aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

eve: convert many loggers to use generate thread context

Browse Source 
- mqtt
- dnp3
- smtp
- ike
- dns
- alert
- tls
- anomaly
- drop
- file
- http
- http2
- templates
- dhcp

The idea is to factor out the commom code for setting
up the output file objects, which is repetitive, and
often done wrong when it comes to threading.
pull/6060/head
Jason Ish 5 years ago
parent 013becf569
commit 08eee26d27
16 changed files with 92 additions and 277 deletions
Show Stats Download Patch File Download Diff File

28
src/output-json-alert.c
Unescape Escape View File

@ -113,11 +113,9 @@ typedef struct AlertJsonOutputCtx_ {
} AlertJsonOutputCtx;
typedef struct JsonAlertLogThread_ {
/** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
LogFileCtx* file_ctx;
MemBuffer *json_buffer;
MemBuffer *payload_buffer;
AlertJsonOutputCtx* json_output_ctx;
OutputJsonThreadCtx *ctx;
} JsonAlertLogThread;
/* Callback function to pack payload contents from a stream into a buffer
@ -630,7 +628,6 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
if (unlikely(jb == NULL))
return TM_ECODE_OK;
MemBufferReset(aft->json_buffer);
/* alert */
AlertJsonHeader(json_output_ctx, p, pa, jb, json_output_ctx->flags,
@ -715,18 +712,17 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
jb_set_string(jb, "xff", xff_buffer);
}
OutputJsonBuilderBuffer(jb, aft->file_ctx, &aft->json_buffer);
OutputJsonBuilderBuffer(jb, aft->ctx->file_ctx, &aft->ctx->buffer);
jb_free(jb);
}
if ((p->flags & PKT_HAS_TAG) && (json_output_ctx->flags &
LOG_JSON_TAGGED_PACKETS)) {
MemBufferReset(aft->json_buffer);
JsonBuilder *packetjs =
CreateEveHeader(p, LOG_DIR_PACKET, "packet", NULL, json_output_ctx->eve_ctx);
if (unlikely(packetjs != NULL)) {
EvePacket(p, packetjs, 0);
OutputJsonBuilderBuffer(packetjs, aft->file_ctx, &aft->json_buffer);
OutputJsonBuilderBuffer(packetjs, aft->ctx->file_ctx, &aft->ctx->buffer);
jb_free(packetjs);
}
}
@ -745,8 +741,6 @@ static int AlertJsonDecoderEvent(ThreadVars *tv, JsonAlertLogThread *aft, const
CreateIsoTimeString(&p->ts, timebuf, sizeof(timebuf));
for (int i = 0; i < p->alerts.cnt; i++) {
MemBufferReset(aft->json_buffer);
const PacketAlert *pa = &p->alerts.alerts[i];
if (unlikely(pa->s == NULL)) {
continue;
@ -762,7 +756,7 @@ static int AlertJsonDecoderEvent(ThreadVars *tv, JsonAlertLogThread *aft, const
AlertJsonHeader(json_output_ctx, p, pa, jb, json_output_ctx->flags, NULL);
OutputJsonBuilderBuffer(jb, aft->file_ctx, &aft->json_buffer);
OutputJsonBuilderBuffer(jb, aft->ctx->file_ctx, &aft->ctx->buffer);
jb_free(jb);
}
@ -801,11 +795,6 @@ static TmEcode JsonAlertLogThreadInit(ThreadVars *t, const void *initdata, void
goto error_exit;
}
aft->json_buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (aft->json_buffer == NULL) {
goto error_exit;
}
/** Use the Output Context (file pointer and mutex) */
AlertJsonOutputCtx *json_output_ctx = ((OutputCtx *)initdata)->data;
@ -813,8 +802,8 @@ static TmEcode JsonAlertLogThreadInit(ThreadVars *t, const void *initdata, void
if (aft->payload_buffer == NULL) {
goto error_exit;
}
aft->file_ctx = LogFileEnsureExists(json_output_ctx->file_ctx, t->id);
if (!aft->file_ctx) {
aft->ctx = CreateEveThreadCtx(t, json_output_ctx->eve_ctx);
if (!aft->ctx) {
goto error_exit;
}
@ -824,9 +813,6 @@ static TmEcode JsonAlertLogThreadInit(ThreadVars *t, const void *initdata, void
return TM_ECODE_OK;
error_exit:
if (aft->json_buffer != NULL) {
MemBufferFree(aft->json_buffer);
}
if (aft->payload_buffer != NULL) {
MemBufferFree(aft->payload_buffer);
}
@ -841,8 +827,8 @@ static TmEcode JsonAlertLogThreadDeinit(ThreadVars *t, void *data)
return TM_ECODE_OK;
}
MemBufferFree(aft->json_buffer);
MemBufferFree(aft->payload_buffer);
FreeEveThreadCtx(aft->ctx);
/* clear memory */
memset(aft, 0, sizeof(JsonAlertLogThread));

26
src/output-json-anomaly.c
Unescape Escape View File

@ -77,10 +77,8 @@ typedef struct AnomalyJsonOutputCtx_ {
} AnomalyJsonOutputCtx;
typedef struct JsonAnomalyLogThread_ {
/** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
LogFileCtx* file_ctx;
MemBuffer *json_buffer;
AnomalyJsonOutputCtx* json_output_ctx;
OutputJsonThreadCtx *ctx;
} JsonAnomalyLogThread;
/*
@ -119,8 +117,6 @@ static int AnomalyDecodeEventJson(ThreadVars *tv, JsonAnomalyLogThread *aft,
if (!is_decode && !log_stream)
continue;
MemBufferReset(aft->json_buffer);
JsonBuilder *js = CreateEveHeader(
p, LOG_DIR_PACKET, ANOMALY_EVENT_TYPE, NULL, aft->json_output_ctx->eve_ctx);
if (unlikely(js == NULL)) {
@ -149,7 +145,7 @@ static int AnomalyDecodeEventJson(ThreadVars *tv, JsonAnomalyLogThread *aft,
EvePacket(p, js, GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32);
}
OutputJsonBuilderBuffer(js, aft->file_ctx, &aft->json_buffer);
OutputJsonBuilderBuffer(js, aft->ctx->file_ctx, &aft->ctx->buffer);
jb_free(js);
}
@ -168,8 +164,6 @@ static int AnomalyAppLayerDecoderEventJson(JsonAnomalyLogThread *aft,
tx_id != TX_ID_UNUSED ? "tx" : "no-tx");
for (int i = decoder_events->event_last_logged; i < decoder_events->cnt; i++) {
MemBufferReset(aft->json_buffer);
JsonBuilder *js;
if (tx_id != TX_ID_UNUSED) {
js = CreateEveHeaderWithTxId(p, LOG_DIR_PACKET, ANOMALY_EVENT_TYPE, NULL, tx_id,
@ -209,7 +203,7 @@ static int AnomalyAppLayerDecoderEventJson(JsonAnomalyLogThread *aft,
/* anomaly */
jb_close(js);
OutputJsonBuilderBuffer(js, aft->file_ctx, &aft->json_buffer);
OutputJsonBuilderBuffer(js, aft->ctx->file_ctx, &aft->ctx->buffer);
jb_free(js);
/* Current implementation assumes a single owner for this value */
@ -306,16 +300,11 @@ static TmEcode JsonAnomalyLogThreadInit(ThreadVars *t, const void *initdata, voi
goto error_exit;
}
aft->json_buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (aft->json_buffer == NULL) {
goto error_exit;
}
/** Use the Output Context (file pointer and mutex) */
AnomalyJsonOutputCtx *json_output_ctx = ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(json_output_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) {
aft->ctx = CreateEveThreadCtx(t, json_output_ctx->eve_ctx);
if (!aft->ctx) {
goto error_exit;
}
aft->json_output_ctx = json_output_ctx;
@ -324,9 +313,6 @@ static TmEcode JsonAnomalyLogThreadInit(ThreadVars *t, const void *initdata, voi
return TM_ECODE_OK;
error_exit:
if (aft->json_buffer != NULL) {
MemBufferFree(aft->json_buffer);
}
SCFree(aft);
return TM_ECODE_FAILED;
}
@ -338,7 +324,7 @@ static TmEcode JsonAnomalyLogThreadDeinit(ThreadVars *t, void *data)
return TM_ECODE_OK;
}
MemBufferFree(aft->json_buffer);
FreeEveThreadCtx(aft->ctx);
/* clear memory */
memset(aft, 0, sizeof(JsonAnomalyLogThread));

39
src/output-json-dhcp.c
Unescape Escape View File

@ -53,8 +53,7 @@ typedef struct LogDHCPFileCtx_ {
typedef struct LogDHCPLogThread_ {
LogDHCPFileCtx *dhcplog_ctx;
MemBuffer *buffer;
LogFileCtx *file_ctx;
OutputJsonThreadCtx *thread;
} LogDHCPLogThread;
static int JsonDHCPLogger(ThreadVars *tv, void *thread_data,
@ -74,8 +73,7 @@ static int JsonDHCPLogger(ThreadVars *tv, void *thread_data,
rs_dhcp_logger_log(ctx->rs_logger, tx, js);
MemBufferReset(thread->buffer);
OutputJsonBuilderBuffer(js, thread->file_ctx, &thread->buffer);
OutputJsonBuilderBuffer(js, thread->thread->file_ctx, &thread->thread->buffer);
jb_free(js);
return TM_ECODE_OK;
@ -117,39 +115,22 @@ static OutputInitResult OutputDHCPLogInitSub(ConfNode *conf,
return result;
}
static TmEcode JsonDHCPLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
LogDHCPLogThread *thread = SCCalloc(1, sizeof(*thread));
if (unlikely(thread == NULL)) {
return TM_ECODE_FAILED;
}
if (initdata == NULL) {
SCLogDebug("Error getting context for EveLogDHCP. \"initdata\" is NULL.");
goto error_exit;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->dhcplog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->dhcplog_ctx->eve_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
goto error_exit;
LogDHCPFileCtx *ctx = ((OutputCtx *)initdata)->data;
thread->dhcplog_ctx = ctx;
thread->thread = CreateEveThreadCtx(t, ctx->eve_ctx);
if (thread->thread == NULL) {
SCFree(thread);
return TM_ECODE_FAILED;
}
*data = (void *)thread;
return TM_ECODE_OK;
error_exit:
if (unlikely(thread->buffer != NULL)) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
static TmEcode JsonDHCPLogThreadDeinit(ThreadVars *t, void *data)
@ -158,9 +139,7 @@ static TmEcode JsonDHCPLogThreadDeinit(ThreadVars *t, void *data)
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
FreeEveThreadCtx(thread->thread);
SCFree(thread);
return TM_ECODE_OK;
}

27
src/output-json-dnp3.c
Unescape Escape View File

@ -50,9 +50,8 @@ typedef struct LogDNP3FileCtx_ {
} LogDNP3FileCtx;
typedef struct LogDNP3LogThread_ {
LogFileCtx *file_ctx;
LogDNP3FileCtx *dnp3log_ctx;
MemBuffer *buffer;
OutputJsonThreadCtx *ctx;
} LogDNP3LogThread;
static void JsonDNP3LogLinkControl(JsonBuilder *js, uint8_t lc)
@ -217,7 +216,7 @@ static int JsonDNP3LoggerToServer(ThreadVars *tv, void *thread_data,
LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data;
DNP3Transaction *tx = vtx;
MemBuffer *buffer = (MemBuffer *)thread->buffer;
MemBuffer *buffer = (MemBuffer *)thread->ctx->buffer;
MemBufferReset(buffer);
if (tx->has_request && tx->request_done) {
@ -230,7 +229,7 @@ static int JsonDNP3LoggerToServer(ThreadVars *tv, void *thread_data,
jb_open_object(js, "dnp3");
JsonDNP3LogRequest(js, tx);
jb_close(js);
OutputJsonBuilderBuffer(js, thread->file_ctx, &buffer);
OutputJsonBuilderBuffer(js, thread->ctx->file_ctx, &buffer);
jb_free(js);
}
@ -244,7 +243,7 @@ static int JsonDNP3LoggerToClient(ThreadVars *tv, void *thread_data,
LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data;
DNP3Transaction *tx = vtx;
MemBuffer *buffer = (MemBuffer *)thread->buffer;
MemBuffer *buffer = (MemBuffer *)thread->ctx->buffer;
MemBufferReset(buffer);
if (tx->has_response && tx->response_done) {
@ -257,7 +256,7 @@ static int JsonDNP3LoggerToClient(ThreadVars *tv, void *thread_data,
jb_open_object(js, "dnp3");
JsonDNP3LogResponse(js, tx);
jb_close(js);
OutputJsonBuilderBuffer(js, thread->file_ctx, &buffer);
OutputJsonBuilderBuffer(js, thread->ctx->file_ctx, &buffer);
jb_free(js);
}
@ -315,14 +314,9 @@ static TmEcode JsonDNP3LogThreadInit(ThreadVars *t, const void *initdata, void *
goto error_exit;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->dnp3log_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->dnp3log_ctx->eve_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
thread->ctx = CreateEveThreadCtx(t, thread->dnp3log_ctx->eve_ctx);
if (thread->ctx == NULL) {
goto error_exit;
}
@ -331,9 +325,6 @@ static TmEcode JsonDNP3LogThreadInit(ThreadVars *t, const void *initdata, void *
return TM_ECODE_OK;
error_exit:
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
@ -344,9 +335,7 @@ static TmEcode JsonDNP3LogThreadDeinit(ThreadVars *t, void *data)
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
FreeEveThreadCtx(thread->ctx);
SCFree(thread);
return TM_ECODE_OK;
}

32
src/output-json-dns.c
Unescape Escape View File

@ -264,9 +264,7 @@ typedef struct LogDnsFileCtx_ {
typedef struct LogDnsLogThread_ {
LogDnsFileCtx *dnslog_ctx;
/** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
LogFileCtx *file_ctx;
MemBuffer *buffer;
OutputJsonThreadCtx *ctx;
} LogDnsLogThread;
static bool v1_deprecation_warned = false;
@ -330,8 +328,7 @@ static int JsonDnsLoggerToServer(ThreadVars *tv, void *thread_data,
}
jb_close(jb);
MemBufferReset(td->buffer);
OutputJsonBuilderBuffer(jb, td->file_ctx, &td->buffer);
OutputJsonBuilderBuffer(jb, td->ctx->file_ctx, &td->ctx->buffer);
jb_free(jb);
}
@ -360,8 +357,7 @@ static int JsonDnsLoggerToClient(ThreadVars *tv, void *thread_data,
jb_open_object(jb, "dns");
rs_dns_log_json_answer(txptr, td->dnslog_ctx->flags, jb);
jb_close(jb);
MemBufferReset(td->buffer);
OutputJsonBuilderBuffer(jb, td->file_ctx, &td->buffer);
OutputJsonBuilderBuffer(jb, td->ctx->file_ctx, &td->ctx->buffer);
jb_free(jb);
}
} else {
@ -381,8 +377,7 @@ static int JsonDnsLoggerToClient(ThreadVars *tv, void *thread_data,
jb_set_object(jb, "dns", answer);
jb_free(answer);
MemBufferReset(td->buffer);
OutputJsonBuilderBuffer(jb, td->file_ctx, &td->buffer);
OutputJsonBuilderBuffer(jb, td->ctx->file_ctx, &td->ctx->buffer);
jb_free(jb);
}
/* Log authorities. */
@ -401,8 +396,7 @@ static int JsonDnsLoggerToClient(ThreadVars *tv, void *thread_data,
jb_set_object(jb, "dns", answer);
jb_free(answer);
MemBufferReset(td->buffer);
OutputJsonBuilderBuffer(jb, td->file_ctx, &td->buffer);
OutputJsonBuilderBuffer(jb, td->ctx->file_ctx, &td->ctx->buffer);
jb_free(jb);
}
}
@ -433,15 +427,10 @@ static TmEcode LogDnsLogThreadInit(ThreadVars *t, const void *initdata, void **d
goto error_exit;
}
aft->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (aft->buffer == NULL) {
goto error_exit;
}
/* Use the Ouptut Context (file pointer and mutex) */
aft->dnslog_ctx= ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(aft->dnslog_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) {
aft->dnslog_ctx = ((OutputCtx *)initdata)->data;
aft->ctx = CreateEveThreadCtx(t, aft->dnslog_ctx->eve_ctx);
if (!aft->ctx) {
goto error_exit;
}
@ -449,9 +438,6 @@ static TmEcode LogDnsLogThreadInit(ThreadVars *t, const void *initdata, void **d
return TM_ECODE_OK;
error_exit:
if (aft->buffer != NULL) {
MemBufferFree(aft->buffer);
}
SCFree(aft);
return TM_ECODE_FAILED;
}
@ -462,8 +448,8 @@ static TmEcode LogDnsLogThreadDeinit(ThreadVars *t, void *data)
if (aft == NULL) {
return TM_ECODE_OK;
}
FreeEveThreadCtx(aft->ctx);
MemBufferFree(aft->buffer);
/* clear memory */
memset(aft, 0, sizeof(LogDnsLogThread));

22
src/output-json-drop.c
Unescape Escape View File

@ -66,9 +66,8 @@ typedef struct JsonDropOutputCtx_ {
} JsonDropOutputCtx;
typedef struct JsonDropLogThread_ {
LogFileCtx *file_ctx;
JsonDropOutputCtx *drop_ctx;
MemBuffer *buffer;
OutputJsonThreadCtx *ctx;
} JsonDropLogThread;
/* default to true as this has been the default behavior for a long time */
@ -96,9 +95,6 @@ static int DropLogJSON (JsonDropLogThread *aft, const Packet *p)
jb_open_object(js, "drop");
/* reset */
MemBufferReset(aft->buffer);
uint16_t proto = 0;
if (PKT_IS_IPV4(p)) {
jb_set_uint(js, "len", IPV4_GET_IPLEN(p));
@ -172,7 +168,7 @@ static int DropLogJSON (JsonDropLogThread *aft, const Packet *p)
}
}
OutputJsonBuilderBuffer(js, aft->file_ctx, &aft->buffer);
OutputJsonBuilderBuffer(js, aft->ctx->file_ctx, &aft->ctx->buffer);
jb_free(js);
return TM_ECODE_OK;
@ -190,15 +186,10 @@ static TmEcode JsonDropLogThreadInit(ThreadVars *t, const void *initdata, void *
goto error_exit;
}
aft->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (aft->buffer == NULL) {
goto error_exit;
}
/** Use the Ouptut Context (file pointer and mutex) */
aft->drop_ctx = ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(aft->drop_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) {
aft->ctx = CreateEveThreadCtx(t, aft->drop_ctx->eve_ctx);
if (!aft->ctx) {
goto error_exit;
}
@ -206,9 +197,6 @@ static TmEcode JsonDropLogThreadInit(ThreadVars *t, const void *initdata, void *
return TM_ECODE_OK;
error_exit:
if (aft->buffer != NULL) {
MemBufferFree(aft->buffer);
}
SCFree(aft);
return TM_ECODE_FAILED;
}
@ -220,7 +208,7 @@ static TmEcode JsonDropLogThreadDeinit(ThreadVars *t, void *data)
return TM_ECODE_OK;
}
MemBufferFree(aft->buffer);
FreeEveThreadCtx(aft->ctx);
/* clear memory */
memset(aft, 0, sizeof(*aft));

3
src/output-json-email-common.h
Unescape Escape View File

@ -31,9 +31,8 @@ typedef struct OutputJsonEmailCtx_ {
} OutputJsonEmailCtx;
typedef struct JsonEmailLogThread_ {
LogFileCtx *file_ctx;
OutputJsonEmailCtx *emaillog_ctx;
MemBuffer *buffer;
OutputJsonThreadCtx *ctx;
} JsonEmailLogThread;
TmEcode EveEmailLogJson(JsonEmailLogThread *aft, JsonBuilder *js, const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id);

21
src/output-json-file.c
Unescape Escape View File

@ -78,8 +78,7 @@ typedef struct OutputFileCtx_ {
typedef struct JsonFileLogThread_ {
OutputFileCtx *filelog_ctx;
LogFileCtx *file_ctx;
MemBuffer *buffer;
OutputJsonThreadCtx *ctx;
} JsonFileLogThread;
JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, const bool stored,
@ -213,8 +212,7 @@ static void FileWriteJsonRecord(JsonFileLogThread *aft, const Packet *p, const F
return;
}
MemBufferReset(aft->buffer);
OutputJsonBuilderBuffer(js, aft->file_ctx, &aft->buffer);
OutputJsonBuilderBuffer(js, aft->ctx->file_ctx, &aft->ctx->buffer);
jb_free(js);
}
@ -245,15 +243,10 @@ static TmEcode JsonFileLogThreadInit(ThreadVars *t, const void *initdata, void *
goto error_exit;
}
aft->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (aft->buffer == NULL) {
goto error_exit;
}
/* Use the Ouptut Context (file pointer and mutex) */
aft->filelog_ctx = ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(aft->filelog_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) {
aft->ctx = CreateEveThreadCtx(t, aft->filelog_ctx->eve_ctx);
if (!aft->ctx) {
goto error_exit;
}
@ -261,9 +254,6 @@ static TmEcode JsonFileLogThreadInit(ThreadVars *t, const void *initdata, void *
return TM_ECODE_OK;
error_exit:
if (aft->buffer != NULL) {
MemBufferFree(aft->buffer);
}
SCFree(aft);
return TM_ECODE_FAILED;
}
@ -275,7 +265,8 @@ static TmEcode JsonFileLogThreadDeinit(ThreadVars *t, void *data)
return TM_ECODE_OK;
}
MemBufferFree(aft->buffer);
FreeEveThreadCtx(aft->ctx);
/* clear memory */
memset(aft, 0, sizeof(JsonFileLogThread));

25
src/output-json-http.c
Unescape Escape View File

@ -65,11 +65,8 @@ typedef struct LogHttpFileCtx_ {
typedef struct JsonHttpLogThread_ {
LogHttpFileCtx *httplog_ctx;
LogFileCtx *file_ctx;
/** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
uint32_t uri_cnt;
MemBuffer *buffer;
OutputJsonThreadCtx *ctx;
} JsonHttpLogThread;
#define MAX_SIZE_HEADER_NAME 256
@ -490,9 +487,6 @@ static int JsonHttpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
SCLogDebug("got a HTTP request and now logging !!");
/* reset */
MemBufferReset(jhl->buffer);
EveHttpLogJSON(jhl, js, tx, tx_id);
HttpXFFCfg *xff_cfg = jhl->httplog_ctx->xff_cfg != NULL ?
jhl->httplog_ctx->xff_cfg : jhl->httplog_ctx->parent_xff_cfg;
@ -518,7 +512,7 @@ static int JsonHttpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
}
}
OutputJsonBuilderBuffer(js, jhl->file_ctx, &jhl->buffer);
OutputJsonBuilderBuffer(js, jhl->ctx->file_ctx, &jhl->ctx->buffer);
jb_free(js);
SCReturnInt(TM_ECODE_OK);
@ -649,13 +643,8 @@ static TmEcode JsonHttpLogThreadInit(ThreadVars *t, const void *initdata, void *
/* Use the Output Context (file pointer and mutex) */
aft->httplog_ctx = ((OutputCtx *)initdata)->data; //TODO
aft->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (aft->buffer == NULL) {
goto error_exit;
}
aft->file_ctx = LogFileEnsureExists(aft->httplog_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) {
aft->ctx = CreateEveThreadCtx(t, aft->httplog_ctx->eve_ctx);
if (!aft->ctx) {
goto error_exit;
}
@ -663,9 +652,6 @@ static TmEcode JsonHttpLogThreadInit(ThreadVars *t, const void *initdata, void *
return TM_ECODE_OK;
error_exit:
if (aft->buffer != NULL) {
MemBufferFree(aft->buffer);
}
SCFree(aft);
return TM_ECODE_FAILED;
}
@ -677,7 +663,8 @@ static TmEcode JsonHttpLogThreadDeinit(ThreadVars *t, void *data)
return TM_ECODE_OK;
}
MemBufferFree(aft->buffer);
FreeEveThreadCtx(aft->ctx);
/* clear memory */
memset(aft, 0, sizeof(JsonHttpLogThread));

22
src/output-json-http2.c
Unescape Escape View File

@ -60,8 +60,7 @@ typedef struct OutputHttp2Ctx_ {
typedef struct JsonHttp2LogThread_ {
OutputHttp2Ctx *http2log_ctx;
LogFileCtx *file_ctx;
MemBuffer *buffer;
OutputJsonThreadCtx *ctx;
} JsonHttp2LogThread;
@ -91,15 +90,12 @@ static int JsonHttp2Logger(ThreadVars *tv, void *thread_data, const Packet *p,
if (unlikely(js == NULL))
return 0;
/* reset */
MemBufferReset(aft->buffer);
jb_open_object(js, "http");
if (!rs_http2_log_json(txptr, js)) {
goto end;
}
jb_close(js);
OutputJsonBuilderBuffer(js, aft->file_ctx, &aft->buffer);
OutputJsonBuilderBuffer(js, aft->ctx->file_ctx, &aft->ctx->buffer);
end:
jb_free(js);
return 0;
@ -119,13 +115,8 @@ static TmEcode JsonHttp2LogThreadInit(ThreadVars *t, const void *initdata, void
/* Use the Output Context (file pointer and mutex) */
aft->http2log_ctx = ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(aft->http2log_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) {
goto error_exit;
}
aft->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (aft->buffer == NULL) {
aft->ctx = CreateEveThreadCtx(t, aft->http2log_ctx->eve_ctx);
if (!aft->ctx) {
goto error_exit;
}
@ -133,9 +124,6 @@ static TmEcode JsonHttp2LogThreadInit(ThreadVars *t, const void *initdata, void
return TM_ECODE_OK;
error_exit:
if (aft->buffer != NULL) {
MemBufferFree(aft->buffer);
}
SCFree(aft);
return TM_ECODE_FAILED;
}
@ -147,7 +135,7 @@ static TmEcode JsonHttp2LogThreadDeinit(ThreadVars *t, void *data)
return TM_ECODE_OK;
}
MemBufferFree(aft->buffer);
FreeEveThreadCtx(aft->ctx);
/* clear memory */
memset(aft, 0, sizeof(JsonHttp2LogThread));

22
src/output-json-ike.c
Unescape Escape View File

@ -59,9 +59,8 @@ typedef struct LogIKEFileCtx_ {
} LogIKEFileCtx;
typedef struct LogIKELogThread_ {
LogFileCtx *file_ctx;
LogIKEFileCtx *ikelog_ctx;
MemBuffer *buffer;
OutputJsonThreadCtx *ctx;
} LogIKELogThread;
bool EveIKEAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
@ -92,8 +91,7 @@ static int JsonIKELogger(ThreadVars *tv, void *thread_data, const Packet *p, Flo
goto error;
}
MemBufferReset(thread->buffer);
OutputJsonBuilderBuffer(jb, thread->file_ctx, &thread->buffer);
OutputJsonBuilderBuffer(jb, thread->ctx->file_ctx, &thread->ctx->buffer);
jb_free(jb);
return TM_ECODE_OK;
@ -157,14 +155,9 @@ static TmEcode JsonIKELogThreadInit(ThreadVars *t, const void *initdata, void **
goto error_exit;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->ikelog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->ikelog_ctx->eve_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
thread->ctx = CreateEveThreadCtx(t, thread->ikelog_ctx->eve_ctx);
if (!thread->ctx) {
goto error_exit;
}
@ -172,9 +165,6 @@ static TmEcode JsonIKELogThreadInit(ThreadVars *t, const void *initdata, void **
return TM_ECODE_OK;
error_exit:
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
@ -185,9 +175,7 @@ static TmEcode JsonIKELogThreadDeinit(ThreadVars *t, void *data)
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
FreeEveThreadCtx(thread->ctx);
SCFree(thread);
return TM_ECODE_OK;
}

18
src/output-json-mqtt.c
Unescape Escape View File

@ -57,8 +57,7 @@ typedef struct LogMQTTFileCtx_ {
typedef struct LogMQTTLogThread_ {
LogMQTTFileCtx *mqttlog_ctx;
uint32_t count;
MemBuffer *buffer;
LogFileCtx *file_ctx;
OutputJsonThreadCtx *ctx;
} LogMQTTLogThread;
bool JsonMQTTAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
@ -94,8 +93,7 @@ static int JsonMQTTLogger(ThreadVars *tv, void *thread_data,
if (!rs_mqtt_logger_log(state, tx, thread->mqttlog_ctx->flags, js))
goto error;
MemBufferReset(thread->buffer);
OutputJsonBuilderBuffer(js, thread->mqttlog_ctx->eve_ctx->file_ctx, &thread->buffer);
OutputJsonBuilderBuffer(js, thread->ctx->file_ctx, &thread->ctx->buffer);
jb_free(js);
return TM_ECODE_OK;
@ -168,15 +166,13 @@ static TmEcode JsonMQTTLogThreadInit(ThreadVars *t, const void *initdata, void *
return TM_ECODE_FAILED;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
thread->mqttlog_ctx = ((OutputCtx *)initdata)->data;
thread->ctx = CreateEveThreadCtx(t, thread->mqttlog_ctx->eve_ctx);
if (unlikely(thread->ctx == NULL)) {
SCFree(thread);
return TM_ECODE_FAILED;
}
thread->mqttlog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->mqttlog_ctx->eve_ctx->file_ctx, t->id);
*data = (void *)thread;
return TM_ECODE_OK;
@ -188,9 +184,7 @@ static TmEcode JsonMQTTLogThreadDeinit(ThreadVars *t, void *data)
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
FreeEveThreadCtx(thread->ctx);
SCFree(thread);
return TM_ECODE_OK;
}

18
src/output-json-smtp.c
Unescape Escape View File

@ -81,15 +81,12 @@ static int JsonSmtpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
if (unlikely(jb == NULL))
return TM_ECODE_OK;
/* reset */
MemBufferReset(jhl->buffer);
jb_open_object(jb, "smtp");
EveSmtpDataLogger(f, state, tx, tx_id, jb);
jb_close(jb);
if (EveEmailLogJson(jhl, jb, p, f, state, tx, tx_id) == TM_ECODE_OK) {
OutputJsonBuilderBuffer(jb, jhl->file_ctx, &jhl->buffer);
OutputJsonBuilderBuffer(jb, jhl->ctx->file_ctx, &jhl->ctx->buffer);
}
jb_free(jb);
@ -166,22 +163,15 @@ static TmEcode JsonSmtpLogThreadInit(ThreadVars *t, const void *initdata, void *
/* Use the Output Context (file pointer and mutex) */
aft->emaillog_ctx = ((OutputCtx *)initdata)->data;
aft->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (aft->buffer == NULL) {
aft->ctx = CreateEveThreadCtx(t, aft->emaillog_ctx->eve_ctx);
if (aft->ctx == NULL) {
goto error_exit;
}
aft->file_ctx = LogFileEnsureExists(aft->emaillog_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) {
goto error_exit;
}
*data = (void *)aft;
return TM_ECODE_OK;
error_exit:
if (aft->buffer != NULL) {
MemBufferFree(aft->buffer);
}
SCFree(aft);
return TM_ECODE_FAILED;
}
@ -192,8 +182,8 @@ static TmEcode JsonSmtpLogThreadDeinit(ThreadVars *t, void *data)
if (aft == NULL) {
return TM_ECODE_OK;
}
FreeEveThreadCtx(aft->ctx);
MemBufferFree(aft->buffer);
/* clear memory */
memset(aft, 0, sizeof(JsonEmailLogThread));

22
src/output-json-template-rust.c
Unescape Escape View File

@ -61,8 +61,7 @@ typedef struct LogTemplateFileCtx_ {
typedef struct LogTemplateLogThread_ {
LogTemplateFileCtx *templatelog_ctx;
LogFileCtx *file_ctx;
MemBuffer *buffer;
OutputJsonThreadCtx *ctx;
} LogTemplateLogThread;
static int JsonTemplateLogger(ThreadVars *tv, void *thread_data,
@ -83,8 +82,7 @@ static int JsonTemplateLogger(ThreadVars *tv, void *thread_data,
}
jb_close(js);
MemBufferReset(thread->buffer);
OutputJsonBuilderBuffer(js, thread->file_ctx, &thread->buffer);
OutputJsonBuilderBuffer(js, thread->ctx->file_ctx, &thread->ctx->buffer);
jb_free(js);
return TM_ECODE_OK;
@ -142,14 +140,9 @@ static TmEcode JsonTemplateLogThreadInit(ThreadVars *t, const void *initdata, vo
goto error_exit;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->templatelog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->templatelog_ctx->eve_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
thread->ctx = CreateEveThreadCtx(t, thread->templatelog_ctx->eve_ctx);
if (!thread->ctx) {
goto error_exit;
}
*data = (void *)thread;
@ -157,9 +150,6 @@ static TmEcode JsonTemplateLogThreadInit(ThreadVars *t, const void *initdata, vo
return TM_ECODE_OK;
error_exit:
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
@ -170,9 +160,7 @@ static TmEcode JsonTemplateLogThreadDeinit(ThreadVars *t, void *data)
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
FreeEveThreadCtx(thread->ctx);
SCFree(thread);
return TM_ECODE_OK;
}

22
src/output-json-template.c
Unescape Escape View File

@ -59,9 +59,8 @@ typedef struct LogTemplateFileCtx_ {
} LogTemplateFileCtx;
typedef struct LogTemplateLogThread_ {
LogFileCtx *file_ctx;
LogTemplateFileCtx *templatelog_ctx;
MemBuffer *buffer;
OutputJsonThreadCtx *ctx;
} LogTemplateLogThread;
static int JsonTemplateLogger(ThreadVars *tv, void *thread_data,
@ -95,8 +94,7 @@ static int JsonTemplateLogger(ThreadVars *tv, void *thread_data,
/* Close template. */
jb_close(js);
MemBufferReset(thread->buffer);
OutputJsonBuilderBuffer(js, thread->file_ctx, &thread->buffer);
OutputJsonBuilderBuffer(js, thread->ctx->file_ctx, &thread->ctx->buffer);
jb_free(js);
return TM_ECODE_OK;
@ -150,14 +148,9 @@ static TmEcode JsonTemplateLogThreadInit(ThreadVars *t, const void *initdata, vo
goto error_exit;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->templatelog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->templatelog_ctx->eve_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
thread->ctx = CreateEveThreadCtx(t, thread->templatelog_ctx->eve_ctx);
if (!thread->ctx) {
goto error_exit;
}
*data = (void *)thread;
@ -165,9 +158,6 @@ static TmEcode JsonTemplateLogThreadInit(ThreadVars *t, const void *initdata, vo
return TM_ECODE_OK;
error_exit:
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
@ -178,9 +168,7 @@ static TmEcode JsonTemplateLogThreadDeinit(ThreadVars *t, void *data)
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
FreeEveThreadCtx(thread->ctx);
SCFree(thread);
return TM_ECODE_OK;
}

22
src/output-json-tls.c
Unescape Escape View File

@ -105,9 +105,8 @@ typedef struct OutputTlsCtx_ {
typedef struct JsonTlsLogThread_ {
LogFileCtx *file_ctx;
OutputTlsCtx *tlslog_ctx;
MemBuffer *buffer;
OutputJsonThreadCtx *ctx;
} JsonTlsLogThread;
static void JsonTlsLogSubject(JsonBuilder *js, SSLState *ssl_state)
@ -420,9 +419,6 @@ static int JsonTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p,
jb_open_object(js, "tls");
/* reset */
MemBufferReset(aft->buffer);
/* log custom fields */
if (tls_ctx->flags & LOG_TLS_CUSTOM) {
JsonTlsLogJSONCustom(tls_ctx, js, ssl_state);
@ -446,7 +442,7 @@ static int JsonTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p,
/* Close the tls object. */
jb_close(js);
OutputJsonBuilderBuffer(js, aft->file_ctx, &aft->buffer);
OutputJsonBuilderBuffer(js, aft->ctx->file_ctx, &aft->ctx->buffer);
jb_free(js);
return 0;
@ -464,25 +460,17 @@ static TmEcode JsonTlsLogThreadInit(ThreadVars *t, const void *initdata, void **
goto error_exit;
}
aft->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (aft->buffer == NULL) {
goto error_exit;
}
/* use the Output Context (file pointer and mutex) */
aft->tlslog_ctx = ((OutputCtx *)initdata)->data;
aft->file_ctx = LogFileEnsureExists(aft->tlslog_ctx->eve_ctx->file_ctx, t->id);
if (!aft->file_ctx) {
aft->ctx = CreateEveThreadCtx(t, aft->tlslog_ctx->eve_ctx);
if (!aft->ctx) {
goto error_exit;
}
*data = (void *)aft;
return TM_ECODE_OK;
error_exit:
if (aft->buffer != NULL) {
MemBufferFree(aft->buffer);
}
SCFree(aft);
return TM_ECODE_FAILED;
}
@ -494,7 +482,7 @@ static TmEcode JsonTlsLogThreadDeinit(ThreadVars *t, void *data)
return TM_ECODE_OK;
}
MemBufferFree(aft->buffer);
FreeEveThreadCtx(aft->ctx);
/* clear memory */
memset(aft, 0, sizeof(JsonTlsLogThread));

Write Preview
Loading…
Cancel
Save