diff options
Diffstat (limited to 'framework/src/suricata/contrib')
20 files changed, 0 insertions, 1588 deletions
diff --git a/framework/src/suricata/contrib/Makefile.am b/framework/src/suricata/contrib/Makefile.am deleted file mode 100644 index 0eb1719a..00000000 --- a/framework/src/suricata/contrib/Makefile.am +++ /dev/null @@ -1,3 +0,0 @@ -SUBDIRS = file_processor tile_pcie_logd - -EXTRA_DIST = suri-graphite diff --git a/framework/src/suricata/contrib/file_processor/Action/Log.pm b/framework/src/suricata/contrib/file_processor/Action/Log.pm deleted file mode 100644 index f47fedbe..00000000 --- a/framework/src/suricata/contrib/file_processor/Action/Log.pm +++ /dev/null @@ -1,15 +0,0 @@ -package Action::Log; -use Moose; -extends 'Processor'; - -has 'data' => (is => 'rw', isa => 'HashRef', required => 1); - -sub name { 'log' } -sub description { 'Log to file' } - -sub perform { - my $self = shift; - $self->log->info($self->json->encode($self->data)); -} - -1
\ No newline at end of file diff --git a/framework/src/suricata/contrib/file_processor/Action/Makefile.am b/framework/src/suricata/contrib/file_processor/Action/Makefile.am deleted file mode 100644 index ddf7321a..00000000 --- a/framework/src/suricata/contrib/file_processor/Action/Makefile.am +++ /dev/null @@ -1 +0,0 @@ -EXTRA_DIST=Log.pm Syslog.pm diff --git a/framework/src/suricata/contrib/file_processor/Action/Syslog.pm b/framework/src/suricata/contrib/file_processor/Action/Syslog.pm deleted file mode 100644 index 6b7c31a1..00000000 --- a/framework/src/suricata/contrib/file_processor/Action/Syslog.pm +++ /dev/null @@ -1,20 +0,0 @@ -package Action::Syslog; -use Moose; -extends 'Processor'; -use Sys::Syslog qw(:standard :macros); - -our $Program = 'suricata_file'; -our $Facility = LOG_LOCAL0; -has 'data' => (is => 'rw', isa => 'HashRef', required => 1); - -sub name { 'syslog' } -sub description { 'Log to local syslog' } - -sub perform { - my $self = shift; - openlog($Program, undef, $Facility); - syslog(LOG_INFO, $self->json->encode($self->data)); - closelog; -} - -1 diff --git a/framework/src/suricata/contrib/file_processor/LICENSE b/framework/src/suricata/contrib/file_processor/LICENSE deleted file mode 100644 index d511905c..00000000 --- a/framework/src/suricata/contrib/file_processor/LICENSE +++ /dev/null @@ -1,339 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 2, June 1991 - - Copyright (C) 1989, 1991 Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The licenses for most software are designed to take away your -freedom to share and change it. By contrast, the GNU General Public -License is intended to guarantee your freedom to share and change free -software--to make sure the software is free for all its users. This -General Public License applies to most of the Free Software -Foundation's software and to any other program whose authors commit to -using it. (Some other Free Software Foundation software is covered by -the GNU Lesser General Public License instead.) You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -this service if you wish), that you receive source code or can get it -if you want it, that you can change the software or use pieces of it -in new free programs; and that you know you can do these things. - - To protect your rights, we need to make restrictions that forbid -anyone to deny you these rights or to ask you to surrender the rights. -These restrictions translate to certain responsibilities for you if you -distribute copies of the software, or if you modify it. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must give the recipients all the rights that -you have. You must make sure that they, too, receive or can get the -source code. And you must show them these terms so they know their -rights. - - We protect your rights with two steps: (1) copyright the software, and -(2) offer you this license which gives you legal permission to copy, -distribute and/or modify the software. - - Also, for each author's protection and ours, we want to make certain -that everyone understands that there is no warranty for this free -software. If the software is modified by someone else and passed on, we -want its recipients to know that what they have is not the original, so -that any problems introduced by others will not reflect on the original -authors' reputations. - - Finally, any free program is threatened constantly by software -patents. We wish to avoid the danger that redistributors of a free -program will individually obtain patent licenses, in effect making the -program proprietary. To prevent this, we have made it clear that any -patent must be licensed for everyone's free use or not licensed at all. - - The precise terms and conditions for copying, distribution and -modification follow. - - GNU GENERAL PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. This License applies to any program or other work which contains -a notice placed by the copyright holder saying it may be distributed -under the terms of this General Public License. The "Program", below, -refers to any such program or work, and a "work based on the Program" -means either the Program or any derivative work under copyright law: -that is to say, a work containing the Program or a portion of it, -either verbatim or with modifications and/or translated into another -language. (Hereinafter, translation is included without limitation in -the term "modification".) Each licensee is addressed as "you". - -Activities other than copying, distribution and modification are not -covered by this License; they are outside its scope. The act of -running the Program is not restricted, and the output from the Program -is covered only if its contents constitute a work based on the -Program (independent of having been made by running the Program). -Whether that is true depends on what the Program does. - - 1. You may copy and distribute verbatim copies of the Program's -source code as you receive it, in any medium, provided that you -conspicuously and appropriately publish on each copy an appropriate -copyright notice and disclaimer of warranty; keep intact all the -notices that refer to this License and to the absence of any warranty; -and give any other recipients of the Program a copy of this License -along with the Program. - -You may charge a fee for the physical act of transferring a copy, and -you may at your option offer warranty protection in exchange for a fee. - - 2. You may modify your copy or copies of the Program or any portion -of it, thus forming a work based on the Program, and copy and -distribute such modifications or work under the terms of Section 1 -above, provided that you also meet all of these conditions: - - a) You must cause the modified files to carry prominent notices - stating that you changed the files and the date of any change. - - b) You must cause any work that you distribute or publish, that in - whole or in part contains or is derived from the Program or any - part thereof, to be licensed as a whole at no charge to all third - parties under the terms of this License. - - c) If the modified program normally reads commands interactively - when run, you must cause it, when started running for such - interactive use in the most ordinary way, to print or display an - announcement including an appropriate copyright notice and a - notice that there is no warranty (or else, saying that you provide - a warranty) and that users may redistribute the program under - these conditions, and telling the user how to view a copy of this - License. (Exception: if the Program itself is interactive but - does not normally print such an announcement, your work based on - the Program is not required to print an announcement.) - -These requirements apply to the modified work as a whole. If -identifiable sections of that work are not derived from the Program, -and can be reasonably considered independent and separate works in -themselves, then this License, and its terms, do not apply to those -sections when you distribute them as separate works. But when you -distribute the same sections as part of a whole which is a work based -on the Program, the distribution of the whole must be on the terms of -this License, whose permissions for other licensees extend to the -entire whole, and thus to each and every part regardless of who wrote it. - -Thus, it is not the intent of this section to claim rights or contest -your rights to work written entirely by you; rather, the intent is to -exercise the right to control the distribution of derivative or -collective works based on the Program. - -In addition, mere aggregation of another work not based on the Program -with the Program (or with a work based on the Program) on a volume of -a storage or distribution medium does not bring the other work under -the scope of this License. - - 3. You may copy and distribute the Program (or a work based on it, -under Section 2) in object code or executable form under the terms of -Sections 1 and 2 above provided that you also do one of the following: - - a) Accompany it with the complete corresponding machine-readable - source code, which must be distributed under the terms of Sections - 1 and 2 above on a medium customarily used for software interchange; or, - - b) Accompany it with a written offer, valid for at least three - years, to give any third party, for a charge no more than your - cost of physically performing source distribution, a complete - machine-readable copy of the corresponding source code, to be - distributed under the terms of Sections 1 and 2 above on a medium - customarily used for software interchange; or, - - c) Accompany it with the information you received as to the offer - to distribute corresponding source code. (This alternative is - allowed only for noncommercial distribution and only if you - received the program in object code or executable form with such - an offer, in accord with Subsection b above.) - -The source code for a work means the preferred form of the work for -making modifications to it. For an executable work, complete source -code means all the source code for all modules it contains, plus any -associated interface definition files, plus the scripts used to -control compilation and installation of the executable. However, as a -special exception, the source code distributed need not include -anything that is normally distributed (in either source or binary -form) with the major components (compiler, kernel, and so on) of the -operating system on which the executable runs, unless that component -itself accompanies the executable. - -If distribution of executable or object code is made by offering -access to copy from a designated place, then offering equivalent -access to copy the source code from the same place counts as -distribution of the source code, even though third parties are not -compelled to copy the source along with the object code. - - 4. You may not copy, modify, sublicense, or distribute the Program -except as expressly provided under this License. Any attempt -otherwise to copy, modify, sublicense or distribute the Program is -void, and will automatically terminate your rights under this License. -However, parties who have received copies, or rights, from you under -this License will not have their licenses terminated so long as such -parties remain in full compliance. - - 5. You are not required to accept this License, since you have not -signed it. However, nothing else grants you permission to modify or -distribute the Program or its derivative works. These actions are -prohibited by law if you do not accept this License. Therefore, by -modifying or distributing the Program (or any work based on the -Program), you indicate your acceptance of this License to do so, and -all its terms and conditions for copying, distributing or modifying -the Program or works based on it. - - 6. Each time you redistribute the Program (or any work based on the -Program), the recipient automatically receives a license from the -original licensor to copy, distribute or modify the Program subject to -these terms and conditions. You may not impose any further -restrictions on the recipients' exercise of the rights granted herein. -You are not responsible for enforcing compliance by third parties to -this License. - - 7. If, as a consequence of a court judgment or allegation of patent -infringement or for any other reason (not limited to patent issues), -conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot -distribute so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you -may not distribute the Program at all. For example, if a patent -license would not permit royalty-free redistribution of the Program by -all those who receive copies directly or indirectly through you, then -the only way you could satisfy both it and this License would be to -refrain entirely from distribution of the Program. - -If any portion of this section is held invalid or unenforceable under -any particular circumstance, the balance of the section is intended to -apply and the section as a whole is intended to apply in other -circumstances. - -It is not the purpose of this section to induce you to infringe any -patents or other property right claims or to contest validity of any -such claims; this section has the sole purpose of protecting the -integrity of the free software distribution system, which is -implemented by public license practices. Many people have made -generous contributions to the wide range of software distributed -through that system in reliance on consistent application of that -system; it is up to the author/donor to decide if he or she is willing -to distribute software through any other system and a licensee cannot -impose that choice. - -This section is intended to make thoroughly clear what is believed to -be a consequence of the rest of this License. - - 8. If the distribution and/or use of the Program is restricted in -certain countries either by patents or by copyrighted interfaces, the -original copyright holder who places the Program under this License -may add an explicit geographical distribution limitation excluding -those countries, so that distribution is permitted only in or among -countries not thus excluded. In such case, this License incorporates -the limitation as if written in the body of this License. - - 9. The Free Software Foundation may publish revised and/or new versions -of the General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - -Each version is given a distinguishing version number. If the Program -specifies a version number of this License which applies to it and "any -later version", you have the option of following the terms and conditions -either of that version or of any later version published by the Free -Software Foundation. If the Program does not specify a version number of -this License, you may choose any version ever published by the Free Software -Foundation. - - 10. If you wish to incorporate parts of the Program into other free -programs whose distribution conditions are different, write to the author -to ask for permission. For software which is copyrighted by the Free -Software Foundation, write to the Free Software Foundation; we sometimes -make exceptions for this. Our decision will be guided by the two goals -of preserving the free status of all derivatives of our free software and -of promoting the sharing and reuse of software generally. - - NO WARRANTY - - 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY -FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN -OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES -PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED -OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS -TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE -PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, -REPAIR OR CORRECTION. - - 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR -REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING -OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED -TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY -YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER -PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE -POSSIBILITY OF SUCH DAMAGES. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -convey the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - <one line to give the program's name and a brief idea of what it does.> - Copyright (C) <year> <name of author> - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License along - with this program; if not, write to the Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. - -Also add information on how to contact you by electronic and paper mail. - -If the program is interactive, make it output a short notice like this -when it starts in an interactive mode: - - Gnomovision version 69, Copyright (C) year name of author - Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, the commands you use may -be called something other than `show w' and `show c'; they could even be -mouse-clicks or menu items--whatever suits your program. - -You should also get your employer (if you work as a programmer) or your -school, if any, to sign a "copyright disclaimer" for the program, if -necessary. Here is a sample; alter the names: - - Yoyodyne, Inc., hereby disclaims all copyright interest in the program - `Gnomovision' (which makes passes at compilers) written by James Hacker. - - <signature of Ty Coon>, 1 April 1989 - Ty Coon, President of Vice - -This General Public License does not permit incorporating your program into -proprietary programs. If your program is a subroutine library, you may -consider it more useful to permit linking proprietary applications with the -library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. diff --git a/framework/src/suricata/contrib/file_processor/Makefile.am b/framework/src/suricata/contrib/file_processor/Makefile.am deleted file mode 100644 index 925c174b..00000000 --- a/framework/src/suricata/contrib/file_processor/Makefile.am +++ /dev/null @@ -1,2 +0,0 @@ -SUBDIRS = Action Processor -EXTRA_DIST = file_processor.conf file_processor.pl LICENSE README diff --git a/framework/src/suricata/contrib/file_processor/Processor/Anubis.pm b/framework/src/suricata/contrib/file_processor/Processor/Anubis.pm deleted file mode 100644 index 6cdabb8d..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/Anubis.pm +++ /dev/null @@ -1,33 +0,0 @@ -package Processor::Anubis; -use Moose; -extends 'Processor'; -use Data::Dumper; -use LWP::UserAgent; - -has 'md5' => (is => 'ro', isa => 'Str', required => 1); -has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); -has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://anubis.iseclab.org/?action=result&task_id=%s'); -sub name { 'Anubis' } -sub description { 'Processor for anubis.iseclab.org' } - -sub process { - my $self = shift; - my $url = sprintf($self->url_template, $self->md5); - $self->log->debug('Getting url ' . $url); - my $response = $self->ua->get($url); - #$self->log->debug(Dumper($response)); - if ($response->code eq 200){ - if ($response->decoded_content =~ /Invalid Task ID/){ - $self->log->debug('No result'); - return 0; - } - $self->log->info('Got result'); - return $url; - } - else { - $self->log->debug('Communications failure: ' . Dumper($response)); - return 0; - } -} - -1
\ No newline at end of file diff --git a/framework/src/suricata/contrib/file_processor/Processor/Makefile.am b/framework/src/suricata/contrib/file_processor/Processor/Makefile.am deleted file mode 100644 index a9a2fef8..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/Makefile.am +++ /dev/null @@ -1,2 +0,0 @@ -EXTRA_DIST=Anubis.pm Malwr.pm ShadowServer.pm ThreatExpert.pm VirusTotal.pm - diff --git a/framework/src/suricata/contrib/file_processor/Processor/Malwr.pm b/framework/src/suricata/contrib/file_processor/Processor/Malwr.pm deleted file mode 100644 index b8428c1e..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/Malwr.pm +++ /dev/null @@ -1,32 +0,0 @@ -package Processor::Malwr; -use Moose; -extends 'Processor'; -use Data::Dumper; -use LWP::UserAgent; - -has 'md5' => (is => 'ro', isa => 'Str', required => 1); -has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); -has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://malwr.com/analysis/%s/'); -sub name { 'Malwr' } -sub description { 'Processor for Malwr.com' } - -sub process { - my $self = shift; - my $url = sprintf($self->url_template, $self->md5); - $self->log->debug('Getting url ' . $url); - my $response = $self->ua->get($url); - if ($response->code eq 200){ - if ($response->decoded_content =~ /Cannot find analysis with specified ID or MD5/){ - $self->log->debug('No result'); - return 0; - } - $self->log->info('Got malwr.com result'); - return $url; - } - else { - $self->log->debug('Communications failure: ' . Dumper($response)); - return 0; - } -} - -1
\ No newline at end of file diff --git a/framework/src/suricata/contrib/file_processor/Processor/ShadowServer.pm b/framework/src/suricata/contrib/file_processor/Processor/ShadowServer.pm deleted file mode 100644 index c9c7a5f9..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/ShadowServer.pm +++ /dev/null @@ -1,49 +0,0 @@ -package Processor::ShadowServer; -use Moose; -extends 'Processor'; -use Data::Dumper; -use LWP::UserAgent; -use JSON; - -has 'md5' => (is => 'ro', isa => 'Str', required => 1); -has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); -has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://innocuous.shadowserver.org/api/?query=%s'); -sub name { 'ShadowServer' } -sub description { 'Processor for shadowserver.com' } - -sub process { - my $self = shift; - my $url = sprintf($self->url_template, $self->md5); - $self->log->debug('Getting url ' . $url); - my $response = $self->ua->get($url); - if ($response->code eq 200){ - if ($response->decoded_content =~ /No match/){ - $self->log->debug('No result'); - return 0; - } - elsif ($response->decoded_content =~ /Whitelisted/){ - $self->log->info('Whitelisted'); - return 0; - } - $self->log->info('Got shadowserver.com result'); - my $ret; - eval { - my ($meta,$json) = split(/\n/, $response->decoded_content); - my @meta_cols = qw(md5 sha1 first_date last_date type ssdeep); - my %metas; - @metas{@meta_cols} = split(/\,/, $meta); - $ret = { meta => \%metas, results => decode_json($json) }; - }; - if ($@){ - $self->log->error($@); - return 0; - } - return $ret; - } - else { - $self->log->debug('Communications failure: ' . Dumper($response)); - return 0; - } -} - -1 diff --git a/framework/src/suricata/contrib/file_processor/Processor/ThreatExpert.pm b/framework/src/suricata/contrib/file_processor/Processor/ThreatExpert.pm deleted file mode 100644 index b61fb0fc..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/ThreatExpert.pm +++ /dev/null @@ -1,33 +0,0 @@ -package Processor::ThreatExpert; -use Moose; -extends 'Processor'; -use Data::Dumper; -use LWP::UserAgent; - -has 'md5' => (is => 'ro', isa => 'Str', required => 1); -has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); -has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://www.threatexpert.com/report.aspx?md5=%s'); -sub name { 'ThreatExpert' } -sub description { 'Processor for threatexpert.com' } - -sub process { - my $self = shift; - my $url = sprintf($self->url_template, $self->md5); - $self->log->debug('Getting url ' . $url); - my $response = $self->ua->get($url); - #$self->log->debug(Dumper($response)); - if ($response->code eq 200){ - if ($response->decoded_content =~ /Search All Reports/){ - $self->log->debug('No result'); - return 0; - } - $self->log->info('Got result'); - return $url; - } - else { - $self->log->debug('Communications failure: ' . Dumper($response)); - return 0; - } -} - -1
\ No newline at end of file diff --git a/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm b/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm deleted file mode 100644 index 91a9939e..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm +++ /dev/null @@ -1,39 +0,0 @@ -package Processor::VirusTotal; -use Moose; -extends 'Processor'; -use Data::Dumper; -use LWP::UserAgent; - -has 'md5' => (is => 'ro', isa => 'Str', required => 1); -has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); -has 'url' => (is => 'ro', isa => 'Str', required => 1, default => 'https://www.virustotal.com/vtapi/v2/file/report'); -sub name { 'VirusTotal' } -sub description { 'Processor for virustotal.com' } - -sub process { - my $self = shift; - unless ($self->conf->{virustotal_apikey}){ - warn('No VirusTotal apikey configured in config file'); - return 0; - } - $self->log->debug('Getting url ' . $self->url); - #$self->log->debug('md5: ' . $self->md5 . ', apikey: ' . $self->conf->{virustotal_apikey}); - my $response = $self->ua->post($self->url, { resource => $self->md5, apikey => $self->conf->{virustotal_apikey} }); - #$self->log->debug(Dumper($response)); - if ($response->code eq 200){ - my $data = $self->json->decode($response->decoded_content); - $self->log->debug('data: ' . Dumper($data)); - if ($data->{positives}){ - return $data; - } - else { - return 0; - } - } - else { - $self->log->debug('Communications failure: ' . Dumper($response)); - return 0; - } -} - -1
\ No newline at end of file diff --git a/framework/src/suricata/contrib/file_processor/README b/framework/src/suricata/contrib/file_processor/README deleted file mode 100644 index 2dca715b..00000000 --- a/framework/src/suricata/contrib/file_processor/README +++ /dev/null @@ -1,8 +0,0 @@ -This directory contains what's needed for reading the JSON file /var/log/suricata/files-json.log and processing those entries against plugins. Included are plugins for checking the MD5 of the observed file on the network against already created reports on anubis.iseclab.org, malwr.com, and threatexpert.com. If you have a virustotal.com API key (free, though see the terms of use on virustotal.com/documentation/public-api/), you can enable the virustotal.com plugin and configure your API key so you can check the MD5 against over forty AV vendors' results. - -To create new plugins, use the existing modules as a guide. Drop a new file with the .pm extension in either the Processor or Action directory, depending on what kind of plugin it is. Processor plugins add information to the data. Action plugins do something with the data once all of the information is available. A simple logging demo has been included, but many different kinds of action plugins could be written to do things like submit full files to a sandbox, send an email, log to a database, send an SNMP trap, etc. - -INSTALLATION -You will need a few Perl modules to get going. I recommend using the excellent cpanm utility which can be installed by typing "cpan App::cpanminus." After cpanm is installed, you can install everything in one command like this: -cpanm Moose Module::Pluggable Log::Log4perl Config::JSON File::Tail LWP::UserAgent Sys::Syslog -Alternatively, you may wish to install using your operating system's package manager, though that may not use the latest code for these modules. diff --git a/framework/src/suricata/contrib/file_processor/file_processor.conf b/framework/src/suricata/contrib/file_processor/file_processor.conf deleted file mode 100644 index 839c0c35..00000000 --- a/framework/src/suricata/contrib/file_processor/file_processor.conf +++ /dev/null @@ -1,16 +0,0 @@ -{ - "logdir": "/var/log/suricata", - "debug_level": "INFO", - #"virustotal_apikey": "xxx" - "actions": { - "Action::Log": 1, - "Action::Syslog": 1 - }, - "processors": { - "Processor::Anubis": 1, - "Processor::Malwr": 1, - "Processor::ThreatExpert": 1, - "Processor::ShadowServer": 1 - #"Processor::VirusTotal": 1 - } -} diff --git a/framework/src/suricata/contrib/file_processor/file_processor.pl b/framework/src/suricata/contrib/file_processor/file_processor.pl deleted file mode 100644 index f9cce022..00000000 --- a/framework/src/suricata/contrib/file_processor/file_processor.pl +++ /dev/null @@ -1,155 +0,0 @@ -# Copyright (C) 2012 Martin Holste -# -# You can copy, redistribute or modify this Program under the terms of -# the GNU General Public License version 2 as published by the Free -# Software Foundation. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# version 2 along with this program; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA -# 02110-1301, USA. -# - - -package Processor; -use Moose; -use Data::Dumper; -use Module::Pluggable search_path => qw(Processor), sub_name => 'processors'; -use Module::Pluggable search_path => qw(Action), sub_name => 'actions'; -use Log::Log4perl; -use JSON; - -has 'conf' => (is => 'rw', isa => 'HashRef', required => 1); -has 'log' => (is => 'rw', isa => 'Object', required => 1); -has 'json' => (is => 'ro', isa => 'JSON', required => 1, default => sub { return JSON->new->pretty->allow_blessed }); - -sub BUILD { - my $self = shift; - - foreach my $processor_plugin ($self->processors){ - next unless exists $self->conf->{processors}->{$processor_plugin}; - eval qq{require $processor_plugin}; - $self->log->info('Using processor plugin ' . $processor_plugin->description); - } - - foreach my $action_plugin ($self->actions){ - next unless exists $self->conf->{actions}->{$action_plugin}; - eval qq{require $action_plugin}; - $self->log->info('Using action plugin ' . $action_plugin->description); - } -} - -sub process { - my $self = shift; - my $line = shift; - #$self->log->debug('got line ' . $line); - eval { - my $data = $self->json->decode($line); - $data->{processors} = {}; - if($data->{md5}){ - foreach my $processor_plugin ($self->processors){ - next unless exists $self->conf->{processors}->{$processor_plugin}; - my $processor = $processor_plugin->new(conf => $self->conf, log => $self->log, md5 => $data->{md5}); - $self->log->debug('processing with plugin ' . $processor->description); - $data->{processors}->{ $processor->name } = $processor->process(); - } - } - #$self->log->debug('data: ' . Dumper($data)); - foreach my $action_plugin ($self->actions){ - next unless exists $self->conf->{actions}->{$action_plugin}; - my $action = $action_plugin->new(conf => $self->conf, log => $self->log, data => $data); - $self->log->debug('performing action with plugin ' . $action->description); - $action->perform(); - } - }; - if ($@){ - $self->log->error('Error: ' . $@ . ', processing line: ' . $line); - } -} - -package main; -use strict; -use Getopt::Std; -use FindBin; -use Config::JSON; -use File::Tail; - -# Include the directory this script is in -use lib $FindBin::Bin; - -my %Opts; -getopts('c:', \%Opts); - -my $conf_file = $Opts{c} ? $Opts{c} : '/etc/suricata/file_processor.conf'; -my $Conf = { - logdir => '/tmp', - debug_level => 'TRACE', - actions => { - 'Action::Log' => 1, - 'Action::Syslog' => 1, - }, - processors => { - 'Processor::Anubis' => 1, - 'Processor::Malwr' => 1, - 'Processor::ThreatExpert' => 1, - } -}; -if (-f $conf_file){ - $Conf = Config::JSON->new( $conf_file ); - $Conf = $Conf->{config}; # native hash is 10x faster than using Config::JSON->get() -} - -# Setup logger -my $logdir = $Conf->{logdir} ? $Conf->{logdir} : '/var/log/suricata'; -my $debug_level = $Conf->{debug_level} ? $Conf->{debug_level} : 'TRACE'; -my $l4pconf = qq( - log4perl.category.App = $debug_level, File, Screen - log4perl.appender.File = Log::Log4perl::Appender::File - log4perl.appender.File.filename = $logdir/file_processor.log - log4perl.appender.File.syswrite = 1 - log4perl.appender.File.recreate = 1 - log4perl.appender.File.layout = Log::Log4perl::Layout::PatternLayout - log4perl.appender.File.layout.ConversionPattern = * %p [%d] %F (%L) %M %P %m%n - log4perl.filter.ScreenLevel = Log::Log4perl::Filter::LevelRange - log4perl.filter.ScreenLevel.LevelMin = $debug_level - log4perl.filter.ScreenLevel.LevelMax = ERROR - log4perl.filter.ScreenLevel.AcceptOnMatch = true - log4perl.appender.Screen = Log::Log4perl::Appender::Screen - log4perl.appender.Screen.Filter = ScreenLevel - log4perl.appender.Screen.stderr = 1 - log4perl.appender.Screen.layout = Log::Log4perl::Layout::PatternLayout - log4perl.appender.Screen.layout.ConversionPattern = * %p [%d] %F (%L) %M %P %m%n -); -Log::Log4perl::init( \$l4pconf ) or die("Unable to init logger\n"); -my $Log = Log::Log4perl::get_logger('App') or die("Unable to init logger\n"); - -my $processor = new Processor(conf => $Conf, log => $Log); - -my $file = $Conf->{file} ? $Conf->{file} : '/var/log/suricata/files-json.log'; -my $tail = new File::Tail(name => $file, maxinterval => 1); - -while (my $line = $tail->read){ - $processor->process($line); -} - -__END__ -Example config file /etc/suricata/file_processor.conf -{ - "logdir": "/var/log/suricata", - "debug_level": "INFO", - "virustotal_apikey": "xxx" - "actions": { - "Action::Log": 1 - }, - "processors": { - "Processor::Anubis": 1, - "Processor::Malwr": 1, - "Processor::ThreatExpert": 1, - "Processor::VirusTotal": 1 - } -} diff --git a/framework/src/suricata/contrib/suri-graphite b/framework/src/suricata/contrib/suri-graphite deleted file mode 100755 index beac0792..00000000 --- a/framework/src/suricata/contrib/suri-graphite +++ /dev/null @@ -1,80 +0,0 @@ -#!/usr/bin/env python -# Copyright (C) 2013, 2015 Eric Leblond <eric@regit.org> -# -# You can copy, redistribute or modify this Program under the terms of -# the GNU General Public License version 3 as published by the Free -# Software Foundation. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# version 3 along with this program; if not, write to the Free Software -# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA -# 02110-1301, USA. - -import suricatasc -import socket -import time -import argparse - -have_daemon = True -try: - import daemon -except: - logging.warning("No daemon support available, install python-daemon if feature is needed") - have_daemon = False - -parser = argparse.ArgumentParser(prog='suri-graphite', description='Export suricata stats to Graphite') -parser.add_argument('-H', '--host', default='localhost', help='Host running Graphite') -parser.add_argument('-P', '--port', default=2003, help='Port of Graphite data socket') -parser.add_argument('-O', '--oneshot', action='store_const', const=True, help='Send one update and exit', default=False) -parser.add_argument('-D', '--delay', default=10, help='Delay between data dump') -parser.add_argument('-r', '--root', default='suricata.perf', help='Prefix of data name in Graphite') -parser.add_argument('-o', '--output', default=None, help='Output stats to a file instead of using Graphite') -parser.add_argument('socket', help='suricata socket file to connect to', - default="/usr/local/var/run/suricata/suricata-command.socket", nargs='?') -parser.add_argument('-v', '--verbose', action='store_const', const=True, help='verbose output', default=False) -if have_daemon: - parser.add_argument('-d', '--daemon', default=False, action="store_true", help="Run as unix daemon") - - -args = parser.parse_args() - -if args.output: - import json - -def main_task(args): - sc = suricatasc.SuricataSC(args.socket) - sc.connect() - - if args.output: - logfile = open(args.output, 'a') - else: - sck = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - sck.connect((args.host, int(args.port))) - - while 1: - res = sc.send_command("dump-counters") - res = res['message'] - tnow = int(time.time()) - for thread in res: - for counter in res[thread]: - if args.output: - data = {"key": "%s.%s" % (thread , counter), "value": res[thread][counter], "time": tnow} - logfile.write(json.dumps(data) + '\n') - else: - sck.send("%s.%s.%s %s %d\n" % (args.root, thread , counter, res[thread][counter], tnow)) - if args.verbose: - print "%s.%s.%s %s %d\n" % (args.root, thread , counter, res[thread][counter], tnow) - if args.oneshot: - break - time.sleep(float(args.delay)) - -if have_daemon and args.daemon: - with daemon.DaemonContext(): - main_task(args) -else: - main_task(args) diff --git a/framework/src/suricata/contrib/tile_pcie_logd/LICENSE b/framework/src/suricata/contrib/tile_pcie_logd/LICENSE deleted file mode 100644 index d511905c..00000000 --- a/framework/src/suricata/contrib/tile_pcie_logd/LICENSE +++ /dev/null @@ -1,339 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 2, June 1991 - - Copyright (C) 1989, 1991 Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The licenses for most software are designed to take away your -freedom to share and change it. By contrast, the GNU General Public -License is intended to guarantee your freedom to share and change free -software--to make sure the software is free for all its users. This -General Public License applies to most of the Free Software -Foundation's software and to any other program whose authors commit to -using it. (Some other Free Software Foundation software is covered by -the GNU Lesser General Public License instead.) You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -this service if you wish), that you receive source code or can get it -if you want it, that you can change the software or use pieces of it -in new free programs; and that you know you can do these things. - - To protect your rights, we need to make restrictions that forbid -anyone to deny you these rights or to ask you to surrender the rights. -These restrictions translate to certain responsibilities for you if you -distribute copies of the software, or if you modify it. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must give the recipients all the rights that -you have. You must make sure that they, too, receive or can get the -source code. And you must show them these terms so they know their -rights. - - We protect your rights with two steps: (1) copyright the software, and -(2) offer you this license which gives you legal permission to copy, -distribute and/or modify the software. - - Also, for each author's protection and ours, we want to make certain -that everyone understands that there is no warranty for this free -software. If the software is modified by someone else and passed on, we -want its recipients to know that what they have is not the original, so -that any problems introduced by others will not reflect on the original -authors' reputations. - - Finally, any free program is threatened constantly by software -patents. We wish to avoid the danger that redistributors of a free -program will individually obtain patent licenses, in effect making the -program proprietary. To prevent this, we have made it clear that any -patent must be licensed for everyone's free use or not licensed at all. - - The precise terms and conditions for copying, distribution and -modification follow. - - GNU GENERAL PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. This License applies to any program or other work which contains -a notice placed by the copyright holder saying it may be distributed -under the terms of this General Public License. The "Program", below, -refers to any such program or work, and a "work based on the Program" -means either the Program or any derivative work under copyright law: -that is to say, a work containing the Program or a portion of it, -either verbatim or with modifications and/or translated into another -language. (Hereinafter, translation is included without limitation in -the term "modification".) Each licensee is addressed as "you". - -Activities other than copying, distribution and modification are not -covered by this License; they are outside its scope. The act of -running the Program is not restricted, and the output from the Program -is covered only if its contents constitute a work based on the -Program (independent of having been made by running the Program). -Whether that is true depends on what the Program does. - - 1. You may copy and distribute verbatim copies of the Program's -source code as you receive it, in any medium, provided that you -conspicuously and appropriately publish on each copy an appropriate -copyright notice and disclaimer of warranty; keep intact all the -notices that refer to this License and to the absence of any warranty; -and give any other recipients of the Program a copy of this License -along with the Program. - -You may charge a fee for the physical act of transferring a copy, and -you may at your option offer warranty protection in exchange for a fee. - - 2. You may modify your copy or copies of the Program or any portion -of it, thus forming a work based on the Program, and copy and -distribute such modifications or work under the terms of Section 1 -above, provided that you also meet all of these conditions: - - a) You must cause the modified files to carry prominent notices - stating that you changed the files and the date of any change. - - b) You must cause any work that you distribute or publish, that in - whole or in part contains or is derived from the Program or any - part thereof, to be licensed as a whole at no charge to all third - parties under the terms of this License. - - c) If the modified program normally reads commands interactively - when run, you must cause it, when started running for such - interactive use in the most ordinary way, to print or display an - announcement including an appropriate copyright notice and a - notice that there is no warranty (or else, saying that you provide - a warranty) and that users may redistribute the program under - these conditions, and telling the user how to view a copy of this - License. (Exception: if the Program itself is interactive but - does not normally print such an announcement, your work based on - the Program is not required to print an announcement.) - -These requirements apply to the modified work as a whole. If -identifiable sections of that work are not derived from the Program, -and can be reasonably considered independent and separate works in -themselves, then this License, and its terms, do not apply to those -sections when you distribute them as separate works. But when you -distribute the same sections as part of a whole which is a work based -on the Program, the distribution of the whole must be on the terms of -this License, whose permissions for other licensees extend to the -entire whole, and thus to each and every part regardless of who wrote it. - -Thus, it is not the intent of this section to claim rights or contest -your rights to work written entirely by you; rather, the intent is to -exercise the right to control the distribution of derivative or -collective works based on the Program. - -In addition, mere aggregation of another work not based on the Program -with the Program (or with a work based on the Program) on a volume of -a storage or distribution medium does not bring the other work under -the scope of this License. - - 3. You may copy and distribute the Program (or a work based on it, -under Section 2) in object code or executable form under the terms of -Sections 1 and 2 above provided that you also do one of the following: - - a) Accompany it with the complete corresponding machine-readable - source code, which must be distributed under the terms of Sections - 1 and 2 above on a medium customarily used for software interchange; or, - - b) Accompany it with a written offer, valid for at least three - years, to give any third party, for a charge no more than your - cost of physically performing source distribution, a complete - machine-readable copy of the corresponding source code, to be - distributed under the terms of Sections 1 and 2 above on a medium - customarily used for software interchange; or, - - c) Accompany it with the information you received as to the offer - to distribute corresponding source code. (This alternative is - allowed only for noncommercial distribution and only if you - received the program in object code or executable form with such - an offer, in accord with Subsection b above.) - -The source code for a work means the preferred form of the work for -making modifications to it. For an executable work, complete source -code means all the source code for all modules it contains, plus any -associated interface definition files, plus the scripts used to -control compilation and installation of the executable. However, as a -special exception, the source code distributed need not include -anything that is normally distributed (in either source or binary -form) with the major components (compiler, kernel, and so on) of the -operating system on which the executable runs, unless that component -itself accompanies the executable. - -If distribution of executable or object code is made by offering -access to copy from a designated place, then offering equivalent -access to copy the source code from the same place counts as -distribution of the source code, even though third parties are not -compelled to copy the source along with the object code. - - 4. You may not copy, modify, sublicense, or distribute the Program -except as expressly provided under this License. Any attempt -otherwise to copy, modify, sublicense or distribute the Program is -void, and will automatically terminate your rights under this License. -However, parties who have received copies, or rights, from you under -this License will not have their licenses terminated so long as such -parties remain in full compliance. - - 5. You are not required to accept this License, since you have not -signed it. However, nothing else grants you permission to modify or -distribute the Program or its derivative works. These actions are -prohibited by law if you do not accept this License. Therefore, by -modifying or distributing the Program (or any work based on the -Program), you indicate your acceptance of this License to do so, and -all its terms and conditions for copying, distributing or modifying -the Program or works based on it. - - 6. Each time you redistribute the Program (or any work based on the -Program), the recipient automatically receives a license from the -original licensor to copy, distribute or modify the Program subject to -these terms and conditions. You may not impose any further -restrictions on the recipients' exercise of the rights granted herein. -You are not responsible for enforcing compliance by third parties to -this License. - - 7. If, as a consequence of a court judgment or allegation of patent -infringement or for any other reason (not limited to patent issues), -conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot -distribute so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you -may not distribute the Program at all. For example, if a patent -license would not permit royalty-free redistribution of the Program by -all those who receive copies directly or indirectly through you, then -the only way you could satisfy both it and this License would be to -refrain entirely from distribution of the Program. - -If any portion of this section is held invalid or unenforceable under -any particular circumstance, the balance of the section is intended to -apply and the section as a whole is intended to apply in other -circumstances. - -It is not the purpose of this section to induce you to infringe any -patents or other property right claims or to contest validity of any -such claims; this section has the sole purpose of protecting the -integrity of the free software distribution system, which is -implemented by public license practices. Many people have made -generous contributions to the wide range of software distributed -through that system in reliance on consistent application of that -system; it is up to the author/donor to decide if he or she is willing -to distribute software through any other system and a licensee cannot -impose that choice. - -This section is intended to make thoroughly clear what is believed to -be a consequence of the rest of this License. - - 8. If the distribution and/or use of the Program is restricted in -certain countries either by patents or by copyrighted interfaces, the -original copyright holder who places the Program under this License -may add an explicit geographical distribution limitation excluding -those countries, so that distribution is permitted only in or among -countries not thus excluded. In such case, this License incorporates -the limitation as if written in the body of this License. - - 9. The Free Software Foundation may publish revised and/or new versions -of the General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - -Each version is given a distinguishing version number. If the Program -specifies a version number of this License which applies to it and "any -later version", you have the option of following the terms and conditions -either of that version or of any later version published by the Free -Software Foundation. If the Program does not specify a version number of -this License, you may choose any version ever published by the Free Software -Foundation. - - 10. If you wish to incorporate parts of the Program into other free -programs whose distribution conditions are different, write to the author -to ask for permission. For software which is copyrighted by the Free -Software Foundation, write to the Free Software Foundation; we sometimes -make exceptions for this. Our decision will be guided by the two goals -of preserving the free status of all derivatives of our free software and -of promoting the sharing and reuse of software generally. - - NO WARRANTY - - 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY -FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN -OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES -PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED -OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS -TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE -PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, -REPAIR OR CORRECTION. - - 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR -REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING -OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED -TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY -YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER -PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE -POSSIBILITY OF SUCH DAMAGES. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -convey the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - <one line to give the program's name and a brief idea of what it does.> - Copyright (C) <year> <name of author> - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License along - with this program; if not, write to the Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. - -Also add information on how to contact you by electronic and paper mail. - -If the program is interactive, make it output a short notice like this -when it starts in an interactive mode: - - Gnomovision version 69, Copyright (C) year name of author - Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, the commands you use may -be called something other than `show w' and `show c'; they could even be -mouse-clicks or menu items--whatever suits your program. - -You should also get your employer (if you work as a programmer) or your -school, if any, to sign a "copyright disclaimer" for the program, if -necessary. Here is a sample; alter the names: - - Yoyodyne, Inc., hereby disclaims all copyright interest in the program - `Gnomovision' (which makes passes at compilers) written by James Hacker. - - <signature of Ty Coon>, 1 April 1989 - Ty Coon, President of Vice - -This General Public License does not permit incorporating your program into -proprietary programs. If your program is a subroutine library, you may -consider it more useful to permit linking proprietary applications with the -library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. diff --git a/framework/src/suricata/contrib/tile_pcie_logd/Makefile.am b/framework/src/suricata/contrib/tile_pcie_logd/Makefile.am deleted file mode 100644 index 81a63fcb..00000000 --- a/framework/src/suricata/contrib/tile_pcie_logd/Makefile.am +++ /dev/null @@ -1,14 +0,0 @@ - -EXTRA_DIST = LICENSE README - -if BUILD_PCIE_LOGGING -bin_PROGRAMS = tile_pcie_logd - -tile_pcie_logd_SOURCE = tile_pcie_logd.c - -AM_CFLAGS = -std=gnu99 -Wall -Werror -g -O2 -I$(TILERA_ROOT)/include \ - -DTILEPCI_HOST - -tile_pcie_logd_LDDADD = -pthread - -endif diff --git a/framework/src/suricata/contrib/tile_pcie_logd/README b/framework/src/suricata/contrib/tile_pcie_logd/README deleted file mode 100644 index 32ce7a31..00000000 --- a/framework/src/suricata/contrib/tile_pcie_logd/README +++ /dev/null @@ -1,38 +0,0 @@ -Introduction ------------- - -This application allows writing files to an x86 host from a TILEncore-Gx -PCIe card. The file name and data are sent over PCIe using the Tilera -Packet Queue API from an aplication running on the Tilera processor. - -The original purpose is to write log files from Suricata (Intrusion -Dectection System) on the x86 host's file system. - -Running The Logger ------------------- - -To run the application, set the TILERA_ROOT environment variable to -point to a valide Tilera MDE, then do: - - make run - -The application should be started before the application on the Tile -side that will be generating the log data. - -By default, queue number 0 is used. The --queue_index=N command line -argument can be used to change the queue number. - -If more than one TILEncore-Gx PCIe card is installed, the --card=M -argument changes to listening to card M. - -Caveats -------- - -Due to the fact that the host driver allocates 4MB physically -contiguous memory for the packet queue ring buffer, it is possible -that this allocation could fail on a host whose memory has been -considerably fragmented. If the host program exits with the following -error, reboot the host and run the test again. - -Host: Failed to open '/dev/tilegxpci%d/packet_queue/t2h/0': Cannot -allocate memory diff --git a/framework/src/suricata/contrib/tile_pcie_logd/tile_pcie_logd.c b/framework/src/suricata/contrib/tile_pcie_logd/tile_pcie_logd.c deleted file mode 100644 index eb06f9e4..00000000 --- a/framework/src/suricata/contrib/tile_pcie_logd/tile_pcie_logd.c +++ /dev/null @@ -1,370 +0,0 @@ -/* Copyright (C) 2013-2014 Tilera Corporation. - * - * You can copy, redistribute or modify this Program under the terms of - * the GNU General Public License version 2 as published by the Free - * Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * version 2 along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA - * 02110-1301, USA. - */ - -/** - * \file - * - * \author Ken Steele, Tilera Corporation <suricata@tilera.com> - * \author Tom DeCanio <decanio.tom@gmail.com> - * - * Host side of PCIe alert logging from Suricata running on a - * TILEncore-Gx card. - */ - -#include <stdio.h> -#include <stdlib.h> -#include <sys/mman.h> -#include <sys/ioctl.h> -#include <sys/time.h> -#include <fcntl.h> -#include <malloc.h> -#include <unistd.h> -#include <stdint.h> -#include <string.h> -#include <errno.h> -#include <time.h> -#include <assert.h> - -#include <asm/tilegxpci.h> - -#define CHECK_SEQ_NUM 1 - -/* The "/dev/tilegxpci%d" device to be used. */ -unsigned int card_index = 0; - -unsigned int debug = 0; - -/* - * When set, drop all alerts rather than write to file. This is for - * testing performance on a file system that can't write files fast - * enough. - */ -unsigned int drop_alerts = 0; - -/* Packet queue index. */ -unsigned int queue_index; - -/* Prefix added to all file paths sent from PCIe card. */ -char * path_prefix = NULL; - -/* By default, the host ring buffer is 4MB in size and it consists of - * 1024 entries of 4KB buffers. Modify GXPCI_HOST_PQ_RING_ENTRIES in - * <asm/tilegxpci.h> to change the size of each buffer. To increase - * the total ring buffer size, re-configure the host kernel using - * CONFIG_FORCE_MAX_ZONEORDER. - */ -#ifdef GXPCI_HOST_PQ_SEGMENT_ENTRIES -/* New definitions for MDE 4.1.5 */ -#define RING_BUF_ELEMS GXPCI_HOST_PQ_SEGMENT_ENTRIES -#define RING_BUF_ELEM_SIZE (HOST_PQ_SEGMENT_MAX_SIZE / GXPCI_HOST_PQ_SEGMENT_ENTRIES) -#else -/* Definitions prior to MDE 4.1.5 */ -#define RING_BUF_ELEMS GXPCI_HOST_PQ_RING_ENTRIES -#define RING_BUF_ELEM_SIZE (HOST_PQ_RING_BUF_MAX_SIZE / GXPCI_HOST_PQ_RING_ENTRIES) -#endif - -/*********************************************************************/ -/* Host-Side Packet Consumer */ -/*********************************************************************/ - -#define TAIL_UPDATE_LIMIT_ENABLE - -#define OP_OPEN 1 -#define OP_WRITE 2 -#define OP_CLOSE 3 - -typedef struct { - uint32_t magic; - uint32_t fileno; - uint32_t op; - uint32_t seq; - volatile uint32_t len; - uint32_t next_offset; - char buf[]; -} TrioMsg; - -typedef struct { - FILE *fd; -} FDesc; - -#define MAX_FDESC 1024 - -static FDesc *fdesc[MAX_FDESC]; - -void run_pcie_logging(void) -{ - char dev_name[40]; - int pq_fd; - unsigned int host_ring_buffer_size = RING_BUF_ELEMS * RING_BUF_ELEM_SIZE; - volatile TrioMsg *p; - - printf("Waiting for PCIe logging data from card %d on queue %d...\n", - card_index, queue_index); - - if (path_prefix) { - printf("PCIe logging into directory: '%s'\n", path_prefix); - fflush(stdout); - } - - /* Open the packet queue file. */ - snprintf(dev_name, sizeof(dev_name), "/dev/tilegxpci%d/packet_queue/t2h/%d", - card_index, queue_index); - do { - pq_fd = open(dev_name, O_RDWR); - if (pq_fd < 0) { - sleep(1); - } - } while (pq_fd < 0); - - /* mmap the register space. */ - struct gxpci_host_pq_regs_app* pq_regs = - (struct gxpci_host_pq_regs_app*) - mmap(0, sizeof(struct gxpci_host_pq_regs_app), - PROT_READ | PROT_WRITE, - MAP_SHARED, pq_fd, TILEPCI_PACKET_QUEUE_INDICES_MMAP_OFFSET); - if (pq_regs == MAP_FAILED) { - fprintf(stderr, "Failed to mmap PCIe control registers.\n"); - exit(EXIT_FAILURE); - } - - /* Configure and allocate the ring buffer for the receive queue. */ - tilepci_packet_queue_info_t buf_info; - - buf_info.buf_size = RING_BUF_ELEM_SIZE; - - int err = ioctl(pq_fd, TILEPCI_IOC_SET_PACKET_QUEUE_BUF, &buf_info); - if (err < 0) { - fprintf(stderr, "Failed TILEPCI_IOC_SET_PACKET_QUEUE_BUF: %s\n", - strerror(errno)); - abort(); - } - - /* On the host side, mmap the receive queue region. */ - void* buffer = - mmap(0, host_ring_buffer_size, PROT_READ | PROT_WRITE, - MAP_SHARED, pq_fd, TILEPCI_PACKET_QUEUE_BUF_MMAP_OFFSET); - assert(buffer != MAP_FAILED); - - /* On the host side, mmap the queue status. */ - struct tlr_pq_status *pq_status = - mmap(0, sizeof(struct tlr_pq_status), PROT_READ | PROT_WRITE, - MAP_SHARED, pq_fd, TILEPCI_PACKET_QUEUE_STS_MMAP_OFFSET); - assert(pq_status != MAP_FAILED); - - pq_regs->consumer_index = 0; - - uint64_t packet_count = 0; - volatile uint32_t write; - uint32_t read = 0; - -#ifdef CHECK_SEQ_NUM - uint32_t expect_seq = 1; -#endif - -#ifdef HOST_INTERRUPT_MODE - volatile uint32_t* producer_index = &(pq_status->drv_consumer_index); -#else - volatile uint32_t* producer_index = &(pq_regs->producer_index); -#endif - - volatile uint32_t* consumer_index = &(pq_regs->consumer_index); - volatile enum gxpci_chan_status_t* status = &(pq_status->status); - - while (1) { - if (*status == GXPCI_CHAN_RESET) { - printf("Tile to Host PCIe logging channel was reset.\n"); - fflush(stdout); - return; - } - - // Get packets off the ring buffer by accessing the receive queue at - // the new write index. - write = *producer_index; - - while (write != read) { - if (*status == GXPCI_CHAN_RESET) { - printf("Tile to Host PCIe logging channel was reset.\n"); - fflush(stdout); - return; - } - - packet_count++; - - p = (TrioMsg *)(buffer + ((read&(RING_BUF_ELEMS-1))*RING_BUF_ELEM_SIZE)); - - if (debug) { - fprintf(stdout, "got a message\n"); - fprintf(stdout, "p->magic: %d\n", p->magic); - fprintf(stdout, "p->fileno: %d\n", p->fileno); -#ifdef CHECK_SEQ_NUM - fprintf(stdout, "p->seq: %d\n", p->seq); -#endif - fprintf(stdout, "p->len: %d\n", p->len); - fprintf(stdout, "p->next_offset: %d\n", p->next_offset); - fprintf(stdout, "p->buf: "); - fwrite(&p->buf, sizeof(char), p->len - offsetof(TrioMsg, buf), stdout); - fprintf(stdout, "\n"); - fflush(stdout); - } - -#ifdef CHECK_SEQ_NUM - if (p->seq != expect_seq) { - /* Check for a reset before reporting a bad sequence - * number to prevent confusing users. */ - if (*status == GXPCI_CHAN_RESET) { - printf("Tile to Host PCIe logging channel was reset.\n"); - fflush(stdout); - return; - } - fprintf(stderr, "BAD sequence expected %d got %d\n", expect_seq, p->seq); - return; - } - expect_seq = p->seq + 1; -#endif - - switch (p->op) { - case OP_OPEN: - if (p->fileno < MAX_FDESC) { - fdesc[p->fileno] = malloc(sizeof(FDesc)); - if (fdesc[p->fileno]) { - char mode[2]; - mode[0] = p->buf[0]; - mode[1] = '\0'; - char *file_name = (char *)&p->buf[1]; - if (path_prefix) { - /* Added path_prefix to the start of the - * file name. Added space for '\0' and '\'. - * By default, no prefix is added. */ - int new_size = strlen(path_prefix) + strlen(file_name) + 1 + 1; - char *new_name = malloc(new_size); - if (!new_name) { - fprintf(stderr, "Failed to allocate memory for %s/%s\n", - path_prefix, file_name); - return; - } - snprintf(new_name, new_size, "%s/%s", - path_prefix, file_name); - file_name = new_name; - } - if ((fdesc[p->fileno]->fd = fopen(file_name, mode)) == NULL) { - fprintf(stderr, "Could not open %s: %s\n", - file_name, strerror(errno)); - } else { - printf("Opened '%s' for logging.\n", file_name); - fflush(stdout); - } - } - } else { - fprintf(stderr, "File number %d exceeds Max of %d\n", p->fileno, MAX_FDESC); - } - break; - case OP_WRITE: - if (drop_alerts) { - /* TODO: Report alert count periodically. */ - } else { - if (fdesc[p->fileno] && fdesc[p->fileno]->fd) { - fwrite(&p->buf, sizeof(char), - p->len - offsetof(TrioMsg, buf), - fdesc[p->fileno]->fd); - fflush(fdesc[p->fileno]->fd); - } - } - break; - case OP_CLOSE: - if (fdesc[p->fileno] && fdesc[p->fileno]->fd) { - fclose( fdesc[p->fileno]->fd); - free(fdesc[p->fileno]); - fdesc[p->fileno] = NULL; - } - break; - } - - read++; - /* Update the read index register to inform the tile side - * that the packet has been read. */ - -#ifdef TAIL_UPDATE_LIMIT_ENABLE - if ((packet_count & 0x3f) == 0) - *consumer_index = read; -#else - *consumer_index = read; -#endif - } - } - return; -} - -/* - * Match argument list option. - * Options ending in '=' take an additional value, which may be - * attached in the same argument or detached in the following - * argument. - * @param arglist Points to remaining argv, updated on match. - * @param option The option to match, ending in '=' if it takes a value. - * @return Value if option matches, NULL otherwise. - */ -char *shift_option(char ***arglist, const char* option) -{ - char** args = *arglist; - char* arg = args[0], **rest = &args[1]; - int optlen = strlen(option); - char* val = arg+optlen; - if (option[optlen - 1] != '=') { - if (strcmp(arg, option)) - return NULL; - } else { - if (strncmp(arg, option, optlen-1)) - return NULL; - if (arg[optlen- 1 ] == '\0') - val = *rest++; - else if (arg[optlen - 1] != '=') - return NULL; - } - *arglist = rest; - return val; -} - -int main(int argc, char** argv) -{ - char **args = &argv[1]; - - /* - * Scan command line options. - */ - while (*args) { - char* opt = NULL; - - if ((opt = shift_option(&args, "--queue_index="))) - queue_index = strtoul(opt, NULL, 0); - else if ((opt = shift_option(&args, "--card="))) - card_index = strtoul(opt, NULL, 0); - else if ((opt = shift_option(&args, "--debug"))) - debug = 1; - else if ((opt = shift_option(&args, "--drop"))) - drop_alerts = 1; - else if ((opt = shift_option(&args, "--prefix="))) - path_prefix = opt; - else { - fprintf(stderr, "Unknown option '%s'.\n", args[0]); - exit(EXIT_FAILURE); - } - } - - run_pcie_logging(); - - return 0; -} |