aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

eve cleanup: remove duplicate/redundant code

Browse Source 
The first change was to have CreateEveHeader add the common options
as this was left out in a few loggers. While update all the loggers
that use CreateEveHeader, remove redundant code, in particular
from loggers that don't need to use their own context but
can use the generic one.
pull/6006/head
Jason Ish 6 years ago
parent 64330498f8
commit 06ba611667
28 changed files with 194 additions and 984 deletions
Show Stats Download Patch File Download Diff File

4
src/detect-engine-profile.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2016-2020 Open Information Security Foundation /* Copyright (C) 2016-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -38,7 +38,7 @@ SCMutex g_rule_dump_write_m = SCMUTEX_INITIALIZER;
void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx, void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx,
const SigGroupHead *sgh, const Packet *p) const SigGroupHead *sgh, const Packet *p)
{ {
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "inspectedrules", NULL); JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "inspectedrules", NULL, NULL);
if (js == NULL) if (js == NULL)
return; return;

6
src/output-filestore.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2018-2020 Open Information Security Foundation /* Copyright (C) 2018-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -168,8 +168,8 @@ static void OutputFilestoreFinalizeFiles(ThreadVars *tv,
WARN_ONCE(SC_ERR_SPRINTF, WARN_ONCE(SC_ERR_SPRINTF,
"Failed to write file info record. Output filename truncated."); "Failed to write file info record. Output filename truncated.");
} else { } else {
JsonBuilder *js_fileinfo = JsonBuildFileInfoRecord(p, ff, true, dir, JsonBuilder *js_fileinfo =
ctx->xff_cfg); JsonBuildFileInfoRecord(p, ff, true, dir, ctx->xff_cfg, NULL);
if (likely(js_fileinfo != NULL)) { if (likely(js_fileinfo != NULL)) {
jb_close(js_fileinfo); jb_close(js_fileinfo);
FILE *out = fopen(js_metadata_filename, "w"); FILE *out = fopen(js_metadata_filename, "w");

13
src/output-json-alert.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2013-2020 Open Information Security Foundation /* Copyright (C) 2013-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -109,7 +109,7 @@ typedef struct AlertJsonOutputCtx_ {
uint32_t payload_buffer_size; uint32_t payload_buffer_size;
HttpXFFCfg *xff_cfg; HttpXFFCfg *xff_cfg;
HttpXFFCfg *parent_xff_cfg; HttpXFFCfg *parent_xff_cfg;
OutputJsonCommonSettings cfg; OutputJsonCtx *eve_ctx;
} AlertJsonOutputCtx; } AlertJsonOutputCtx;
typedef struct JsonAlertLogThread_ { typedef struct JsonAlertLogThread_ {
@ -625,10 +625,10 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
} }
} }
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "alert", &addr); JsonBuilder *jb =
CreateEveHeader(p, LOG_DIR_PACKET, "alert", &addr, json_output_ctx->eve_ctx);
if (unlikely(jb == NULL)) if (unlikely(jb == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
EveAddCommonOptions(&json_output_ctx->cfg, p, p->flow, jb);
MemBufferReset(aft->json_buffer); MemBufferReset(aft->json_buffer);
@ -722,7 +722,8 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
if ((p->flags & PKT_HAS_TAG) && (json_output_ctx->flags & if ((p->flags & PKT_HAS_TAG) && (json_output_ctx->flags &
LOG_JSON_TAGGED_PACKETS)) { LOG_JSON_TAGGED_PACKETS)) {
MemBufferReset(aft->json_buffer); MemBufferReset(aft->json_buffer);
JsonBuilder *packetjs = CreateEveHeader(p, LOG_DIR_PACKET, "packet", NULL); JsonBuilder *packetjs =
CreateEveHeader(p, LOG_DIR_PACKET, "packet", NULL, json_output_ctx->eve_ctx);
if (unlikely(packetjs != NULL)) { if (unlikely(packetjs != NULL)) {
EvePacket(p, packetjs, 0); EvePacket(p, packetjs, 0);
OutputJsonBuilderBuffer(packetjs, aft->file_ctx, &aft->json_buffer); OutputJsonBuilderBuffer(packetjs, aft->file_ctx, &aft->json_buffer);
@ -996,7 +997,7 @@ static OutputInitResult JsonAlertLogInitCtxSub(ConfNode *conf, OutputCtx *parent
memset(json_output_ctx, 0, sizeof(AlertJsonOutputCtx)); memset(json_output_ctx, 0, sizeof(AlertJsonOutputCtx));
json_output_ctx->file_ctx = ajt->file_ctx; json_output_ctx->file_ctx = ajt->file_ctx;
json_output_ctx->cfg = ajt->cfg; json_output_ctx->eve_ctx = ajt;
JsonAlertLogSetupMetadata(json_output_ctx, conf); JsonAlertLogSetupMetadata(json_output_ctx, conf);
json_output_ctx->xff_cfg = JsonAlertLogGetXffCfg(conf); json_output_ctx->xff_cfg = JsonAlertLogGetXffCfg(conf);

23
src/output-json-anomaly.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2019-2020 Open Information Security Foundation /* Copyright (C) 2019-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -72,9 +72,8 @@
#define TX_ID_UNUSED UINT64_MAX #define TX_ID_UNUSED UINT64_MAX
typedef struct AnomalyJsonOutputCtx_ { typedef struct AnomalyJsonOutputCtx_ {
LogFileCtx* file_ctx;
uint16_t flags; uint16_t flags;
OutputJsonCommonSettings cfg; OutputJsonCtx *eve_ctx;
} AnomalyJsonOutputCtx; } AnomalyJsonOutputCtx;
typedef struct JsonAnomalyLogThread_ { typedef struct JsonAnomalyLogThread_ {
@ -108,7 +107,6 @@ static void OutputAnomalyLoggerDisable(void)
static int AnomalyDecodeEventJson(ThreadVars *tv, JsonAnomalyLogThread *aft, static int AnomalyDecodeEventJson(ThreadVars *tv, JsonAnomalyLogThread *aft,
const Packet *p) const Packet *p)
{ {
const bool is_ip_pkt = PKT_IS_IPV4(p) || PKT_IS_IPV6(p);
const uint16_t log_type = aft->json_output_ctx->flags; const uint16_t log_type = aft->json_output_ctx->flags;
const bool log_stream = log_type & LOG_JSON_STREAM_TYPE; const bool log_stream = log_type & LOG_JSON_STREAM_TYPE;
const bool log_decode = log_type & LOG_JSON_DECODE_TYPE; const bool log_decode = log_type & LOG_JSON_DECODE_TYPE;
@ -123,15 +121,12 @@ static int AnomalyDecodeEventJson(ThreadVars *tv, JsonAnomalyLogThread *aft,
MemBufferReset(aft->json_buffer); MemBufferReset(aft->json_buffer);
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, ANOMALY_EVENT_TYPE, NULL); JsonBuilder *js = CreateEveHeader(
p, LOG_DIR_PACKET, ANOMALY_EVENT_TYPE, NULL, aft->json_output_ctx->eve_ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
if (is_ip_pkt) {
EveAddCommonOptions(&aft->json_output_ctx->cfg, p, p->flow, js);
}
jb_open_object(js, ANOMALY_EVENT_TYPE); jb_open_object(js, ANOMALY_EVENT_TYPE);
if (event_code < DECODE_EVENT_MAX) { if (event_code < DECODE_EVENT_MAX) {
@ -179,14 +174,15 @@ static int AnomalyAppLayerDecoderEventJson(JsonAnomalyLogThread *aft,
if (tx_id != TX_ID_UNUSED) { if (tx_id != TX_ID_UNUSED) {
js = CreateEveHeaderWithTxId(p, LOG_DIR_PACKET, js = CreateEveHeaderWithTxId(p, LOG_DIR_PACKET,
ANOMALY_EVENT_TYPE, NULL, tx_id); ANOMALY_EVENT_TYPE, NULL, tx_id);
EveAddCommonOptions(&aft->json_output_ctx->eve_ctx->cfg, p, p->flow, js);
} else { } else {
js = CreateEveHeader(p, LOG_DIR_PACKET, ANOMALY_EVENT_TYPE, NULL); js = CreateEveHeader(
p, LOG_DIR_PACKET, ANOMALY_EVENT_TYPE, NULL, aft->json_output_ctx->eve_ctx);
} }
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
EveAddCommonOptions(&aft->json_output_ctx->cfg, p, p->flow, js);
jb_open_object(js, ANOMALY_EVENT_TYPE); jb_open_object(js, ANOMALY_EVENT_TYPE);
@ -319,7 +315,7 @@ static TmEcode JsonAnomalyLogThreadInit(ThreadVars *t, const void *initdata, voi
/** Use the Output Context (file pointer and mutex) */ /** Use the Output Context (file pointer and mutex) */
AnomalyJsonOutputCtx *json_output_ctx = ((OutputCtx *)initdata)->data; AnomalyJsonOutputCtx *json_output_ctx = ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(json_output_ctx->file_ctx, t->id); aft->file_ctx = LogFileEnsureExists(json_output_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) { if (!aft->file_ctx) {
goto error_exit; goto error_exit;
} }
@ -431,9 +427,8 @@ static OutputInitResult JsonAnomalyLogInitCtxHelper(ConfNode *conf, OutputCtx *p
goto error; goto error;
} }
json_output_ctx->file_ctx = ajt->file_ctx;
JsonAnomalyLogConf(json_output_ctx, conf); JsonAnomalyLogConf(json_output_ctx, conf);
json_output_ctx->cfg = ajt->cfg; json_output_ctx->eve_ctx = ajt;
output_ctx->data = json_output_ctx; output_ctx->data = json_output_ctx;
output_ctx->DeInit = JsonAnomalyLogDeInitCtxSubHelper; output_ctx->DeInit = JsonAnomalyLogDeInitCtxSubHelper;

4
src/output-json-dcerpc.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2017-2020 Open Information Security Foundation /* Copyright (C) 2017-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -46,7 +46,7 @@ static int JsonDCERPCLogger(ThreadVars *tv, void *thread_data,
{ {
OutputJsonThreadCtx *thread = thread_data; OutputJsonThreadCtx *thread = thread_data;
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dcerpc", NULL); JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dcerpc", NULL, thread->ctx);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }

16
src/output-json-dhcp.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2015-2020 Open Information Security Foundation /* Copyright (C) 2015-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -47,10 +47,8 @@
typedef struct LogDHCPFileCtx_ { typedef struct LogDHCPFileCtx_ {
LogFileCtx *file_ctx;
uint32_t flags;
void *rs_logger; void *rs_logger;
OutputJsonCommonSettings cfg; OutputJsonCtx *eve_ctx;
} LogDHCPFileCtx; } LogDHCPFileCtx;
typedef struct LogDHCPLogThread_ { typedef struct LogDHCPLogThread_ {
@ -69,13 +67,11 @@ static int JsonDHCPLogger(ThreadVars *tv, void *thread_data,
return TM_ECODE_OK; return TM_ECODE_OK;
} }
JsonBuilder *js = CreateEveHeader((Packet *)p, 0, "dhcp", NULL); JsonBuilder *js = CreateEveHeader((Packet *)p, 0, "dhcp", NULL, ctx->eve_ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
EveAddCommonOptions(&thread->dhcplog_ctx->cfg, p, f, js);
rs_dhcp_logger_log(ctx->rs_logger, tx, js); rs_dhcp_logger_log(ctx->rs_logger, tx, js);
MemBufferReset(thread->buffer); MemBufferReset(thread->buffer);
@ -97,14 +93,12 @@ static OutputInitResult OutputDHCPLogInitSub(ConfNode *conf,
OutputCtx *parent_ctx) OutputCtx *parent_ctx)
{ {
OutputInitResult result = { NULL, false }; OutputInitResult result = { NULL, false };
OutputJsonCtx *ajt = parent_ctx->data;
LogDHCPFileCtx *dhcplog_ctx = SCCalloc(1, sizeof(*dhcplog_ctx)); LogDHCPFileCtx *dhcplog_ctx = SCCalloc(1, sizeof(*dhcplog_ctx));
if (unlikely(dhcplog_ctx == NULL)) { if (unlikely(dhcplog_ctx == NULL)) {
return result; return result;
} }
dhcplog_ctx->file_ctx = ajt->file_ctx; dhcplog_ctx->eve_ctx = parent_ctx->data;
dhcplog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) { if (unlikely(output_ctx == NULL)) {
@ -142,7 +136,7 @@ static TmEcode JsonDHCPLogThreadInit(ThreadVars *t, const void *initdata, void *
} }
thread->dhcplog_ctx = ((OutputCtx *)initdata)->data; thread->dhcplog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->dhcplog_ctx->file_ctx, t->id); thread->file_ctx = LogFileEnsureExists(thread->dhcplog_ctx->eve_ctx->file_ctx, t->id);
if (!thread->file_ctx) { if (!thread->file_ctx) {
goto error_exit; goto error_exit;
} }

19
src/output-json-dnp3.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2015-2020 Open Information Security Foundation /* Copyright (C) 2015-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -44,10 +44,9 @@
#include "output-json-dnp3-objects.h" #include "output-json-dnp3-objects.h"
typedef struct LogDNP3FileCtx_ { typedef struct LogDNP3FileCtx_ {
LogFileCtx *file_ctx;
uint32_t flags; uint32_t flags;
uint8_t include_object_data; uint8_t include_object_data;
OutputJsonCommonSettings cfg; OutputJsonCtx *eve_ctx;
} LogDNP3FileCtx; } LogDNP3FileCtx;
typedef struct LogDNP3LogThread_ { typedef struct LogDNP3LogThread_ {
@ -222,13 +221,12 @@ static int JsonDNP3LoggerToServer(ThreadVars *tv, void *thread_data,
MemBufferReset(buffer); MemBufferReset(buffer);
if (tx->has_request && tx->request_done) { if (tx->has_request && tx->request_done) {
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL); JsonBuilder *js =
CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL, thread->dnp3log_ctx->eve_ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
EveAddCommonOptions(&thread->dnp3log_ctx->cfg, p, f, js);
jb_open_object(js, "dnp3"); jb_open_object(js, "dnp3");
JsonDNP3LogRequest(js, tx); JsonDNP3LogRequest(js, tx);
jb_close(js); jb_close(js);
@ -250,12 +248,12 @@ static int JsonDNP3LoggerToClient(ThreadVars *tv, void *thread_data,
MemBufferReset(buffer); MemBufferReset(buffer);
if (tx->has_response && tx->response_done) { if (tx->has_response && tx->response_done) {
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL); JsonBuilder *js =
CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL, thread->dnp3log_ctx->eve_ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
EveAddCommonOptions(&thread->dnp3log_ctx->cfg, p, f, js);
jb_open_object(js, "dnp3"); jb_open_object(js, "dnp3");
JsonDNP3LogResponse(js, tx); JsonDNP3LogResponse(js, tx);
jb_close(js); jb_close(js);
@ -285,8 +283,7 @@ static OutputInitResult OutputDNP3LogInitSub(ConfNode *conf, OutputCtx *parent_c
if (unlikely(dnp3log_ctx == NULL)) { if (unlikely(dnp3log_ctx == NULL)) {
return result; return result;
} }
dnp3log_ctx->file_ctx = json_ctx->file_ctx; dnp3log_ctx->eve_ctx = json_ctx;
dnp3log_ctx->cfg = json_ctx->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) { if (unlikely(output_ctx == NULL)) {
@ -324,7 +321,7 @@ static TmEcode JsonDNP3LogThreadInit(ThreadVars *t, const void *initdata, void *
} }
thread->dnp3log_ctx = ((OutputCtx *)initdata)->data; thread->dnp3log_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->dnp3log_ctx->file_ctx, t->id); thread->file_ctx = LogFileEnsureExists(thread->dnp3log_ctx->eve_ctx->file_ctx, t->id);
if (!thread->file_ctx) { if (!thread->file_ctx) {
goto error_exit; goto error_exit;
} }

22
src/output-json-dns.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2007-2020 Open Information Security Foundation /* Copyright (C) 2007-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -257,10 +257,9 @@ static struct {
}; };
typedef struct LogDnsFileCtx_ { typedef struct LogDnsFileCtx_ {
LogFileCtx *file_ctx;
uint64_t flags; /** Store mode */ uint64_t flags; /** Store mode */
DnsVersion version; DnsVersion version;
OutputJsonCommonSettings cfg; OutputJsonCtx *eve_ctx;
} LogDnsFileCtx; } LogDnsFileCtx;
typedef struct LogDnsLogThread_ { typedef struct LogDnsLogThread_ {
@ -319,11 +318,10 @@ static int JsonDnsLoggerToServer(ThreadVars *tv, void *thread_data,
} }
for (uint16_t i = 0; i < 0xffff; i++) { for (uint16_t i = 0; i < 0xffff; i++) {
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL); JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
EveAddCommonOptions(&dnslog_ctx->cfg, p, f, jb);
jb_open_object(jb, "dns"); jb_open_object(jb, "dns");
if (!rs_dns_log_json_query(txptr, i, td->dnslog_ctx->flags, jb)) { if (!rs_dns_log_json_query(txptr, i, td->dnslog_ctx->flags, jb)) {
@ -354,11 +352,10 @@ static int JsonDnsLoggerToClient(ThreadVars *tv, void *thread_data,
if (td->dnslog_ctx->version == DNS_VERSION_2) { if (td->dnslog_ctx->version == DNS_VERSION_2) {
if (rs_dns_do_log_answer(txptr, td->dnslog_ctx->flags)) { if (rs_dns_do_log_answer(txptr, td->dnslog_ctx->flags)) {
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL); JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
EveAddCommonOptions(&dnslog_ctx->cfg, p, f, jb);
jb_open_object(jb, "dns"); jb_open_object(jb, "dns");
rs_dns_log_json_answer(txptr, td->dnslog_ctx->flags, jb); rs_dns_log_json_answer(txptr, td->dnslog_ctx->flags, jb);
@ -370,11 +367,10 @@ static int JsonDnsLoggerToClient(ThreadVars *tv, void *thread_data,
} else { } else {
/* Log answers. */ /* Log answers. */
for (uint16_t i = 0; i < UINT16_MAX; i++) { for (uint16_t i = 0; i < UINT16_MAX; i++) {
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL); JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
EveAddCommonOptions(&dnslog_ctx->cfg, p, f, jb);
JsonBuilder *answer = rs_dns_log_json_answer_v1(txptr, i, JsonBuilder *answer = rs_dns_log_json_answer_v1(txptr, i,
td->dnslog_ctx->flags); td->dnslog_ctx->flags);
@ -391,11 +387,10 @@ static int JsonDnsLoggerToClient(ThreadVars *tv, void *thread_data,
} }
/* Log authorities. */ /* Log authorities. */
for (uint16_t i = 0; i < UINT16_MAX; i++) { for (uint16_t i = 0; i < UINT16_MAX; i++) {
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL); JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
EveAddCommonOptions(&dnslog_ctx->cfg, p, f, jb);
JsonBuilder *answer = rs_dns_log_json_authority_v1(txptr, i, JsonBuilder *answer = rs_dns_log_json_authority_v1(txptr, i,
td->dnslog_ctx->flags); td->dnslog_ctx->flags);
@ -434,7 +429,7 @@ static TmEcode LogDnsLogThreadInit(ThreadVars *t, const void *initdata, void **d
/* Use the Ouptut Context (file pointer and mutex) */ /* Use the Ouptut Context (file pointer and mutex) */
aft->dnslog_ctx= ((OutputCtx *)initdata)->data; aft->dnslog_ctx= ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(aft->dnslog_ctx->file_ctx, t->id); aft->file_ctx = LogFileEnsureExists(aft->dnslog_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) { if (!aft->file_ctx) {
goto error_exit; goto error_exit;
} }
@ -626,8 +621,7 @@ static OutputInitResult JsonDnsLogInitCtxSub(ConfNode *conf, OutputCtx *parent_c
} }
memset(dnslog_ctx, 0x00, sizeof(LogDnsFileCtx)); memset(dnslog_ctx, 0x00, sizeof(LogDnsFileCtx));
dnslog_ctx->file_ctx = ojc->file_ctx; dnslog_ctx->eve_ctx = ojc;
dnslog_ctx->cfg = ojc->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
if (unlikely(output_ctx == NULL)) { if (unlikely(output_ctx == NULL)) {

16
src/output-json-drop.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2007-2020 Open Information Security Foundation /* Copyright (C) 2007-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -61,9 +61,8 @@
#define LOG_DROP_ALERTS 1 #define LOG_DROP_ALERTS 1
typedef struct JsonDropOutputCtx_ { typedef struct JsonDropOutputCtx_ {
LogFileCtx *file_ctx;
uint8_t flags; uint8_t flags;
OutputJsonCommonSettings cfg; OutputJsonCtx *eve_ctx;
} JsonDropOutputCtx; } JsonDropOutputCtx;
typedef struct JsonDropLogThread_ { typedef struct JsonDropLogThread_ {
@ -91,12 +90,10 @@ static int DropLogJSON (JsonDropLogThread *aft, const Packet *p)
JsonAddrInfo addr = json_addr_info_zero; JsonAddrInfo addr = json_addr_info_zero;
JsonAddrInfoInit(p, LOG_DIR_PACKET, &addr); JsonAddrInfoInit(p, LOG_DIR_PACKET, &addr);
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "drop", &addr); JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "drop", &addr, drop_ctx->eve_ctx);
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
EveAddCommonOptions(&drop_ctx->cfg, p, p->flow, js);
jb_open_object(js, "drop"); jb_open_object(js, "drop");
/* reset */ /* reset */
@ -200,7 +197,7 @@ static TmEcode JsonDropLogThreadInit(ThreadVars *t, const void *initdata, void *
/** Use the Ouptut Context (file pointer and mutex) */ /** Use the Ouptut Context (file pointer and mutex) */
aft->drop_ctx = ((OutputCtx *)initdata)->data; aft->drop_ctx = ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(aft->drop_ctx->file_ctx, t->id); aft->file_ctx = LogFileEnsureExists(aft->drop_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) { if (!aft->file_ctx) {
goto error_exit; goto error_exit;
} }
@ -235,8 +232,6 @@ static TmEcode JsonDropLogThreadDeinit(ThreadVars *t, void *data)
static void JsonDropOutputCtxFree(JsonDropOutputCtx *drop_ctx) static void JsonDropOutputCtxFree(JsonDropOutputCtx *drop_ctx)
{ {
if (drop_ctx != NULL) { if (drop_ctx != NULL) {
if (drop_ctx->file_ctx != NULL)
LogFileFreeCtx(drop_ctx->file_ctx);
SCFree(drop_ctx); SCFree(drop_ctx);
} }
} }
@ -292,8 +287,7 @@ static OutputInitResult JsonDropLogInitCtxSub(ConfNode *conf, OutputCtx *parent_
} }
} }
drop_ctx->file_ctx = ajt->file_ctx; drop_ctx->eve_ctx = ajt;
drop_ctx->cfg = ajt->cfg;
output_ctx->data = drop_ctx; output_ctx->data = drop_ctx;
output_ctx->DeInit = JsonDropLogDeInitCtxSub; output_ctx->DeInit = JsonDropLogDeInitCtxSub;

25
src/output-json-file.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2007-2020 Open Information Security Foundation /* Copyright (C) 2007-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -70,10 +70,10 @@
#include "stream-tcp-reassemble.h" #include "stream-tcp-reassemble.h"
typedef struct OutputFileCtx_ { typedef struct OutputFileCtx_ {
LogFileCtx *file_ctx;
uint32_t file_cnt; uint32_t file_cnt;
HttpXFFCfg *xff_cfg; HttpXFFCfg *xff_cfg;
HttpXFFCfg *parent_xff_cfg; HttpXFFCfg *parent_xff_cfg;
OutputJsonCtx *eve_ctx;
} OutputFileCtx; } OutputFileCtx;
typedef struct JsonFileLogThread_ { typedef struct JsonFileLogThread_ {
@ -82,8 +82,8 @@ typedef struct JsonFileLogThread_ {
MemBuffer *buffer; MemBuffer *buffer;
} JsonFileLogThread; } JsonFileLogThread;
JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, const bool stored,
const bool stored, uint8_t dir, HttpXFFCfg *xff_cfg) uint8_t dir, HttpXFFCfg *xff_cfg, OutputJsonCtx *eve_ctx)
{ {
enum OutputJsonLogDirection fdir = LOG_DIR_FLOW; enum OutputJsonLogDirection fdir = LOG_DIR_FLOW;
@ -119,7 +119,7 @@ JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff,
} }
} }
JsonBuilder *js = CreateEveHeader(p, fdir, "fileinfo", &addr); JsonBuilder *js = CreateEveHeader(p, fdir, "fileinfo", &addr, eve_ctx);
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return NULL; return NULL;
@ -202,13 +202,13 @@ JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff,
* \internal * \internal
* \brief Write meta data on a single line json record * \brief Write meta data on a single line json record
*/ */
static void FileWriteJsonRecord(JsonFileLogThread *aft, const Packet *p, static void FileWriteJsonRecord(JsonFileLogThread *aft, const Packet *p, const File *ff,
const File *ff, uint32_t dir) uint32_t dir, OutputJsonCtx *eve_ctx)
{ {
HttpXFFCfg *xff_cfg = aft->filelog_ctx->xff_cfg != NULL ? HttpXFFCfg *xff_cfg = aft->filelog_ctx->xff_cfg != NULL ?
aft->filelog_ctx->xff_cfg : aft->filelog_ctx->parent_xff_cfg;; aft->filelog_ctx->xff_cfg : aft->filelog_ctx->parent_xff_cfg;;
JsonBuilder *js = JsonBuildFileInfoRecord(p, ff, JsonBuilder *js = JsonBuildFileInfoRecord(
ff->flags & FILE_STORED ? true : false, dir, xff_cfg); p, ff, ff->flags & FILE_STORED ? true : false, dir, xff_cfg, eve_ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return; return;
} }
@ -228,7 +228,7 @@ static int JsonFileLogger(ThreadVars *tv, void *thread_data, const Packet *p,
SCLogDebug("ff %p", ff); SCLogDebug("ff %p", ff);
FileWriteJsonRecord(aft, p, ff, dir); FileWriteJsonRecord(aft, p, ff, dir, aft->filelog_ctx->eve_ctx);
return 0; return 0;
} }
@ -252,7 +252,7 @@ static TmEcode JsonFileLogThreadInit(ThreadVars *t, const void *initdata, void *
/* Use the Ouptut Context (file pointer and mutex) */ /* Use the Ouptut Context (file pointer and mutex) */
aft->filelog_ctx = ((OutputCtx *)initdata)->data; aft->filelog_ctx = ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(aft->filelog_ctx->file_ctx, t->id); aft->file_ctx = LogFileEnsureExists(aft->filelog_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) { if (!aft->file_ctx) {
goto error_exit; goto error_exit;
} }
@ -312,8 +312,6 @@ static OutputInitResult OutputFileLogInitSub(ConfNode *conf, OutputCtx *parent_c
return result; return result;
} }
output_file_ctx->file_ctx = ojc->file_ctx;
if (conf) { if (conf) {
const char *force_filestore = ConfNodeLookupChildValue(conf, "force-filestore"); const char *force_filestore = ConfNodeLookupChildValue(conf, "force-filestore");
if (force_filestore != NULL && ConfValIsTrue(force_filestore)) { if (force_filestore != NULL && ConfValIsTrue(force_filestore)) {
@ -339,6 +337,7 @@ static OutputInitResult OutputFileLogInitSub(ConfNode *conf, OutputCtx *parent_c
output_file_ctx->parent_xff_cfg = ojc->xff_cfg; output_file_ctx->parent_xff_cfg = ojc->xff_cfg;
} }
output_file_ctx->eve_ctx = ojc;
output_ctx->data = output_file_ctx; output_ctx->data = output_file_ctx;
output_ctx->DeInit = OutputFileLogDeinitSub; output_ctx->DeInit = OutputFileLogDeinitSub;

8
src/output-json-file.h
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2007-2013 Open Information Security Foundation /* Copyright (C) 2007-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -26,8 +26,10 @@
#include "app-layer-htp-xff.h" #include "app-layer-htp-xff.h"
typedef struct OutputJsonCtx_ OutputJsonCtx;
void JsonFileLogRegister(void); void JsonFileLogRegister(void);
JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, const bool stored,
const bool stored, uint8_t dir, HttpXFFCfg *xff_cfg); uint8_t dir, HttpXFFCfg *xff_cfg, OutputJsonCtx *eve_ctx);
#endif /* __OUTPUT_JSON_FILE_H__ */ #endif /* __OUTPUT_JSON_FILE_H__ */

14
src/output-json-ike.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2018-2020 Open Information Security Foundation /* Copyright (C) 2018-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -54,9 +54,8 @@
#define LOG_IKE_EXTENDED (1 << 0) #define LOG_IKE_EXTENDED (1 << 0)
typedef struct LogIKEFileCtx_ { typedef struct LogIKEFileCtx_ {
LogFileCtx *file_ctx;
uint32_t flags; uint32_t flags;
OutputJsonCommonSettings cfg; OutputJsonCtx *eve_ctx;
} LogIKEFileCtx; } LogIKEFileCtx;
typedef struct LogIKELogThread_ { typedef struct LogIKELogThread_ {
@ -82,11 +81,11 @@ static int JsonIKELogger(ThreadVars *tv, void *thread_data, const Packet *p, Flo
void *tx, uint64_t tx_id) void *tx, uint64_t tx_id)
{ {
LogIKELogThread *thread = thread_data; LogIKELogThread *thread = thread_data;
JsonBuilder *jb = CreateEveHeader((Packet *)p, LOG_DIR_PACKET, "ike", NULL); JsonBuilder *jb =
CreateEveHeader((Packet *)p, LOG_DIR_PACKET, "ike", NULL, thread->ikelog_ctx->eve_ctx);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
EveAddCommonOptions(&thread->ikelog_ctx->cfg, p, f, jb);
LogIKEFileCtx *ike_ctx = thread->ikelog_ctx; LogIKEFileCtx *ike_ctx = thread->ikelog_ctx;
if (!rs_ike_logger_log(state, tx, ike_ctx->flags, jb)) { if (!rs_ike_logger_log(state, tx, ike_ctx->flags, jb)) {
@ -120,8 +119,7 @@ static OutputInitResult OutputIKELogInitSub(ConfNode *conf, OutputCtx *parent_ct
if (unlikely(ikelog_ctx == NULL)) { if (unlikely(ikelog_ctx == NULL)) {
return result; return result;
} }
ikelog_ctx->file_ctx = ajt->file_ctx; ikelog_ctx->eve_ctx = ajt;
ikelog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) { if (unlikely(output_ctx == NULL)) {
@ -165,7 +163,7 @@ static TmEcode JsonIKELogThreadInit(ThreadVars *t, const void *initdata, void **
} }
thread->ikelog_ctx = ((OutputCtx *)initdata)->data; thread->ikelog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->ikelog_ctx->file_ctx, t->id); thread->file_ctx = LogFileEnsureExists(thread->ikelog_ctx->eve_ctx->file_ctx, t->id);
if (!thread->file_ctx) { if (!thread->file_ctx) {
goto error_exit; goto error_exit;
} }

105
src/output-json-krb5.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2018-2020 Open Information Security Foundation /* Copyright (C) 2018-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -49,30 +49,17 @@
#include "rust.h" #include "rust.h"
typedef struct LogKRB5FileCtx_ {
LogFileCtx *file_ctx;
OutputJsonCommonSettings cfg;
} LogKRB5FileCtx;
typedef struct LogKRB5LogThread_ {
LogFileCtx *file_ctx;
LogKRB5FileCtx *krb5log_ctx;
MemBuffer *buffer;
} LogKRB5LogThread;
static int JsonKRB5Logger(ThreadVars *tv, void *thread_data, static int JsonKRB5Logger(ThreadVars *tv, void *thread_data,
const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
{ {
KRB5Transaction *krb5tx = tx; KRB5Transaction *krb5tx = tx;
LogKRB5LogThread *thread = thread_data; OutputJsonThreadCtx *thread = thread_data;
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "krb5", NULL); JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "krb5", NULL, thread->ctx);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
EveAddCommonOptions(&thread->krb5log_ctx->cfg, p, f, jb);
jb_open_object(jb, "krb5"); jb_open_object(jb, "krb5");
if (!rs_krb5_log_json_response(jb, state, krb5tx)) { if (!rs_krb5_log_json_response(jb, state, krb5tx)) {
goto error; goto error;
@ -90,98 +77,20 @@ error:
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
static void OutputKRB5LogDeInitCtxSub(OutputCtx *output_ctx)
{
LogKRB5FileCtx *krb5log_ctx = (LogKRB5FileCtx *)output_ctx->data;
SCFree(krb5log_ctx);
SCFree(output_ctx);
}
static OutputInitResult OutputKRB5LogInitSub(ConfNode *conf, static OutputInitResult OutputKRB5LogInitSub(ConfNode *conf,
OutputCtx *parent_ctx) OutputCtx *parent_ctx)
{ {
OutputInitResult result = { NULL, false };
OutputJsonCtx *ajt = parent_ctx->data;
LogKRB5FileCtx *krb5log_ctx = SCCalloc(1, sizeof(*krb5log_ctx));
if (unlikely(krb5log_ctx == NULL)) {
return result;
}
krb5log_ctx->file_ctx = ajt->file_ctx;
krb5log_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) {
SCFree(krb5log_ctx);
return result;
}
output_ctx->data = krb5log_ctx;
output_ctx->DeInit = OutputKRB5LogDeInitCtxSub;
SCLogDebug("KRB5 log sub-module initialized.");
AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_KRB5); AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_KRB5);
AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_KRB5); AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_KRB5);
return OutputJsonLogInitSub(conf, parent_ctx);
result.ctx = output_ctx;
result.ok = true;
return result;
}
static TmEcode JsonKRB5LogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
LogKRB5LogThread *thread = SCCalloc(1, sizeof(*thread));
if (unlikely(thread == NULL)) {
return TM_ECODE_FAILED;
}
if (initdata == NULL) {
SCLogDebug("Error getting context for EveLogKRB5. \"initdata\" is NULL.");
goto error_exit;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->krb5log_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->krb5log_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
goto error_exit;
}
*data = (void *)thread;
return TM_ECODE_OK;
error_exit:
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
static TmEcode JsonKRB5LogThreadDeinit(ThreadVars *t, void *data)
{
LogKRB5LogThread *thread = (LogKRB5LogThread *)data;
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_OK;
} }
void JsonKRB5LogRegister(void) void JsonKRB5LogRegister(void)
{ {
/* Register as an eve sub-module. */ /* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_KRB5, "eve-log", "JsonKRB5Log", OutputRegisterTxSubModule(LOGGER_JSON_KRB5, "eve-log", "JsonKRB5Log", "eve-log.krb5",
"eve-log.krb5", OutputKRB5LogInitSub, ALPROTO_KRB5, OutputKRB5LogInitSub, ALPROTO_KRB5, JsonKRB5Logger, JsonLogThreadInit,
JsonKRB5Logger, JsonKRB5LogThreadInit, JsonLogThreadDeinit, NULL);
JsonKRB5LogThreadDeinit, NULL);
SCLogDebug("KRB5 JSON logger registered."); SCLogDebug("KRB5 JSON logger registered.");
} }

149
src/output-json-metadata.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2013-2020 Open Information Security Foundation /* Copyright (C) 2013-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -65,26 +65,18 @@
#define MODULE_NAME "JsonMetadataLog" #define MODULE_NAME "JsonMetadataLog"
typedef struct MetadataJsonOutputCtx_ { static int MetadataJson(ThreadVars *tv, OutputJsonThreadCtx *aft, const Packet *p)
LogFileCtx* file_ctx;
OutputJsonCommonSettings cfg;
} MetadataJsonOutputCtx;
typedef struct JsonMetadataLogThread_ {
/** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
LogFileCtx* file_ctx;
MemBuffer *json_buffer;
MetadataJsonOutputCtx* json_output_ctx;
} JsonMetadataLogThread;
static int MetadataJson(ThreadVars *tv, JsonMetadataLogThread *aft, const Packet *p)
{ {
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "metadata", NULL); JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "metadata", NULL, aft->ctx);
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
EveAddCommonOptions(&aft->json_output_ctx->cfg, p, p->flow, js); /* If metadata is not enabled for eve, explicitly log it here as this is
OutputJsonBuilderBuffer(js, aft->file_ctx, &aft->json_buffer); * what logging metadata is about. */
if (!aft->ctx->cfg.include_metadata) {
EveAddMetadata(p, p->flow, js);
}
OutputJsonBuilderBuffer(js, aft->file_ctx, &aft->buffer);
jb_free(js); jb_free(js);
return TM_ECODE_OK; return TM_ECODE_OK;
@ -92,7 +84,7 @@ static int MetadataJson(ThreadVars *tv, JsonMetadataLogThread *aft, const Packet
static int JsonMetadataLogger(ThreadVars *tv, void *thread_data, const Packet *p) static int JsonMetadataLogger(ThreadVars *tv, void *thread_data, const Packet *p)
{ {
JsonMetadataLogThread *aft = thread_data; OutputJsonThreadCtx *aft = thread_data;
return MetadataJson(tv, aft, p); return MetadataJson(tv, aft, p);
} }
@ -105,123 +97,14 @@ static int JsonMetadataLogCondition(ThreadVars *tv, const Packet *p)
return FALSE; return FALSE;
} }
static TmEcode JsonMetadataLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
JsonMetadataLogThread *aft = SCCalloc(1, sizeof(JsonMetadataLogThread));
if (unlikely(aft == NULL))
return TM_ECODE_FAILED;
if(initdata == NULL) {
SCLogDebug("Error getting context for EveLogMetadata. \"initdata\" argument NULL");
goto error_exit;
}
aft->json_buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (aft->json_buffer == NULL) {
goto error_exit;
}
/** Use the Output Context (file pointer and mutex) */
MetadataJsonOutputCtx *json_output_ctx = ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(json_output_ctx->file_ctx, t->id);
if (!aft->file_ctx) {
goto error_exit;
}
aft->json_output_ctx = json_output_ctx;
*data = (void *)aft;
return TM_ECODE_OK;
error_exit:
if (aft->json_buffer != NULL) {
MemBufferFree(aft->json_buffer);
}
SCFree(aft);
return TM_ECODE_FAILED;
}
static TmEcode JsonMetadataLogThreadDeinit(ThreadVars *t, void *data)
{
JsonMetadataLogThread *aft = (JsonMetadataLogThread *)data;
if (aft == NULL) {
return TM_ECODE_OK;
}
MemBufferFree(aft->json_buffer);
/* clear memory */
memset(aft, 0, sizeof(JsonMetadataLogThread));
SCFree(aft);
return TM_ECODE_OK;
}
static void JsonMetadataLogDeInitCtxSub(OutputCtx *output_ctx)
{
SCLogDebug("cleaning up sub output_ctx %p", output_ctx);
MetadataJsonOutputCtx *json_output_ctx = (MetadataJsonOutputCtx *) output_ctx->data;
if (json_output_ctx != NULL) {
SCFree(json_output_ctx);
}
SCFree(output_ctx);
}
/**
* \brief Create a new LogFileCtx for "fast" output style.
* \param conf The configuration node for this output.
* \return A LogFileCtx pointer on success, NULL on failure.
*/
static OutputInitResult JsonMetadataLogInitCtxSub(ConfNode *conf, OutputCtx *parent_ctx)
{
OutputInitResult result = { NULL, false };
OutputJsonCtx *ajt = parent_ctx->data;
MetadataJsonOutputCtx *json_output_ctx = NULL;
OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
if (unlikely(output_ctx == NULL))
return result;
json_output_ctx = SCMalloc(sizeof(MetadataJsonOutputCtx));
if (unlikely(json_output_ctx == NULL)) {
goto error;
}
memset(json_output_ctx, 0, sizeof(MetadataJsonOutputCtx));
json_output_ctx->file_ctx = ajt->file_ctx;
json_output_ctx->cfg = ajt->cfg;
/* override config setting as this logger is about metadata */
json_output_ctx->cfg.include_metadata = true;
output_ctx->data = json_output_ctx;
output_ctx->DeInit = JsonMetadataLogDeInitCtxSub;
result.ctx = output_ctx;
result.ok = true;
return result;
error:
if (json_output_ctx != NULL) {
SCFree(json_output_ctx);
}
if (output_ctx != NULL) {
SCFree(output_ctx);
}
return result;
}
void JsonMetadataLogRegister (void) void JsonMetadataLogRegister (void)
{ {
OutputRegisterPacketSubModule(LOGGER_JSON_METADATA, "eve-log", MODULE_NAME, OutputRegisterPacketSubModule(LOGGER_JSON_METADATA, "eve-log", MODULE_NAME, "eve-log.metadata",
"eve-log.metadata", JsonMetadataLogInitCtxSub, JsonMetadataLogger, OutputJsonLogInitSub, JsonMetadataLogger, JsonMetadataLogCondition, JsonLogThreadInit,
JsonMetadataLogCondition, JsonMetadataLogThreadInit, JsonLogThreadDeinit, NULL);
JsonMetadataLogThreadDeinit, NULL);
/* Kept for compatibility. */ /* Kept for compatibility. */
OutputRegisterPacketSubModule(LOGGER_JSON_METADATA, "eve-log", MODULE_NAME, OutputRegisterPacketSubModule(LOGGER_JSON_METADATA, "eve-log", MODULE_NAME, "eve-log.vars",
"eve-log.vars", JsonMetadataLogInitCtxSub, JsonMetadataLogger, OutputJsonLogInitSub, JsonMetadataLogger, JsonMetadataLogCondition, JsonLogThreadInit,
JsonMetadataLogCondition, JsonMetadataLogThreadInit, JsonLogThreadDeinit, NULL);
JsonMetadataLogThreadDeinit, NULL);
} }

12
src/output-json-mqtt.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2020 Open Information Security Foundation /* Copyright (C) 2020-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -50,8 +50,8 @@
#define MQTT_DEFAULTS (MQTT_LOG_PASSWORDS) #define MQTT_DEFAULTS (MQTT_LOG_PASSWORDS)
typedef struct LogMQTTFileCtx_ { typedef struct LogMQTTFileCtx_ {
LogFileCtx *file_ctx;
uint32_t flags; uint32_t flags;
OutputJsonCtx *eve_ctx;
} LogMQTTFileCtx; } LogMQTTFileCtx;
typedef struct LogMQTTLogThread_ { typedef struct LogMQTTLogThread_ {
@ -86,7 +86,7 @@ static int JsonMQTTLogger(ThreadVars *tv, void *thread_data,
dir = LOG_DIR_FLOW_TOSERVER; dir = LOG_DIR_FLOW_TOSERVER;
} }
JsonBuilder *js = CreateEveHeader(p, dir, "mqtt", NULL); JsonBuilder *js = CreateEveHeader(p, dir, "mqtt", NULL, thread->mqttlog_ctx->eve_ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
@ -95,7 +95,7 @@ static int JsonMQTTLogger(ThreadVars *tv, void *thread_data,
goto error; goto error;
MemBufferReset(thread->buffer); MemBufferReset(thread->buffer);
OutputJsonBuilderBuffer(js, thread->file_ctx, &thread->buffer); OutputJsonBuilderBuffer(js, thread->mqttlog_ctx->eve_ctx->file_ctx, &thread->buffer);
jb_free(js); jb_free(js);
return TM_ECODE_OK; return TM_ECODE_OK;
@ -136,7 +136,7 @@ static OutputInitResult OutputMQTTLogInitSub(ConfNode *conf,
if (unlikely(mqttlog_ctx == NULL)) { if (unlikely(mqttlog_ctx == NULL)) {
return result; return result;
} }
mqttlog_ctx->file_ctx = ajt->file_ctx; mqttlog_ctx->eve_ctx = ajt;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) { if (unlikely(output_ctx == NULL)) {
@ -175,7 +175,7 @@ static TmEcode JsonMQTTLogThreadInit(ThreadVars *t, const void *initdata, void *
} }
thread->mqttlog_ctx = ((OutputCtx *)initdata)->data; thread->mqttlog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->mqttlog_ctx->file_ctx, t->id); thread->file_ctx = LogFileEnsureExists(thread->mqttlog_ctx->eve_ctx->file_ctx, t->id);
*data = (void *)thread; *data = (void *)thread;

5
src/output-json-nfs.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2015-2020 Open Information Security Foundation /* Copyright (C) 2015-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -81,11 +81,10 @@ static int JsonNFSLogger(ThreadVars *tv, void *thread_data,
if (rs_nfs_tx_logging_is_filtered(state, nfstx)) if (rs_nfs_tx_logging_is_filtered(state, nfstx))
return TM_ECODE_OK; return TM_ECODE_OK;
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "nfs", NULL); JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "nfs", NULL, thread->ctx);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
EveAddCommonOptions(&thread->ctx->cfg, p, f, jb);
jb_open_object(jb, "rpc"); jb_open_object(jb, "rpc");
rs_rpc_log_json_response(tx, jb); rs_rpc_log_json_response(tx, jb);

113
src/output-json-rdp.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2019-2020 Open Information Security Foundation /* Copyright (C) 2019-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -43,28 +43,15 @@
#include "output-json-rdp.h" #include "output-json-rdp.h"
#include "rust.h" #include "rust.h"
typedef struct LogRdpFileCtx_ {
LogFileCtx *file_ctx;
uint32_t flags;
OutputJsonCommonSettings cfg;
} LogRdpFileCtx;
typedef struct LogRdpLogThread_ {
LogRdpFileCtx *rdplog_ctx;
LogFileCtx *file_ctx;
MemBuffer *buffer;
} LogRdpLogThread;
static int JsonRdpLogger(ThreadVars *tv, void *thread_data, static int JsonRdpLogger(ThreadVars *tv, void *thread_data,
const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
{ {
LogRdpLogThread *thread = thread_data; OutputJsonThreadCtx *thread = thread_data;
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "rdp", NULL); JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "rdp", NULL, thread->ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
EveAddCommonOptions(&thread->rdplog_ctx->cfg, p, f, js);
if (!rs_rdp_to_json(tx, js)) { if (!rs_rdp_to_json(tx, js)) {
jb_free(js); jb_free(js);
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
@ -76,105 +63,19 @@ static int JsonRdpLogger(ThreadVars *tv, void *thread_data,
return TM_ECODE_OK; return TM_ECODE_OK;
} }
static void OutputRdpLogDeInitCtxSub(OutputCtx *output_ctx)
{
LogRdpFileCtx *rdplog_ctx = (LogRdpFileCtx *)output_ctx->data;
SCFree(rdplog_ctx);
SCFree(output_ctx);
}
static OutputInitResult OutputRdpLogInitSub(ConfNode *conf, static OutputInitResult OutputRdpLogInitSub(ConfNode *conf,
OutputCtx *parent_ctx) OutputCtx *parent_ctx)
{ {
OutputInitResult result = { NULL, false };
OutputJsonCtx *ajt = parent_ctx->data;
LogRdpFileCtx *rdplog_ctx = SCCalloc(1, sizeof(*rdplog_ctx));
if (unlikely(rdplog_ctx == NULL)) {
return result;
}
rdplog_ctx->file_ctx = ajt->file_ctx;
rdplog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) {
SCFree(rdplog_ctx);
return result;
}
output_ctx->data = rdplog_ctx;
output_ctx->DeInit = OutputRdpLogDeInitCtxSub;
AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_RDP); AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_RDP);
return OutputJsonLogInitSub(conf, parent_ctx);
SCLogDebug("rdp log sub-module initialized.");
result.ctx = output_ctx;
result.ok = true;
return result;
}
static TmEcode JsonRdpLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
if (initdata == NULL) {
SCLogDebug("Error getting context for EveLogRdp. \"initdata\" is NULL.");
return TM_ECODE_FAILED;
}
LogRdpLogThread *thread = SCCalloc(1, sizeof(*thread));
if (unlikely(thread == NULL)) {
return TM_ECODE_FAILED;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->rdplog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->rdplog_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
goto error_exit;
}
*data = (void *)thread;
return TM_ECODE_OK;
error_exit:
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
static TmEcode JsonRdpLogThreadDeinit(ThreadVars *t, void *data)
{
LogRdpLogThread *thread = (LogRdpLogThread *)data;
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_OK;
} }
void JsonRdpLogRegister(void) void JsonRdpLogRegister(void)
{ {
/* Register as an eve sub-module. */ /* Register as an eve sub-module. */
OutputRegisterTxSubModule( OutputRegisterTxSubModule(LOGGER_JSON_RDP, "eve-log", "JsonRdpLog", "eve-log.rdp",
LOGGER_JSON_RDP, OutputRdpLogInitSub, ALPROTO_RDP, JsonRdpLogger, JsonLogThreadInit, JsonLogThreadDeinit,
"eve-log", NULL);
"JsonRdpLog",
"eve-log.rdp",
OutputRdpLogInitSub,
ALPROTO_RDP,
JsonRdpLogger,
JsonRdpLogThreadInit,
JsonRdpLogThreadDeinit,
NULL
);
SCLogDebug("rdp json logger registered."); SCLogDebug("rdp json logger registered.");
} }

100
src/output-json-rfb.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2020 Open Information Security Foundation /* Copyright (C) 2020-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -46,17 +46,6 @@
#include "rust-bindings.h" #include "rust-bindings.h"
typedef struct LogRFBFileCtx_ {
LogFileCtx *file_ctx;
uint32_t flags;
} LogRFBFileCtx;
typedef struct LogRFBLogThread_ {
LogRFBFileCtx *rfblog_ctx;
LogFileCtx *file_ctx;
MemBuffer *buffer;
} LogRFBLogThread;
bool JsonRFBAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js) bool JsonRFBAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
{ {
RFBState *state = FlowGetAppState(f); RFBState *state = FlowGetAppState(f);
@ -73,9 +62,9 @@ bool JsonRFBAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
static int JsonRFBLogger(ThreadVars *tv, void *thread_data, static int JsonRFBLogger(ThreadVars *tv, void *thread_data,
const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
{ {
LogRFBLogThread *thread = thread_data; OutputJsonThreadCtx *thread = thread_data;
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "rfb", NULL); JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "rfb", NULL, thread->ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
@ -95,92 +84,17 @@ error:
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
static void OutputRFBLogDeInitCtxSub(OutputCtx *output_ctx)
{
LogRFBFileCtx *rfblog_ctx = (LogRFBFileCtx *)output_ctx->data;
SCFree(rfblog_ctx);
SCFree(output_ctx);
}
static OutputInitResult OutputRFBLogInitSub(ConfNode *conf, static OutputInitResult OutputRFBLogInitSub(ConfNode *conf,
OutputCtx *parent_ctx) OutputCtx *parent_ctx)
{ {
OutputInitResult result = { NULL, false };
OutputJsonCtx *ajt = parent_ctx->data;
LogRFBFileCtx *rfblog_ctx = SCCalloc(1, sizeof(*rfblog_ctx));
if (unlikely(rfblog_ctx == NULL)) {
return result;
}
rfblog_ctx->file_ctx = ajt->file_ctx;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) {
SCFree(rfblog_ctx);
return result;
}
output_ctx->data = rfblog_ctx;
output_ctx->DeInit = OutputRFBLogDeInitCtxSub;
AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_RFB); AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_RFB);
return OutputJsonLogInitSub(conf, parent_ctx);
result.ctx = output_ctx;
result.ok = true;
return result;
}
static TmEcode JsonRFBLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
if (initdata == NULL) {
SCLogDebug("Error getting context for EveLogRFB. \"initdata\" is NULL.");
return TM_ECODE_FAILED;
}
LogRFBLogThread *thread = SCCalloc(1, sizeof(*thread));
if (unlikely(thread == NULL)) {
return TM_ECODE_FAILED;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->rfblog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->rfblog_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
goto error_exit;
}
*data = (void *)thread;
return TM_ECODE_OK;
error_exit:
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
static TmEcode JsonRFBLogThreadDeinit(ThreadVars *t, void *data)
{
LogRFBLogThread *thread = (LogRFBLogThread *)data;
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_OK;
} }
void JsonRFBLogRegister(void) void JsonRFBLogRegister(void)
{ {
/* Register as an eve sub-module. */ /* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_RFB, "eve-log", OutputRegisterTxSubModule(LOGGER_JSON_RFB, "eve-log", "JsonRFBLog", "eve-log.rfb",
"JsonRFBLog", "eve-log.rfb", OutputRFBLogInitSub, ALPROTO_RFB, JsonRFBLogger, JsonLogThreadInit, JsonLogThreadDeinit,
OutputRFBLogInitSub, ALPROTO_RFB, JsonRFBLogger, NULL);
JsonRFBLogThreadInit, JsonRFBLogThreadDeinit, NULL);
} }

107
src/output-json-sip.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2018-2020 Open Information Security Foundation /* Copyright (C) 2018-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -49,17 +49,6 @@
#include "rust.h" #include "rust.h"
typedef struct LogSIPFileCtx_ {
LogFileCtx *file_ctx;
OutputJsonCommonSettings cfg;
} LogSIPFileCtx;
typedef struct LogSIPLogThread_ {
LogFileCtx *file_ctx;
LogSIPFileCtx *siplog_ctx;
MemBuffer *buffer;
} LogSIPLogThread;
void JsonSIPAddMetadata(JsonBuilder *js, const Flow *f, uint64_t tx_id) void JsonSIPAddMetadata(JsonBuilder *js, const Flow *f, uint64_t tx_id)
{ {
SIPState *state = FlowGetAppState(f); SIPState *state = FlowGetAppState(f);
@ -75,13 +64,12 @@ static int JsonSIPLogger(ThreadVars *tv, void *thread_data,
const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
{ {
SIPTransaction *siptx = tx; SIPTransaction *siptx = tx;
LogSIPLogThread *thread = thread_data; OutputJsonThreadCtx *thread = thread_data;
JsonBuilder *js = CreateEveHeader((Packet *)p, LOG_DIR_PACKET, "sip", NULL); JsonBuilder *js = CreateEveHeader((Packet *)p, LOG_DIR_PACKET, "sip", NULL, thread->ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
EveAddCommonOptions(&thread->siplog_ctx->cfg, p, f, js);
if (!rs_sip_log_json(siptx, js)) { if (!rs_sip_log_json(siptx, js)) {
goto error; goto error;
@ -98,100 +86,19 @@ error:
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
static void OutputSIPLogDeInitCtxSub(OutputCtx *output_ctx)
{
LogSIPFileCtx *siplog_ctx = (LogSIPFileCtx *)output_ctx->data;
SCFree(siplog_ctx);
SCFree(output_ctx);
}
static OutputInitResult OutputSIPLogInitSub(ConfNode *conf, static OutputInitResult OutputSIPLogInitSub(ConfNode *conf,
OutputCtx *parent_ctx) OutputCtx *parent_ctx)
{ {
OutputInitResult result = { NULL, false };
OutputJsonCtx *ajt = parent_ctx->data;
LogSIPFileCtx *siplog_ctx = SCCalloc(1, sizeof(*siplog_ctx));
if (unlikely(siplog_ctx == NULL)) {
return result;
}
siplog_ctx->file_ctx = ajt->file_ctx;
siplog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) {
SCFree(siplog_ctx);
return result;
}
output_ctx->data = siplog_ctx;
output_ctx->DeInit = OutputSIPLogDeInitCtxSub;
SCLogDebug("SIP log sub-module initialized.");
AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_SIP); AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_SIP);
return OutputJsonLogInitSub(conf, parent_ctx);
result.ctx = output_ctx;
result.ok = true;
return result;
}
#define OUTPUT_BUFFER_SIZE 65535
static TmEcode JsonSIPLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
LogSIPLogThread *thread = SCCalloc(1, sizeof(*thread));
if (unlikely(thread == NULL)) {
return TM_ECODE_FAILED;
}
if (initdata == NULL) {
SCLogDebug("Error getting context for EveLogSIP. \"initdata\" is NULL.");
goto error_exit;
}
thread->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->siplog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->siplog_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
goto error_exit;
}
*data = (void *)thread;
return TM_ECODE_OK;
error_exit:
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
static TmEcode JsonSIPLogThreadDeinit(ThreadVars *t, void *data)
{
LogSIPLogThread *thread = (LogSIPLogThread *)data;
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_OK;
} }
void JsonSIPLogRegister(void) void JsonSIPLogRegister(void)
{ {
/* Register as an eve sub-module. */ /* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_SIP, "eve-log", "JsonSIPLog", OutputRegisterTxSubModule(LOGGER_JSON_SIP, "eve-log", "JsonSIPLog", "eve-log.sip",
"eve-log.sip", OutputSIPLogInitSub, ALPROTO_SIP, OutputSIPLogInitSub, ALPROTO_SIP, JsonSIPLogger, JsonLogThreadInit, JsonLogThreadDeinit,
JsonSIPLogger, JsonSIPLogThreadInit, NULL);
JsonSIPLogThreadDeinit, NULL);
SCLogDebug("SIP JSON logger registered."); SCLogDebug("SIP JSON logger registered.");
} }

4
src/output-json-smb.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2017-2020 Open Information Security Foundation /* Copyright (C) 2017-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -64,7 +64,7 @@ static int JsonSMBLogger(ThreadVars *tv, void *thread_data,
{ {
OutputJsonThreadCtx *thread = thread_data; OutputJsonThreadCtx *thread = thread_data;
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "smb", NULL); JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "smb", NULL, thread->ctx);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }

106
src/output-json-snmp.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2018-2020 Open Information Security Foundation /* Copyright (C) 2018-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -49,30 +49,17 @@
#include "rust.h" #include "rust.h"
typedef struct LogSNMPFileCtx_ {
LogFileCtx *file_ctx;
OutputJsonCommonSettings cfg;
} LogSNMPFileCtx;
typedef struct LogSNMPLogThread_ {
LogFileCtx *file_ctx;
LogSNMPFileCtx *snmplog_ctx;
MemBuffer *buffer;
} LogSNMPLogThread;
static int JsonSNMPLogger(ThreadVars *tv, void *thread_data, static int JsonSNMPLogger(ThreadVars *tv, void *thread_data,
const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
{ {
SNMPTransaction *snmptx = tx; SNMPTransaction *snmptx = tx;
LogSNMPLogThread *thread = thread_data; OutputJsonThreadCtx *thread = thread_data;
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "snmp", NULL); JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "snmp", NULL, thread->ctx);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
EveAddCommonOptions(&thread->snmplog_ctx->cfg, p, f, jb);
jb_open_object(jb, "snmp"); jb_open_object(jb, "snmp");
if (!rs_snmp_log_json_response(jb, state, snmptx)) { if (!rs_snmp_log_json_response(jb, state, snmptx)) {
goto error; goto error;
@ -90,98 +77,19 @@ error:
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
static void OutputSNMPLogDeInitCtxSub(OutputCtx *output_ctx)
{
LogSNMPFileCtx *snmplog_ctx = (LogSNMPFileCtx *)output_ctx->data;
SCFree(snmplog_ctx);
SCFree(output_ctx);
}
static OutputInitResult OutputSNMPLogInitSub(ConfNode *conf, static OutputInitResult OutputSNMPLogInitSub(ConfNode *conf,
OutputCtx *parent_ctx) OutputCtx *parent_ctx)
{ {
OutputInitResult result = { NULL, false };
OutputJsonCtx *ajt = parent_ctx->data;
LogSNMPFileCtx *snmplog_ctx = SCCalloc(1, sizeof(*snmplog_ctx));
if (unlikely(snmplog_ctx == NULL)) {
return result;
}
snmplog_ctx->file_ctx = ajt->file_ctx;
snmplog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) {
SCFree(snmplog_ctx);
return result;
}
output_ctx->data = snmplog_ctx;
output_ctx->DeInit = OutputSNMPLogDeInitCtxSub;
SCLogDebug("SNMP log sub-module initialized.");
AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_SNMP); AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_SNMP);
return OutputJsonLogInitSub(conf, parent_ctx);
result.ctx = output_ctx;
result.ok = true;
return result;
}
static TmEcode JsonSNMPLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
LogSNMPLogThread *thread = SCCalloc(1, sizeof(*thread));
if (unlikely(thread == NULL)) {
return TM_ECODE_FAILED;
}
if (initdata == NULL) {
SCLogDebug("Error getting context for EveLogSNMP. \"initdata\" is NULL.");
goto error_exit;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->snmplog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->snmplog_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
goto error_exit;
}
*data = (void *)thread;
return TM_ECODE_OK;
error_exit:
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
static TmEcode JsonSNMPLogThreadDeinit(ThreadVars *t, void *data)
{
LogSNMPLogThread *thread = (LogSNMPLogThread *)data;
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_OK;
} }
void JsonSNMPLogRegister(void) void JsonSNMPLogRegister(void)
{ {
/* Register as an eve sub-module. */ /* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_SNMP, "eve-log", "JsonSNMPLog", OutputRegisterTxSubModule(LOGGER_JSON_SNMP, "eve-log", "JsonSNMPLog", "eve-log.snmp",
"eve-log.snmp", OutputSNMPLogInitSub, ALPROTO_SNMP, OutputSNMPLogInitSub, ALPROTO_SNMP, JsonSNMPLogger, JsonLogThreadInit,
JsonSNMPLogger, JsonSNMPLogThreadInit, JsonLogThreadDeinit, NULL);
JsonSNMPLogThreadDeinit, NULL);
SCLogDebug("SNMP JSON logger registered."); SCLogDebug("SNMP JSON logger registered.");
} }

112
src/output-json-ssh.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2014-2020 Open Information Security Foundation /* Copyright (C) 2014-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -53,24 +53,10 @@
#define MODULE_NAME "LogSshLog" #define MODULE_NAME "LogSshLog"
typedef struct OutputSshCtx_ {
LogFileCtx *file_ctx;
OutputJsonCommonSettings cfg;
} OutputSshCtx;
typedef struct JsonSshLogThread_ {
OutputSshCtx *sshlog_ctx;
LogFileCtx *file_ctx;
MemBuffer *buffer;
} JsonSshLogThread;
static int JsonSshLogger(ThreadVars *tv, void *thread_data, const Packet *p, static int JsonSshLogger(ThreadVars *tv, void *thread_data, const Packet *p,
Flow *f, void *state, void *txptr, uint64_t tx_id) Flow *f, void *state, void *txptr, uint64_t tx_id)
{ {
JsonSshLogThread *aft = (JsonSshLogThread *)thread_data; OutputJsonThreadCtx *thread = thread_data;
OutputSshCtx *ssh_ctx = aft->sshlog_ctx;
if (unlikely(state == NULL)) { if (unlikely(state == NULL)) {
return 0; return 0;
@ -80,113 +66,33 @@ static int JsonSshLogger(ThreadVars *tv, void *thread_data, const Packet *p,
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return 0; return 0;
EveAddCommonOptions(&ssh_ctx->cfg, p, f, js); EveAddCommonOptions(&thread->ctx->cfg, p, f, js);
/* reset */ /* reset */
MemBufferReset(aft->buffer); MemBufferReset(thread->buffer);
jb_open_object(js, "ssh"); jb_open_object(js, "ssh");
if (!rs_ssh_log_json(txptr, js)) { if (!rs_ssh_log_json(txptr, js)) {
goto end; goto end;
} }
jb_close(js); jb_close(js);
OutputJsonBuilderBuffer(js, aft->file_ctx, &aft->buffer); OutputJsonBuilderBuffer(js, thread->file_ctx, &thread->buffer);
end: end:
jb_free(js); jb_free(js);
return 0; return 0;
} }
static TmEcode JsonSshLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
if (initdata == NULL) {
SCLogDebug("Error getting context for EveLogSSH. \"initdata\" argument NULL");
return TM_ECODE_FAILED;
}
JsonSshLogThread *aft = SCCalloc(1, sizeof(JsonSshLogThread));
if (unlikely(aft == NULL))
return TM_ECODE_FAILED;
/* Use the Output Context (file pointer and mutex) */
aft->sshlog_ctx = ((OutputCtx *)initdata)->data;
aft->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (aft->buffer == NULL) {
goto error_exit;
}
aft->file_ctx = LogFileEnsureExists(aft->sshlog_ctx->file_ctx, t->id);
if (!aft->file_ctx) {
goto error_exit;
}
*data = (void *)aft;
return TM_ECODE_OK;
error_exit:
if (aft->buffer != NULL) {
MemBufferFree(aft->buffer);
}
SCFree(aft);
return TM_ECODE_FAILED;
}
static TmEcode JsonSshLogThreadDeinit(ThreadVars *t, void *data)
{
JsonSshLogThread *aft = (JsonSshLogThread *)data;
if (aft == NULL) {
return TM_ECODE_OK;
}
MemBufferFree(aft->buffer);
/* clear memory */
memset(aft, 0, sizeof(JsonSshLogThread));
SCFree(aft);
return TM_ECODE_OK;
}
static void OutputSshLogDeinitSub(OutputCtx *output_ctx)
{
OutputSshCtx *ssh_ctx = output_ctx->data;
SCFree(ssh_ctx);
SCFree(output_ctx);
}
static OutputInitResult OutputSshLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) static OutputInitResult OutputSshLogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
{ {
OutputInitResult result = { NULL, false };
OutputJsonCtx *ojc = parent_ctx->data;
OutputSshCtx *ssh_ctx = SCMalloc(sizeof(OutputSshCtx));
if (unlikely(ssh_ctx == NULL))
return result;
OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
if (unlikely(output_ctx == NULL)) {
SCFree(ssh_ctx);
return result;
}
ssh_ctx->file_ctx = ojc->file_ctx;
ssh_ctx->cfg = ojc->cfg;
output_ctx->data = ssh_ctx;
output_ctx->DeInit = OutputSshLogDeinitSub;
AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_SSH); AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_SSH);
return OutputJsonLogInitSub(conf, parent_ctx);
result.ctx = output_ctx;
result.ok = true;
return result;
} }
void JsonSshLogRegister (void) void JsonSshLogRegister (void)
{ {
/* register as child of eve-log */ /* register as child of eve-log */
OutputRegisterTxSubModuleWithCondition(LOGGER_JSON_SSH, OutputRegisterTxSubModuleWithCondition(LOGGER_JSON_SSH, "eve-log", "JsonSshLog", "eve-log.ssh",
"eve-log", "JsonSshLog", "eve-log.ssh", OutputSshLogInitSub, ALPROTO_SSH, JsonSshLogger, SSHTxLogCondition, JsonLogThreadInit,
OutputSshLogInitSub, ALPROTO_SSH, JsonSshLogger, JsonLogThreadDeinit, NULL);
SSHTxLogCondition, JsonSshLogThreadInit, JsonSshLogThreadDeinit, NULL);
} }

11
src/output-json-template-rust.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2018-2020 Open Information Security Foundation /* Copyright (C) 2018-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -55,8 +55,8 @@
#include "rust.h" #include "rust.h"
typedef struct LogTemplateFileCtx_ { typedef struct LogTemplateFileCtx_ {
LogFileCtx *file_ctx;
uint32_t flags; uint32_t flags;
OutputJsonCtx *eve_ctx;
} LogTemplateFileCtx; } LogTemplateFileCtx;
typedef struct LogTemplateLogThread_ { typedef struct LogTemplateLogThread_ {
@ -71,7 +71,8 @@ static int JsonTemplateLogger(ThreadVars *tv, void *thread_data,
SCLogNotice("JsonTemplateLogger"); SCLogNotice("JsonTemplateLogger");
LogTemplateLogThread *thread = thread_data; LogTemplateLogThread *thread = thread_data;
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "template-rust", NULL); JsonBuilder *js = CreateEveHeader(
p, LOG_DIR_PACKET, "template-rust", NULL, thread->templatelog_ctx->eve_ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
@ -110,7 +111,7 @@ static OutputInitResult OutputTemplateLogInitSub(ConfNode *conf,
if (unlikely(templatelog_ctx == NULL)) { if (unlikely(templatelog_ctx == NULL)) {
return result; return result;
} }
templatelog_ctx->file_ctx = ajt->file_ctx; templatelog_ctx->eve_ctx = ajt;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) { if (unlikely(output_ctx == NULL)) {
@ -147,7 +148,7 @@ static TmEcode JsonTemplateLogThreadInit(ThreadVars *t, const void *initdata, vo
} }
thread->templatelog_ctx = ((OutputCtx *)initdata)->data; thread->templatelog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->templatelog_ctx->file_ctx, t->id); thread->file_ctx = LogFileEnsureExists(thread->templatelog_ctx->eve_ctx->file_ctx, t->id);
if (!thread->file_ctx) { if (!thread->file_ctx) {
goto error_exit; goto error_exit;
} }

11
src/output-json-template.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2015-2020 Open Information Security Foundation /* Copyright (C) 2015-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -54,8 +54,8 @@
#include "output-json-template.h" #include "output-json-template.h"
typedef struct LogTemplateFileCtx_ { typedef struct LogTemplateFileCtx_ {
LogFileCtx *file_ctx;
uint32_t flags; uint32_t flags;
OutputJsonCtx *eve_ctx;
} LogTemplateFileCtx; } LogTemplateFileCtx;
typedef struct LogTemplateLogThread_ { typedef struct LogTemplateLogThread_ {
@ -72,7 +72,8 @@ static int JsonTemplateLogger(ThreadVars *tv, void *thread_data,
SCLogNotice("Logging template transaction %"PRIu64".", templatetx->tx_id); SCLogNotice("Logging template transaction %"PRIu64".", templatetx->tx_id);
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "template", NULL); JsonBuilder *js =
CreateEveHeader(p, LOG_DIR_PACKET, "template", NULL, thread->templatelog_ctx->eve_ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
@ -118,7 +119,7 @@ static OutputInitResult OutputTemplateLogInitSub(ConfNode *conf,
if (unlikely(templatelog_ctx == NULL)) { if (unlikely(templatelog_ctx == NULL)) {
return result; return result;
} }
templatelog_ctx->file_ctx = ajt->file_ctx; templatelog_ctx->eve_ctx = ajt;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) { if (unlikely(output_ctx == NULL)) {
@ -155,7 +156,7 @@ static TmEcode JsonTemplateLogThreadInit(ThreadVars *t, const void *initdata, vo
} }
thread->templatelog_ctx = ((OutputCtx *)initdata)->data; thread->templatelog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->templatelog_ctx->file_ctx, t->id); thread->file_ctx = LogFileEnsureExists(thread->templatelog_ctx->eve_ctx->file_ctx, t->id);
if (!thread->file_ctx) { if (!thread->file_ctx) {
goto error_exit; goto error_exit;
} }

106
src/output-json-tftp.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2020 Open Information Security Foundation /* Copyright (C) 2020-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -50,24 +50,12 @@
#include "rust.h" #include "rust.h"
typedef struct LogTFTPFileCtx_ {
LogFileCtx *file_ctx;
uint32_t flags;
OutputJsonCommonSettings cfg;
} LogTFTPFileCtx;
typedef struct LogTFTPLogThread_ {
LogFileCtx *file_ctx;
LogTFTPFileCtx *tftplog_ctx;
MemBuffer *buffer;
} LogTFTPLogThread;
static int JsonTFTPLogger(ThreadVars *tv, void *thread_data, static int JsonTFTPLogger(ThreadVars *tv, void *thread_data,
const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
{ {
LogTFTPLogThread *thread = thread_data; OutputJsonThreadCtx *thread = thread_data;
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "tftp", NULL); JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "tftp", NULL, thread->ctx);
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
@ -78,7 +66,6 @@ static int JsonTFTPLogger(ThreadVars *tv, void *thread_data,
} }
jb_close(jb); jb_close(jb);
EveAddCommonOptions(&thread->tftplog_ctx->cfg, p, f, jb);
MemBufferReset(thread->buffer); MemBufferReset(thread->buffer);
OutputJsonBuilderBuffer(jb, thread->file_ctx, &thread->buffer); OutputJsonBuilderBuffer(jb, thread->file_ctx, &thread->buffer);
@ -90,98 +77,19 @@ error:
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
static void OutputTFTPLogDeInitCtxSub(OutputCtx *output_ctx)
{
LogTFTPFileCtx *tftplog_ctx = (LogTFTPFileCtx *)output_ctx->data;
SCFree(tftplog_ctx);
SCFree(output_ctx);
}
static OutputInitResult OutputTFTPLogInitSub(ConfNode *conf, static OutputInitResult OutputTFTPLogInitSub(ConfNode *conf,
OutputCtx *parent_ctx) OutputCtx *parent_ctx)
{ {
OutputInitResult result = { NULL, false };
OutputJsonCtx *ajt = parent_ctx->data;
LogTFTPFileCtx *tftplog_ctx = SCCalloc(1, sizeof(*tftplog_ctx));
if (unlikely(tftplog_ctx == NULL)) {
return result;
}
tftplog_ctx->file_ctx = ajt->file_ctx;
tftplog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) {
SCFree(tftplog_ctx);
return result;
}
output_ctx->data = tftplog_ctx;
output_ctx->DeInit = OutputTFTPLogDeInitCtxSub;
SCLogDebug("TFTP log sub-module initialized.");
AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_TFTP); AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_TFTP);
return OutputJsonLogInitSub(conf, parent_ctx);
result.ctx = output_ctx;
result.ok = true;
return result;
}
static TmEcode JsonTFTPLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
LogTFTPLogThread *thread = SCCalloc(1, sizeof(*thread));
if (unlikely(thread == NULL)) {
return TM_ECODE_FAILED;
}
if (initdata == NULL) {
SCLogDebug("Error getting context for EveLogTFTP. \"initdata\" is NULL.");
goto error_exit;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->tftplog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->tftplog_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
goto error_exit;
}
*data = (void *)thread;
return TM_ECODE_OK;
error_exit:
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
static TmEcode JsonTFTPLogThreadDeinit(ThreadVars *t, void *data)
{
LogTFTPLogThread *thread = (LogTFTPLogThread *)data;
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_OK;
} }
void JsonTFTPLogRegister(void) void JsonTFTPLogRegister(void)
{ {
/* Register as an eve sub-module. */ /* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_TFTP, "eve-log", "JsonTFTPLog", OutputRegisterTxSubModule(LOGGER_JSON_TFTP, "eve-log", "JsonTFTPLog", "eve-log.tftp",
"eve-log.tftp", OutputTFTPLogInitSub, OutputTFTPLogInitSub, ALPROTO_TFTP, JsonTFTPLogger, JsonLogThreadInit,
ALPROTO_TFTP, JsonTFTPLogger, JsonLogThreadDeinit, NULL);
JsonTFTPLogThreadInit, JsonTFTPLogThreadDeinit,
NULL);
SCLogDebug("TFTP JSON logger registered."); SCLogDebug("TFTP JSON logger registered.");
} }

14
src/output-json-tls.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2007-2020 Open Information Security Foundation /* Copyright (C) 2007-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -98,10 +98,9 @@ TlsFields tls_fields[] = {
}; };
typedef struct OutputTlsCtx_ { typedef struct OutputTlsCtx_ {
LogFileCtx *file_ctx;
uint32_t flags; /** Store mode */ uint32_t flags; /** Store mode */
uint64_t fields; /** Store fields */ uint64_t fields; /** Store fields */
OutputJsonCommonSettings cfg; OutputJsonCtx *eve_ctx;
} OutputTlsCtx; } OutputTlsCtx;
@ -414,13 +413,11 @@ static int JsonTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p,
return 0; return 0;
} }
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "tls", NULL); JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "tls", NULL, aft->tlslog_ctx->eve_ctx);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return 0; return 0;
} }
EveAddCommonOptions(&tls_ctx->cfg, p, f, js);
jb_open_object(js, "tls"); jb_open_object(js, "tls");
/* reset */ /* reset */
@ -475,7 +472,7 @@ static TmEcode JsonTlsLogThreadInit(ThreadVars *t, const void *initdata, void **
/* use the Output Context (file pointer and mutex) */ /* use the Output Context (file pointer and mutex) */
aft->tlslog_ctx = ((OutputCtx *)initdata)->data; aft->tlslog_ctx = ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(aft->tlslog_ctx->file_ctx, t->id); aft->file_ctx = LogFileEnsureExists(aft->tlslog_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) { if (!aft->file_ctx) {
goto error_exit; goto error_exit;
} }
@ -586,8 +583,7 @@ static OutputInitResult OutputTlsLogInitSub(ConfNode *conf, OutputCtx *parent_ct
return result; return result;
} }
tls_ctx->file_ctx = ojc->file_ctx; tls_ctx->eve_ctx = ojc;
tls_ctx->cfg = ojc->cfg;
if ((tls_ctx->fields & LOG_TLS_FIELD_CERTIFICATE) && if ((tls_ctx->fields & LOG_TLS_FIELD_CERTIFICATE) &&
(tls_ctx->fields & LOG_TLS_FIELD_CHAIN)) { (tls_ctx->fields & LOG_TLS_FIELD_CHAIN)) {

12
src/output-json.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2007-2020 Open Information Security Foundation /* Copyright (C) 2007-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -398,7 +398,7 @@ static void EveAddFlowVars(const Flow *f, JsonBuilder *js_root, JsonBuilder **js
} }
} }
static void EveAddMetadata(const Packet *p, const Flow *f, JsonBuilder *js) void EveAddMetadata(const Packet *p, const Flow *f, JsonBuilder *js)
{ {
if ((p && p->pktvar) || (f && f->flowvar)) { if ((p && p->pktvar) || (f && f->flowvar)) {
JsonBuilder *js_vars = jb_new_object(); JsonBuilder *js_vars = jb_new_object();
@ -836,7 +836,7 @@ int CreateJSONEther(JsonBuilder *js, const Packet *p, const Flow *f)
} }
JsonBuilder *CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, JsonBuilder *CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir,
const char *event_type, JsonAddrInfo *addr) const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
{ {
char timebuf[64]; char timebuf[64];
const Flow *f = (const Flow *)p->flow; const Flow *f = (const Flow *)p->flow;
@ -909,13 +909,17 @@ JsonBuilder *CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir,
break; break;
} }
if (eve_ctx != NULL) {
EveAddCommonOptions(&eve_ctx->cfg, p, f, js);
}
return js; return js;
} }
JsonBuilder *CreateEveHeaderWithTxId(const Packet *p, enum OutputJsonLogDirection dir, JsonBuilder *CreateEveHeaderWithTxId(const Packet *p, enum OutputJsonLogDirection dir,
const char *event_type, JsonAddrInfo *addr, uint64_t tx_id) const char *event_type, JsonAddrInfo *addr, uint64_t tx_id)
{ {
JsonBuilder *js = CreateEveHeader(p, dir, event_type, addr); JsonBuilder *js = CreateEveHeader(p, dir, event_type, addr, NULL);
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return NULL; return NULL;

41
src/output-json.h
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2007-2020 Open Information Security Foundation /* Copyright (C) 2007-2021 Open Information Security Foundation
* *
* You can copy, redistribute or modify this Program under the terms of * You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free * the GNU General Public License version 2 as published by the Free
@ -68,26 +68,6 @@ typedef struct OutputJSONMemBufferWrapper_ {
size_t expand_by; /**< expand by this size */ size_t expand_by; /**< expand by this size */
} OutputJSONMemBufferWrapper; } OutputJSONMemBufferWrapper;
int OutputJSONMemBufferCallback(const char *str, size_t size, void *data);
void CreateEveFlowId(JsonBuilder *js, const Flow *f);
void EveFileInfo(JsonBuilder *js, const File *file, const bool stored);
void EveTcpFlags(uint8_t flags, JsonBuilder *js);
void EvePacket(const Packet *p, JsonBuilder *js, unsigned long max_length);
JsonBuilder *CreateEveHeader(const Packet *p,
enum OutputJsonLogDirection dir, const char *event_type,
JsonAddrInfo *addr);
JsonBuilder *CreateEveHeaderWithTxId(const Packet *p,
enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr,
uint64_t tx_id);
int OutputJSONBuffer(json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer);
int OutputJsonBuilderBuffer(JsonBuilder *js, LogFileCtx *file_ctx, MemBuffer **buffer);
OutputInitResult OutputJsonInitCtx(ConfNode *);
OutputInitResult OutputJsonLogInitSub(ConfNode *conf, OutputCtx *parent_ctx);
TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data);
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data);
typedef struct OutputJsonCommonSettings_ { typedef struct OutputJsonCommonSettings_ {
bool include_metadata; bool include_metadata;
bool include_community_id; bool include_community_id;
@ -114,7 +94,26 @@ typedef struct OutputJsonThreadCtx_ {
json_t *SCJsonString(const char *val); json_t *SCJsonString(const char *val);
void CreateEveFlowId(JsonBuilder *js, const Flow *f);
void EveFileInfo(JsonBuilder *js, const File *file, const bool stored);
void EveTcpFlags(uint8_t flags, JsonBuilder *js);
void EvePacket(const Packet *p, JsonBuilder *js, unsigned long max_length);
JsonBuilder *CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir,
const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx);
JsonBuilder *CreateEveHeaderWithTxId(const Packet *p, enum OutputJsonLogDirection dir,
const char *event_type, JsonAddrInfo *addr, uint64_t tx_id);
int OutputJSONBuffer(json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer);
int OutputJsonBuilderBuffer(JsonBuilder *js, LogFileCtx *file_ctx, MemBuffer **buffer);
OutputInitResult OutputJsonInitCtx(ConfNode *);
OutputInitResult OutputJsonLogInitSub(ConfNode *conf, OutputCtx *parent_ctx);
TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data);
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data);
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, void EveAddCommonOptions(const OutputJsonCommonSettings *cfg,
const Packet *p, const Flow *f, JsonBuilder *js); const Packet *p, const Flow *f, JsonBuilder *js);
void EveAddMetadata(const Packet *p, const Flow *f, JsonBuilder *js);
int OutputJSONMemBufferCallback(const char *str, size_t size, void *data);
#endif /* __OUTPUT_JSON_H__ */ #endif /* __OUTPUT_JSON_H__ */

Write Preview
Loading…
Cancel
Save