aboutsummaryrefslogtreecommitdiffstats
path: root/framework/src/suricata/src/alert-prelude.c
diff options
context:
space:
mode:
Diffstat (limited to 'framework/src/suricata/src/alert-prelude.c')
-rw-r--r--framework/src/suricata/src/alert-prelude.c885
1 files changed, 885 insertions, 0 deletions
diff --git a/framework/src/suricata/src/alert-prelude.c b/framework/src/suricata/src/alert-prelude.c
new file mode 100644
index 00000000..a053e38b
--- /dev/null
+++ b/framework/src/suricata/src/alert-prelude.c
@@ -0,0 +1,885 @@
+/* Copyright (C) 2007-2014 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Pierre Chifflier <chifflier@edenwall.com>
+ * \author Yoann Vandoorselaere <yoann.v@prelude-ids.com>
+ *
+ * Logs alerts to the Prelude system, using IDMEF (RFC 4765) messages.
+ *
+ * Each message contains the alert description and reference (using
+ * the SID/GID), and a normalized description (assessment, impact,
+ * sources etc.)
+ *
+ * libprelude handles the connection with the manager (collecting component),
+ * spooling and sending the event asynchronously. It also offers transport
+ * security (using TLS and trusted certificates) and reliability (events
+ * are retransmitted if not sent successfully).
+ *
+ * This modules requires a Prelude profile to work (see man prelude-admin
+ * and the Prelude Handbook for help).
+ */
+
+#include "suricata-common.h"
+#include "debug.h"
+#include "detect.h"
+#include "flow.h"
+#include "conf.h"
+
+#include "threads.h"
+#include "threadvars.h"
+#include "tm-threads.h"
+
+#include "util-unittest.h"
+#include "util-time.h"
+#include "util-debug.h"
+#include "util-error.h"
+#include "util-print.h"
+
+#include "output.h"
+#include "util-privs.h"
+#include "util-optimize.h"
+
+#include "stream.h"
+
+#ifndef PRELUDE
+
+/* Handle the case where no PRELUDE support is compiled in. */
+
+static TmEcode AlertPreludeThreadInit(ThreadVars *t, void *initdata, void **data)
+{
+ SCLogDebug("Can't init Prelude output thread - Prelude support was disabled during build.");
+ return TM_ECODE_FAILED;
+}
+
+static TmEcode AlertPreludeThreadDeinit(ThreadVars *t, void *data)
+{
+ return TM_ECODE_FAILED;
+}
+
+void TmModuleAlertPreludeRegister (void)
+{
+ tmm_modules[TMM_ALERTPRELUDE].name = "AlertPrelude";
+ tmm_modules[TMM_ALERTPRELUDE].ThreadInit = AlertPreludeThreadInit;
+ tmm_modules[TMM_ALERTPRELUDE].ThreadDeinit = AlertPreludeThreadDeinit;
+}
+
+#else /* implied we do have PRELUDE support */
+
+#include <libprelude/prelude.h>
+
+#define ANALYZER_CLASS "NIDS"
+#define ANALYZER_MODEL "Suricata"
+#define ANALYZER_MANUFACTURER "http://www.openinfosecfoundation.org/"
+#define ANALYZER_SID_URL "http://www.snort.org/search/sid/"
+
+#define SNORT_MAX_OWNED_SID 1000000
+#define DEFAULT_ANALYZER_NAME "suricata"
+
+#define DEFAULT_PRELUDE_PROFILE "suricata"
+
+static unsigned int info_priority = 4;
+static unsigned int low_priority = 3;
+static unsigned int mid_priority = 2;
+
+/**
+ * This holds global structures and variables. Since libprelude is thread-safe,
+ * there is no need to store a mutex.
+ */
+typedef struct AlertPreludeCtx_ {
+ /** The client (which has the send function) */
+ prelude_client_t *client;
+ int log_packet_content;
+ int log_packet_header;
+} AlertPreludeCtx;
+
+/**
+ * This holds per-thread specific structures and variables.
+ */
+typedef struct AlertPreludeThread_ {
+ /** Pointer to the global context */
+ AlertPreludeCtx *ctx;
+} AlertPreludeThread;
+
+
+/**
+ * \brief Initialize analyzer description
+ *
+ * \return 0 if ok
+ */
+static int SetupAnalyzer(idmef_analyzer_t *analyzer)
+{
+ int ret;
+ prelude_string_t *string;
+
+ SCEnter();
+
+ ret = idmef_analyzer_new_model(analyzer, &string);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+ prelude_string_set_constant(string, ANALYZER_MODEL);
+
+ ret = idmef_analyzer_new_class(analyzer, &string);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+ prelude_string_set_constant(string, ANALYZER_CLASS);
+
+ ret = idmef_analyzer_new_manufacturer(analyzer, &string);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+ prelude_string_set_constant(string, ANALYZER_MANUFACTURER);
+
+ ret = idmef_analyzer_new_version(analyzer, &string);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+ prelude_string_set_constant(string, VERSION);
+
+ SCReturnInt(0);
+}
+
+/**
+ * \brief Create event impact description (see section
+ * 4.2.6.1 of RFC 4765).
+ * The impact contains the severity, completion (succeeded or failed)
+ * and basic classification of the attack type.
+ * Here, we don't set the completion since we don't know it (default
+ * is unknown).
+ *
+ * \return 0 if ok
+ */
+static int EventToImpact(const PacketAlert *pa, const Packet *p, idmef_alert_t *alert)
+{
+ int ret;
+ prelude_string_t *str;
+ idmef_impact_t *impact;
+ idmef_assessment_t *assessment;
+ idmef_impact_severity_t severity;
+
+ SCEnter();
+
+ ret = idmef_alert_new_assessment(alert, &assessment);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = idmef_assessment_new_impact(assessment, &impact);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ if ( (unsigned int)pa->s->prio < mid_priority )
+ severity = IDMEF_IMPACT_SEVERITY_HIGH;
+
+ else if ( (unsigned int)pa->s->prio < low_priority )
+ severity = IDMEF_IMPACT_SEVERITY_MEDIUM;
+
+ else if ( (unsigned int)pa->s->prio < info_priority )
+ severity = IDMEF_IMPACT_SEVERITY_LOW;
+
+ else
+ severity = IDMEF_IMPACT_SEVERITY_INFO;
+
+ idmef_impact_set_severity(impact, severity);
+
+ if (PACKET_TEST_ACTION(p, ACTION_DROP)) {
+ idmef_action_t *action;
+
+ ret = idmef_action_new(&action);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ idmef_action_set_category(action, IDMEF_ACTION_CATEGORY_BLOCK_INSTALLED);
+ idmef_assessment_set_action(assessment, action, 0);
+ }
+
+ if (pa->s->class_msg) {
+ ret = idmef_impact_new_description(impact, &str);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ prelude_string_set_ref(str, pa->s->class_msg);
+ }
+
+ SCReturnInt(0);
+}
+
+/**
+ * \brief Add Source and Target fields to the IDMEF alert.
+ * These objects contains IP addresses, source and destination
+ * ports (see sections 4.2.4.3 and 4.2.4.4 of RFC 4765).
+ *
+ * \return 0 if ok
+ */
+static int EventToSourceTarget(const Packet *p, idmef_alert_t *alert)
+{
+ int ret;
+ idmef_node_t *node;
+ idmef_source_t *source;
+ idmef_target_t *target;
+ idmef_address_t *address;
+ idmef_service_t *service;
+ prelude_string_t *string;
+ static char saddr[128], daddr[128];
+ uint8_t ip_vers;
+ uint8_t ip_proto;
+
+ SCEnter();
+
+ if ( !p )
+ SCReturnInt(0);
+
+ if ( ! IPH_IS_VALID(p) )
+ SCReturnInt(0);
+
+ if (PKT_IS_IPV4(p)) {
+ ip_vers = 4;
+ ip_proto = IPV4_GET_RAW_IPPROTO(p->ip4h);
+ PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), saddr, sizeof(saddr));
+ PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), daddr, sizeof(daddr));
+ } else if (PKT_IS_IPV6(p)) {
+ ip_vers = 6;
+ ip_proto = IPV6_GET_L4PROTO(p);
+ PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), saddr, sizeof(saddr));
+ PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), daddr, sizeof(daddr));
+ } else
+ SCReturnInt(0);
+
+ ret = idmef_alert_new_source(alert, &source, IDMEF_LIST_APPEND);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = idmef_source_new_service(source, &service);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ if ( p->tcph || p->udph )
+ idmef_service_set_port(service, p->sp);
+
+ idmef_service_set_ip_version(service, ip_vers);
+ idmef_service_set_iana_protocol_number(service, ip_proto);
+
+ ret = idmef_source_new_node(source, &node);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = idmef_address_new_address(address, &string);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ prelude_string_set_ref(string, saddr);
+
+ ret = idmef_alert_new_target(alert, &target, IDMEF_LIST_APPEND);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = idmef_target_new_service(target, &service);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ if ( p->tcph || p->udph )
+ idmef_service_set_port(service, p->dp);
+
+ idmef_service_set_ip_version(service, ip_vers);
+ idmef_service_set_iana_protocol_number(service, ip_proto);
+
+ ret = idmef_target_new_node(target, &node);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = idmef_node_new_address(node, &address, IDMEF_LIST_APPEND);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = idmef_address_new_address(address, &string);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ prelude_string_set_ref(string, daddr);
+
+ SCReturnInt(0);
+}
+
+/**
+ * \brief Add binary data, to be stored in the Additional Data
+ * field of the IDMEF alert (see section 4.2.4.6 of RFC 4765).
+ *
+ * \return 0 if ok
+ */
+static int AddByteData(idmef_alert_t *alert, const char *meaning, const unsigned char *data, size_t size)
+{
+ int ret;
+ prelude_string_t *str;
+ idmef_additional_data_t *ad;
+
+ SCEnter();
+
+ if ( ! data || ! size )
+ SCReturnInt(0);
+
+ ret = idmef_alert_new_additional_data(alert, &ad, IDMEF_LIST_APPEND);
+ if (unlikely(ret < 0))
+ SCReturnInt(0);
+
+ ret = idmef_additional_data_set_byte_string_ref(ad, data, size);
+ if (unlikely(ret < 0)) {
+ SCLogDebug("%s: error setting byte string data: %s.",
+ prelude_strsource(ret), prelude_strerror(ret));
+ SCReturnInt(-1);
+ }
+
+ ret = idmef_additional_data_new_meaning(ad, &str);
+ if (unlikely(ret < 0)) {
+ SCLogDebug("%s: error creating additional-data meaning: %s.",
+ prelude_strsource(ret), prelude_strerror(ret));
+ SCReturnInt(-1);
+ }
+
+ ret = prelude_string_set_ref(str, meaning);
+ if (unlikely(ret < 0)) {
+ SCLogDebug("%s: error setting byte string data meaning: %s.",
+ prelude_strsource(ret), prelude_strerror(ret));
+ SCReturnInt(-1);
+ }
+
+ SCReturnInt(0);
+}
+
+/**
+ * \brief Add integer data, to be stored in the Additional Data
+ * field of the IDMEF alert (see section 4.2.4.6 of RFC 4765).
+ *
+ * \return 0 if ok
+ */
+static int AddIntData(idmef_alert_t *alert, const char *meaning, uint32_t data)
+{
+ int ret;
+ prelude_string_t *str;
+ idmef_additional_data_t *ad;
+
+ SCEnter();
+
+ ret = idmef_alert_new_additional_data(alert, &ad, IDMEF_LIST_APPEND);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ idmef_additional_data_set_integer(ad, data);
+
+ ret = idmef_additional_data_new_meaning(ad, &str);
+ if (unlikely(ret < 0)) {
+ SCLogDebug("%s: error creating additional-data meaning: %s.",
+ prelude_strsource(ret), prelude_strerror(ret));
+ SCReturnInt(-1);
+ }
+
+ ret = prelude_string_set_ref(str, meaning);
+ if (unlikely(ret < 0)) {
+ SCLogDebug("%s: error setting integer data meaning: %s.",
+ prelude_strsource(ret), prelude_strerror(ret));
+ SCReturnInt(-1);
+ }
+
+ SCReturnInt(0);
+}
+
+/**
+ * \brief Add IPv4 header data, to be stored in the Additional Data
+ * field of the IDMEF alert (see section 4.2.4.6 of RFC 4765).
+ *
+ * \return 0 if ok
+ */
+static int PacketToDataV4(const Packet *p, const PacketAlert *pa, idmef_alert_t *alert)
+{
+ SCEnter();
+
+ AddIntData(alert, "ip_ver", IPV4_GET_RAW_VER(p->ip4h));
+ AddIntData(alert, "ip_hlen", IPV4_GET_RAW_HLEN(p->ip4h));
+ AddIntData(alert, "ip_tos", IPV4_GET_RAW_IPTOS(p->ip4h));
+ AddIntData(alert, "ip_len", ntohs(IPV4_GET_RAW_IPLEN(p->ip4h)));
+
+ AddIntData(alert, "ip_id", ntohs(IPV4_GET_RAW_IPID(p->ip4h)));
+
+ AddIntData(alert, "ip_off", ntohs(IPV4_GET_RAW_IPOFFSET(p->ip4h)));
+
+ AddIntData(alert, "ip_ttl", IPV4_GET_RAW_IPTTL(p->ip4h));
+ AddIntData(alert, "ip_proto", IPV4_GET_RAW_IPPROTO(p->ip4h));
+
+ AddIntData(alert, "ip_sum", ntohs(p->ip4h->ip_csum));
+
+ SCReturnInt(0);
+}
+
+/**
+ * \brief Add IPv6 header data, to be stored in the Additional Data
+ * field of the IDMEF alert (see section 4.2.4.6 of RFC 4765).
+ *
+ * \return 0 if ok
+ */
+static int PacketToDataV6(const Packet *p, const PacketAlert *pa, idmef_alert_t *alert)
+{
+ return 0;
+}
+
+
+/**
+ * \brief Convert IP packet to an IDMEF alert (RFC 4765).
+ * This function stores the alert SID (description and reference),
+ * the payload of the packet, and pre-processed data.
+ *
+ * \return 0 if ok
+ */
+static int PacketToData(const Packet *p, const PacketAlert *pa, idmef_alert_t *alert, AlertPreludeCtx *ctx)
+{
+ SCEnter();
+
+ if (unlikely(p == NULL))
+ SCReturnInt(0);
+
+ AddIntData(alert, "snort_rule_sid", pa->s->id);
+ AddIntData(alert, "snort_rule_rev", pa->s->rev);
+
+ if (ctx->log_packet_header) {
+ if ( PKT_IS_IPV4(p) )
+ PacketToDataV4(p, pa, alert);
+
+ else if ( PKT_IS_IPV6(p) )
+ PacketToDataV6(p, pa, alert);
+
+ if ( PKT_IS_TCP(p) ) {
+ AddIntData(alert, "tcp_seq", ntohl(p->tcph->th_seq));
+ AddIntData(alert, "tcp_ack", ntohl(p->tcph->th_ack));
+
+ AddIntData(alert, "tcp_off", TCP_GET_RAW_OFFSET(p->tcph));
+ AddIntData(alert, "tcp_res", TCP_GET_RAW_X2(p->tcph));
+ AddIntData(alert, "tcp_flags", p->tcph->th_flags);
+
+ AddIntData(alert, "tcp_win", ntohs(p->tcph->th_win));
+ AddIntData(alert, "tcp_sum", ntohs(p->tcph->th_sum));
+ AddIntData(alert, "tcp_urp", ntohs(p->tcph->th_urp));
+
+ }
+
+ else if ( PKT_IS_UDP(p) ) {
+ AddIntData(alert, "udp_len", ntohs(p->udph->uh_len));
+ AddIntData(alert, "udp_sum", ntohs(p->udph->uh_sum));
+ }
+
+ else if ( PKT_IS_ICMPV4(p) ) {
+ AddIntData(alert, "icmp_type", p->icmpv4h->type);
+ AddIntData(alert, "icmp_code", p->icmpv4h->code);
+ AddIntData(alert, "icmp_sum", ntohs(p->icmpv4h->checksum));
+
+ }
+ }
+
+ if (ctx->log_packet_content)
+ AddByteData(alert, "payload", p->payload, p->payload_len);
+
+ SCReturnInt(0);
+}
+
+/**
+ * \brief Store reference on rule (SID and GID) in the IDMEF alert,
+ * and embed an URL pointing to the rule description.
+ *
+ * \return 0 if ok
+ */
+static int AddSnortReference(idmef_classification_t *class, int gen_id, int sig_id)
+{
+ int ret;
+ prelude_string_t *str;
+ idmef_reference_t *ref;
+
+ SCEnter();
+
+ if ( sig_id >= SNORT_MAX_OWNED_SID )
+ SCReturnInt(0);
+
+ ret = idmef_classification_new_reference(class, &ref, IDMEF_LIST_APPEND);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = idmef_reference_new_name(ref, &str);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ idmef_reference_set_origin(ref, IDMEF_REFERENCE_ORIGIN_VENDOR_SPECIFIC);
+
+ if ( gen_id == 0 )
+ ret = prelude_string_sprintf(str, "%u", sig_id);
+ else
+ ret = prelude_string_sprintf(str, "%u:%u", gen_id, sig_id);
+
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = idmef_reference_new_meaning(ref, &str);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = prelude_string_sprintf(str, "Snort Signature ID");
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = idmef_reference_new_url(ref, &str);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ if ( gen_id == 0 )
+ ret = prelude_string_sprintf(str, ANALYZER_SID_URL "%u", sig_id);
+ else
+ ret = prelude_string_sprintf(str, ANALYZER_SID_URL "%u-%u", gen_id, sig_id);
+
+ SCReturnInt(ret);
+}
+
+/**
+ * \brief Create event classification description (see section
+ * 4.2.4.2 of RFC 4765).
+ * The classification is the "name" of the alert, identification of the
+ * rule signature, and additional information on the rule.
+ *
+ * \return 0 if ok
+ */
+static int EventToReference(const PacketAlert *pa, const Packet *p, idmef_classification_t *class)
+{
+ int ret;
+ prelude_string_t *str;
+
+ SCEnter();
+
+ ret = idmef_classification_new_ident(class, &str);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ if ( pa->s->gid == 0 )
+ ret = prelude_string_sprintf(str, "%u", pa->s->id);
+ else
+ ret = prelude_string_sprintf(str, "%u:%u", pa->s->gid, pa->s->id);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ ret = AddSnortReference(class, pa->s->gid, pa->s->id);
+ if (unlikely(ret < 0))
+ SCReturnInt(ret);
+
+ SCReturnInt(0);
+}
+
+static int PreludePrintStreamSegmentCallback(const Packet *p, void *data, uint8_t *buf, uint32_t buflen)
+{
+ int ret;
+
+ ret = AddByteData((idmef_alert_t *)data, "stream-segment", buf, buflen);
+ if (ret == 0)
+ return 1;
+ else
+ return -1;
+}
+
+/**
+ * \brief Initialize thread-specific data. Each thread structure contains
+ * a pointer to the \a AlertPreludeCtx context.
+ *
+ * \return TM_ECODE_OK if ok, else TM_ECODE_FAILED
+ */
+static TmEcode AlertPreludeThreadInit(ThreadVars *t, void *initdata, void **data)
+{
+ AlertPreludeThread *aun;
+
+ SCEnter();
+
+ if(unlikely(initdata == NULL))
+ {
+ SCLogDebug("Error getting context for Prelude. \"initdata\" argument NULL");
+ SCReturnInt(TM_ECODE_FAILED);
+ }
+
+ aun = SCMalloc(sizeof(AlertPreludeThread));
+ if (unlikely(aun == NULL))
+ SCReturnInt(TM_ECODE_FAILED);
+ memset(aun, 0, sizeof(AlertPreludeThread));
+
+ /** Use the Ouput Context */
+ aun->ctx = ((OutputCtx *)initdata)->data;
+
+ *data = (void *)aun;
+ SCReturnInt(TM_ECODE_OK);
+}
+
+/**
+ * \brief Free thread-specific data.
+ *
+ * \return TM_ECODE_OK if ok, else TM_ECODE_FAILED
+ */
+static TmEcode AlertPreludeThreadDeinit(ThreadVars *t, void *data)
+{
+ AlertPreludeThread *aun = (AlertPreludeThread *)data;
+
+ SCEnter();
+
+ if (unlikely(aun == NULL)) {
+ SCLogDebug("AlertPreludeThreadDeinit done (error)");
+ SCReturnInt(TM_ECODE_FAILED);
+ }
+
+ /* clear memory */
+ memset(aun, 0, sizeof(AlertPreludeThread));
+ SCFree(aun);
+
+ SCReturnInt(TM_ECODE_OK);
+}
+
+static void AlertPreludeDeinitCtx(OutputCtx *output_ctx)
+{
+ AlertPreludeCtx *ctx = (AlertPreludeCtx *)output_ctx->data;
+
+ prelude_client_destroy(ctx->client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
+ SCFree(output_ctx);
+}
+
+/** \brief Initialize the Prelude logging module: initialize
+ * library, create the client and try to establish the connection
+ * to the Prelude Manager.
+ * Client flags are set to force asynchronous (non-blocking) mode for
+ * both alerts and heartbeats.
+ * This function requires an existing Prelude profile to work.
+ *
+ * \return A newly allocated AlertPreludeCtx structure, or NULL
+ */
+static OutputCtx *AlertPreludeInitCtx(ConfNode *conf)
+{
+ int ret;
+ prelude_client_t *client;
+ AlertPreludeCtx *ctx;
+ const char *prelude_profile_name;
+ const char *log_packet_content;
+ const char *log_packet_header;
+ OutputCtx *output_ctx;
+
+ SCEnter();
+
+ ret = prelude_init(0, NULL);
+ if (unlikely(ret < 0)) {
+ prelude_perror(ret, "unable to initialize the prelude library");
+ SCReturnPtr(NULL, "AlertPreludeCtx");
+ }
+
+ prelude_profile_name = ConfNodeLookupChildValue(conf, "profile");
+ if (prelude_profile_name == NULL)
+ prelude_profile_name = DEFAULT_PRELUDE_PROFILE;
+
+ log_packet_content = ConfNodeLookupChildValue(conf, "log-packet-content");
+ log_packet_header = ConfNodeLookupChildValue(conf, "log-packet-header");
+
+ ret = prelude_client_new(&client, prelude_profile_name);
+ if ( unlikely(ret < 0 || client == NULL )) {
+ prelude_perror(ret, "Unable to create a prelude client object");
+ prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
+ SCReturnPtr(NULL, "AlertPreludeCtx");
+ }
+
+ ret = prelude_client_set_flags(client, prelude_client_get_flags(client) | PRELUDE_CLIENT_FLAGS_ASYNC_TIMER|PRELUDE_CLIENT_FLAGS_ASYNC_SEND);
+ if (unlikely(ret < 0)) {
+ SCLogDebug("Unable to set asynchronous send and timer.");
+ prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
+ SCReturnPtr(NULL, "AlertPreludeCtx");
+ }
+
+ SetupAnalyzer(prelude_client_get_analyzer(client));
+
+ ret = prelude_client_start(client);
+ if (unlikely(ret < 0)) {
+ prelude_perror(ret, "Unable to start prelude client");
+ prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
+ SCReturnPtr(NULL, "AlertPreludeCtx");
+ }
+
+ ctx = SCMalloc(sizeof(AlertPreludeCtx));
+ if (unlikely(ctx == NULL)) {
+ prelude_perror(ret, "Unable to allocate memory");
+ prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
+ SCReturnPtr(NULL, "AlertPreludeCtx");
+ }
+
+ ctx->client = client;
+ ctx->log_packet_content = 0;
+ ctx->log_packet_header = 1;
+ if (log_packet_content && ConfValIsTrue(log_packet_content))
+ ctx->log_packet_content = 1;
+ if (log_packet_header && ConfValIsFalse(log_packet_header))
+ ctx->log_packet_header = 0;
+
+ output_ctx = SCMalloc(sizeof(OutputCtx));
+ if (unlikely(output_ctx == NULL)) {
+ SCFree(ctx);
+ prelude_perror(ret, "Unable to allocate memory");
+ prelude_client_destroy(client, PRELUDE_CLIENT_EXIT_STATUS_SUCCESS);
+ SCReturnPtr(NULL, "AlertPreludeCtx");
+ }
+
+ output_ctx->data = ctx;
+ output_ctx->DeInit = AlertPreludeDeinitCtx;
+
+ SCReturnPtr((void*)output_ctx, "OutputCtx");
+}
+
+static int AlertPreludeCondition(ThreadVars *tv, const Packet *p)
+{
+ if (p->alerts.cnt == 0)
+ return FALSE;
+ if (!IPH_IS_VALID(p))
+ return FALSE;
+ return TRUE;
+}
+
+/**
+ * \brief Handle Suricata alert: convert it to and IDMEF alert (see RFC 4765)
+ * and send it asynchronously (so, this function does not block and returns
+ * immediately).
+ * If the destination Prelude Manager is not available, the alert is spooled
+ * (and the function also returns immediately).
+ * An IDMEF object is created, and all available information is added: IP packet
+ * header and data, rule signature ID, additional data like URL pointing to
+ * rule description, CVE, etc.
+ * The IDMEF alert has a reference to all created objects, so freeing it will
+ * automatically free all allocated memory.
+ *
+ * \note This function is thread safe.
+ *
+ * \return TM_ECODE_OK if ok, else TM_ECODE_FAILED
+ */
+static int AlertPreludeLogger(ThreadVars *tv, void *thread_data, const Packet *p)
+{
+ AlertPreludeThread *apn = (AlertPreludeThread *)thread_data;
+ int ret;
+ idmef_time_t *time;
+ idmef_alert_t *alert;
+ prelude_string_t *str;
+ idmef_message_t *idmef = NULL;
+ idmef_classification_t *class;
+ const PacketAlert *pa;
+
+ SCEnter();
+
+ if (unlikely(apn == NULL || apn->ctx == NULL)) {
+ SCReturnInt(TM_ECODE_FAILED);
+ }
+
+ if (p->alerts.cnt == 0)
+ SCReturnInt(TM_ECODE_OK);
+
+ if ( !IPH_IS_VALID(p) )
+ SCReturnInt(TM_ECODE_OK);
+
+ /* XXX which one to add to this alert? Lets see how Snort solves this.
+ * For now just take last alert. */
+ pa = &p->alerts.alerts[p->alerts.cnt-1];
+ if (unlikely(pa->s == NULL))
+ goto err;
+
+ ret = idmef_message_new(&idmef);
+ if (unlikely(ret < 0))
+ SCReturnInt(TM_ECODE_FAILED);
+
+ ret = idmef_message_new_alert(idmef, &alert);
+ if (unlikely(ret < 0))
+ goto err;
+
+ ret = idmef_alert_new_classification(alert, &class);
+ if (unlikely(ret < 0))
+ goto err;
+
+ if (pa->s->msg) {
+ ret = idmef_classification_new_text(class, &str);
+ if (unlikely(ret < 0))
+ goto err;
+
+ prelude_string_set_ref(str, pa->s->msg);
+ }
+
+ ret = EventToImpact(pa, p, alert);
+ if (unlikely(ret < 0))
+ goto err;
+
+ ret = EventToReference(pa, p, class);
+ if (unlikely(ret < 0))
+ goto err;
+
+ ret = EventToSourceTarget(p, alert);
+ if (unlikely(ret < 0))
+ goto err;
+
+ ret = PacketToData(p, pa, alert, apn->ctx);
+ if (unlikely(ret < 0))
+ goto err;
+
+ if (PKT_IS_TCP(p) && (pa->flags & PACKET_ALERT_FLAG_STATE_MATCH)) {
+ uint8_t flag;
+ if (p->flowflags & FLOW_PKT_TOSERVER) {
+ flag = FLOW_PKT_TOCLIENT;
+ } else {
+ flag = FLOW_PKT_TOSERVER;
+ }
+ ret = StreamSegmentForEach(p, flag,
+ PreludePrintStreamSegmentCallback,
+ (void *)alert);
+ }
+ if (unlikely(ret < 0))
+ goto err;
+
+ ret = idmef_alert_new_detect_time(alert, &time);
+ if (unlikely(ret < 0))
+ goto err;
+ idmef_time_set_from_timeval(time, &p->ts);
+
+ ret = idmef_time_new_from_gettimeofday(&time);
+ if (unlikely(ret < 0))
+ goto err;
+ idmef_alert_set_create_time(alert, time);
+
+ idmef_alert_set_analyzer(alert, idmef_analyzer_ref(prelude_client_get_analyzer(apn->ctx->client)), IDMEF_LIST_PREPEND);
+
+ /* finally, send event */
+ prelude_client_send_idmef(apn->ctx->client, idmef);
+ idmef_message_destroy(idmef);
+
+ SCReturnInt(TM_ECODE_OK);
+
+err:
+ if (idmef != NULL)
+ idmef_message_destroy(idmef);
+ SCReturnInt(TM_ECODE_FAILED);
+}
+
+void TmModuleAlertPreludeRegister (void)
+{
+ tmm_modules[TMM_ALERTPRELUDE].name = "AlertPrelude";
+ tmm_modules[TMM_ALERTPRELUDE].ThreadInit = AlertPreludeThreadInit;
+ tmm_modules[TMM_ALERTPRELUDE].Func = NULL;
+ tmm_modules[TMM_ALERTPRELUDE].ThreadDeinit = AlertPreludeThreadDeinit;
+ tmm_modules[TMM_ALERTPRELUDE].cap_flags = 0;
+ tmm_modules[TMM_ALERTPRELUDE].flags = TM_FLAG_LOGAPI_TM;
+
+ OutputRegisterPacketModule("AlertPrelude", "alert-prelude", AlertPreludeInitCtx,
+ AlertPreludeLogger, AlertPreludeCondition);
+}
+#endif /* PRELUDE */
+