Pull request #3386: events: add action logging to the event

Merge in SNORT/snort3 from ~VHORBATO/snort3:events_upd to master

Squashed commit of the following:

commit 68bc9987e0c57edc1aae1bb18fb88a29529d1ca7
Author: Vitalii <vhorbato@cisco.com>
Date:   Sun Apr 3 13:45:25 2022 +0300

    events: add action logging to the event

    packet_io: add rewrite action logging

diff --git a/src/actions/act_replace.cc b/src/actions/act_replace.cc
index d49986add337ef4477ead141b04cbdfb1ab51fb1..2dd2a7d56f1d4621c7fe7c51113be9e9746fa0b2 100644 (file)
--- a/src/actions/act_replace.cc
+++ b/src/actions/act_replace.cc
@@ -106,6 +106,8 @@ private:
 
 void ReplaceAction::exec(Packet* p, const OptTreeNode* otn)
 {
+    p->active->rewrite_packet(p);
+    
     Actions::alert(p, otn);
 }
 

diff --git a/src/detection/detect.cc b/src/detection/detect.cc
index 881d805ad0eea895fef7cfdb07769a20e5d8d895..8b219c4947ca39dc404fb196c5fa60199fdcbd3a 100644 (file)
--- a/src/detection/detect.cc
+++ b/src/detection/detect.cc
@@ -83,6 +83,8 @@ void CallLogFuncs(Packet* p, const OptTreeNode* otn, ListHead* head)
     event.ref_time.tv_sec = p->pkth->ts.tv_sec;
     event.ref_time.tv_usec = p->pkth->ts.tv_usec;
     event.update_event_id_and_ref(p->context->conf->get_event_log_id());
+    if (head and head->ruleListNode)
+        event.action_string = head->ruleListNode->name;
 
     DetectionEngine::set_check_tags(false);
     pc.log_pkts++;
@@ -99,6 +101,8 @@ void CallAlertFuncs(Packet* p, const OptTreeNode* otn, ListHead* head)
     event.ref_time.tv_sec = p->pkth->ts.tv_sec;
     event.ref_time.tv_usec = p->pkth->ts.tv_usec;
     event.update_event_id_and_ref(p->context->conf->get_event_log_id());
+    if (head and head->ruleListNode)
+        event.action_string = head->ruleListNode->name;
 
     pc.total_alert_pkts++;
 

diff --git a/src/events/event.cc b/src/events/event.cc
index 1debf01d7f2b53c51e840f64a67ecd0cedaec64e..4f8b49f275765e5af5d4c210df5af1488d0bf2af 100644 (file)
--- a/src/events/event.cc
+++ b/src/events/event.cc
@@ -71,7 +71,7 @@ uint32_t Event::update_and_get_event_id(void)
 
 void Event::set_event(uint32_t gid, uint32_t sid, uint32_t rev,
     uint32_t classification, uint32_t priority, uint16_t event_ref,
-    uint16_t log_id, const struct timeval& tv)
+    uint16_t log_id, const struct timeval& tv, const std::string& act)
 {
     sig_info->gid = gid;
     sig_info->sid = sid;
@@ -88,5 +88,6 @@ void Event::set_event(uint32_t gid, uint32_t sid, uint32_t rev,
 
     ref_time.tv_sec = tv.tv_sec;
     ref_time.tv_usec = tv.tv_usec;
+    action_string = act;
 }
 

diff --git a/src/events/event.h b/src/events/event.h
index e81160554275ad86f41d8a89e49a7fd3429b9a41..36d817cfcdc4c1cf015858270e0cec7b72d33010 100644 (file)
--- a/src/events/event.h
+++ b/src/events/event.h
@@ -39,6 +39,7 @@ struct Event
     SigInfo* sig_info = nullptr;
     struct sf_timeval32 ref_time = { 0, 0 };   /* reference time for the event reference */
     const char* alt_msg = nullptr;
+    std::string action_string;
 
     Event() = default;
     Event(SigInfo& si)
@@ -56,7 +57,7 @@ struct Event
 
     void set_event(uint32_t gid, uint32_t sid, uint32_t rev,
         uint32_t classification, uint32_t priority, uint16_t event_ref,
-        uint16_t log_id, const struct timeval& tv);
+        uint16_t log_id, const struct timeval& tv, const std::string& act = "");
 
 
 private:

diff --git a/src/main/analyzer.cc b/src/main/analyzer.cc
index cc5297bff4b259ac97aba84a39263da630a217a8..acfa36f00ecf1a0bcf24283c16eb10f3cc25a86e 100644 (file)
--- a/src/main/analyzer.cc
+++ b/src/main/analyzer.cc
@@ -229,7 +229,7 @@ static DAQ_Verdict distill_verdict(Packet* p)
     if ( act->session_was_blocked() ||
             (p->flow && (p->flow->flow_state == Flow::FlowState::BLOCK)) )
     {
-        if ( !act->can_block() )
+        if ( !act->can_act() )
             verdict = DAQ_VERDICT_PASS;
         else if ( act->get_tunnel_bypass() )
         {
@@ -243,7 +243,7 @@ static DAQ_Verdict distill_verdict(Packet* p)
     }
 
     // Second Pass, now with more side effects
-    if ( act->packet_was_dropped() && act->can_block() )
+    if ( act->packet_was_dropped() && act->can_act() )
     {
         if ( verdict == DAQ_VERDICT_PASS )
             verdict = DAQ_VERDICT_BLOCK;

diff --git a/src/main/test/distill_verdict_stubs.h b/src/main/test/distill_verdict_stubs.h
index dd4a9851e7a016cc08ceec89088a9285dcd0e72a..c4d81c14d50082caa2a92f86b2ea0dcadc15f012 100644 (file)
--- a/src/main/test/distill_verdict_stubs.h
+++ b/src/main/test/distill_verdict_stubs.h
@@ -156,6 +156,7 @@ bool SFDAQ::forwarding_packet(const DAQ_PktHdr_t*) { return false; }
 int SFDAQ::inject(DAQ_Msg_h, int, const uint8_t*, uint32_t) { return -1; }
 bool SFDAQ::can_inject() { return false; }
 bool SFDAQ::can_inject_raw() { return false; }
+bool SFDAQ::can_replace() { return false; }
 int SFDAQInstance::set_packet_verdict_reason(DAQ_Msg_h, uint8_t) { return 0; }
 DetectionEngine::DetectionEngine() = default;
 DetectionEngine::~DetectionEngine() = default;

diff --git a/src/packet_io/active.cc b/src/packet_io/active.cc
index 4ab8a33403438f58470381ce9e713c4508767850..33fcc23ae08706b62ed221378e44ab3a4e293c44 100644 (file)
--- a/src/packet_io/active.cc
+++ b/src/packet_io/active.cc
@@ -61,6 +61,7 @@ const char* Active::act_str[Active::ACT_MAX][Active::AST_MAX] =
     { "allow", "error", "error", "error" },
     { "hold", "error", "error", "error" },
     { "retry", "error", "error", "error" },
+    { "rewrite", "cant_rewrite", "would_rewrite", "force_rewrite" },
     { "drop", "cant_drop", "would_drop", "force_drop" },
     { "block", "cant_block", "would_block", "force_block" },
     { "reset", "cant_reset", "would_reset", "force_reset" },
@@ -527,6 +528,11 @@ void Active::update_status_actionable(const Packet* p)
             active_status = AST_WOULD;
             active_would_reason = WHD_INTERFACE_IDS;
         }
+        else if ( active_action == ACT_REWRITE and !SFDAQ::can_replace() )
+        {
+            active_status = AST_WOULD;
+            active_would_reason = WHD_INTERFACE_IDS;
+        }
     }
     else if ( p->context->conf->inline_test_mode() )
     {
@@ -552,9 +558,7 @@ void Active::update_status(const Packet* p, bool force)
     else if ( force )
         active_status = AST_FORCE;
     else if ( active_status != AST_FORCE )
-    {
         update_status_actionable(p);
-    }
 }
 
 void Active::daq_update_status(const Packet* p)
@@ -588,6 +592,14 @@ void Active::daq_drop_packet(const Packet* p)
     daq_update_status(p);
 }
 
+void Active::rewrite_packet(const Packet* p, bool force)
+{
+    if ( active_action < ACT_REWRITE )
+        active_action = ACT_REWRITE;
+
+    update_status(p, force);
+}
+
 bool Active::retry_packet(const Packet* p)
 {
     if (ACT_RETRY == active_action)
@@ -854,4 +866,3 @@ void Active::send_reason_to_daq(Packet& p)
     if ( reason != -1 )
         p.daq_instance->set_packet_verdict_reason(p.daq_msg, reason);
 }
-

diff --git a/src/packet_io/active.h b/src/packet_io/active.h
index 403ee8ac58c2ce4797fe3312ef238aacbae0ea60..e41ba384d0e1a15cf3d680fb06b55897c8683294 100644 (file)
--- a/src/packet_io/active.h
+++ b/src/packet_io/active.h
@@ -60,7 +60,7 @@ public:
     // apply_delayed_action, in a big switch(action). Do away with these and
     // use the actual (Base)Action objects.
     enum ActiveActionType : uint8_t
-    { ACT_TRUST, ACT_ALLOW, ACT_HOLD, ACT_RETRY, ACT_DROP, ACT_BLOCK, ACT_RESET, ACT_MAX };
+    { ACT_TRUST, ACT_ALLOW, ACT_HOLD, ACT_RETRY, ACT_REWRITE, ACT_DROP, ACT_BLOCK, ACT_RESET, ACT_MAX };
 
 public:
 
@@ -111,7 +111,7 @@ public:
 
     void kill_session(Packet*, EncodeFlags = ENC_FLAG_FWD);
 
-    bool can_block() const
+    bool can_act() const
     { return active_status == AST_ALLOW or active_status == AST_FORCE; }
 
     const char* get_action_string() const
@@ -121,6 +121,7 @@ public:
 
     void drop_packet(const Packet*, bool force = false);
     void daq_drop_packet(const Packet*);
+    void rewrite_packet(const Packet*, bool force = false);
     bool retry_packet(const Packet*);
     bool hold_packet(const Packet*);
     void cancel_packet_hold();

diff --git a/src/piglet_plugins/pp_event_iface.cc b/src/piglet_plugins/pp_event_iface.cc
index 6885bea3b5990d942c38bbf02f6f15d4887ca7c1..d8cefe6bffbf1107aa404fcdffd04b1b201e4c14 100644 (file)
--- a/src/piglet_plugins/pp_event_iface.cc
+++ b/src/piglet_plugins/pp_event_iface.cc
@@ -48,13 +48,22 @@ static void set_fields(lua_State* L, int tindex, Event& self)
     table.get_field("event_reference", value);
     self.set_event_reference(value);
 
-    const char* s = nullptr;
-    if ( table.get_field("alt_msg", s) && s )  // FIXIT-L shouldn't need both conditions
+    const char* s_alt_msg = nullptr;
+    if ( table.get_field("alt_msg", s_alt_msg) && s_alt_msg )  // FIXIT-L shouldn't need both conditions
     {
-        self.alt_msg = RawBufferIface.create(L, s).c_str();
+        self.alt_msg = RawBufferIface.create(L, s_alt_msg).c_str();
         Lua::add_ref(L, &self, "alt_msg", lua_gettop(L));
         lua_pop(L, 1);
     }
+
+    const char* s_action_string = nullptr;
+    // FIXIT-L shouldn't need both conditions
+    if ( table.get_field("action_string", s_action_string) && s_action_string )
+    {
+        self.action_string = RawBufferIface.create(L, s_action_string);
+        Lua::add_ref(L, &self, "action_string", lua_gettop(L));
+        lua_pop(L, 1);
+    }
 }
 
 static void get_fields(lua_State* L, int tindex, Event& self)
@@ -66,6 +75,9 @@ static void get_fields(lua_State* L, int tindex, Event& self)
 
     if ( self.alt_msg )
         table.set_field("alt_msg", self.alt_msg);
+
+    if ( !self.action_string.empty() )
+        table.set_field("action_string", self.action_string);
 }
 
 static const luaL_Reg methods[] =

diff --git a/tools/u2spewfoo/u2spewfoo.cc b/tools/u2spewfoo/u2spewfoo.cc
index ff3f9180848e1fd7a8a622b78710cf3558281858..290ce74df919989cdb714fdc581be836c6b0a5b1 100644 (file)
--- a/tools/u2spewfoo/u2spewfoo.cc
+++ b/tools/u2spewfoo/u2spewfoo.cc
@@ -301,7 +301,7 @@ static const char* get_status(uint8_t stat)
 
 static const char* get_action(uint8_t act)
 {
-    const char* acts[] = { "trust", "pass", "hold", "retry", "drop", "block", "reset" };
+    const char* acts[] = { "trust", "pass", "hold", "retry", "rewrite", "drop", "block", "reset" };
     return lookup(acts, sizeof(acts)/sizeof(acts[0]), act);
 }