From: Russ Combs Date: Sun, 5 Oct 2014 02:22:44 +0000 (-0400) Subject: fixed build of extra/; added some packet data to alert_luajit X-Git-Tag: 3.0.0-233~1397^2~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=697eabad5c348f981df42eab5679fc51a29599ab;p=thirdparty%2Fsnort3.git fixed build of extra/; added some packet data to alert_luajit --- diff --git a/ChangeLog b/ChangeLog index 3984311da..e4a3e965a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,7 @@ -- changed all output filename configs to be based on module name -- fixed -K handling -- fixed laulert when rule has no msg +-- made some packet data available to alert_luajit 122 -- pulled thread pinning from Josh diff --git a/extra/src/codecs/pim.cc b/extra/src/codecs/pim.cc index 0175d1638..b95f69ccb 100644 --- a/extra/src/codecs/pim.cc +++ b/extra/src/codecs/pim.cc @@ -44,7 +44,7 @@ public: virtual void get_protocol_ids(std::vector&); - virtual bool decode(const RawData&, CodecData&, SnortData&); + virtual bool decode(const RawData&, CodecData&, DecodeData&); }; @@ -58,7 +58,7 @@ void PimCodec::get_protocol_ids(std::vector& v) v.push_back(IPPROTO_ID_PIM); } -bool PimCodec::decode(const RawData&, CodecData& codec, SnortData&) +bool PimCodec::decode(const RawData&, CodecData& codec, DecodeData&) { codec_events::decoder_event(codec, DECODE_IP_BAD_PROTO); return true; diff --git a/extra/src/codecs/token_ring.cc b/extra/src/codecs/token_ring.cc index 7b1acd7ab..d501af20e 100644 --- a/extra/src/codecs/token_ring.cc +++ b/extra/src/codecs/token_ring.cc @@ -71,7 +71,7 @@ public: virtual void get_data_link_type(std::vector&); - virtual bool decode(const RawData&, CodecData&, SnortData&); + virtual bool decode(const RawData&, CodecData&, DecodeData&); }; @@ -105,7 +105,7 @@ void TrCodec::get_data_link_type(std::vector&v) //void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt) -bool TrCodec::decode(const RawData& raw, CodecData& codec, SnortData&) +bool TrCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) { const uint32_t cap_len = raw.len; diff --git a/extra/src/ips_options/ips_urg.cc b/extra/src/ips_options/ips_urg.cc index 918377e6b..f38f9e118 100644 --- a/extra/src/ips_options/ips_urg.cc +++ b/extra/src/ips_options/ips_urg.cc @@ -37,6 +37,7 @@ #include "framework/range.h" #include "hash/sfhashfcn.h" #include "protocols/packet.h" +#include "protocols/tcp.h" #include "time/profiler.h" static const char* s_name = "urg"; diff --git a/extra/src/loggers/alert.lua b/extra/src/loggers/alert.lua index 669e384ae..64b471cb9 100755 --- a/extra/src/loggers/alert.lua +++ b/extra/src/loggers/alert.lua @@ -41,13 +41,18 @@ end -- alert() is required function alert () - -- evt is a luajit SnortEvent + -- get luajit structs local evt = ffi.C.get_event() + local pkt = ffi.C.get_packet() -- str is a luajit string local str = ffi.string(evt.msg) - print(string.format('%d:%d:%d:%s', evt.gid, evt.sid, evt.rev, str)) + -- FIXIT - this gets: + -- bad argument #2 to 'format' (number expected, got cdata) + --print(string.format('%ld %d:%d:%d %s', pkt.num, evt.gid, evt.sid, evt.rev, str)) + + print(string.format('%d:%d:%d %s', evt.gid, evt.sid, evt.rev, str)) end -- plugin table is required diff --git a/src/framework/CMakeLists.txt b/src/framework/CMakeLists.txt index e9ff0f793..216530b72 100644 --- a/src/framework/CMakeLists.txt +++ b/src/framework/CMakeLists.txt @@ -6,6 +6,7 @@ set (FRAMEWORK_INCLUDES codec.h counts.h cursor.h + decode_data.h logger.h inspector.h ips_option.h diff --git a/src/framework/Makefile.am b/src/framework/Makefile.am index 7d2c468c4..45ce11030 100644 --- a/src/framework/Makefile.am +++ b/src/framework/Makefile.am @@ -10,6 +10,7 @@ bits.h \ codec.h \ counts.h \ cursor.h \ +decode_data.h \ logger.h \ inspector.h \ ips_option.h \ diff --git a/src/log/text_log.h b/src/log/text_log.h index 436ff7a62..0e799acdc 100644 --- a/src/log/text_log.h +++ b/src/log/text_log.h @@ -38,8 +38,8 @@ * name plus a timestamp. */ -#ifndef SF_TEXTLOG_H -#define SF_TEXTLOG_H +#ifndef TEXT_LOG_H +#define TEXT_LOG_H #include #include @@ -49,6 +49,9 @@ #define M_BYTES (K_BYTES*K_BYTES) #define G_BYTES (K_BYTES*M_BYTES) +// FIXIT-L need a LogMessage based subclass of TextLog +// or some such to get stdout or syslog + /* * DO NOT ACCESS STRUCT MEMBERS DIRECTLY * EXCEPT FROM WITHIN THE IMPLEMENTATION! @@ -111,5 +114,5 @@ static inline bool TextLog_Puts (TextLog* const txt, const char* str) return TextLog_Write(txt, str, strlen(str)); } -#endif /* SF_TEXTLOG_H */ +#endif diff --git a/src/loggers/alert_luajit.cc b/src/loggers/alert_luajit.cc index 76534d113..1fcb56103 100644 --- a/src/loggers/alert_luajit.cc +++ b/src/loggers/alert_luajit.cc @@ -29,15 +29,20 @@ #include "managers/script_manager.h" #include "hash/sfhashfcn.h" #include "parser/parser.h" +#include "protocols/packet.h" #include "framework/logger.h" #include "framework/module.h" #include "framework/parameter.h" #include "time/profiler.h" +#include "utils/stats.h" static THREAD_LOCAL ProfileStats luaLogPerfStats; //------------------------------------------------------------------------- // ffi stuff +// +// IMPORTANT - if you change these structs, you must also update +// snort_plugins.lua. //------------------------------------------------------------------------- struct SnortEvent @@ -54,14 +59,27 @@ struct SnortEvent const char* os; }; +struct SnortPacket +{ + // FIXIT-L add ip addrs and other useful foo to lua packet + const char* type; + uint64_t num; + unsigned sp; + unsigned dp; +}; + extern "C" { // ensure Lua can link with this const SnortEvent* get_event(); +const SnortPacket* get_packet(); } static THREAD_LOCAL Event* event; static THREAD_LOCAL SnortEvent lua_event; +static THREAD_LOCAL Packet* packet; +static THREAD_LOCAL SnortPacket lua_packet; + SO_PUBLIC const SnortEvent* get_event() { assert(event); @@ -84,6 +102,26 @@ SO_PUBLIC const SnortEvent* get_event() return &lua_event; } +SO_PUBLIC const SnortPacket* get_packet() +{ + assert(packet); + + switch ( packet->type() ) + { + case PktType::IP: lua_packet.type = "IP"; break; + case PktType::TCP: lua_packet.type = "TCP"; break; + case PktType::UDP: lua_packet.type = "UDP"; break; + case PktType::ICMP: lua_packet.type = "ICMP"; break; + default: lua_packet.type = "OTHER"; + } + + lua_packet.num = pc.total_from_daq; + lua_packet.sp = packet->ptrs.sp; + lua_packet.dp = packet->ptrs.dp; + + return &lua_packet; +} + //------------------------------------------------------------------------- // module stuff //------------------------------------------------------------------------- @@ -172,11 +210,12 @@ LuaJitLogger::~LuaJitLogger() delete[] lua; } -void LuaJitLogger::alert(Packet*, const char*, Event* e) +void LuaJitLogger::alert(Packet* p, const char*, Event* e) { PROFILE_VARS; MODULE_PROFILE_START(luaLogPerfStats); + packet = p; event = e; lua_State* L = lua[get_instance_id()]; diff --git a/src/managers/snort_plugin.lua b/src/managers/snort_plugin.lua index 74023dc29..b86e7469a 100644 --- a/src/managers/snort_plugin.lua +++ b/src/managers/snort_plugin.lua @@ -42,5 +42,14 @@ struct SnortEvent const char* os; }; const struct SnortEvent* get_event(); + +struct SnortPacket +{ + const char* type; + uint64_t num; + unsigned sp; + unsigned dp; +}; +const struct SnortPacket* get_packet(); ]]