added console interface for packet capture

diff --git a/src/main.cc b/src/main.cc
index eee883748d0c7239254a19f0c5b36126fad8968a..97d16deeb2d50872da17691b7df9a12ece7f0aeb 100644 (file)
--- a/src/main.cc
+++ b/src/main.cc
@@ -54,6 +54,7 @@ using namespace std;
 #include "memory/memory_cap.h"
 #include "utils/util.h"
 #include "parser/parser.h"
+#include "packet_capture/packet_capture.h"
 #include "packet_io/trough.h"
 #include "packet_io/intf.h"
 #include "packet_io/sfdaq.h"
@@ -433,6 +434,19 @@ int main_dump_plugins(lua_State*)
     return 0;
 }
 
+int main_capture_enable(lua_State* L)
+{
+    packet_capture_enable(lua_tostring(L, 1));
+    return 0;
+}
+
+int main_capture_disable(lua_State*)
+{
+    packet_capture_disable();
+    request.respond("== disabling");
+    return 0;
+}
+
 #endif
 
 int main_quit(lua_State*)

diff --git a/src/main.h b/src/main.h
index 980dbe86b503cb6f650d3f59a3ced208addfef04..e32a7c54b243e2843d4f600b1d9e6b00470c0702 100644 (file)
--- a/src/main.h
+++ b/src/main.h
@@ -43,6 +43,8 @@ int main_help(lua_State* = nullptr);
 #ifdef BUILD_SHELL
 int main_dump_plugins(lua_State* = nullptr);
 int main_detach(lua_State* = nullptr);
+int main_capture_enable(lua_State* = nullptr);
+int main_capture_disable(lua_State* = nullptr);
 #endif
 
 #endif

diff --git a/src/main/snort_module.cc b/src/main/snort_module.cc
index b7d204f885a6fc0ebad098bcd259118c891fadac..a2ae2fcab337417f80f5e512168053684a88ba4f 100644 (file)
--- a/src/main/snort_module.cc
+++ b/src/main/snort_module.cc
@@ -66,6 +66,14 @@ static const Parameter s_reload[] =
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
 
+static const Parameter s_capture[] =
+{
+    { "filter", Parameter::PT_STRING, nullptr, nullptr,
+      "bpf filter to use for packet dump" },
+
+    { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
 static const Command snort_cmds[] =
 {
     { "show_plugins", main_dump_plugins, nullptr, "show available plugins" },
@@ -73,6 +81,8 @@ static const Command snort_cmds[] =
     { "rotate_stats", main_rotate_stats, nullptr, "roll perfmonitor log files" },
     { "reload_config", main_reload_config, s_reload, "load new configuration" },
     { "reload_hosts", main_reload_hosts, s_reload, "load a new hosts table" },
+    { "capture_enable", main_capture_enable, s_capture, "dump raw packets"},
+    { "capture_disable", main_capture_disable, nullptr, "stop packet dump"},
 
     // FIXIT-M rewrite trough to permit updates on the fly
     //{ "process", main_process, nullptr, "process given pcap" },

diff --git a/src/network_inspectors/packet_capture/packet_capture.cc b/src/network_inspectors/packet_capture/packet_capture.cc
index c0783894f54a844de1d8d62c0759ef7a70ab0d2a..5983183508f6cd013541dfad33b1feb71b8f44b9 100644 (file)
--- a/src/network_inspectors/packet_capture/packet_capture.cc
+++ b/src/network_inspectors/packet_capture/packet_capture.cc
@@ -43,6 +43,9 @@
 
 using namespace std;
 
+static bool enabled = false;
+static string filter = "";
+
 static THREAD_LOCAL pcap_t* pcap = nullptr;
 static THREAD_LOCAL pcap_dumper_t* dumper = nullptr;
 static THREAD_LOCAL struct sfbpf_program bpf;
@@ -58,6 +61,22 @@ static inline FILE* open_file(const char* name, bool tmp = false)
         return fopen(name, "wb+");
 }
 
+void packet_capture_enable(string f)
+{
+    if ( enabled == true )
+    {
+        WarningMessage("Conflicting packet capture already in progress.\n");
+        return;
+    }
+    filter = f;
+    enabled = true;
+}
+
+void packet_capture_disable()
+{
+    enabled = false;
+    LogMessage("Packet capture disabled\n");
+}
 
 //-------------------------------------------------------------------------
 // class stuff
@@ -72,9 +91,6 @@ public:
     void eval(Packet*) override;
     void tterm() override { capture_term(); };
 
-    virtual void enable(string);
-    virtual void disable();
-
 protected:
     virtual void capture_init();
     virtual void capture_term();
@@ -82,8 +98,6 @@ protected:
     virtual void write_packet(Packet* p);
 
 private:
-    bool enabled = false;
-    string filter = "";
 };
 
 void PacketCapture::eval(Packet* p)
@@ -100,35 +114,18 @@ void PacketCapture::eval(Packet* p)
         capture_term();
 }
 
-void PacketCapture::enable(string filter)
-{
-    if ( enabled == true )
-    {
-        WarningMessage("Conflicting packet capture already in progress.\n");
-        return;
-    }
-    this->filter = filter;
-    enabled = true;
-}
-
-void PacketCapture::disable()
-{
-    enabled = false;
-    LogMessage("Packet capture disabled\n");
-}
-
 void PacketCapture::capture_init()
 {
     if ( sfbpf_compile(SNAP_LEN, DLT_EN10MB, &bpf, filter.c_str(), 1, 0) < 0 )
     {
         WarningMessage("Unable to compile BPF filter\n");
-        disable();
+        packet_capture_disable();
         return;
     }
     if ( !sfbpf_validate(bpf.bf_insns, bpf.bf_len) )
     {
         WarningMessage("Unable to validate BPF filter\n");
-        disable();
+        packet_capture_disable();
         capture_term();
         return;
     }
@@ -139,7 +136,7 @@ void PacketCapture::capture_init()
     if ( !dumper )
     {
         WarningMessage("Could not initialize dump file\n");
-        disable();
+        packet_capture_disable();
         capture_term();
     }
 }
@@ -278,12 +275,12 @@ TEST_CASE("toggle", "[PacketCapture]")
     CHECK ( !cap.write_packet_called );
 
     cap.write_packet_called = false;
-    cap.enable("");
+    packet_capture_enable("");
     cap.eval(null_packet);
     CHECK ( cap.write_packet_called );
     
     cap.write_packet_called = false;
-    cap.disable();
+    packet_capture_disable();
     cap.eval(null_packet);
     CHECK ( !cap.write_packet_called );
 }
@@ -300,13 +297,13 @@ TEST_CASE("lazy init", "[PacketCapture]")
     cap->eval(null_packet);
     CHECK ( !capture_initialized() );
 
-    cap->enable("");
+    packet_capture_enable("");
     CHECK ( !capture_initialized() );
 
     cap->eval(null_packet);
     CHECK ( capture_initialized() );
 
-    cap->disable();
+    packet_capture_disable();
     CHECK ( capture_initialized() );
 
     cap->eval(null_packet);
@@ -323,7 +320,7 @@ TEST_CASE("pcap init", "[PacketCapture]")
     CaptureModule mod;
     MockPacketCapture cap(&mod);
     
-    cap.enable("");
+    packet_capture_enable("");
     cap.eval(null_packet);
 
     fseek(cap.fh, 0, SEEK_SET);
@@ -333,7 +330,7 @@ TEST_CASE("pcap init", "[PacketCapture]")
 
     free(pcap);
 
-    cap.disable();
+    packet_capture_disable();
     cap.eval(null_packet);
 }
 
@@ -356,7 +353,7 @@ TEST_CASE("write packet", "[PacketCapture]")
     CaptureModule mod;
     MockPacketCapture cap(&mod);
     
-    cap.enable("");
+    packet_capture_enable("");
     cap.eval(&p);
 
     fseek(cap.fh, 0, SEEK_SET);
@@ -368,7 +365,7 @@ TEST_CASE("write packet", "[PacketCapture]")
 
     free(pcap);
 
-    cap.disable();
+    packet_capture_disable();
     cap.eval(null_packet);
 }
 
@@ -379,11 +376,11 @@ TEST_CASE("bad filter", "[PacketCapture]")
     CaptureModule mod;
     MockPacketCapture cap(&mod);
 
-    cap.enable("this is garbage");
+    packet_capture_enable("this is garbage");
     cap.eval(null_packet);
     CHECK ( !capture_initialized() );
 
-    cap.enable(
+    packet_capture_enable(
     "port 0 "
     "port 1 "
     "port 2 "
@@ -442,8 +439,8 @@ TEST_CASE("bpf filter", "[PacketCapture]")
     CaptureModule mod;
     MockPacketCapture cap(&mod);
     
-    cap.enable("ip host 10.82.240.82");
-    cap.enable(""); //Test double-enable guard
+    packet_capture_enable("ip host 10.82.240.82");
+    packet_capture_enable(""); //Test double-enable guard
 
     p.pkt = match;
     cap.write_packet_called = false;
@@ -473,7 +470,7 @@ TEST_CASE("bpf filter", "[PacketCapture]")
 
     free(pcap);
 
-    cap.disable();
+    packet_capture_disable();
     cap.eval(null_packet);
 }
 #endif

diff --git a/src/network_inspectors/packet_capture/packet_capture.h b/src/network_inspectors/packet_capture/packet_capture.h
index a65c1f8b279d8ad49117b326586af1210ec7e5d9..13f03e9cf95465a9eed86203edb7f6f76cfd2128 100644 (file)
--- a/src/network_inspectors/packet_capture/packet_capture.h
+++ b/src/network_inspectors/packet_capture/packet_capture.h
@@ -23,5 +23,8 @@
 
 #include "capture_module.h"
 
+void packet_capture_enable(string);
+void packet_capture_disable();
+
 #endif