added lua config option to start capture at startup

diff --git a/src/network_inspectors/packet_capture/capture_module.cc b/src/network_inspectors/packet_capture/capture_module.cc
index 74823f3b3b590770821f53d61ee478b94ac869f1..410e82f70cd1ea289a5e9433a8206976e2b6e2d4 100644 (file)
--- a/src/network_inspectors/packet_capture/capture_module.cc
+++ b/src/network_inspectors/packet_capture/capture_module.cc
@@ -38,7 +38,10 @@ const PegInfo cap_names[] =
 
 static const Parameter s_capture[] =
 {
-    { "filter", Parameter::PT_STRING, nullptr, nullptr,
+    { "enable", Parameter::PT_BOOL, nullptr, "false",
+      "initially enable packet dumping" },
+
+    { "filter", Parameter::PT_STRING, nullptr, "",
       "bpf filter to use for packet dump" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
@@ -46,7 +49,7 @@ static const Parameter s_capture[] =
 
 static const Command cap_cmds[] = 
 {
-    { "enable", enable, s_capture, "dump raw packets"},
+    { "enable", enable, &s_capture[1], "dump raw packets"},
     { "disable", disable, nullptr, "stop packet dump"},
     { nullptr, nullptr, nullptr, nullptr }
 };
@@ -66,7 +69,23 @@ static int disable(lua_State*)
     return 0;
 }
 
-CaptureModule::CaptureModule() : Module(CAPTURE_NAME, CAPTURE_HELP){ }
+CaptureModule::CaptureModule() :
+    Module(CAPTURE_NAME, CAPTURE_HELP, s_capture)
+{ memset(&config, 0, sizeof(config)); }
+
+bool CaptureModule::set(const char*, Value& v, SnortConfig*)
+{
+    if ( v.is("enable") )
+        config.enabled = v.get_bool();
+
+    else if ( v.is("filter") )
+        config.filter = v.get_string();
+
+    else
+        return false;
+
+    return true;
+}
 
 const Command* CaptureModule::get_commands() const
 { return cap_cmds; }

diff --git a/src/network_inspectors/packet_capture/capture_module.h b/src/network_inspectors/packet_capture/capture_module.h
index 3b7c7861be8f535bfdcc4f44cc4cc326c76773c6..d97eef1af66778ea962414e346aee7635ab0662d 100644 (file)
--- a/src/network_inspectors/packet_capture/capture_module.h
+++ b/src/network_inspectors/packet_capture/capture_module.h
@@ -26,7 +26,17 @@
 #define CAPTURE_NAME "packet_capture"
 #define CAPTURE_HELP "raw packet dumping facility"
 
-struct CaptureConfig{};
+struct CaptureConfig
+{
+    bool enabled;
+    std::string filter;    
+};
+
+struct CaptureStats
+{
+    PegCount checked;
+    PegCount matched;
+};
 
 class CaptureModule : public Module
 {
@@ -37,6 +47,7 @@ public:
     PegCount* get_counts() const override;
     ProfileStats* get_profile() const override;
     const Command* get_commands() const override;
+    bool set(const char*, Value&, SnortConfig*) override;
 
     void get_config(CaptureConfig&);
 
@@ -44,12 +55,6 @@ private:
     CaptureConfig config;
 };
 
-struct CaptureStats
-{
-    PegCount checked;
-    PegCount matched;
-};
-
 extern THREAD_LOCAL CaptureStats cap_count_stats;
 extern THREAD_LOCAL ProfileStats cap_prof_stats;
 

diff --git a/src/network_inspectors/packet_capture/packet_capture.cc b/src/network_inspectors/packet_capture/packet_capture.cc
index 43536816c262431047f615bfcaea4dd8a3a7a18e..159d93437ef49fa3266e0013822583a5f05122a7 100644 (file)
--- a/src/network_inspectors/packet_capture/packet_capture.cc
+++ b/src/network_inspectors/packet_capture/packet_capture.cc
@@ -43,8 +43,7 @@
 
 using namespace std;
 
-static bool enabled = false;
-static string filter = "";
+static CaptureConfig config;
 
 static THREAD_LOCAL pcap_t* pcap = nullptr;
 static THREAD_LOCAL pcap_dumper_t* dumper = nullptr;
@@ -55,10 +54,10 @@ static inline bool capture_initialized()
 
 void packet_capture_enable(string f)
 {
-    if ( !enabled )
+    if ( !config.enabled )
     {
-        filter = f;
-        enabled = true;
+        config.filter = f;
+        config.enabled = true;
     }
     else
         WarningMessage("Conflicting packet capture already in progress.\n");
@@ -66,7 +65,7 @@ void packet_capture_enable(string f)
 
 void packet_capture_disable()
 {
-    enabled = false;
+    config.enabled = false;
     LogMessage("Packet capture disabled\n");
 }
 
@@ -77,7 +76,7 @@ void packet_capture_disable()
 class PacketCapture : public Inspector
 {
 public:
-    PacketCapture(CaptureModule*) {};
+    PacketCapture(CaptureModule*);
     
     void eval(Packet*) override;
     void tterm() override { capture_term(); };
@@ -89,9 +88,12 @@ protected:
     virtual void write_packet(Packet* p);
 };
 
+PacketCapture::PacketCapture(CaptureModule* m)
+{ m->get_config(config); }
+
 void PacketCapture::eval(Packet* p)
 {
-    if ( enabled )
+    if ( config.enabled )
     {
         if ( !capture_initialized() )
             if ( !capture_init() )
@@ -112,7 +114,8 @@ void PacketCapture::eval(Packet* p)
 
 bool PacketCapture::capture_init()
 {
-    if ( sfbpf_compile(SNAP_LEN, DLT_EN10MB, &bpf, filter.c_str(), 1, 0) >= 0 )
+    if ( sfbpf_compile(SNAP_LEN, DLT_EN10MB, &bpf,
+        config.filter.c_str(), 1, 0) >= 0 )
     {
         if ( sfbpf_validate(bpf.bf_insns, bpf.bf_len) )
         {