fixed build of extra/; added some packet data to alert_luajit

diff --git a/ChangeLog b/ChangeLog
index 3984311dac25e788c799c3dd6b20c0839747ef46..e4a3e965a6bfa6b3fbe880fff5cd3b6cc8b05a2d 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -10,6 +10,7 @@
 -- changed all output filename configs to be based on module name
 -- fixed -K handling
 -- fixed laulert when rule has no msg
+-- made some packet data available to alert_luajit
 
 122
 -- pulled thread pinning from Josh

diff --git a/extra/src/codecs/pim.cc b/extra/src/codecs/pim.cc
index 0175d1638b5d0aca6b7e520fbd56a7331b16c290..b95f69ccba605b4832e514e7b0e6f62399bb69a3 100644 (file)
--- a/extra/src/codecs/pim.cc
+++ b/extra/src/codecs/pim.cc
@@ -44,7 +44,7 @@ public:
 
 
     virtual void get_protocol_ids(std::vector<uint16_t>&);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 
 };
 
@@ -58,7 +58,7 @@ void PimCodec::get_protocol_ids(std::vector<uint16_t>& v)
     v.push_back(IPPROTO_ID_PIM);
 }
 
-bool PimCodec::decode(const RawData&, CodecData& codec, SnortData&)
+bool PimCodec::decode(const RawData&, CodecData& codec, DecodeData&)
 {
     codec_events::decoder_event(codec, DECODE_IP_BAD_PROTO);
     return true;

diff --git a/extra/src/codecs/token_ring.cc b/extra/src/codecs/token_ring.cc
index 7b1acd7abfedfad011bb08b5a68e83e734d03244..d501af20e219bfc4cf4765b359235aff85d9c0c4 100644 (file)
--- a/extra/src/codecs/token_ring.cc
+++ b/extra/src/codecs/token_ring.cc
@@ -71,7 +71,7 @@ public:
 
 
     virtual void get_data_link_type(std::vector<int>&);
-    virtual bool decode(const RawData&, CodecData&, SnortData&);
+    virtual bool decode(const RawData&, CodecData&, DecodeData&);
 };
 
 
@@ -105,7 +105,7 @@ void TrCodec::get_data_link_type(std::vector<int>&v)
 
 
 //void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt)
-bool TrCodec::decode(const RawData& raw, CodecData& codec, SnortData&)
+bool TrCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
 {
 
     const uint32_t cap_len = raw.len;

diff --git a/extra/src/ips_options/ips_urg.cc b/extra/src/ips_options/ips_urg.cc
index 918377e6bc91c533687bb316b65f74aa5c45434a..f38f9e1187ab6a096f958e1113e6a5fc8d97e6ba 100644 (file)
--- a/extra/src/ips_options/ips_urg.cc
+++ b/extra/src/ips_options/ips_urg.cc
@@ -37,6 +37,7 @@
 #include "framework/range.h"
 #include "hash/sfhashfcn.h"
 #include "protocols/packet.h"
+#include "protocols/tcp.h"
 #include "time/profiler.h"
 
 static const char* s_name = "urg";

diff --git a/extra/src/loggers/alert.lua b/extra/src/loggers/alert.lua
index 669e384ae203d989d3c77e1d42fb62145701d1b5..64b471cb9e8c6f9a7df33fe7e47f1b95e370fc67 100755 (executable)
--- a/extra/src/loggers/alert.lua
+++ b/extra/src/loggers/alert.lua
@@ -41,13 +41,18 @@ end
 
 -- alert() is required
 function alert ()
-    -- evt is a luajit SnortEvent
+    -- get luajit structs
     local evt = ffi.C.get_event()
+    local pkt = ffi.C.get_packet()
 
     -- str is a luajit string
     local str = ffi.string(evt.msg)
 
-    print(string.format('%d:%d:%d:%s', evt.gid, evt.sid, evt.rev, str))
+    -- FIXIT - this gets:
+    -- bad argument #2 to 'format' (number expected, got cdata)
+    --print(string.format('%ld %d:%d:%d %s', pkt.num, evt.gid, evt.sid, evt.rev, str))
+
+    print(string.format('%d:%d:%d %s', evt.gid, evt.sid, evt.rev, str))
 end
 
 -- plugin table is required

diff --git a/src/framework/CMakeLists.txt b/src/framework/CMakeLists.txt
index e9ff0f793ba42d4c6a47321203d2f2935354001f..216530b7283862c0a0c7e034eee023ce92e03d07 100644 (file)
--- a/src/framework/CMakeLists.txt
+++ b/src/framework/CMakeLists.txt
@@ -6,6 +6,7 @@ set (FRAMEWORK_INCLUDES
     codec.h
     counts.h
     cursor.h
+    decode_data.h
     logger.h
     inspector.h
     ips_option.h

diff --git a/src/framework/Makefile.am b/src/framework/Makefile.am
index 7d2c468c44c8b762ccd6c81613e8eebcf0a43446..45ce110305097cb6a80a6af30f59308e18cd9c70 100644 (file)
--- a/src/framework/Makefile.am
+++ b/src/framework/Makefile.am
@@ -10,6 +10,7 @@ bits.h \
 codec.h \
 counts.h \
 cursor.h \
+decode_data.h \
 logger.h \
 inspector.h \
 ips_option.h \

diff --git a/src/log/text_log.h b/src/log/text_log.h
index 436ff7a62862b19637e64fc586078a3d7d012f2d..0e799acdcd83cbb1e534df2ab084e5edc315f8ef 100644 (file)
--- a/src/log/text_log.h
+++ b/src/log/text_log.h
@@ -38,8 +38,8 @@
  * name plus a timestamp.
  */
 
-#ifndef SF_TEXTLOG_H
-#define SF_TEXTLOG_H
+#ifndef TEXT_LOG_H
+#define TEXT_LOG_H
 
 #include <stdio.h>
 #include <string.h>
@@ -49,6 +49,9 @@
 #define M_BYTES (K_BYTES*K_BYTES)
 #define G_BYTES (K_BYTES*M_BYTES)
 
+// FIXIT-L need a LogMessage based subclass of TextLog
+// or some such to get stdout or syslog
+
 /*
  * DO NOT ACCESS STRUCT MEMBERS DIRECTLY
  * EXCEPT FROM WITHIN THE IMPLEMENTATION!
@@ -111,5 +114,5 @@ static inline bool TextLog_Puts (TextLog* const txt, const char* str)
     return TextLog_Write(txt, str, strlen(str));
 }
 
-#endif /* SF_TEXTLOG_H */
+#endif
 

diff --git a/src/loggers/alert_luajit.cc b/src/loggers/alert_luajit.cc
index 76534d1134750a829cc89485f0ac3a870b0bbec0..1fcb56103d6c90081178fca5db4b897855fd3588 100644 (file)
--- a/src/loggers/alert_luajit.cc
+++ b/src/loggers/alert_luajit.cc
@@ -29,15 +29,20 @@
 #include "managers/script_manager.h"
 #include "hash/sfhashfcn.h"
 #include "parser/parser.h"
+#include "protocols/packet.h"
 #include "framework/logger.h"
 #include "framework/module.h"
 #include "framework/parameter.h"
 #include "time/profiler.h"
+#include "utils/stats.h"
 
 static THREAD_LOCAL ProfileStats luaLogPerfStats;
 
 //-------------------------------------------------------------------------
 // ffi stuff
+//
+// IMPORTANT - if you change these structs, you must also update
+// snort_plugins.lua.
 //-------------------------------------------------------------------------
 
 struct SnortEvent
@@ -54,14 +59,27 @@ struct SnortEvent
     const char* os;
 };
 
+struct SnortPacket
+{
+    // FIXIT-L add ip addrs and other useful foo to lua packet
+    const char* type;
+    uint64_t num;
+    unsigned sp;
+    unsigned dp;
+};
+
 extern "C" {
 // ensure Lua can link with this
 const SnortEvent* get_event();
+const SnortPacket* get_packet();
 }
 
 static THREAD_LOCAL Event* event;
 static THREAD_LOCAL SnortEvent lua_event;
 
+static THREAD_LOCAL Packet* packet;
+static THREAD_LOCAL SnortPacket lua_packet;
+
 SO_PUBLIC const SnortEvent* get_event()
 {
     assert(event);
@@ -84,6 +102,26 @@ SO_PUBLIC const SnortEvent* get_event()
     return &lua_event;
 }
 
+SO_PUBLIC const SnortPacket* get_packet()
+{
+    assert(packet);
+
+    switch ( packet->type() )
+    {
+    case PktType::IP: lua_packet.type = "IP"; break;
+    case PktType::TCP: lua_packet.type = "TCP"; break;
+    case PktType::UDP: lua_packet.type = "UDP"; break;
+    case PktType::ICMP: lua_packet.type = "ICMP"; break;
+    default: lua_packet.type = "OTHER";
+    }
+
+    lua_packet.num = pc.total_from_daq;
+    lua_packet.sp = packet->ptrs.sp;
+    lua_packet.dp = packet->ptrs.dp;
+
+    return &lua_packet;
+}
+
 //-------------------------------------------------------------------------
 // module stuff
 //-------------------------------------------------------------------------
@@ -172,11 +210,12 @@ LuaJitLogger::~LuaJitLogger()
     delete[] lua;
 }
 
-void LuaJitLogger::alert(Packet*, const char*, Event* e)
+void LuaJitLogger::alert(Packet* p, const char*, Event* e)
 {
     PROFILE_VARS;
     MODULE_PROFILE_START(luaLogPerfStats);
 
+    packet = p;
     event = e;
 
     lua_State* L = lua[get_instance_id()];

diff --git a/src/managers/snort_plugin.lua b/src/managers/snort_plugin.lua
index 74023dc29b369e9df84b65cef3e30617d2234e68..b86e7469a3b33d7575957043ed5386b0f517278a 100644 (file)
--- a/src/managers/snort_plugin.lua
+++ b/src/managers/snort_plugin.lua
@@ -42,5 +42,14 @@ struct SnortEvent
     const char* os;
 };
 const struct SnortEvent* get_event();
+
+struct SnortPacket
+{
+    const char* type;
+    uint64_t num;
+    unsigned sp;
+    unsigned dp;
+};
+const struct SnortPacket* get_packet();
 ]]