From: Carter Waxman Date: Thu, 21 Apr 2016 15:57:02 +0000 (-0400) Subject: added console interface for packet capture X-Git-Tag: 3.0.0-233~431^2~11 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=53fa4e65435daa6367c7dca4d5708d68ce73d6ea;p=thirdparty%2Fsnort3.git added console interface for packet capture --- diff --git a/src/main.cc b/src/main.cc index eee883748..97d16deeb 100644 --- a/src/main.cc +++ b/src/main.cc @@ -54,6 +54,7 @@ using namespace std; #include "memory/memory_cap.h" #include "utils/util.h" #include "parser/parser.h" +#include "packet_capture/packet_capture.h" #include "packet_io/trough.h" #include "packet_io/intf.h" #include "packet_io/sfdaq.h" @@ -433,6 +434,19 @@ int main_dump_plugins(lua_State*) return 0; } +int main_capture_enable(lua_State* L) +{ + packet_capture_enable(lua_tostring(L, 1)); + return 0; +} + +int main_capture_disable(lua_State*) +{ + packet_capture_disable(); + request.respond("== disabling"); + return 0; +} + #endif int main_quit(lua_State*) diff --git a/src/main.h b/src/main.h index 980dbe86b..e32a7c54b 100644 --- a/src/main.h +++ b/src/main.h @@ -43,6 +43,8 @@ int main_help(lua_State* = nullptr); #ifdef BUILD_SHELL int main_dump_plugins(lua_State* = nullptr); int main_detach(lua_State* = nullptr); +int main_capture_enable(lua_State* = nullptr); +int main_capture_disable(lua_State* = nullptr); #endif #endif diff --git a/src/main/snort_module.cc b/src/main/snort_module.cc index b7d204f88..a2ae2fcab 100644 --- a/src/main/snort_module.cc +++ b/src/main/snort_module.cc @@ -66,6 +66,14 @@ static const Parameter s_reload[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const Parameter s_capture[] = +{ + { "filter", Parameter::PT_STRING, nullptr, nullptr, + "bpf filter to use for packet dump" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + static const Command snort_cmds[] = { { "show_plugins", main_dump_plugins, nullptr, "show available plugins" }, @@ -73,6 +81,8 @@ static const Command snort_cmds[] = { "rotate_stats", main_rotate_stats, nullptr, "roll perfmonitor log files" }, { "reload_config", main_reload_config, s_reload, "load new configuration" }, { "reload_hosts", main_reload_hosts, s_reload, "load a new hosts table" }, + { "capture_enable", main_capture_enable, s_capture, "dump raw packets"}, + { "capture_disable", main_capture_disable, nullptr, "stop packet dump"}, // FIXIT-M rewrite trough to permit updates on the fly //{ "process", main_process, nullptr, "process given pcap" }, diff --git a/src/network_inspectors/packet_capture/packet_capture.cc b/src/network_inspectors/packet_capture/packet_capture.cc index c0783894f..598318350 100644 --- a/src/network_inspectors/packet_capture/packet_capture.cc +++ b/src/network_inspectors/packet_capture/packet_capture.cc @@ -43,6 +43,9 @@ using namespace std; +static bool enabled = false; +static string filter = ""; + static THREAD_LOCAL pcap_t* pcap = nullptr; static THREAD_LOCAL pcap_dumper_t* dumper = nullptr; static THREAD_LOCAL struct sfbpf_program bpf; @@ -58,6 +61,22 @@ static inline FILE* open_file(const char* name, bool tmp = false) return fopen(name, "wb+"); } +void packet_capture_enable(string f) +{ + if ( enabled == true ) + { + WarningMessage("Conflicting packet capture already in progress.\n"); + return; + } + filter = f; + enabled = true; +} + +void packet_capture_disable() +{ + enabled = false; + LogMessage("Packet capture disabled\n"); +} //------------------------------------------------------------------------- // class stuff @@ -72,9 +91,6 @@ public: void eval(Packet*) override; void tterm() override { capture_term(); }; - virtual void enable(string); - virtual void disable(); - protected: virtual void capture_init(); virtual void capture_term(); @@ -82,8 +98,6 @@ protected: virtual void write_packet(Packet* p); private: - bool enabled = false; - string filter = ""; }; void PacketCapture::eval(Packet* p) @@ -100,35 +114,18 @@ void PacketCapture::eval(Packet* p) capture_term(); } -void PacketCapture::enable(string filter) -{ - if ( enabled == true ) - { - WarningMessage("Conflicting packet capture already in progress.\n"); - return; - } - this->filter = filter; - enabled = true; -} - -void PacketCapture::disable() -{ - enabled = false; - LogMessage("Packet capture disabled\n"); -} - void PacketCapture::capture_init() { if ( sfbpf_compile(SNAP_LEN, DLT_EN10MB, &bpf, filter.c_str(), 1, 0) < 0 ) { WarningMessage("Unable to compile BPF filter\n"); - disable(); + packet_capture_disable(); return; } if ( !sfbpf_validate(bpf.bf_insns, bpf.bf_len) ) { WarningMessage("Unable to validate BPF filter\n"); - disable(); + packet_capture_disable(); capture_term(); return; } @@ -139,7 +136,7 @@ void PacketCapture::capture_init() if ( !dumper ) { WarningMessage("Could not initialize dump file\n"); - disable(); + packet_capture_disable(); capture_term(); } } @@ -278,12 +275,12 @@ TEST_CASE("toggle", "[PacketCapture]") CHECK ( !cap.write_packet_called ); cap.write_packet_called = false; - cap.enable(""); + packet_capture_enable(""); cap.eval(null_packet); CHECK ( cap.write_packet_called ); cap.write_packet_called = false; - cap.disable(); + packet_capture_disable(); cap.eval(null_packet); CHECK ( !cap.write_packet_called ); } @@ -300,13 +297,13 @@ TEST_CASE("lazy init", "[PacketCapture]") cap->eval(null_packet); CHECK ( !capture_initialized() ); - cap->enable(""); + packet_capture_enable(""); CHECK ( !capture_initialized() ); cap->eval(null_packet); CHECK ( capture_initialized() ); - cap->disable(); + packet_capture_disable(); CHECK ( capture_initialized() ); cap->eval(null_packet); @@ -323,7 +320,7 @@ TEST_CASE("pcap init", "[PacketCapture]") CaptureModule mod; MockPacketCapture cap(&mod); - cap.enable(""); + packet_capture_enable(""); cap.eval(null_packet); fseek(cap.fh, 0, SEEK_SET); @@ -333,7 +330,7 @@ TEST_CASE("pcap init", "[PacketCapture]") free(pcap); - cap.disable(); + packet_capture_disable(); cap.eval(null_packet); } @@ -356,7 +353,7 @@ TEST_CASE("write packet", "[PacketCapture]") CaptureModule mod; MockPacketCapture cap(&mod); - cap.enable(""); + packet_capture_enable(""); cap.eval(&p); fseek(cap.fh, 0, SEEK_SET); @@ -368,7 +365,7 @@ TEST_CASE("write packet", "[PacketCapture]") free(pcap); - cap.disable(); + packet_capture_disable(); cap.eval(null_packet); } @@ -379,11 +376,11 @@ TEST_CASE("bad filter", "[PacketCapture]") CaptureModule mod; MockPacketCapture cap(&mod); - cap.enable("this is garbage"); + packet_capture_enable("this is garbage"); cap.eval(null_packet); CHECK ( !capture_initialized() ); - cap.enable( + packet_capture_enable( "port 0 " "port 1 " "port 2 " @@ -442,8 +439,8 @@ TEST_CASE("bpf filter", "[PacketCapture]") CaptureModule mod; MockPacketCapture cap(&mod); - cap.enable("ip host 10.82.240.82"); - cap.enable(""); //Test double-enable guard + packet_capture_enable("ip host 10.82.240.82"); + packet_capture_enable(""); //Test double-enable guard p.pkt = match; cap.write_packet_called = false; @@ -473,7 +470,7 @@ TEST_CASE("bpf filter", "[PacketCapture]") free(pcap); - cap.disable(); + packet_capture_disable(); cap.eval(null_packet); } #endif diff --git a/src/network_inspectors/packet_capture/packet_capture.h b/src/network_inspectors/packet_capture/packet_capture.h index a65c1f8b2..13f03e9cf 100644 --- a/src/network_inspectors/packet_capture/packet_capture.h +++ b/src/network_inspectors/packet_capture/packet_capture.h @@ -23,5 +23,8 @@ #include "capture_module.h" +void packet_capture_enable(string); +void packet_capture_disable(); + #endif