *data)
         protoptr = proto;
     }
 
-    /* Not sure if this mutex is needed around calls to syslog. */
-    SCMutexLock(&ast->file_ctx->fp_mutex);
-
     for (i = 0; i < p->alerts.cnt; i++) {
         const PacketAlert *pa = &p->alerts.alerts[i];
         if (unlikely(pa->s == NULL)) {
@@ -232,13 +229,15 @@ static TmEcode AlertSyslogIPv4(ThreadVars *tv, const Packet *p, void *data)
             action = "[wDrop] ";
         }
 
+        /* Not sure if this mutex is needed around calls to syslog. */
+        SCMutexLock(&ast->file_ctx->fp_mutex);
         syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"
                 PRIu32 "] %s [Classification: %s] [Priority: %"PRIu32"]"
                 " {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "", action, pa->s->gid,
                 pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio,
                 protoptr,  srcip, p->sp, dstip, p->dp);
+        SCMutexUnlock(&ast->file_ctx->fp_mutex);
     }
-    SCMutexUnlock(&ast->file_ctx->fp_mutex);
 
     return TM_ECODE_OK;
 }
@@ -270,8 +269,6 @@ static TmEcode AlertSyslogIPv6(ThreadVars *tv, const Packet *p, void *data)
         protoptr = proto;
     }
 
-    SCMutexLock(&ast->file_ctx->fp_mutex);
-
     for (i = 0; i < p->alerts.cnt; i++) {
         const PacketAlert *pa = &p->alerts.alerts[i];
         if (unlikely(pa->s == NULL)) {
@@ -289,15 +286,15 @@ static TmEcode AlertSyslogIPv6(ThreadVars *tv, const Packet *p, void *data)
             action = "[wDrop] ";
         }
 
+        SCMutexLock(&ast->file_ctx->fp_mutex);
         syslog(alert_syslog_level, "%s[%" PRIu32 ":%" PRIu32 ":%"
                 "" PRIu32 "] %s [Classification: %s] [Priority: %"
                 "" PRIu32 "] {%s} %s:%" PRIu32 " -> %s:%" PRIu32 "",
                 action, pa->s->gid, pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg,
                 pa->s->prio, protoptr, srcip, p->sp,
                 dstip, p->dp);
-
+        SCMutexUnlock(&ast->file_ctx->fp_mutex);
     }
-    SCMutexUnlock(&ast->file_ctx->fp_mutex);
 
     return TM_ECODE_OK;
 }
@@ -320,8 +317,6 @@ static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *da
     if (p->alerts.cnt == 0)
         return TM_ECODE_OK;
 
-    SCMutexLock(&ast->file_ctx->fp_mutex);
-
     char temp_buf_hdr[512];
     char temp_buf_pkt[65] = "";
     char temp_buf_tail[64];
@@ -357,9 +352,10 @@ static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *da
         }
         strlcat(alert, temp_buf_tail, sizeof(alert));
 
+        SCMutexLock(&ast->file_ctx->fp_mutex);
         syslog(alert_syslog_level, "%s", alert);
+        SCMutexUnlock(&ast->file_ctx->fp_mutex);
     }
-    SCMutexUnlock(&ast->file_ctx->fp_mutex);
 
     return TM_ECODE_OK;
 }