/** * \brief Convert IP packet to an IDMEF alert (RFC 4765). * This function stores the alert SID (description and reference), * the payload of the packet, and pre-processed data. * * \return 0 if ok */ static int PacketToData(Packet *p, PacketAlert *pa, idmef_alert_t *alert, AlertPreludeCtx *ctx) { SCEnter(); if ( ! p ) SCReturnInt(0); AddIntData(alert, "snort_rule_sid", pa->s->id); AddIntData(alert, "snort_rule_rev", pa->s->rev); if (ctx->log_packet_header) { if ( PKT_IS_IPV4(p) ) PacketToDataV4(p, pa, alert); else if ( PKT_IS_IPV6(p) ) PacketToDataV6(p, pa, alert); if ( PKT_IS_TCP(p) ) { AddIntData(alert, "tcp_seq", ntohl(p->tcph->th_seq)); AddIntData(alert, "tcp_ack", ntohl(p->tcph->th_ack)); AddIntData(alert, "tcp_off", TCP_GET_RAW_OFFSET(p->tcph)); AddIntData(alert, "tcp_res", TCP_GET_RAW_X2(p->tcph)); AddIntData(alert, "tcp_flags", p->tcph->th_flags); AddIntData(alert, "tcp_win", ntohs(p->tcph->th_win)); AddIntData(alert, "tcp_sum", ntohs(p->tcph->th_sum)); AddIntData(alert, "tcp_urp", ntohs(p->tcph->th_urp)); } else if ( PKT_IS_UDP(p) ) { AddIntData(alert, "udp_len", ntohs(p->udph->uh_len)); AddIntData(alert, "udp_sum", ntohs(p->udph->uh_sum)); } else if ( PKT_IS_ICMPV4(p) ) { AddIntData(alert, "icmp_type", p->icmpv4h->type); AddIntData(alert, "icmp_code", p->icmpv4h->code); AddIntData(alert, "icmp_sum", ntohs(p->icmpv4h->checksum)); } } if (ctx->log_packet_content) AddByteData(alert, "payload", p->payload, p->payload_len); SCReturnInt(0); }
/** * \brief Convert IP packet to an IDMEF alert (RFC 4765). * This function stores the alert SID (description and reference), * the payload of the packet, and pre-processed data. * * \return 0 if ok */ static int PacketToData(const Packet *p, const PacketAlert *pa, idmef_alert_t *alert, AlertPreludeCtx *ctx) { SCEnter(); if (unlikely(p == NULL)) SCReturnInt(0); AddIntData(alert, "snort_rule_sid", pa->s->id); AddIntData(alert, "snort_rule_rev", pa->s->rev); if (ctx->log_packet_header) { if ( PKT_IS_IPV4(p) ) PacketToDataV4(p, pa, alert); else if ( PKT_IS_IPV6(p) ) PacketToDataV6(p, pa, alert); if ( PKT_IS_TCP(p) ) { AddIntData(alert, "tcp_seq", TCP_GET_SEQ(p)); AddIntData(alert, "tcp_ack", TCP_GET_ACK(p)); AddIntData(alert, "tcp_off", TCP_GET_OFFSET(p)); AddIntData(alert, "tcp_res", TCP_GET_X2(p)); AddIntData(alert, "tcp_flags", TCP_GET_FLAGS(p)); AddIntData(alert, "tcp_win", TCP_GET_WINDOW(p)); AddIntData(alert, "tcp_sum", TCP_GET_SUM(p)); AddIntData(alert, "tcp_urp", TCP_GET_URG_POINTER(p)); if (p->tcpvars.ts_val != 0) { AddIntData(alert, "tcp_tsval", TCP_GET_TSVAL(p)); } if (p->tcpvars.ts_ecr != 0) { AddIntData(alert, "tcp_tsecr", TCP_GET_TSECR(p)); } if (p->tcph != NULL) { AddIntData(alert, "tcp_wscale", TCP_GET_WSCALE(p)); } if (TCP_HAS_SACKOK(p)) { AddIntData(alert, "tcp_sackok", TCP_GET_SACKOK(p)); } if (TCP_HAS_SACK(p)) { AddIntData(alert, "tcp_sack_cnt", TCP_GET_SACK_CNT(p)); } AddIntData(alert, "tcp_hlen", TCP_GET_HLEN(p)); } else if ( PKT_IS_UDP(p) ) { AddIntData(alert, "udp_len", UDP_GET_LEN(p)); AddIntData(alert, "udp_sum", UDP_GET_SUM(p)); } else if ( PKT_IS_ICMPV4(p) ) { AddIntData(alert, "icmp_type", ICMPV4_GET_TYPE(p)); AddIntData(alert, "icmp_code", ICMPV4_GET_CODE(p)); AddIntData(alert, "icmp_sum", ICMPV4_GET_RAW_CSUM(p)); } else if ( PKT_IS_ICMPV6(p) ) { AddIntData(alert, "icmp_type", ICMPV6_GET_TYPE(p)); AddIntData(alert, "icmp_code", ICMPV6_GET_CODE(p)); AddIntData(alert, "icmp_csum", ICMPV6_GET_RAW_CSUM(p)); } } if (ctx->log_packet_content) AddByteData(alert, "payload", p->payload, p->payload_len); SCReturnInt(0); }