|
|
|
|
/* Copyright (C) 2007-2013 Open Information Security Foundation
|
|
|
|
|
*
|
|
|
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
|
|
|
* the GNU General Public License version 2 as published by the Free
|
|
|
|
|
* Software Foundation.
|
|
|
|
|
*
|
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
|
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
|
|
|
* 02110-1301, USA.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* \file
|
|
|
|
|
*
|
|
|
|
|
* \author Tom DeCanio <td@npulsetech.com>
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#ifndef __OUTPUT_JSON_H__
|
|
|
|
|
#define __OUTPUT_JSON_H__
|
|
|
|
|
|
|
|
|
|
#include "suricata-common.h"
|
|
|
|
|
#include "util-buffer.h"
|
Add option on Tile-Gx for logging for fast.log alerts over PCIe
When running on a TILEncore-Gx PCIe card, setting the filetype of fast.log
to pcie, will open a connection over PCIe to a host application caleld
tile-pcie-logd, that receives the alert strings and writes them to a file
on the host. The file name to open is also passed over the PCIe link.
This allows running Suricata on the TILEncore-Gx PCIe card, but have the
alerts logged to the host system's file system efficiently. The PCIe API that
is used is the Tilera Packet Queue (PQ) API which can access PCIe from User
Space, thus avoiding system calls.
Created util-logopenfile-tile.c and util-logopen-tile.h for the TILE
specific PCIe logging functionality.
Using Write() and Close() function pointers in LogFileCtx, which
default to standard write and close for files and sockets, but are
changed to PCIe write and close functions when a PCIe channel is
openned for logging.
Moved Logging contex out of tm-modules.h into util-logopenfile.h,
where it makes more sense. This required including util-logopenfile.h
into a couple of alert-*.c files, which previously were getting the
definitions from tm-modules.h.
The source and Makefile for tile-pcie-logd are added in contrib/tile-pcie-logd.
By default, the file name for fast.log specified in suricata.yaml is used as
the filename on the host. An optional argument to tile-pcie-logd, --prefix=,
can be added to prepend the supplied file path. For example, is the file
in suricata.yaml is specified as "/var/log/fast.log" and --prefix="/tmp",
then the file will be written to "/tmp/var/log/fast.log".
Check for TILERA_ROOT environment variable before building tile_pcie_logd
Building tile_pcie_logd on x86 requires the Tilera MDE for its PCIe libraries
and API header files. Configure now checs for TILERA_ROOT before enabling
builing tile_pcie_logd in contrib/tile_pcie_logd
12 years ago
|
|
|
#include "util-logopenfile.h"
|
|
|
|
|
#include "output.h"
|
|
|
|
|
|
|
|
|
|
void OutputJsonRegister(void);
|
|
|
|
|
|
|
|
|
|
#ifdef HAVE_LIBJANSSON
|
|
|
|
|
|
|
|
|
|
enum OutputJsonLogDirection {
|
|
|
|
|
LOG_DIR_PACKET = 0,
|
|
|
|
|
LOG_DIR_FLOW,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
/* helper struct for OutputJSONMemBufferCallback */
|
|
|
|
|
typedef struct OutputJSONMemBufferWrapper_ {
|
|
|
|
|
MemBuffer **buffer; /**< buffer to use & expand as needed */
|
|
|
|
|
size_t expand_by; /**< expand by this size */
|
|
|
|
|
} OutputJSONMemBufferWrapper;
|
|
|
|
|
|
|
|
|
|
int OutputJSONMemBufferCallback(const char *str, size_t size, void *data);
|
|
|
|
|
|
|
|
|
|
void JsonAddMetadata(const Packet *p, const Flow *f, json_t *js);
|
|
|
|
|
void CreateJSONFlowId(json_t *js, const Flow *f);
|
|
|
|
|
void JsonTcpFlags(uint8_t flags, json_t *js);
|
|
|
|
|
void JsonFiveTuple(const Packet *, enum OutputJsonLogDirection, json_t *);
|
|
|
|
|
json_t *CreateJSONHeader(const Packet *p,
|
|
|
|
|
enum OutputJsonLogDirection dir, const char *event_type);
|
|
|
|
|
json_t *CreateJSONHeaderWithTxId(const Packet *p,
|
|
|
|
|
enum OutputJsonLogDirection dir, const char *event_type, uint64_t tx_id);
|
|
|
|
|
int OutputJSONBuffer(json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer);
|
|
|
|
|
OutputInitResult OutputJsonInitCtx(ConfNode *);
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Global configuration context data
|
|
|
|
|
*/
|
|
|
|
|
typedef struct OutputJsonCtx_ {
|
|
|
|
|
LogFileCtx *file_ctx;
|
|
|
|
|
enum LogFileType json_out;
|
|
|
|
|
bool include_metadata;
|
|
|
|
|
} OutputJsonCtx;
|
|
|
|
|
|
|
|
|
|
json_t *SCJsonBool(int val);
|
|
|
|
|
void SCJsonDecref(json_t *js);
|
|
|
|
|
|
|
|
|
|
#endif /* HAVE_LIBJANSSON */
|
|
|
|
|
|
|
|
|
|
#endif /* __OUTPUT_JSON_H__ */
|
