@ -1,4 +1,4 @@
/* Copyright (C) 2013-202 0 Open Information Security Foundation
/* Copyright (C) 2013-202 1 Open Information Security Foundation
*
* You can copy , redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
@ -65,26 +65,18 @@
# define MODULE_NAME "JsonMetadataLog"
typedef struct MetadataJsonOutputCtx_ {
LogFileCtx * file_ctx ;
OutputJsonCommonSettings cfg ;
} MetadataJsonOutputCtx ;
typedef struct JsonMetadataLogThread_ {
/** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
LogFileCtx * file_ctx ;
MemBuffer * json_buffer ;
MetadataJsonOutputCtx * json_output_ctx ;
} JsonMetadataLogThread ;
static int MetadataJson ( ThreadVars * tv , JsonMetadataLogThread * aft , const Packet * p )
static int MetadataJson ( ThreadVars * tv , OutputJsonThreadCtx * aft , const Packet * p )
{
JsonBuilder * js = CreateEveHeader ( p , LOG_DIR_PACKET , " metadata " , NULL ;
JsonBuilder * js = CreateEveHeader ( p , LOG_DIR_PACKET , " metadata " , NULL , aft - > ctx ) ;
if ( unlikely ( js = = NULL ) )
return TM_ECODE_OK ;
EveAddCommonOptions ( & aft - > json_output_ctx - > cfg , p , p - > flow , js ) ;
OutputJsonBuilderBuffer ( js , aft - > file_ctx , & aft - > json_buffer ) ;
/* If metadata is not enabled for eve, explicitly log it here as this is
* what logging metadata is about . */
if ( ! aft - > ctx - > cfg . include_metadata ) {
EveAddMetadata ( p , p - > flow , js ) ;
}
OutputJsonBuilderBuffer ( js , aft - > file_ctx , & aft - > buffer ) ;
jb_free ( js ) ;
return TM_ECODE_OK ;
@ -92,7 +84,7 @@ static int MetadataJson(ThreadVars *tv, JsonMetadataLogThread *aft, const Packet
static int JsonMetadataLogger ( ThreadVars * tv , void * thread_data , const Packet * p )
{
MetadataLog Thread * aft = thread_data ;
Output JsonThreadCtx * aft = thread_data ;
return MetadataJson ( tv , aft , p ) ;
}
@ -105,123 +97,14 @@ static int JsonMetadataLogCondition(ThreadVars *tv, const Packet *p)
return FALSE ;
}
static TmEcode JsonMetadataLogThreadInit ( ThreadVars * t , const void * initdata , void * * data )
{
JsonMetadataLogThread * aft = SCCalloc ( 1 , sizeof ( JsonMetadataLogThread ) ) ;
if ( unlikely ( aft = = NULL ) )
return TM_ECODE_FAILED ;
if ( initdata = = NULL ) {
SCLogDebug ( " Error getting context for EveLogMetadata. \" initdata \" argument NULL " ) ;
goto error_exit ;
}
aft - > json_buffer = MemBufferCreateNew ( JSON_OUTPUT_BUFFER_SIZE ) ;
if ( aft - > json_buffer = = NULL ) {
goto error_exit ;
}
/** Use the Output Context (file pointer and mutex) */
MetadataJsonOutputCtx * json_output_ctx = ( ( OutputCtx * ) initdata ) - > data ;
aft - > file_ctx = LogFileEnsureExists ( json_output_ctx - > file_ctx , t - > id ) ;
if ( ! aft - > file_ctx ) {
goto error_exit ;
}
aft - > json_output_ctx = json_output_ctx ;
* data = ( void * ) aft ;
return TM_ECODE_OK ;
error_exit :
if ( aft - > json_buffer ! = NULL ) {
MemBufferFree ( aft - > json_buffer ) ;
}
SCFree ( aft ) ;
return TM_ECODE_FAILED ;
}
static TmEcode JsonMetadataLogThreadDeinit ( ThreadVars * t , void * data )
{
JsonMetadataLogThread * aft = ( JsonMetadataLogThread * ) data ;
if ( aft = = NULL ) {
return TM_ECODE_OK ;
}
MemBufferFree ( aft - > json_buffer ) ;
/* clear memory */
memset ( aft , 0 , sizeof ( JsonMetadataLogThread ) ) ;
SCFree ( aft ) ;
return TM_ECODE_OK ;
}
static void JsonMetadataLogDeInitCtxSub ( OutputCtx * output_ctx )
{
SCLogDebug ( " cleaning up sub output_ctx %p " , output_ctx ) ;
MetadataJsonOutputCtx * json_output_ctx = ( MetadataJsonOutputCtx * ) output_ctx - > data ;
if ( json_output_ctx ! = NULL ) {
SCFree ( json_output_ctx ) ;
}
SCFree ( output_ctx ) ;
}
/**
* \ brief Create a new LogFileCtx for " fast " output style .
* \ param conf The configuration node for this output .
* \ return A LogFileCtx pointer on success , NULL on failure .
*/
static OutputInitResult JsonMetadataLogInitCtxSub ( ConfNode * conf , OutputCtx * parent_ctx )
{
OutputInitResult result = { NULL , false } ;
OutputJsonCtx * ajt = parent_ctx - > data ;
MetadataJsonOutputCtx * json_output_ctx = NULL ;
OutputCtx * output_ctx = SCCalloc ( 1 , sizeof ( OutputCtx ) ) ;
if ( unlikely ( output_ctx = = NULL ) )
return result ;
json_output_ctx = SCMalloc ( sizeof ( MetadataJsonOutputCtx ) ) ;
if ( unlikely ( json_output_ctx = = NULL ) ) {
goto error ;
}
memset ( json_output_ctx , 0 , sizeof ( MetadataJsonOutputCtx ) ) ;
json_output_ctx - > file_ctx = ajt - > file_ctx ;
json_output_ctx - > cfg = ajt - > cfg ;
/* override config setting as this logger is about metadata */
json_output_ctx - > cfg . include_metadata = true ;
output_ctx - > data = json_output_ctx ;
output_ctx - > DeInit = JsonMetadataLogDeInitCtxSub ;
result . ctx = output_ctx ;
result . ok = true ;
return result ;
error :
if ( json_output_ctx ! = NULL ) {
SCFree ( json_output_ctx ) ;
}
if ( output_ctx ! = NULL ) {
SCFree ( output_ctx ) ;
}
return result ;
}
void JsonMetadataLogRegister ( void )
{
OutputRegisterPacketSubModule ( LOGGER_JSON_METADATA , " eve-log " , MODULE_NAME ,
" eve-log.metadata " , JsonMetadataLogInitCtxSub , JsonMetadataLogger ,
JsonMetadataLogCondition , JsonMetadataLogThreadInit ,
JsonMetadataLogThreadDeinit , NULL ) ;
OutputRegisterPacketSubModule ( LOGGER_JSON_METADATA , " eve-log " , MODULE_NAME , " eve-log.metadata " ,
OutputJsonLogInitSub , JsonMetadataLogger , JsonMetadataLogCondition , JsonLogThreadInit ,
JsonLogThreadDeinit , NULL ) ;
/* Kept for compatibility. */
OutputRegisterPacketSubModule ( LOGGER_JSON_METADATA , " eve-log " , MODULE_NAME ,
" eve-log.vars " , JsonMetadataLogInitCtxSub , JsonMetadataLogger ,
JsonMetadataLogCondition , JsonMetadataLogThreadInit ,
JsonMetadataLogThreadDeinit , NULL ) ;
OutputRegisterPacketSubModule ( LOGGER_JSON_METADATA , " eve-log " , MODULE_NAME , " eve-log.vars " ,
OutputJsonLogInitSub , JsonMetadataLogger , JsonMetadataLogCondition , JsonLogThreadInit ,
JsonLogThreadDeinit , NULL ) ;
}
Jason Ish
6 years ago