virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
const Packet* const);
virtual void get_protocol_ids(std::vector<uint16_t>&);
{ v.push_back(IPPROTO_ID_FRAGMENT); }
-void Ipv6FragCodec::log(TextLog* log, const uint8_t* raw_pkt,
+void Ipv6FragCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
const Packet* const)
{
const ip::IP6Frag* fragh = reinterpret_cast<const ip::IP6Frag*>(raw_pkt);
const uint16_t offlg = ntohs(fragh->get_off());
- TextLog_Print(log, "Frag6: Next:%s(%02X) Off:%u ID:%u",
- PacketManager::get_proto_name(fragh->ip6f_nxt), fragh->ip6f_nxt,
- (offlg >> 3), ntohl(fragh->get_id()));
+ TextLog_Print(text_log, "\tNext:0x%02X Off:%u ID:%u",
+ fragh->ip6f_nxt, (offlg >> 3), ntohl(fragh->get_id()));
if (offlg & ip::IP6F_MF_MASK)
- TextLog_Puts(log, " MF");
-
- TextLog_NewLine(log);
+ TextLog_Puts(text_log, " MF");
}
//-------------------------------------------------------------------------
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- void log(TextLog* /*log*/, const uint8_t* /*raw_pkt*/,
+ void log(TextLog* const, const uint8_t* /*raw_pkt*/,
const Packet* const);
}
-void GreCodec::log(TextLog* log, const uint8_t* raw_pkt,
+void GreCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
const Packet* const)
{
const gre::GREHdr *greh = reinterpret_cast<const gre::GREHdr *>(raw_pkt);
- TextLog_Print(log, "GRE version:%u flags:0x%02X ether-type:%s(0x%04X)\n",
+ TextLog_Putc(text_log, '\t');
+ TextLog_Print(text_log, "version:%u flags:0x%02X ether-type:%s(0x%04X)",
greh->get_version(), greh->flags,
PacketManager::get_proto_name(greh->get_proto()),
greh->get_proto());
#include "codecs/sf_protocols.h"
#include "codecs/ip/ip_util.h"
#include "packet_io/active.h"
+#include "log/text_log.h"
namespace{
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+ const Packet* const);
private:
void ICMP4AddrTests (Packet* );
if(raw_len < icmp::ICMP_HEADER_LEN)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "WARNING: Truncated ICMP4 header (%d bytes).\n", raw_len););
-
codec_events::decoder_event(p, DECODE_ICMP4_HDR_TRUNC);
p->icmph = NULL;
return false;
/* set the header ptr first */
- p->icmph = reinterpret_cast<ICMPHdr *>(const_cast<uint8_t *> (raw_pkt));
+ p->icmph = reinterpret_cast<const ICMPHdr *>(raw_pkt);
switch (p->icmph->type)
{
lyr_len = icmp::ICMP_HEADER_LEN;
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "ICMP type: %d code: %d\n",
- p->icmph->type, p->icmph->code););
-
switch(p->icmph->type)
{
case icmp::IcmpType::ECHO_4:
codec_events::decoder_event(p, DECODE_ICMP_DST_UNREACH_DST_NET_PROHIBITED);
}
+/******************************************************************
+ ************************* L O G G E R **************************
+ ******************************************************************/
+
+void Icmp4Codec::log(TextLog* const log, const uint8_t* raw_pkt,
+ const Packet* const)
+{
+
+ const icmp::ICMPHdr* const icmph = reinterpret_cast<const ICMPHdr *>(raw_pkt);
+
+ /* 32 digits plus 7 colons and a NULL byte */
+ char buf[8*4 + 7 + 1];
+
+ TextLog_Putc(log, '\t');
+ TextLog_Print(log, "Type:%d Code:%d ", icmph->type, icmph->code);
+
+ switch(icmph->type)
+ {
+ case icmp::IcmpType::ECHOREPLY:
+ TextLog_Print(log, "ID:%d Seq:%d ", ntohs(icmph->s_icmp_id),
+ ntohs(icmph->s_icmp_seq));
+ TextLog_Puts(log, "ECHO REPLY");
+ break;
+
+ case icmp::IcmpType::DEST_UNREACH:
+ TextLog_Puts(log, "DESTINATION UNREACHABLE: ");
+ switch(icmph->code)
+ {
+ case icmp::IcmpCode::NET_UNREACH:
+ TextLog_Puts(log, "NET UNREACHABLE");
+ break;
+
+ case icmp::IcmpCode::HOST_UNREACH:
+ TextLog_Puts(log, "HOST UNREACHABLE");
+ break;
+
+ case icmp::IcmpCode::PROT_UNREACH:
+ TextLog_Puts(log, "PROTOCOL UNREACHABLE");
+ break;
+
+ case icmp::IcmpCode::PORT_UNREACH:
+ TextLog_Puts(log, "PORT UNREACHABLE");
+ break;
+
+ case icmp::IcmpCode::FRAG_NEEDED:
+ TextLog_Print(log, "FRAGMENTATION NEEDED,\n\tDF SET,"
+ " NEXT LINK MTU: %u",
+ ntohs(icmph->s_icmp_nextmtu));
+ break;
+
+ case icmp::IcmpCode::SR_FAILED:
+ TextLog_Puts(log, "SOURCE ROUTE FAILED");
+ break;
+
+ case icmp::IcmpCode::NET_UNKNOWN:
+ TextLog_Puts(log, "NET UNKNOWN");
+ break;
+
+ case icmp::IcmpCode::HOST_UNKNOWN:
+ TextLog_Puts(log, "HOST UNKNOWN");
+ break;
+
+ case icmp::IcmpCode::HOST_ISOLATED:
+ TextLog_Puts(log, "HOST ISOLATED");
+ break;
+
+ case icmp::IcmpCode::PKT_FILTERED_NET:
+ TextLog_Puts(log, "ADMINISTRATIVELY PROHIBITED NETWORK FILTERED");
+ break;
+
+ case icmp::IcmpCode::PKT_FILTERED_HOST:
+ TextLog_Puts(log, "ADMINISTRATIVELY PROHIBITED HOST FILTERED");
+ break;
+
+ case icmp::IcmpCode::NET_UNR_TOS:
+ TextLog_Puts(log, "NET UNREACHABLE FOR TOS");
+ break;
+
+ case icmp::IcmpCode::HOST_UNR_TOS:
+ TextLog_Puts(log, "HOST UNREACHABLE FOR TOS");
+ break;
+
+ case icmp::IcmpCode::PKT_FILTERED:
+ TextLog_Puts(log, "ADMINISTRATIVELY PROHIBITED,\n\tPACKET FILTERED");
+ break;
+
+ case icmp::IcmpCode::PREC_VIOLATION:
+ TextLog_Puts(log, "PREC VIOLATION");
+ break;
+
+ case icmp::IcmpCode::PREC_CUTOFF:
+ TextLog_Puts(log, "PREC CUTOFF");
+ break;
+
+ default:
+ TextLog_Puts(log, "UNKNOWN");
+ break;
+
+ }
+ break;
+
+ case icmp::IcmpType::SOURCE_QUENCH:
+ TextLog_Puts(log, "SOURCE QUENCH");
+ break;
+
+ case icmp::IcmpType::REDIRECT:
+ TextLog_Puts(log, "REDIRECT");
+ switch(icmph->code)
+ {
+ case icmp::IcmpCode::REDIR_NET:
+ TextLog_Puts(log, " NET");
+ break;
+
+ case icmp::IcmpCode::REDIR_HOST:
+ TextLog_Puts(log, " HOST");
+ break;
+
+ case icmp::IcmpCode::REDIR_TOS_NET:
+ TextLog_Puts(log, " TOS NET");
+ break;
+
+ case icmp::IcmpCode::REDIR_TOS_HOST:
+ TextLog_Puts(log, " TOS HOST");
+ break;
+
+ default:
+ break;
+ }
+
+/* written this way since inet_ntoa was typedef'ed to use sfip_ntoa
+ * which requires sfip_t instead of inaddr's. This call to inet_ntoa
+ * is a rare case that doesn't use sfip_t's. */
+
+// XXX-IPv6 NOT YET IMPLEMENTED - IPV6 addresses technically not supported - need to change ICMP
+
+ /* no inet_ntop in Windows */
+ sfip_raw_ntop(AF_INET, (const void *)(&icmph->s_icmp_gwaddr.s_addr),
+ buf, sizeof(buf));
+ TextLog_Print(log, " NEW GW: %s", buf);
+ break;
+
+ case icmp::IcmpType::ECHO_4:
+ TextLog_Print(log, "ID:%d Seq:%d ", ntohs(icmph->s_icmp_id),
+ ntohs(icmph->s_icmp_seq));
+ TextLog_Puts(log, "ECHO");
+ break;
+
+ case icmp::IcmpType::ROUTER_ADVERTISE:
+ TextLog_Print(log, "ROUTER ADVERTISMENT: "
+ "Num addrs: %d Addr entry size: %d Lifetime: %u",
+ icmph->s_icmp_num_addrs, icmph->s_icmp_wpa,
+ ntohs(icmph->s_icmp_lifetime));
+ break;
+
+ case icmp::IcmpType::ROUTER_SOLICIT:
+ TextLog_Puts(log, "ROUTER SOLICITATION");
+ break;
+
+ case icmp::IcmpType::TIME_EXCEEDED:
+ TextLog_Puts(log, "TTL EXCEEDED");
+ switch(icmph->code)
+ {
+ case icmp::IcmpCode::TIMEOUT_TRANSIT:
+ TextLog_Puts(log, " IN TRANSIT");
+ break;
+
+ case icmp::IcmpCode::TIMEOUT_REASSY:
+ TextLog_Puts(log, " TIME EXCEEDED IN FRAG REASSEMBLY");
+ break;
+
+ default:
+ break;
+ }
+
+ break;
+
+ case icmp::IcmpType::PARAMETERPROB:
+ TextLog_Puts(log, "PARAMETER PROBLEM");
+ switch(icmph->code)
+ {
+ case icmp::IcmpCode::PARAM_BADIPHDR:
+ TextLog_Print(log, ": BAD IP HEADER BYTE %u",
+ icmph->s_icmp_pptr);
+ break;
+
+ case icmp::IcmpCode::PARAM_OPTMISSING:
+ TextLog_Puts(log, ": OPTION MISSING");
+ break;
+
+ case icmp::IcmpCode::PARAM_BAD_LENGTH:
+ TextLog_Puts(log, ": BAD LENGTH");
+ break;
+
+ default:
+ break;
+ }
+
+ break;
+
+ case icmp::IcmpType::TIMESTAMP:
+ TextLog_Print(log, "ID: %u Seq: %u TIMESTAMP REQUEST",
+ ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq));
+ break;
+
+ case icmp::IcmpType::TIMESTAMPREPLY:
+ TextLog_Print(log, "ID: %u Seq: %u TIMESTAMP REPLY:\n\t"
+ "Orig: %u Rtime: %u Ttime: %u",
+ ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq),
+ icmph->s_icmp_otime, icmph->s_icmp_rtime,
+ icmph->s_icmp_ttime);
+ break;
+
+ case icmp::IcmpType::INFO_REQUEST:
+ TextLog_Print(log, "ID: %u Seq: %u INFO REQUEST",
+ ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq));
+ break;
+
+ case icmp::IcmpType::INFO_REPLY:
+ TextLog_Print(log, "ID: %u Seq: %u INFO REPLY",
+ ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq));
+ break;
+
+ case icmp::IcmpType::ADDRESS:
+ TextLog_Print(log, "ID: %u Seq: %u ADDRESS REQUEST",
+ ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq));
+ break;
+
+ case icmp::IcmpType::ADDRESSREPLY:
+ TextLog_Print(log, "ID: %u Seq: %u ADDRESS REPLY: 0x%08X",
+ ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq),
+ (u_int) ntohl(icmph->s_icmp_mask));
+ break;
+
+ default:
+ TextLog_Puts(log, "UNKNOWN");
+
+ break;
+ }
+}
+
/******************************************************************
******************** E N C O D E R ******************************
******************************************************************/
#include "codecs/ip/checksum.h"
#include "codecs/ip/ip_util.h"
#include "packet_io/active.h"
+#include "log/text_log.h"
namespace
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+ const Packet* const);
};
/******************************************************************
- ******************** E N C O D E R ******************************
+ ************************* L O G G E R *************************
+ ******************************************************************/
+
+void Icmp6Codec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+ const Packet* const)
+{
+ const icmp::ICMP6Hdr* const icmph = reinterpret_cast<const icmp::ICMP6Hdr*>(raw_pkt);
+ TextLog_Print(text_log, "\tsType:%d Code:%d ", icmph->type, icmph->code);
+}
+
+/******************************************************************
+ ************************* E N C O D E R *************************
******************************************************************/
//-------------------------------------------------------------------------
static Module* mod_ctor()
-{
- return new Icmp6Module;
-}
+{ return new Icmp6Module; }
static void mod_dtor(Module* m)
-{
- delete m;
-}
+{ delete m; }
static Codec* ctor(Module*)
-{
- return new Icmp6Codec();
-}
+{ return new Icmp6Codec(); }
static void dtor(Codec *cd)
-{
- delete cd;
-}
+{ delete cd; }
static const CodecApi ipv6_api =
{
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
const Packet* const);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
byte_skip = 1;
break;
default:
- /* handle all the dynamic features */
+ /* FIXIT-L - J ip option validation should be updated. 3 of these fields are useless */
code = OptLenValidate(option_ptr, end_ptr, len_ptr, -1,
reinterpret_cast<Options *>(&p->ip_options[opt_count]), &byte_skip);
}
};
};
-void Ipv4Codec::log(TextLog* log, const uint8_t* raw_pkt, const Packet* const p)
+void Ipv4Codec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+ const Packet* const p)
{
const IP4Hdr* const ip4h = reinterpret_cast<const IP4Hdr*>(raw_pkt);
+ TextLog_Putc(text_log, '\t');
// FIXIT-H --> This does NOT obfuscate correctly
if (ScObfuscate())
{
- TextLog_Print(log, "IPv4 xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx");
+ TextLog_Print(text_log, "xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx");
}
else
{
src.addr32 = ip4h->get_src();
dst.addr32 = ip4h->get_dst();
- TextLog_Print(log, "%d.%d.%d.%d -> %d.%d.%d.%d",
+ TextLog_Print(text_log, "%d.%d.%d.%d -> %d.%d.%d.%d",
(int)src.addr8[0], (int)src.addr8[1],
(int)src.addr8[2], (int)src.addr8[3],
(int)dst.addr8[0], (int)dst.addr8[1],
(int)dst.addr8[2], (int)dst.addr8[3]);
}
- TextLog_NewLine(log);
+ TextLog_NewLine(text_log);
+ TextLog_Putc(text_log, '\t');
+
const uint16_t hlen = ip4h->get_hlen() << 2;
const uint16_t len = ntohs(ip4h->get_len());
const uint16_t frag_off = ntohs(ip4h->get_off());
- TextLog_Print(log, "\tNext:%s(%02X) TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u",
- PacketManager::get_proto_name(ip4h->get_proto()),
+ TextLog_Print(text_log, "Next:0x%02X TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u",
ip4h->get_proto(), ip4h->get_ttl(), ip4h->get_tos(),
ip4h->get_id(), hlen, len);
/* print the reserved bit if it's set */
if(frag_off & 0x8000)
- TextLog_Puts(log, " RB");
+ TextLog_Puts(text_log, " RB");
/* printf more frags/don't frag bits */
if(frag_off & 0x4000)
- TextLog_Puts(log, " DF");
+ TextLog_Puts(text_log, " DF");
if(frag_off & 0x2000)
- TextLog_Puts(log, " MF");
-
- TextLog_NewLine(log);
+ TextLog_Puts(text_log, " MF");
/* print IP options */
if(p->ip_option_count > 0)
{
- LogIpOptions(log, p);
+ TextLog_Putc(text_log, '\t');
+ TextLog_NewLine(text_log);
+ LogIpOptions(text_log, p);
}
if( p->decode_flags & DECODE__FRAG)
{
- TextLog_Print(log, "Frag Offset: 0x%04X Frag Size: 0x%04X\n",
+ TextLog_NewLine(text_log);
+ TextLog_Putc(text_log, '\t');
+ TextLog_Print(text_log, "Frag Offset: 0x%04X Frag Size: 0x%04X\n",
(frag_off & 0x1FFF), (len - hlen));
}
}
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
- virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
const Packet* const) ;
private:
********************* L O G G E R ******************************
*******************************************************************/
-void Ipv6Codec::log(TextLog* log, const uint8_t* raw_pkt,
+void Ipv6Codec::log(TextLog* const text_log, const uint8_t* raw_pkt,
const Packet* const)
{
const ip::IP6Hdr* const ip6h = reinterpret_cast<const ip::IP6Hdr*>(raw_pkt);
-
-
- TextLog_NewLine(log);
+ TextLog_Putc(text_log, '\t');
//FIXIT-H --> This does NOT obfuscate correctly
// FIXIT-H --> This does NOT obfuscate correctly
if (ScObfuscate())
{
- TextLog_Print(log, "IPv6 x:x:x:x::x:x:x:x -> x:x:x:x::x:x:x:x");
+ TextLog_Print(text_log, "x:x:x:x::x:x:x:x -> x:x:x:x::x:x:x:x");
}
else
{
const ip::snort_in6_addr* const src = ip6h->get_src();
const ip::snort_in6_addr* const dst = ip6h->get_dst();
- TextLog_Print(log, "%02X%02X:%02X%02X:%02X%02X:%02X%02X:%02X%02X:"
+ TextLog_Print(text_log, "%02X%02X:%02X%02X:%02X%02X:%02X%02X:%02X%02X:"
"%02X%02X:%02X%02X:%02X%02X -> %02X%02X:%02X%02X:"
"%02X%02X:%02X%02X:%02X%02X:%02X%02X",
(int)src->u6_addr8[0], (int)src->u6_addr8[1], (int)src->u6_addr8[2],
}
- TextLog_NewLine(log);
+ TextLog_NewLine(text_log);
+ TextLog_Putc(text_log, '\t');
- TextLog_Print(log, "\tNext:%s(%02X) TTL:%u TOS:0x%X DgmLen:%u",
- PacketManager::get_proto_name(ip6h->get_next()),
+ TextLog_Print(text_log, "Next:0x%02X TTL:%u TOS:0x%X DgmLen:%u",
ip6h->get_next(), ip6h->get_hop_lim(), ip6h->get_tos(),
ntohs(ip6h->get_len()));
-
- TextLog_NewLine(log);
}
virtual PROTO_ID get_proto_id() { return PROTO_TCP; };
virtual void get_protocol_ids(std::vector<uint16_t>& v);
- virtual void log(TextLog*, const uint8_t* /*raw_pkt*/,
- const Packet* const) ;
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+ const Packet* const);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &);
virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in);
******************************************************************/
-void TcpCodec::log(TextLog* log, const uint8_t* raw_pkt,
+void TcpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
const Packet* const p)
{
char tcpFlags[9];
const tcp::TCPHdr* tcph = reinterpret_cast<const tcp::TCPHdr*>(raw_pkt);
- TextLog_Puts(log, "TCP ");
+ TextLog_Putc(text_log, '\t');
/* print TCP flags */
CreateTCPFlagString(tcph, tcpFlags);
- TextLog_Puts(log, tcpFlags); /* We don't care about the NULL */
+ TextLog_Puts(text_log, tcpFlags); /* We don't care about the NULL */
/* print other TCP info */
- TextLog_Print(log, " SrcPort:%u DstPort:%u Seq: 0x%lX Ack: 0x%lX "
+ TextLog_Print(text_log, " SrcPort:%u DstPort:%u Seq: 0x%lX Ack: 0x%lX "
"Win: 0x%X TcpLen: %d",ntohs(tcph->th_sport),
ntohs(tcph->th_dport), (u_long) ntohl(tcph->th_seq),
(u_long) ntohl(tcph->th_ack),
ntohs(tcph->th_win), TCP_OFFSET(tcph) << 2);
if((tcph->th_flags & TH_URG) != 0)
- TextLog_Print(log, " UrgPtr: 0x%X\n", (uint16_t) ntohs(tcph->th_urp));
+ TextLog_Print(text_log, "UrgPtr: 0x%X", (uint16_t) ntohs(tcph->th_urp));
- TextLog_NewLine(log);
/* dump the TCP options */
if(p->tcp_option_count > 0)
{
- LogTcpOptions(log, p);
+ TextLog_NewLine(text_log);
+ TextLog_Putc(text_log, '\t');
+ LogTcpOptions(text_log, p);
}
}
virtual bool encode(EncState*, Buffer* out, const uint8_t *raw_in);
virtual bool update(Packet*, Layer*, uint32_t* len);
virtual void format(EncodeFlags, const Packet* p, Packet* c, Layer*);
- virtual void log(TextLog*, const uint8_t* /*raw_pkt*/, const Packet* const);
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+ const Packet* const);
};
p->dsize = p->ip_api.pay_len();
}
-void UdpCodec::log(TextLog* log, const uint8_t* raw_pkt, const Packet* const)
+void UdpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt, const Packet* const)
{
const udp::UDPHdr* udph = reinterpret_cast<const udp::UDPHdr*>(raw_pkt);
- TextLog_Print(log, "UDP SourcePort:%d DestPort:%d Len:%d\n",
+ TextLog_Print(text_log, "\tSourcePort:%d DestPort:%d Len:%d",
ntohs(udph->uh_sport), ntohs(udph->uh_dport),
ntohs(udph->uh_len) - udp::UDP_HEADER_LEN);
}
#include "codecs/sf_protocols.h"
#include "protocols/arp.h"
#include "protocols/packet.h"
+#include "log/text_log.h"
namespace
{
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &);
-
};
return true;
}
-
-
//-------------------------------------------------------------------------
// api
//-------------------------------------------------------------------------
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- virtual void log(TextLog*, const uint8_t* /*raw_pkt*/, const Packet* const);
-
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+ const Packet* const);
};
return iRet;
}
-void MplsCodec::log(TextLog* log, const uint8_t* /*raw_pkt*/,
+void MplsCodec::log(TextLog* const text_log, const uint8_t* /*raw_pkt*/,
const Packet* const p)
{
- TextLog_Print(log,"MPLS label:0x%05X exp:0x%X bos:0x%X ttl:0x%X\n",
+ TextLog_Print(text_log,"\tlabel:0x%05X exp:0x%X bos:0x%X ttl:0x%X\n",
p->mplsHdr.label, p->mplsHdr.exp, p->mplsHdr.bos, p->mplsHdr.ttl);
}
virtual void get_protocol_ids(std::vector<uint16_t>& v);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- virtual void log(TextLog*, const uint8_t* /*raw_pkt*/, const Packet* const);
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+ const Packet* const);
};
return true;
}
-void VlanCodec::log(TextLog* text_log, const uint8_t* raw_pkt, const Packet* const)
+void VlanCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+ const Packet* const)
{
const vlan::VlanTagHdr *vh = reinterpret_cast<const vlan::VlanTagHdr *>(raw_pkt);
const uint16_t proto = ntohs(vh->vth_proto);
const uint16_t vid = vlan::vth_vlan(vh);
- uint16_t proto_name;
- if (proto <= ETHERNET_MAX_LEN_ENCAP)
- proto_name = ETHERNET_LLC;
- else
- proto_name = proto;
+
+ TextLog_Putc(text_log, '\t');
+ TextLog_Print(text_log, "Priority:%d(0x%X) CFI:%d "
+ "Vlan_ID:%d(0x%04X)",
+ vlan::vth_priority(vh), vlan::vth_priority(vh),
+ vlan::vth_cfi(vh), vid, vid);
- TextLog_Print(text_log, "VLAN Priority:%d(0x%X) CFI:%d "
- "Vlan_ID:%d(0x%04X) Next:%s(%04X)",
- vlan::vth_priority(vh), vlan::vth_cfi(vh),
- vid, vid, PacketManager::get_proto_name(proto_name),
- proto);
+ if (proto <= ETHERNET_MAX_LEN_ENCAP)
+ TextLog_Print(text_log, " Len:0x%04X", proto);
+ else
+ TextLog_Print(text_log, " Next:0x%04X", proto);
}
#include "protocols/ipv4.h"
#include "protocols/packet.h"
#include "codecs/codec_events.h"
-
+#include "log/text_log.h"
+#include "main/snort.h"
+#include "log/messages.h"
+#include "protocols/packet_manager.h"
namespace
{
-// yes, macros are necessary. The API and class constructor require different strings.
-//
-// this macros is defined in the module to ensure identical names. However,
-// if you don't want a module, define the name here.
-#ifndef ICMP4_IP_NAME
#define ICMP4_IP_NAME "icmp4_ip"
-#endif
class Icmp4IpCodec : public Codec
{
virtual bool encode(EncState* enc, Buffer* out, const uint8_t* raw_in);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
-
-
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+ const Packet* const);
};
} // namespace
}
+struct ip4_addr
+{
+ union
+ {
+ uint32_t addr32;
+ uint8_t addr8[4];
+ };
+};
+
+void Icmp4IpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+ const Packet* const)
+{
+ const IP4Hdr* const ip4h = reinterpret_cast<const IP4Hdr*>(raw_pkt);
+ TextLog_Puts(text_log, "\t**** ORIGINAL DATAGRAM DUMP: ****");
+ TextLog_NewLine(text_log);
+ TextLog_Puts(text_log, "\tIPv4\n\t\t");
+
+ // COPIED DIRECTLY FROM ipv4 CODEC. This is specificially replicated since
+ // the two are not necessarily the same.
+
+ // FIXIT-H --> This does NOT obfuscate correctly
+ if (ScObfuscate())
+ {
+ TextLog_Print(text_log, "xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx");
+ }
+ else
+ {
+ ip4_addr src, dst;
+ src.addr32 = ip4h->get_src();
+ dst.addr32 = ip4h->get_dst();
+
+ TextLog_Print(text_log, "%d.%d.%d.%d -> %d.%d.%d.%d",
+ (int)src.addr8[0], (int)src.addr8[1],
+ (int)src.addr8[2], (int)src.addr8[3],
+ (int)dst.addr8[0], (int)dst.addr8[1],
+ (int)dst.addr8[2], (int)dst.addr8[3]);
+ }
+
+ TextLog_NewLine(text_log);
+ TextLog_Puts(text_log, "\t\t");
+
+ const uint16_t hlen = ip4h->get_hlen() << 2;
+ const uint16_t len = ntohs(ip4h->get_len());
+ const uint16_t frag_off = ntohs(ip4h->get_off());
+
+ TextLog_Print(text_log, "Next:%s(%02X) TTL:%u TOS:0x%X ID:%u IpLen:%u DgmLen:%u",
+ PacketManager::get_proto_name(ip4h->get_proto()),
+ ip4h->get_proto(), ip4h->get_ttl(), ip4h->get_tos(),
+ ip4h->get_id(), hlen, len);
+
+
+ /* print the reserved bit if it's set */
+ if(frag_off & 0x8000)
+ TextLog_Puts(text_log, " RB");
+
+ /* printf more frags/don't frag bits */
+ if(frag_off & 0x4000)
+ TextLog_Puts(text_log, " DF");
+
+ bool mf = false;
+ if(frag_off & 0x2000)
+ {
+ mf = true;
+ TextLog_Puts(text_log, " MF");
+ }
+
+
+#if 0
+ // FIXIT-L - J more ip options fixits
+ /* print IP options */
+ if(p->ip_option_count > 0)
+ {
+ LogIpOptions(text_log, p);
+ }
+#endif
+
+ if( mf && (frag_off & 0x1FFF) && ((len - hlen > 0)))
+ {
+ TextLog_NewLine(text_log);
+ TextLog_Puts(text_log, "\t\t");
+ TextLog_Print(text_log, "Frag Offset: 0x%04X Frag Size: 0x%04X",
+ (frag_off & 0x1FFF), (len - hlen));
+ }
+
+ TextLog_NewLine(text_log);
+ TextLog_Putc(text_log, '\t');
+
+
+ /* EMBEDDED PROTOCOL */
+ switch(ip4h->get_proto())
+ {
+ case IPPROTO_TCP: /* decode the interesting part of the header */
+ {
+ const tcp::TCPHdr* tcph = reinterpret_cast<const tcp::TCPHdr*>
+ (raw_pkt + hlen);
+ TextLog_Puts(text_log, "TCP\n\t\t");
+ TextLog_Print(text_log, "SrcPort:%u DstPort:%u Seq: 0x%lX "
+ "Ack: 0x%lX Win: 0x%X TcpLen: %d",ntohs(tcph->th_sport),
+ ntohs(tcph->th_dport), (u_long) ntohl(tcph->th_seq),
+ (u_long) ntohl(tcph->th_ack),
+ ntohs(tcph->th_win), TCP_OFFSET(tcph) << 2);
+
+ break;
+ }
+
+ case IPPROTO_UDP:
+ {
+ const udp::UDPHdr* udph = reinterpret_cast<const udp::UDPHdr*>
+ (raw_pkt + hlen);
+ TextLog_Puts(text_log, "UDP\n\t\t");
+ TextLog_Print(text_log, "SourcePort:%d DestPort:%d Len:%d",
+ ntohs(udph->uh_sport), ntohs(udph->uh_dport),
+ ntohs(udph->uh_len) - udp::UDP_HEADER_LEN);
+ break;
+ }
+
+ case IPPROTO_ICMP:
+ {
+ const icmp::ICMPHdr* icmph = reinterpret_cast<const icmp::ICMPHdr*>
+ (raw_pkt + hlen);
+
+ TextLog_Puts(text_log, "ICMPv4\n\t\t");
+ TextLog_Print(text_log, "Type:%d Code:%d Csum:%u",
+ icmph->type, icmph->code, ntohs(icmph->csum));
+
+ switch (icmph->type)
+ {
+ case icmp::IcmpType::DEST_UNREACH:
+ case icmp::IcmpType::TIME_EXCEEDED:
+ case icmp::IcmpType::SOURCE_QUENCH:
+ break;
+
+ case icmp::IcmpType::PARAMETERPROB:
+ if (icmph->code == 0)
+ TextLog_Print(text_log, " Ptr: %u", icmph->s_icmp_pptr);
+ break;
+
+ case ICMP_REDIRECT:
+ // XXX-IPv6 "NOT YET IMPLEMENTED - ICMP printing"
+ break;
+
+ case icmp::IcmpType::ECHO_4:
+ case icmp::IcmpType::ECHOREPLY:
+ case icmp::IcmpType::TIMESTAMP:
+ case icmp::IcmpType::TIMESTAMPREPLY:
+ case icmp::IcmpType::INFO_REQUEST:
+ case icmp::IcmpType::INFO_REPLY:
+ case icmp::IcmpType::ADDRESS:
+ case icmp::IcmpType::ADDRESSREPLY:
+ TextLog_Print(text_log, " Id: %u SeqNo: %u",
+ ntohs(icmph->s_icmp_id), ntohs(icmph->s_icmp_seq));
+ break;
+
+ case icmp::IcmpType::ROUTER_ADVERTISE:
+ TextLog_Print(text_log, " Addrs: %u Size: %u Lifetime: %u",
+ icmph->s_icmp_num_addrs, icmph->s_icmp_wpa,
+ ntohs(icmph->s_icmp_lifetime));
+ break;
+
+ default:
+ break;
+ }
+ break;
+ }
+ default:
+ {
+ TextLog_Print(text_log, "Protocol:%s(%02X)",
+ PacketManager::get_proto_name(ip4h->get_proto()),
+ ip4h->get_proto());
+ break;
+ }
+ }
+}
+
+
bool Icmp4IpCodec::encode(EncState* /*enc*/, Buffer* out, const uint8_t* raw_in)
{
// allocate space for this protocols encoded data
virtual bool decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
- virtual void log(TextLog*, const uint8_t* /*raw_pkt*/, const Packet* const);
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+ const Packet* const);
virtual void get_protocol_ids(std::vector<uint16_t>&);
};
return true;
}
-void LlcCodec::log(TextLog* text_log, const uint8_t* raw_pkt,
- const Packet* const)
+void LlcCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+ const Packet* const)
{
const EthLlc *ehllc = reinterpret_cast<const EthLlc *>(raw_pkt);
- TextLog_Print(text_log, "LLC DSAP:0x%X SSAP:0x%X CTRL:0x%X",
+ TextLog_Putc(text_log, '\t');
+ TextLog_Print(text_log, "DSAP:0x%X SSAP:0x%X CTRL:0x%X",
ehllc->dsap, ehllc->ssap, ehllc->ctrl);
// Assuming that if these three conditions are met, this is SNAP.
const EthLlcOther *other = reinterpret_cast<const EthLlcOther *>(raw_pkt + sizeof(EthLlc));
const uint16_t proto = ntohs(other->proto_id);
- TextLog_Print(text_log, " ORG:0x%02X%02X%02X PROTO:0x%s(%04X)",
+ TextLog_Print(text_log, " ORG:0x%02X%02X%02X PROTO:0x%04X",
other->org_code[0], other->org_code[1], other->org_code[2],
- PacketManager::get_proto_name(proto), proto);
+ proto);
}
}
virtual PROTO_ID get_proto_id() { return PROTO_ETH; };
virtual void get_protocol_ids(std::vector<uint16_t>&);
virtual void get_data_link_type(std::vector<int>&);
- virtual void log(TextLog* /*log*/, const uint8_t* /*raw_pkt*/, const Packet*const );
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
+ const Packet*const );
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id);
virtual bool encode(EncState*, Buffer* out, const uint8_t* raw_in);
/* do a little validation */
if(raw_len < eth::ETH_HEADER_LEN)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
- "WARNING: Truncated eth header (%d bytes).\n", raw_len););
-
codec_events::decoder_event(p, DECODE_ETH_HDR_TRUNC);
-
return false;
}
/* lay the ethernet structure over the packet data */
const eth::EtherHdr *eh = reinterpret_cast<const eth::EtherHdr *>(raw_pkt);
- DEBUG_WRAP(
- DebugMessage(DEBUG_DECODE, "%X:%X:%X:%X:%X:%X -> %X:%X:%X:%X:%X:%X\n",
- eh->ether_src[0],
- eh->ether_src[1], eh->ether_src[2], eh->ether_src[3],
- eh->ether_src[4], eh->ether_src[5], eh->ether_dst[0],
- eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3],
- eh->ether_dst[4], eh->ether_dst[5]);
- );
- DEBUG_WRAP(
- DebugMessage(DEBUG_DECODE, "type:0x%X len:0x%X\n",
- ntohs(eh->ether_type), p->pkth->pktlen)
- );
next_prot_id = ntohs(eh->ether_type);
if (next_prot_id > eth::MIN_ETHERTYPE )
}
-void EthCodec::log(TextLog* log, const uint8_t* raw_pkt, const Packet* const)
+void EthCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
+ const Packet* const)
{
const eth::EtherHdr *eh = reinterpret_cast<const eth::EtherHdr *>(raw_pkt);
/* src addr */
- TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X -> ", eh->ether_src[0],
+ TextLog_Print(text_log, "\t%02X:%02X:%02X:%02X:%02X:%02X -> ", eh->ether_src[0],
eh->ether_src[1], eh->ether_src[2], eh->ether_src[3],
eh->ether_src[4], eh->ether_src[5]);
/* dest addr */
- TextLog_Print(log, "%02X:%02X:%02X:%02X:%02X:%02X", eh->ether_dst[0],
+ TextLog_Print(text_log, "%02X:%02X:%02X:%02X:%02X:%02X", eh->ether_dst[0],
eh->ether_dst[1], eh->ether_dst[2], eh->ether_dst[3],
eh->ether_dst[4], eh->ether_dst[5]);
const uint16_t prot = ntohs(eh->ether_type);
if (prot <= eth::MIN_ETHERTYPE)
- TextLog_Print(log, " len:0x%04X", prot);
+ TextLog_Print(text_log, " len:0x%04X", prot);
else
- TextLog_Print(log, "type:0x%04X", prot);
+ TextLog_Print(text_log, " type:0x%04X", prot);
}
//-------------------------------------------------------------------------
}
bool WlanCodec::decode(const uint8_t *raw_pkt, const uint32_t &raw_len,
- Packet *p, uint16_t &lyr_len, uint16_t &next_prot_id)
+ Packet*, uint16_t &lyr_len, uint16_t &next_prot_id)
{
uint32_t cap_len = raw_len;
// reinterpret the raw data into this codec's data format
/* Codec Initialization */
// Get the codec's name
- inline const char* get_name(){return name; };
+ inline const char* get_name() const {return name; };
// used for backwards compatability.
virtual PROTO_ID get_proto_id() { return PROTO_AH; };
// Registers this Codec's data link type (as defined by libpcap)
* const uint8_t *raw_pkt = the same data seen during decode
* Packet *p = pointer to the packet struct.
*/
- virtual void log(TextLog* /*log*/, const uint8_t* /*raw_pkt*/,
+ virtual void log(TextLog* const, const uint8_t* /*raw_pkt*/,
const Packet* const) {}
{
LogIPPkt(text_log, p->ip_api.proto(), p);
}
+#if 0
+ // ARP not impelemted
else if (p->proto_bits & PROTO_BIT__ARP)
{
+
log_mutex.lock();
LogArpHeader(text_log, p);
TextLog_Flush(text_log);
log_mutex.unlock();
}
+#endif
#if 0
else if (p->eplh != NULL)
{
* ARP stuff cloned from log.c
*--------------------------------------------------------------------
*/
-void LogArpHeader(TextLog*, Packet*)
-{
-// XXX-IPv6 "NOT YET IMPLEMENTED - printing ARP header"
-}
-
#if 0
// these must be converted to use TextLog
SO_PUBLIC void LogTcpOptions(TextLog*, const Packet* const);
void LogUDPHeader(TextLog*, Packet*);
void LogICMPHeader(TextLog*, Packet*);
-void LogArpHeader(TextLog*, Packet*);
#endif
-
* TextLog_Term: destructor
*-------------------------------------------------------------------
*/
-void TextLog_Term (TextLog* txt)
+void TextLog_Term (TextLog* const txt)
{
if ( !txt ) return;
* than resolution of filename discriminator
*-------------------------------------------------------------------
*/
-static void TextLog_Roll (TextLog* txt)
+static void TextLog_Roll (TextLog* const txt)
{
if ( txt->file == stdout ) return;
if ( txt->last >= time(NULL) ) return;
* TextLog_Flush: write buffered stream to file
*-------------------------------------------------------------------
*/
-bool TextLog_Flush(TextLog* txt)
+bool TextLog_Flush(TextLog* const txt)
{
int ok;
* TextLog_Putc: append char to buffer
*-------------------------------------------------------------------
*/
-bool TextLog_Putc (TextLog* txt, char c)
+bool TextLog_Putc (TextLog* const txt, char c)
{
if ( TextLog_Avail(txt) < 1 )
{
* TextLog_Write: append string to buffer
*-------------------------------------------------------------------
*/
-bool TextLog_Write (TextLog* txt, const char* str, int len)
+bool TextLog_Write (TextLog* const txt, const char* str, int len)
{
int avail = TextLog_Avail(txt);
* TextLog_Printf: append formatted string to buffer
*-------------------------------------------------------------------
*/
-bool TextLog_Print (TextLog* txt, const char* fmt, ...)
+bool TextLog_Print (TextLog* const txt, const char* fmt, ...)
{
int avail = TextLog_Avail(txt);
int len;
* checking for 3
*-------------------------------------------------------------------
*/
-bool TextLog_Quote (TextLog* txt, const char* qs)
+bool TextLog_Quote (TextLog* const txt, const char* qs)
{
int pos = txt->pos;
return true;
}
-
);
void TextLog_Term (TextLog*);
-bool TextLog_Putc(TextLog*, char);
-bool TextLog_Quote(TextLog*, const char*);
-bool TextLog_Write(TextLog*, const char*, int len);
-bool TextLog_Print(TextLog*, const char* format, ...);
-bool TextLog_Flush(TextLog*);
+bool TextLog_Putc(TextLog* const, char);
+bool TextLog_Quote(TextLog* const, const char*);
+bool TextLog_Write(TextLog* const, const char*, int len);
+bool TextLog_Print(TextLog* const, const char* format, ...);
+bool TextLog_Flush(TextLog* const);
/*-------------------------------------------------------------------
* helper functions
*-------------------------------------------------------------------
*/
- static inline int TextLog_Tell (TextLog* txt)
+ static inline int TextLog_Tell (TextLog* const txt)
{
return txt->pos;
}
- static inline int TextLog_Avail (TextLog* txt)
+ static inline int TextLog_Avail (TextLog* const txt)
{
return txt->maxBuf - txt->pos - 1;
}
- static inline void TextLog_Reset (TextLog* txt)
+ static inline void TextLog_Reset (TextLog* const txt)
{
txt->pos = 0;
txt->buf[txt->pos] = '\0';
}
-static inline bool TextLog_NewLine (TextLog* txt)
+static inline bool TextLog_NewLine (TextLog* const txt)
{
return TextLog_Putc(txt, '\n');
}
set (LOGGER_SOURCES
alert_luajit.cc
+ log_codecs.cc
loggers.cc
loggers.h
)
if(p->ip_api.is_valid())
LogIPPkt(fast_log, p->ip_api.proto(), p);
+#if 0
+ // FIXIT-L -J LogArpHeader unimplemented
else if(p->proto_bits & PROTO_BIT__ARP)
LogArpHeader(fast_log, p);
-
+#endif
}
TextLog_NewLine(fast_log);
TextLog_Flush(fast_log);
--- /dev/null
+/*
+** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+** Copyright (C) 2013-2013 Sourcefire, Inc.
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+*/
+// alert_codecs.cc author Josh Rosenbaum <jrosenba@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <ctype.h>
+#include <string.h>
+
+#include <algorithm>
+#include <iostream>
+
+#include "main/snort_types.h"
+#include "framework/logger.h"
+#include "framework/module.h"
+#include "protocols/packet.h"
+#include "protocols/packet_manager.h"
+#include "detection/signature.h"
+#include "log/text_log.h"
+
+
+static THREAD_LOCAL TextLog* test_file = nullptr;
+
+//-------------------------------------------------------------------------
+// module stuff
+//-------------------------------------------------------------------------
+
+#define LOG_CODECS_NAME "log_codecs"
+static const unsigned ALERT_FLAG_MSG = 0x01;
+
+static const Parameter ex_params[] =
+{
+ { "file", Parameter::PT_STRING, nullptr, "stdout",
+ "name of tsv alert file or 'stdout'" },
+
+ { "msg", Parameter::PT_BOOL, nullptr, "false",
+ "include alert msg" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+namespace
+{
+
+class LogCodecModule : public Module
+{
+public:
+ LogCodecModule() : Module(LOG_CODECS_NAME, ex_params) { };
+ bool set(const char*, Value&, SnortConfig*);
+ bool begin(const char*, int, SnortConfig*);
+
+public:
+ std::string file;
+ uint8_t flags;
+};
+
+} // namespace
+
+bool LogCodecModule::set(const char*, Value& v, SnortConfig*)
+{
+ if ( v.is("file") )
+ file = v.get_string();
+
+ else if ( v.is("msg") )
+ {
+ if ( v.get_bool() )
+ flags |= ALERT_FLAG_MSG;
+ }
+
+ else
+ return false;
+
+ return true;
+}
+
+bool LogCodecModule::begin(const char*, int, SnortConfig*)
+{
+ file = "stdout";
+ flags = 0;
+ return true;
+}
+
+//-------------------------------------------------------------------------
+// logger stuff
+//-------------------------------------------------------------------------
+
+namespace
+{
+
+class CodecLogger : public Logger {
+public:
+ CodecLogger(LogCodecModule* m);
+
+ void open();
+ void close();
+ virtual void alert(Packet*, const char* msg, Event*);
+ virtual void log(Packet*, const char*, Event*);
+
+public:
+ std::string file;
+ uint8_t flags;
+};
+
+} // namespace
+
+
+CodecLogger::CodecLogger(LogCodecModule* m)
+{
+ file = m->file;
+ flags = m->flags;
+}
+
+void CodecLogger::open()
+{ test_file = TextLog_Init(file.c_str()); }
+
+void CodecLogger::close()
+{ TextLog_Term(test_file); }
+
+void CodecLogger::alert(Packet* p, const char* msg, Event* e)
+{
+ log(p, msg, e);
+#if 0
+ std::string s = std::string(msg);
+
+ if (e != NULL)
+ {
+ TextLog_Print(test_file, "%lu\t%lu\t%lu\t",
+ (unsigned long) e->sig_info->generator,
+ (unsigned long) e->sig_info->id,
+ (unsigned long) e->sig_info->rev);
+ }
+
+ if (flags & ALERT_FLAG_MSG)
+ {
+ if (msg != NULL)
+ TextLog_Print(test_file, "%s\t", msg);
+ }
+
+
+ TextLog_NewLine(test_file);
+ TextLog_Print(test_file, " **** DUMPING PACKET ****");
+ TextLog_NewLine(test_file);
+ PacketManager::log_protocols(test_file, p);
+ TextLog_Print(test_file, " **** FINISHED DUMPING ****");
+ TextLog_NewLine(test_file);
+#endif
+}
+
+void CodecLogger::log(Packet* p, const char* msg, Event* e)
+{
+ std::string s = std::string(msg);
+
+
+ if (e != NULL)
+ {
+ TextLog_Print(test_file, "%lu\t%lu\t%lu\t",
+ (unsigned long) e->sig_info->generator,
+ (unsigned long) e->sig_info->id,
+ (unsigned long) e->sig_info->rev);
+ }
+
+ if (flags & ALERT_FLAG_MSG)
+ {
+ if (msg != NULL)
+ TextLog_Print(test_file, "%s\t", msg);
+ }
+
+ TextLog_NewLine(test_file);
+ TextLog_Print(test_file, " **** DUMPING PACKET ****");
+ TextLog_NewLine(test_file);
+ PacketManager::log_protocols(test_file, p);
+ TextLog_NewLine(test_file);
+ TextLog_Print(test_file, " **** FINISHED DUMPING ****");
+ TextLog_NewLine(test_file);
+ TextLog_NewLine(test_file);
+ TextLog_NewLine(test_file);
+ TextLog_NewLine(test_file);
+
+}
+
+//-------------------------------------------------------------------------
+// api stuff
+//-------------------------------------------------------------------------
+
+static Module* mod_ctor()
+{ return new LogCodecModule; }
+
+static void mod_dtor(Module* m)
+{ delete m; }
+
+static Logger* codec_log_ctor(SnortConfig*, Module* mod)
+{ return new CodecLogger((LogCodecModule*)mod); }
+
+static void codec_log_dtor(Logger* p)
+{ delete p; }
+
+static const LogApi log_codecs_api =
+{
+ {
+ PT_LOGGER,
+ LOG_CODECS_NAME,
+ LOGAPI_PLUGIN_V0,
+ 0,
+ mod_ctor,
+ mod_dtor
+ },
+ (OUTPUT_TYPE_FLAG__LOG | OUTPUT_TYPE_FLAG__ALERT),
+ codec_log_ctor,
+ codec_log_dtor
+};
+
+
+const BaseApi* eh_codecs = &log_codecs_api.base;
#include "framework/logger.h"
+// to ensure PacketManager::log_protocols() is built into Snort++
+extern const BaseApi* eh_codecs;
+extern const BaseApi* log_luajit;
+
#ifdef LINUX
extern const BaseApi* alert_sf_socket;
#endif
#ifdef STATIC_LOGGERS
// alerters
+ alert_csv,
alert_fast,
alert_full,
alert_syslog,
alert_test,
- alert_csv,
alert_unix_sock,
// loggers
log_null,
// both
eh_unified2,
#endif
+ // loggers
+ log_luajit,
+ // both
+ eh_codecs,
nullptr
};
-
constexpr uint8_t ICMP_PKT_FILTERED = 13; /* Packet filtered */
constexpr uint8_t ICMP_PREC_VIOLATION = 14; /* Precedence violation */
constexpr uint8_t ICMP_PREC_CUTOFF = 15; /* Precedence cut off */
-constexpr uint8_t NR_ICMP_UNREACH = 15; /* instead of hardcoding immediate
- * value */
constexpr uint8_t ICMP_REDIR_NET = 0;
constexpr uint8_t ICMP_REDIR_HOST = 1;
#include "protocols/packet.h"
#include "protocols/protocol_ids.h"
+#include "protocols/eth.h"
#include "time/profiler.h"
#include "parser/parser.h"
#include "codecs/codec_events.h"
#include "codecs/decode_module.h"
#include "utils/stats.h"
+#include "log/text_log.h"
#ifdef PERF_PROFILING
uint16_t lyr_len = 0;
uint32_t len;
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet!\n");
- DebugMessage(DEBUG_DECODE, "caplen: %lu pktlen: %lu\n",
- (unsigned long)pkthdr->caplen, (unsigned long)pkthdr->pktlen);
- );
MODULE_PROFILE_START(decodePerfStats);
{
static std::mutex stats_mutex;
- stats_mutex.lock();
+ std::lock_guard<std::mutex> lock(stats_mutex);
sum_stats(&g_stats[0], &s_stats[0], s_stats.size());
- stats_mutex.unlock();
+
+ // mutex is automatically unlocked
}
const char* PacketManager::get_proto_name(uint8_t protocol)
{ return CodecManager::s_protocols[CodecManager::s_proto_map[protocol]]->get_name(); }
+
+
+void PacketManager::log_protocols(TextLog* const text_log,
+ const Packet* const p)
+{
+ uint8_t num_layers = p->num_layers;
+ const Layer* const lyr = p->layers;
+// int pos = TextLog_Tell(text_log);
+
+ if (num_layers != 0)
+ {
+ // Grinder is not in the layer array
+ Codec* const cd = CodecManager::s_protocols[CodecManager::grinder];
+ TextLog_Print(text_log, "DLT %s", cd->get_name());
+ TextLog_NewLine(text_log);
+
+ const int dlt_pos = TextLog_Tell(text_log);
+ cd->log(text_log, lyr[0].start, p);
+
+ if (dlt_pos != TextLog_Tell(text_log))
+ TextLog_NewLine(text_log);
+
+
+ for (int i = 1; i < num_layers; i++)
+ {
+ const uint16_t protocol = lyr[i].prot_id;
+ const uint8_t codec_offset = CodecManager::s_proto_map[protocol];
+ Codec* const cd = CodecManager::s_protocols[codec_offset];
+
+
+ TextLog_Print(text_log, "%s", cd->get_name(), protocol);
+
+ // don't print the type if this is a custom type. Look
+ // in protocol_ids.h for more details.
+ if (protocol <= 0xFF || protocol >= eth::MIN_ETHERTYPE)
+ TextLog_Print(text_log, "(0x%04x)", protocol);
+
+
+ TextLog_NewLine(text_log);
+ const int pos = TextLog_Tell(text_log);
+
+ cd->log(text_log, lyr[i].start, p);
+
+ // Don't print a newline if nothing has been printed or
+ // this is the last line
+ if (pos != TextLog_Tell(text_log) && ((i + 1) < num_layers))
+ TextLog_NewLine(text_log);
+
+ TextLog_Flush(text_log);
+ }
+ }
+
+}
struct _daq_pkthdr;
+struct TextLog;
/*
static const char* get_proto_name(uint16_t protocol);
// Get the name of the given protocol
static const char* get_proto_name(uint8_t protocol);
+ // print this packets information, layer by layer
+ static void log_protocols(TextLog* const, const Packet* const);
private:
// STATISTICS!!
projects / thirdparty / snort3.git / commitdiff
