aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

jsonbuilder: prefix C API with SC

Browse Source
pull/12931/head
Jason Ish 1 year ago committed by Victor Julien
parent 341369f203
commit 155706f96b
63 changed files with 2432 additions and 2438 deletions
Show Stats Download Patch File Download Diff File

4
plugins/ndpi/ndpi.c
Unescape Escape View File

@ -437,7 +437,7 @@ static void DetectnDPIRiskFree(DetectEngineCtx *de_ctx, void *ptr)
SCFree(ptr);
}
static void EveCallback(ThreadVars *tv, const Packet *p, Flow *f, JsonBuilder *jb, void *data)
static void EveCallback(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *jb, void *data)
{
/* Adding ndpi info to EVE requires a flow. */
if (f == NULL) {
@ -460,7 +460,7 @@ static void EveCallback(ThreadVars *tv, const Packet *p, Flow *f, JsonBuilder *j
buffer = ndpi_serializer_get_buffer(&serializer, &buffer_len);
/* Inject the nDPI JSON to the JsonBuilder */
jb_set_formatted(jb, buffer);
SCJbSetFormatted(jb, buffer);
ndpi_term_serializer(&serializer);
}

2
rust/cbindgen.toml
Unescape Escape View File

@ -142,6 +142,8 @@ item_types = ["enums","structs","opaque","functions","constants"]
[export.rename]
"JsonT" = "json_t"
"CLuaState" = "lua_State"
"JsonBuilder" = "SCJsonBuilder"
"JsonBuilderMark" = "SCJsonBuilderMark"
#
# You get the following results:

60
rust/src/jsonbuilder.rs
Unescape Escape View File

@ -839,7 +839,7 @@ fn try_string_from_bytes(input: &[u8]) -> Result<String, JsonError> {
}
#[no_mangle]
pub extern "C" fn jb_new_object() -> *mut JsonBuilder {
pub extern "C" fn SCJbNewObject() -> *mut JsonBuilder {
match JsonBuilder::try_new_object() {
Ok(js) => {
let boxed = Box::new(js);
@ -850,7 +850,7 @@ pub extern "C" fn jb_new_object() -> *mut JsonBuilder {
}
#[no_mangle]
pub extern "C" fn jb_new_array() -> *mut JsonBuilder {
pub extern "C" fn SCJbNewArray() -> *mut JsonBuilder {
match JsonBuilder::try_new_array() {
Ok(js) => {
let boxed = Box::new(js);
@ -861,28 +861,28 @@ pub extern "C" fn jb_new_array() -> *mut JsonBuilder {
}
#[no_mangle]
pub extern "C" fn jb_clone(js: &mut JsonBuilder) -> *mut JsonBuilder {
pub extern "C" fn SCJbClone(js: &mut JsonBuilder) -> *mut JsonBuilder {
let clone = Box::new(js.clone());
Box::into_raw(clone)
}
#[no_mangle]
pub unsafe extern "C" fn jb_free(js: &mut JsonBuilder) {
pub unsafe extern "C" fn SCJbFree(js: &mut JsonBuilder) {
let _ = Box::from_raw(js);
}
#[no_mangle]
pub extern "C" fn jb_capacity(jb: &mut JsonBuilder) -> usize {
pub extern "C" fn SCJbCapacity(jb: &mut JsonBuilder) -> usize {
jb.capacity()
}
#[no_mangle]
pub extern "C" fn jb_reset(jb: &mut JsonBuilder) {
pub extern "C" fn SCJbReset(jb: &mut JsonBuilder) {
jb.reset();
}
#[no_mangle]
pub unsafe extern "C" fn jb_open_object(js: &mut JsonBuilder, key: *const c_char) -> bool {
pub unsafe extern "C" fn SCJbOpenObject(js: &mut JsonBuilder, key: *const c_char) -> bool {
if let Ok(s) = CStr::from_ptr(key).to_str() {
js.open_object(s).is_ok()
} else {
@ -891,12 +891,12 @@ pub unsafe extern "C" fn jb_open_object(js: &mut JsonBuilder, key: *const c_char
}
#[no_mangle]
pub unsafe extern "C" fn jb_start_object(js: &mut JsonBuilder) -> bool {
pub unsafe extern "C" fn SCJbStartObject(js: &mut JsonBuilder) -> bool {
js.start_object().is_ok()
}
#[no_mangle]
pub unsafe extern "C" fn jb_open_array(js: &mut JsonBuilder, key: *const c_char) -> bool {
pub unsafe extern "C" fn SCJbOpenArray(js: &mut JsonBuilder, key: *const c_char) -> bool {
if let Ok(s) = CStr::from_ptr(key).to_str() {
js.open_array(s).is_ok()
} else {
@ -905,7 +905,7 @@ pub unsafe extern "C" fn jb_open_array(js: &mut JsonBuilder, key: *const c_char)
}
#[no_mangle]
pub unsafe extern "C" fn jb_set_string(
pub unsafe extern "C" fn SCJbSetString(
js: &mut JsonBuilder, key: *const c_char, val: *const c_char,
) -> bool {
if val.is_null() {
@ -920,7 +920,7 @@ pub unsafe extern "C" fn jb_set_string(
}
#[no_mangle]
pub unsafe extern "C" fn jb_set_string_from_bytes(
pub unsafe extern "C" fn SCJbSetStringFromBytes(
js: &mut JsonBuilder, key: *const c_char, bytes: *const u8, len: u32,
) -> bool {
if bytes.is_null() || len == 0 {
@ -934,7 +934,7 @@ pub unsafe extern "C" fn jb_set_string_from_bytes(
}
#[no_mangle]
pub unsafe extern "C" fn jb_set_base64(
pub unsafe extern "C" fn SCJbSetBase64(
js: &mut JsonBuilder, key: *const c_char, bytes: *const u8, len: u32,
) -> bool {
if bytes.is_null() || len == 0 {
@ -948,7 +948,7 @@ pub unsafe extern "C" fn jb_set_base64(
}
#[no_mangle]
pub unsafe extern "C" fn jb_set_hex(
pub unsafe extern "C" fn SCJbSetHex(
js: &mut JsonBuilder, key: *const c_char, bytes: *const u8, len: u32,
) -> bool {
if bytes.is_null() || len == 0 {
@ -962,7 +962,7 @@ pub unsafe extern "C" fn jb_set_hex(
}
#[no_mangle]
pub unsafe extern "C" fn jb_set_formatted(js: &mut JsonBuilder, formatted: *const c_char) -> bool {
pub unsafe extern "C" fn SCJbSetFormatted(js: &mut JsonBuilder, formatted: *const c_char) -> bool {
if let Ok(formatted) = CStr::from_ptr(formatted).to_str() {
return js.set_formatted(formatted).is_ok();
}
@ -970,12 +970,12 @@ pub unsafe extern "C" fn jb_set_formatted(js: &mut JsonBuilder, formatted: *cons
}
#[no_mangle]
pub unsafe extern "C" fn jb_append_object(jb: &mut JsonBuilder, obj: &JsonBuilder) -> bool {
pub unsafe extern "C" fn SCJbAppendObject(jb: &mut JsonBuilder, obj: &JsonBuilder) -> bool {
jb.append_object(obj).is_ok()
}
#[no_mangle]
pub unsafe extern "C" fn jb_set_object(
pub unsafe extern "C" fn SCJbSetObject(
js: &mut JsonBuilder, key: *const c_char, val: &mut JsonBuilder,
) -> bool {
if let Ok(key) = CStr::from_ptr(key).to_str() {
@ -985,7 +985,7 @@ pub unsafe extern "C" fn jb_set_object(
}
#[no_mangle]
pub unsafe extern "C" fn jb_append_string(js: &mut JsonBuilder, val: *const c_char) -> bool {
pub unsafe extern "C" fn SCJbAppendString(js: &mut JsonBuilder, val: *const c_char) -> bool {
if val.is_null() {
return false;
}
@ -996,7 +996,7 @@ pub unsafe extern "C" fn jb_append_string(js: &mut JsonBuilder, val: *const c_ch
}
#[no_mangle]
pub unsafe extern "C" fn jb_append_string_from_bytes(
pub unsafe extern "C" fn SCJbAppendStringFromBytes(
js: &mut JsonBuilder, bytes: *const u8, len: u32,
) -> bool {
if bytes.is_null() || len == 0 {
@ -1007,7 +1007,7 @@ pub unsafe extern "C" fn jb_append_string_from_bytes(
}
#[no_mangle]
pub unsafe extern "C" fn jb_append_base64(
pub unsafe extern "C" fn SCJbAppendBase64(
js: &mut JsonBuilder, bytes: *const u8, len: u32,
) -> bool {
if bytes.is_null() || len == 0 {
@ -1018,17 +1018,17 @@ pub unsafe extern "C" fn jb_append_base64(
}
#[no_mangle]
pub unsafe extern "C" fn jb_append_uint(js: &mut JsonBuilder, val: u64) -> bool {
pub unsafe extern "C" fn SCJbAppendUint(js: &mut JsonBuilder, val: u64) -> bool {
return js.append_uint(val).is_ok();
}
#[no_mangle]
pub unsafe extern "C" fn jb_append_float(js: &mut JsonBuilder, val: f64) -> bool {
pub unsafe extern "C" fn SCJbAppendFloat(js: &mut JsonBuilder, val: f64) -> bool {
return js.append_float(val).is_ok();
}
#[no_mangle]
pub unsafe extern "C" fn jb_set_uint(js: &mut JsonBuilder, key: *const c_char, val: u64) -> bool {
pub unsafe extern "C" fn SCJbSetUint(js: &mut JsonBuilder, key: *const c_char, val: u64) -> bool {
if let Ok(key) = CStr::from_ptr(key).to_str() {
return js.set_uint(key, val).is_ok();
}
@ -1036,7 +1036,7 @@ pub unsafe extern "C" fn jb_set_uint(js: &mut JsonBuilder, key: *const c_char, v
}
#[no_mangle]
pub unsafe extern "C" fn jb_set_int(js: &mut JsonBuilder, key: *const c_char, val: i64) -> bool {
pub unsafe extern "C" fn SCJbSetInt(js: &mut JsonBuilder, key: *const c_char, val: i64) -> bool {
if let Ok(key) = CStr::from_ptr(key).to_str() {
return js.set_int(key, val).is_ok();
}
@ -1044,7 +1044,7 @@ pub unsafe extern "C" fn jb_set_int(js: &mut JsonBuilder, key: *const c_char, va
}
#[no_mangle]
pub unsafe extern "C" fn jb_set_float(js: &mut JsonBuilder, key: *const c_char, val: f64) -> bool {
pub unsafe extern "C" fn SCJbSetFloat(js: &mut JsonBuilder, key: *const c_char, val: f64) -> bool {
if let Ok(key) = CStr::from_ptr(key).to_str() {
return js.set_float(key, val).is_ok();
}
@ -1052,7 +1052,7 @@ pub unsafe extern "C" fn jb_set_float(js: &mut JsonBuilder, key: *const c_char,
}
#[no_mangle]
pub unsafe extern "C" fn jb_set_bool(js: &mut JsonBuilder, key: *const c_char, val: bool) -> bool {
pub unsafe extern "C" fn SCJbSetBool(js: &mut JsonBuilder, key: *const c_char, val: bool) -> bool {
if let Ok(key) = CStr::from_ptr(key).to_str() {
return js.set_bool(key, val).is_ok();
}
@ -1060,22 +1060,22 @@ pub unsafe extern "C" fn jb_set_bool(js: &mut JsonBuilder, key: *const c_char, v
}
#[no_mangle]
pub unsafe extern "C" fn jb_close(js: &mut JsonBuilder) -> bool {
pub unsafe extern "C" fn SCJbClose(js: &mut JsonBuilder) -> bool {
js.close().is_ok()
}
#[no_mangle]
pub unsafe extern "C" fn jb_len(js: &JsonBuilder) -> usize {
pub unsafe extern "C" fn SCJbLen(js: &JsonBuilder) -> usize {
js.buf.len()
}
#[no_mangle]
pub unsafe extern "C" fn jb_ptr(js: &mut JsonBuilder) -> *const u8 {
pub unsafe extern "C" fn SCJbPtr(js: &mut JsonBuilder) -> *const u8 {
js.buf.as_ptr()
}
#[no_mangle]
pub unsafe extern "C" fn jb_get_mark(js: &mut JsonBuilder, mark: &mut JsonBuilderMark) {
pub unsafe extern "C" fn SCJbGetMark(js: &mut JsonBuilder, mark: &mut JsonBuilderMark) {
let m = js.get_mark();
mark.position = m.position;
mark.state_index = m.state_index;
@ -1083,7 +1083,7 @@ pub unsafe extern "C" fn jb_get_mark(js: &mut JsonBuilder, mark: &mut JsonBuilde
}
#[no_mangle]
pub unsafe extern "C" fn jb_restore_mark(js: &mut JsonBuilder, mark: &mut JsonBuilderMark) -> bool {
pub unsafe extern "C" fn SCJbRestoreMark(js: &mut JsonBuilder, mark: &mut JsonBuilderMark) -> bool {
js.restore_mark(mark).is_ok()
}

14
scripts/dnp3-gen/dnp3-gen.py
Unescape Escape View File

@ -162,23 +162,23 @@ void OutputJsonDNP3SetItem(JsonBuilder *js, DNP3Object *object,
DNP3ObjectG{{object.group}}V{{object.variation}} *data = point->data;
{% for field in object.fields %}
{% if is_integer_type(field.type) %}
jb_set_uint(js, "{{field.name}}", data->{{field.name}});
SCJbSetUint(js, "{{field.name}}", data->{{field.name}});
{% elif field.type in ["flt32", "flt64"] %}
jb_set_float(js, "{{field.name}}", data->{{field.name}});
SCJbSetFloat(js, "{{field.name}}", data->{{field.name}});
{% elif field.type == "bytearray" %}
jb_set_base64(js, "data->{{field.name}}", data->{{field.name}}, data->{{field.len_field}});
SCJbSetBase64(js, "data->{{field.name}}", data->{{field.name}}, data->{{field.len_field}});
{% elif field.type == "vstr4" %}
jb_set_string(js, "data->{{field.name}}", data->{{field.name}});
SCJbSetString(js, "data->{{field.name}}", data->{{field.name}});
{% elif field.type == "chararray" %}
if (data->{{field.len_field}} > 0) {
jb_set_string_from_bytes(
SCJbSetStringFromBytes(
js, "{{field.name}}", (const uint8_t *)data->{{field.name}}, data->{{field.len_field}});
} else {
jb_set_string(js, "{{field.name}}", "");
SCJbSetString(js, "{{field.name}}", "");
}
{% elif field.type == "bstr8" %}
{% for field in field.fields %}
jb_set_uint(js, "{{field.name}}", data->{{field.name}});
SCJbSetUint(js, "{{field.name}}", data->{{field.name}});
{% endfor %}
{% else %}
{{ raise("Unhandled datatype: %s" % (field.type)) }}

8
src/app-layer-ftp.c
Unescape Escape View File

@ -1365,13 +1365,13 @@ uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
return c == NULL ? len : (uint16_t)(c - buffer + 1);
}
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
bool EveFTPDataAddMetadata(void *vtx, SCJsonBuilder *jb)
{
const FtpDataState *ftp_state = (FtpDataState *)vtx;
jb_open_object(jb, "ftp_data");
SCJbOpenObject(jb, "ftp_data");
if (ftp_state->file_name) {
jb_set_string_from_bytes(jb, "filename", ftp_state->file_name, ftp_state->file_len);
SCJbSetStringFromBytes(jb, "filename", ftp_state->file_name, ftp_state->file_len);
}
switch (ftp_state->command) {
case FTP_COMMAND_STOR:
@ -1383,7 +1383,7 @@ bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
default:
break;
}
jb_close(jb);
SCJbClose(jb);
return true;
}

2
src/app-layer-ftp.h
Unescape Escape View File

@ -129,6 +129,6 @@ uint64_t FTPMemuseGlobalCounter(void);
uint64_t FTPMemcapGlobalCounter(void);
uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len);
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb);
bool EveFTPDataAddMetadata(void *vtx, SCJsonBuilder *jb);
#endif /* SURICATA_APP_LAYER_FTP_H */

544
src/detect-engine-analyzer.c
View File

File diff suppressed because it is too large Load Diff

178
src/detect-engine-build.c
Unescape Escape View File

@ -599,8 +599,8 @@ static bool RuleMpmIsNegated(const Signature *s)
return (cd->flags & DETECT_CONTENT_NEGATED) ? true : false;
}
static JsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx, const SigGroupHead *sgh,
const int add_rules, const int add_mpm_stats)
static SCJsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx,
const SigGroupHead *sgh, const int add_rules, const int add_mpm_stats)
{
uint32_t prefilter_cnt = 0;
uint32_t mpm_cnt = 0;
@ -636,13 +636,13 @@ static JsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx, const
if (sgh->init == NULL)
return NULL;
JsonBuilder *js = jb_new_object();
SCJsonBuilder *js = SCJbNewObject();
if (unlikely(js == NULL))
return NULL;
jb_set_uint(js, "id", sgh->id);
SCJbSetUint(js, "id", sgh->id);
jb_open_array(js, "rules");
SCJbOpenArray(js, "rules");
for (uint32_t x = 0; x < sgh->init->sig_cnt; x++) {
const Signature *s = sgh->init->match_array[x];
if (s == NULL)
@ -765,37 +765,37 @@ static JsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx, const
alstats[s->alproto]++;
if (add_rules) {
JsonBuilder *e = jb_new_object();
SCJsonBuilder *e = SCJbNewObject();
if (e != NULL) {
jb_set_uint(e, "sig_id", s->id);
jb_close(e);
jb_append_object(js, e);
jb_free(e);
SCJbSetUint(e, "sig_id", s->id);
SCJbClose(e);
SCJbAppendObject(js, e);
SCJbFree(e);
}
}
}
jb_close(js);
SCJbClose(js);
jb_open_object(js, "stats");
jb_set_uint(js, "total", sgh->init->sig_cnt);
SCJbOpenObject(js, "stats");
SCJbSetUint(js, "total", sgh->init->sig_cnt);
jb_open_object(js, "types");
jb_set_uint(js, "mpm", mpm_cnt);
jb_set_uint(js, "non_mpm", nonmpm_cnt);
jb_set_uint(js, "mpm_depth", mpm_depth_cnt);
jb_set_uint(js, "mpm_endswith", mpm_endswith_cnt);
jb_set_uint(js, "negated_mpm", negmpm_cnt);
jb_set_uint(js, "payload_but_no_mpm", payload_no_mpm_cnt);
jb_set_uint(js, "prefilter", prefilter_cnt);
jb_set_uint(js, "syn", syn_cnt);
jb_set_uint(js, "any5", any5_cnt);
jb_close(js);
SCJbOpenObject(js, "types");
SCJbSetUint(js, "mpm", mpm_cnt);
SCJbSetUint(js, "non_mpm", nonmpm_cnt);
SCJbSetUint(js, "mpm_depth", mpm_depth_cnt);
SCJbSetUint(js, "mpm_endswith", mpm_endswith_cnt);
SCJbSetUint(js, "negated_mpm", negmpm_cnt);
SCJbSetUint(js, "payload_but_no_mpm", payload_no_mpm_cnt);
SCJbSetUint(js, "prefilter", prefilter_cnt);
SCJbSetUint(js, "syn", syn_cnt);
SCJbSetUint(js, "any5", any5_cnt);
SCJbClose(js);
for (AppProto i = 0; i < g_alproto_max; i++) {
if (alstats[i] > 0) {
const char *proto_name = (i == ALPROTO_UNKNOWN) ? "payload" : AppProtoToString(i);
jb_open_object(js, proto_name);
jb_set_uint(js, "total", alstats[i]);
SCJbOpenObject(js, proto_name);
SCJbSetUint(js, "total", alstats[i]);
for (int y = 0; y < max_buffer_type_id; y++) {
if (alproto_mpm_bufs[i][y] == 0)
@ -807,14 +807,14 @@ static JsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx, const
else
name = DetectEngineBufferTypeGetNameById(de_ctx, y);
jb_set_uint(js, name, alproto_mpm_bufs[i][y]);
SCJbSetUint(js, name, alproto_mpm_bufs[i][y]);
}
jb_close(js);
SCJbClose(js);
}
}
if (add_mpm_stats) {
jb_open_object(js, "mpm");
SCJbOpenObject(js, "mpm");
for (int i = 0; i < max_buffer_type_id; i++) {
if (mpm_stats[i].cnt > 0) {
@ -824,42 +824,42 @@ static JsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx, const
else
name = DetectEngineBufferTypeGetNameById(de_ctx, i);
jb_open_array(js, name);
SCJbOpenArray(js, name);
for (int y = 0; y < 256; y++) {
if (mpm_sizes[i][y] == 0)
continue;
JsonBuilder *e = jb_new_object();
SCJsonBuilder *e = SCJbNewObject();
if (e != NULL) {
jb_set_uint(e, "size", y);
jb_set_uint(e, "count", mpm_sizes[i][y]);
jb_close(e);
jb_append_object(js, e);
jb_free(e);
SCJbSetUint(e, "size", y);
SCJbSetUint(e, "count", mpm_sizes[i][y]);
SCJbClose(e);
SCJbAppendObject(js, e);
SCJbFree(e);
}
}
JsonBuilder *e = jb_new_object();
SCJsonBuilder *e = SCJbNewObject();
if (e != NULL) {
jb_set_uint(e, "total", mpm_stats[i].cnt);
jb_set_uint(e, "avg_strength", mpm_stats[i].total / mpm_stats[i].cnt);
jb_set_uint(e, "min_strength", mpm_stats[i].min);
jb_set_uint(e, "max_strength", mpm_stats[i].max);
jb_close(e);
jb_append_object(js, e);
jb_free(e);
SCJbSetUint(e, "total", mpm_stats[i].cnt);
SCJbSetUint(e, "avg_strength", mpm_stats[i].total / mpm_stats[i].cnt);
SCJbSetUint(e, "min_strength", mpm_stats[i].min);
SCJbSetUint(e, "max_strength", mpm_stats[i].max);
SCJbClose(e);
SCJbAppendObject(js, e);
SCJbFree(e);
}
jb_close(js);
SCJbClose(js);
}
}
jb_close(js);
SCJbClose(js);
}
jb_close(js);
SCJbClose(js);
jb_set_uint(js, "score", sgh->init->score);
jb_close(js);
SCJbSetUint(js, "score", sgh->init->score);
SCJbClose(js);
return js;
}
@ -867,7 +867,7 @@ static JsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx, const
static void RulesDumpGrouping(const DetectEngineCtx *de_ctx,
const int add_rules, const int add_mpm_stats)
{
JsonBuilder *js = jb_new_object();
SCJsonBuilder *js = SCJbNewObject();
if (unlikely(js == NULL))
return;
@ -875,70 +875,70 @@ static void RulesDumpGrouping(const DetectEngineCtx *de_ctx,
if (p == IPPROTO_TCP || p == IPPROTO_UDP) {
const char *name = (p == IPPROTO_TCP) ? "tcp" : "udp";
jb_open_object(js, name);
jb_open_array(js, "toserver");
SCJbOpenObject(js, name);
SCJbOpenArray(js, "toserver");
const DetectPort *list =
(p == IPPROTO_TCP) ? de_ctx->flow_gh[1].tcp : de_ctx->flow_gh[1].udp;
while (list != NULL) {
JsonBuilder *port = jb_new_object();
jb_set_uint(port, "port", list->port);
jb_set_uint(port, "port2", list->port2);
SCJsonBuilder *port = SCJbNewObject();
SCJbSetUint(port, "port", list->port);
SCJbSetUint(port, "port2", list->port2);
JsonBuilder *stats =
SCJsonBuilder *stats =
RulesGroupPrintSghStats(de_ctx, list->sh, add_rules, add_mpm_stats);
jb_set_object(port, "rulegroup", stats);
jb_free(stats);
jb_close(port);
jb_append_object(js, port);
jb_free(port);
SCJbSetObject(port, "rulegroup", stats);
SCJbFree(stats);
SCJbClose(port);
SCJbAppendObject(js, port);
SCJbFree(port);
list = list->next;
}
jb_close(js); // toserver array
SCJbClose(js); // toserver array
jb_open_array(js, "toclient");
SCJbOpenArray(js, "toclient");
list = (p == IPPROTO_TCP) ? de_ctx->flow_gh[0].tcp :
de_ctx->flow_gh[0].udp;
while (list != NULL) {
JsonBuilder *port = jb_new_object();
jb_set_uint(port, "port", list->port);
jb_set_uint(port, "port2", list->port2);
SCJsonBuilder *port = SCJbNewObject();
SCJbSetUint(port, "port", list->port);
SCJbSetUint(port, "port2", list->port2);
JsonBuilder *stats =
SCJsonBuilder *stats =
RulesGroupPrintSghStats(de_ctx, list->sh, add_rules, add_mpm_stats);
jb_set_object(port, "rulegroup", stats);
jb_free(stats);
jb_close(port);
jb_append_object(js, port);
jb_free(port);
SCJbSetObject(port, "rulegroup", stats);
SCJbFree(stats);
SCJbClose(port);
SCJbAppendObject(js, port);
SCJbFree(port);
list = list->next;
}
jb_close(js); // toclient array
jb_close(js);
SCJbClose(js); // toclient array
SCJbClose(js);
} else if (p == IPPROTO_ICMP || p == IPPROTO_ICMPV6) {
const char *name = (p == IPPROTO_ICMP) ? "icmpv4" : "icmpv6";
jb_open_object(js, name);
SCJbOpenObject(js, name);
if (de_ctx->flow_gh[1].sgh[p]) {
jb_open_object(js, "toserver");
JsonBuilder *stats = RulesGroupPrintSghStats(
SCJbOpenObject(js, "toserver");
SCJsonBuilder *stats = RulesGroupPrintSghStats(
de_ctx, de_ctx->flow_gh[1].sgh[p], add_rules, add_mpm_stats);
jb_set_object(js, "rulegroup", stats);
jb_free(stats);
jb_close(js);
SCJbSetObject(js, "rulegroup", stats);
SCJbFree(stats);
SCJbClose(js);
}
if (de_ctx->flow_gh[0].sgh[p]) {
jb_open_object(js, "toclient");
JsonBuilder *stats = RulesGroupPrintSghStats(
SCJbOpenObject(js, "toclient");
SCJsonBuilder *stats = RulesGroupPrintSghStats(
de_ctx, de_ctx->flow_gh[0].sgh[p], add_rules, add_mpm_stats);
jb_set_object(js, "rulegroup", stats);
jb_free(stats);
jb_close(js);
SCJbSetObject(js, "rulegroup", stats);
SCJbFree(stats);
SCJbClose(js);
}
jb_close(js);
SCJbClose(js);
}
}
jb_close(js);
SCJbClose(js);
const char *filename = "rule_group.json";
const char *log_dir = SCConfigGetLogDirectory();
@ -947,10 +947,10 @@ static void RulesDumpGrouping(const DetectEngineCtx *de_ctx,
FILE *fp = fopen(log_path, "w");
if (fp != NULL) {
fwrite(jb_ptr(js), jb_len(js), 1, fp);
fwrite(SCJbPtr(js), SCJbLen(js), 1, fp);
(void)fclose(fp);
}
jb_free(js);
SCJbFree(js);
}
static int RulesGroupByIPProto(DetectEngineCtx *de_ctx)

59
src/detect-engine-profile.c
Unescape Escape View File

@ -35,31 +35,31 @@ void RulesDumpTxMatchArray(const DetectEngineThreadCtx *det_ctx, const SigGroupH
const Packet *p, const uint64_t tx_id, const uint32_t rule_cnt,
const uint32_t pkt_prefilter_cnt)
{
JsonBuilder *js =
SCJsonBuilder *js =
CreateEveHeaderWithTxId(p, LOG_DIR_PACKET, "inspectedrules", NULL, tx_id, NULL);
if (js == NULL)
return;
jb_set_string(js, "app_proto", AppProtoToString(p->flow->alproto));
SCJbSetString(js, "app_proto", AppProtoToString(p->flow->alproto));
jb_open_object(js, "inspectedrules");
jb_set_string(js, "inspect_type", "tx");
jb_set_uint(js, "rule_group_id", sgh->id);
jb_set_uint(js, "rule_cnt", rule_cnt);
jb_set_uint(js, "pkt_rule_cnt", pkt_prefilter_cnt);
jb_set_uint(js, "non_pf_rule_cnt", det_ctx->non_pf_store_cnt);
SCJbOpenObject(js, "inspectedrules");
SCJbSetString(js, "inspect_type", "tx");
SCJbSetUint(js, "rule_group_id", sgh->id);
SCJbSetUint(js, "rule_cnt", rule_cnt);
SCJbSetUint(js, "pkt_rule_cnt", pkt_prefilter_cnt);
SCJbSetUint(js, "non_pf_rule_cnt", det_ctx->non_pf_store_cnt);
jb_open_array(js, "rules");
SCJbOpenArray(js, "rules");
for (uint32_t x = 0; x < rule_cnt; x++) {
SigIntId iid = det_ctx->tx_candidates[x].id;
const Signature *s = det_ctx->de_ctx->sig_array[iid];
if (s == NULL)
continue;
jb_append_uint(js, s->id);
SCJbAppendUint(js, s->id);
}
jb_close(js); // close array
jb_close(js); // close inspectedrules object
jb_close(js); // final close
SCJbClose(js); // close array
SCJbClose(js); // close inspectedrules object
SCJbClose(js); // final close
const char *filename = "packet_inspected_rules.json";
const char *log_dir = SCConfigGetLogDirectory();
@ -69,41 +69,40 @@ void RulesDumpTxMatchArray(const DetectEngineThreadCtx *det_ctx, const SigGroupH
SCMutexLock(&g_rule_dump_write_m);
FILE *fp = fopen(log_path, "a");
if (fp != NULL) {
fwrite(jb_ptr(js), jb_len(js), 1, fp);
fwrite(SCJbPtr(js), SCJbLen(js), 1, fp);
fclose(fp);
}
SCMutexUnlock(&g_rule_dump_write_m);
jb_free(js);
SCJbFree(js);
}
void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx,
const SigGroupHead *sgh, const Packet *p)
{
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "inspectedrules", NULL, NULL);
SCJsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "inspectedrules", NULL, NULL);
if (js == NULL)
return;
if (p->flow) {
jb_set_string(js, "app_proto", AppProtoToString(p->flow->alproto));
SCJbSetString(js, "app_proto", AppProtoToString(p->flow->alproto));
}
jb_open_object(js, "inspectedrules");
jb_set_string(js, "inspect_type", "packet");
jb_set_uint(js, "rule_group_id", sgh->id);
jb_set_uint(js, "rule_cnt", det_ctx->match_array_cnt);
jb_set_uint(js, "non_pf_rule_cnt", det_ctx->non_pf_store_cnt);
SCJbOpenObject(js, "inspectedrules");
SCJbSetString(js, "inspect_type", "packet");
SCJbSetUint(js, "rule_group_id", sgh->id);
SCJbSetUint(js, "rule_cnt", det_ctx->match_array_cnt);
SCJbSetUint(js, "non_pf_rule_cnt", det_ctx->non_pf_store_cnt);
jb_open_array(js, "rules");
SCJbOpenArray(js, "rules");
for (uint32_t x = 0; x < det_ctx->match_array_cnt; x++) {
const Signature *s = det_ctx->match_array[x];
if (s == NULL)
continue;
jb_append_uint(js, s->id);
SCJbAppendUint(js, s->id);
}
jb_close(js); // close array
jb_close(js); // close inspectedrules object
jb_close(js); // final close
SCJbClose(js); // close array
SCJbClose(js); // close inspectedrules object
SCJbClose(js); // final close
const char *filename = "packet_inspected_rules.json";
const char *log_dir = SCConfigGetLogDirectory();
@ -113,10 +112,10 @@ void RulesDumpMatchArray(const DetectEngineThreadCtx *det_ctx,
SCMutexLock(&g_rule_dump_write_m);
FILE *fp = fopen(log_path, "a");
if (fp != NULL) {
fwrite(jb_ptr(js), jb_len(js), 1, fp);
fwrite(SCJbPtr(js), SCJbLen(js), 1, fp);
fclose(fp);
}
SCMutexUnlock(&g_rule_dump_write_m);
jb_free(js);
SCJbFree(js);
}
#endif /* PROFILING */

60
src/detect-flowbits.c
Unescape Escape View File

@ -812,11 +812,11 @@ SCMutex g_flowbits_dump_write_m = SCMUTEX_INITIALIZER;
static void DetectFlowbitsAnalyzeDump(const DetectEngineCtx *de_ctx,
struct FBAnalyze *array, uint32_t elements)
{
JsonBuilder *js = jb_new_object();
SCJsonBuilder *js = SCJbNewObject();
if (js == NULL)
return;
jb_open_array(js, "flowbits");
SCJbOpenArray(js, "flowbits");
for (uint32_t x = 0; x < elements; x++) {
const char *varname = VarNameStoreSetupLookup(x, VAR_TYPE_FLOW_BIT);
if (varname == NULL)
@ -824,64 +824,64 @@ static void DetectFlowbitsAnalyzeDump(const DetectEngineCtx *de_ctx,
const struct FBAnalyze *e = &array[x];
jb_start_object(js);
jb_set_string(js, "name", varname);
jb_set_uint(js, "internal_id", x);
jb_set_uint(js, "set_cnt", e->cnts[DETECT_FLOWBITS_CMD_SET]);
jb_set_uint(js, "unset_cnt", e->cnts[DETECT_FLOWBITS_CMD_UNSET]);
jb_set_uint(js, "toggle_cnt", e->cnts[DETECT_FLOWBITS_CMD_TOGGLE]);
jb_set_uint(js, "isset_cnt", e->cnts[DETECT_FLOWBITS_CMD_ISSET]);
jb_set_uint(js, "isnotset_cnt", e->cnts[DETECT_FLOWBITS_CMD_ISNOTSET]);
SCJbStartObject(js);
SCJbSetString(js, "name", varname);
SCJbSetUint(js, "internal_id", x);
SCJbSetUint(js, "set_cnt", e->cnts[DETECT_FLOWBITS_CMD_SET]);
SCJbSetUint(js, "unset_cnt", e->cnts[DETECT_FLOWBITS_CMD_UNSET]);
SCJbSetUint(js, "toggle_cnt", e->cnts[DETECT_FLOWBITS_CMD_TOGGLE]);
SCJbSetUint(js, "isset_cnt", e->cnts[DETECT_FLOWBITS_CMD_ISSET]);
SCJbSetUint(js, "isnotset_cnt", e->cnts[DETECT_FLOWBITS_CMD_ISNOTSET]);
// sets
if (e->cnts[DETECT_FLOWBITS_CMD_SET]) {
jb_open_array(js, "sets");
SCJbOpenArray(js, "sets");
for (uint32_t i = 0; i < e->set_sids_idx; i++) {
const Signature *s = de_ctx->sig_array[e->set_sids[i]];
jb_append_uint(js, s->id);
SCJbAppendUint(js, s->id);
}
jb_close(js);
SCJbClose(js);
}
// gets
if (e->cnts[DETECT_FLOWBITS_CMD_ISSET]) {
jb_open_array(js, "isset");
SCJbOpenArray(js, "isset");
for (uint32_t i = 0; i < e->isset_sids_idx; i++) {
const Signature *s = de_ctx->sig_array[e->isset_sids[i]];
jb_append_uint(js, s->id);
SCJbAppendUint(js, s->id);
}
jb_close(js);
SCJbClose(js);
}
// isnotset
if (e->cnts[DETECT_FLOWBITS_CMD_ISNOTSET]) {
jb_open_array(js, "isnotset");
SCJbOpenArray(js, "isnotset");
for (uint32_t i = 0; i < e->isnotset_sids_idx; i++) {
const Signature *s = de_ctx->sig_array[e->isnotset_sids[i]];
jb_append_uint(js, s->id);
SCJbAppendUint(js, s->id);
}
jb_close(js);
SCJbClose(js);
}
// unset
if (e->cnts[DETECT_FLOWBITS_CMD_UNSET]) {
jb_open_array(js, "unset");
SCJbOpenArray(js, "unset");
for (uint32_t i = 0; i < e->unset_sids_idx; i++) {
const Signature *s = de_ctx->sig_array[e->unset_sids[i]];
jb_append_uint(js, s->id);
SCJbAppendUint(js, s->id);
}
jb_close(js);
SCJbClose(js);
}
// toggle
if (e->cnts[DETECT_FLOWBITS_CMD_TOGGLE]) {
jb_open_array(js, "toggle");
SCJbOpenArray(js, "toggle");
for (uint32_t i = 0; i < e->toggle_sids_idx; i++) {
const Signature *s = de_ctx->sig_array[e->toggle_sids[i]];
jb_append_uint(js, s->id);
SCJbAppendUint(js, s->id);
}
jb_close(js);
SCJbClose(js);
}
jb_close(js);
SCJbClose(js);
}
jb_close(js); // array
jb_close(js); // object
SCJbClose(js); // array
SCJbClose(js); // object
const char *filename = "flowbits.json";
const char *log_dir = SCConfigGetLogDirectory();
@ -891,13 +891,13 @@ static void DetectFlowbitsAnalyzeDump(const DetectEngineCtx *de_ctx,
SCMutexLock(&g_flowbits_dump_write_m);
FILE *fp = fopen(log_path, "w");
if (fp != NULL) {
fwrite(jb_ptr(js), jb_len(js), 1, fp);
fwrite(SCJbPtr(js), SCJbLen(js), 1, fp);
fprintf(fp, "\n");
fclose(fp);
}
SCMutexUnlock(&g_flowbits_dump_write_m);
jb_free(js);
SCJbFree(js);
}
static bool PrefilterFlowbitIsPrefilterable(const Signature *s)

22
src/detect-metadata.c
Unescape Escape View File

@ -129,7 +129,7 @@ static char *CraftPreformattedJSON(const DetectMetadata *head)
BUG_ON(i != cnt);
qsort(array, cnt, sizeof(DetectMetadata *), SortHelper);
JsonBuilder *js = jb_new_object();
SCJsonBuilder *js = SCJbNewObject();
if (js == NULL)
return NULL;
@ -143,38 +143,38 @@ static char *CraftPreformattedJSON(const DetectMetadata *head)
if (nm && strcasecmp(m->key, nm->key) == 0) {
if (!array_open) {
jb_open_array(js, m->key);
SCJbOpenArray(js, m->key);
array_open = true;
}
jb_append_string(js, m->value);
SCJbAppendString(js, m->value);
} else {
if (!array_open) {
jb_open_array(js, m->key);
SCJbOpenArray(js, m->key);
}
jb_append_string(js, m->value);
jb_close(js);
SCJbAppendString(js, m->value);
SCJbClose(js);
array_open = false;
}
}
jb_close(js);
SCJbClose(js);
/* we have a complete json builder. Now store it as a C string */
const size_t len = jb_len(js);
const size_t len = SCJbLen(js);
#define MD_STR "\"metadata\":"
#define MD_STR_LEN (sizeof(MD_STR) - 1)
char *str = SCMalloc(len + MD_STR_LEN + 1);
if (str == NULL) {
jb_free(js);
SCJbFree(js);
return NULL;
}
char *ptr = str;
memcpy(ptr, MD_STR, MD_STR_LEN);
ptr += MD_STR_LEN;
memcpy(ptr, jb_ptr(js), len);
memcpy(ptr, SCJbPtr(js), len);
ptr += len;
*ptr = '\0';
#undef MD_STR
#undef MD_STR_LEN
jb_free(js);
SCJbFree(js);
return str;
}

204
src/output-eve-stream.c
Unescape Escape View File

@ -174,107 +174,107 @@ static OutputInitResult EveStreamLogInitCtxSub(SCConfNode *conf, OutputCtx *pare
return result;
}
void EveAddFlowTcpStreamFlags(const TcpStream *stream, const char *name, JsonBuilder *jb)
void EveAddFlowTcpStreamFlags(const TcpStream *stream, const char *name, SCJsonBuilder *jb)
{
jb_open_array(jb, name);
SCJbOpenArray(jb, name);
if (stream->flags & STREAMTCP_STREAM_FLAG_HAS_GAP)
jb_append_string(jb, "has_gap");
SCJbAppendString(jb, "has_gap");
if (stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)
jb_append_string(jb, "noreassembly");
SCJbAppendString(jb, "noreassembly");
if (stream->flags & STREAMTCP_STREAM_FLAG_KEEPALIVE)
jb_append_string(jb, "keepalive");
SCJbAppendString(jb, "keepalive");
if (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED)
jb_append_string(jb, "depth_reached");
SCJbAppendString(jb, "depth_reached");
if (stream->flags & STREAMTCP_STREAM_FLAG_TRIGGER_RAW)
jb_append_string(jb, "trigger_raw");
SCJbAppendString(jb, "trigger_raw");
if (stream->flags & STREAMTCP_STREAM_FLAG_TIMESTAMP)
jb_append_string(jb, "timestamp");
SCJbAppendString(jb, "timestamp");
if (stream->flags & STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP)
jb_append_string(jb, "zero_timestamp");
SCJbAppendString(jb, "zero_timestamp");
if (stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)
jb_append_string(jb, "appproto_detection_completed");
SCJbAppendString(jb, "appproto_detection_completed");
if (stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED)
jb_append_string(jb, "appproto_detection_skipped");
SCJbAppendString(jb, "appproto_detection_skipped");
if (stream->flags & STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED)
jb_append_string(jb, "new_raw_disabled");
SCJbAppendString(jb, "new_raw_disabled");
if (stream->flags & STREAMTCP_STREAM_FLAG_DISABLE_RAW)
jb_append_string(jb, "disable_raw");
SCJbAppendString(jb, "disable_raw");
if (stream->flags & STREAMTCP_STREAM_FLAG_RST_RECV)
jb_append_string(jb, "rst_recv");
jb_close(jb);
SCJbAppendString(jb, "rst_recv");
SCJbClose(jb);
}
void EveAddFlowTcpFlags(const TcpSession *ssn, const char *name, JsonBuilder *jb)
void EveAddFlowTcpFlags(const TcpSession *ssn, const char *name, SCJsonBuilder *jb)
{
jb_open_object(jb, "flags");
SCJbOpenObject(jb, "flags");
jb_open_array(jb, name);
SCJbOpenArray(jb, name);
if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) {
jb_append_string(jb, "midstream");
SCJbAppendString(jb, "midstream");
}
if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED) {
jb_append_string(jb, "midstream_established");
SCJbAppendString(jb, "midstream_established");
}
if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM_SYNACK) {
jb_append_string(jb, "midstream_synack");
SCJbAppendString(jb, "midstream_synack");
}
if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) {
jb_append_string(jb, "timestamp");
SCJbAppendString(jb, "timestamp");
}
if (ssn->flags & STREAMTCP_FLAG_SERVER_WSCALE) {
jb_append_string(jb, "server_wscale");
SCJbAppendString(jb, "server_wscale");
}
if (ssn->flags & STREAMTCP_FLAG_CLOSED_BY_RST) {
jb_append_string(jb, "closed_by_rst");
SCJbAppendString(jb, "closed_by_rst");
}
if (ssn->flags & STREAMTCP_FLAG_4WHS) {
jb_append_string(jb, "4whs");
SCJbAppendString(jb, "4whs");
}
if (ssn->flags & STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT) {
jb_append_string(jb, "detect_evasion_attempt");
SCJbAppendString(jb, "detect_evasion_attempt");
}
if (ssn->flags & STREAMTCP_FLAG_CLIENT_SACKOK) {
jb_append_string(jb, "client_sackok");
SCJbAppendString(jb, "client_sackok");
}
if (ssn->flags & STREAMTCP_FLAG_CLIENT_SACKOK) {
jb_append_string(jb, "sackok");
SCJbAppendString(jb, "sackok");
}
if (ssn->flags & STREAMTCP_FLAG_3WHS_CONFIRMED) {
jb_append_string(jb, "3whs_confirmed");
SCJbAppendString(jb, "3whs_confirmed");
}
if (ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) {
jb_append_string(jb, "app_layer_disabled");
SCJbAppendString(jb, "app_layer_disabled");
}
if (ssn->flags & STREAMTCP_FLAG_BYPASS) {
jb_append_string(jb, "bypass");
SCJbAppendString(jb, "bypass");
}
if (ssn->flags & STREAMTCP_FLAG_TCP_FAST_OPEN) {
jb_append_string(jb, "tcp_fast_open");
SCJbAppendString(jb, "tcp_fast_open");
}
if (ssn->flags & STREAMTCP_FLAG_TFO_DATA_IGNORED) {
jb_append_string(jb, "tfo_data_ignored");
SCJbAppendString(jb, "tfo_data_ignored");
}
jb_close(jb);
jb_close(jb);
SCJbClose(jb);
SCJbClose(jb);
}
static void LogStreamSB(const StreamingBuffer *sb, JsonBuilder *js)
static void LogStreamSB(const StreamingBuffer *sb, SCJsonBuilder *js)
{
jb_set_uint(js, "sb_region_size", sb->region.buf_size);
SCJbSetUint(js, "sb_region_size", sb->region.buf_size);
}
static void LogStream(const TcpStream *stream, JsonBuilder *js)
static void LogStream(const TcpStream *stream, SCJsonBuilder *js)
{
jb_set_uint(js, "isn", stream->isn);
jb_set_uint(js, "next_seq", stream->next_seq);
jb_set_uint(js, "last_ack", stream->last_ack);
jb_set_uint(js, "next_win", stream->next_win);
SCJbSetUint(js, "isn", stream->isn);
SCJbSetUint(js, "next_seq", stream->next_seq);
SCJbSetUint(js, "last_ack", stream->last_ack);
SCJbSetUint(js, "next_win", stream->next_win);
if (!(stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) {
jb_set_uint(js, "base_seq", stream->base_seq);
jb_set_uint(js, "segs_right_edge", stream->segs_right_edge);
SCJbSetUint(js, "base_seq", stream->base_seq);
SCJbSetUint(js, "segs_right_edge", stream->segs_right_edge);
}
jb_set_uint(js, "window", stream->window);
jb_set_uint(js, "wscale", stream->wscale);
SCJbSetUint(js, "window", stream->window);
SCJbSetUint(js, "wscale", stream->wscale);
EveAddFlowTcpStreamFlags(stream, "flags", js);
@ -284,7 +284,7 @@ static void LogStream(const TcpStream *stream, JsonBuilder *js)
{
segs++;
}
jb_set_uint(js, "seg_cnt", segs);
SCJbSetUint(js, "seg_cnt", segs);
LogStreamSB(&stream->sb, js);
}
@ -305,104 +305,104 @@ static int EveStreamLogger(ThreadVars *tv, void *thread_data, const Packet *p)
JsonAddrInfo addr = json_addr_info_zero;
JsonAddrInfoInit(p, LOG_DIR_PACKET, &addr);
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "stream_tcp", &addr, ctx->eve_ctx);
SCJsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "stream_tcp", &addr, ctx->eve_ctx);
if (unlikely(js == NULL))
return TM_ECODE_OK;
if (p->flow != NULL) {
if (p->flowflags & FLOW_PKT_TOSERVER) {
jb_set_string(js, "direction", "to_server");
SCJbSetString(js, "direction", "to_server");
} else {
jb_set_string(js, "direction", "to_client");
SCJbSetString(js, "direction", "to_client");
}
}
jb_open_object(js, "stream_tcp");
jb_open_object(js, "packet");
SCJbOpenObject(js, "stream_tcp");
SCJbOpenObject(js, "packet");
if (PacketIsIPv4(p)) {
const IPV4Hdr *ip4h = PacketGetIPv4(p);
jb_set_uint(js, "len", IPV4_GET_RAW_IPLEN(ip4h));
jb_set_uint(js, "tos", IPV4_GET_RAW_IPTOS(ip4h));
jb_set_uint(js, "ttl", IPV4_GET_RAW_IPTTL(ip4h));
jb_set_uint(js, "ipid", IPV4_GET_RAW_IPID(ip4h));
SCJbSetUint(js, "len", IPV4_GET_RAW_IPLEN(ip4h));
SCJbSetUint(js, "tos", IPV4_GET_RAW_IPTOS(ip4h));
SCJbSetUint(js, "ttl", IPV4_GET_RAW_IPTTL(ip4h));
SCJbSetUint(js, "ipid", IPV4_GET_RAW_IPID(ip4h));
} else if (PacketIsIPv6(p)) {
const IPV6Hdr *ip6h = PacketGetIPv6(p);
jb_set_uint(js, "len", IPV6_GET_RAW_PLEN(ip6h));
jb_set_uint(js, "tc", IPV6_GET_RAW_CLASS(ip6h));
jb_set_uint(js, "hoplimit", IPV6_GET_RAW_HLIM(ip6h));
jb_set_uint(js, "flowlbl", IPV6_GET_RAW_FLOW(ip6h));
SCJbSetUint(js, "len", IPV6_GET_RAW_PLEN(ip6h));
SCJbSetUint(js, "tc", IPV6_GET_RAW_CLASS(ip6h));
SCJbSetUint(js, "hoplimit", IPV6_GET_RAW_HLIM(ip6h));
SCJbSetUint(js, "flowlbl", IPV6_GET_RAW_FLOW(ip6h));
}
if (PacketIsTCP(p)) {
const TCPHdr *tcph = PacketGetTCP(p);
jb_set_uint(js, "tcpseq", TCP_GET_RAW_SEQ(tcph));
jb_set_uint(js, "tcpack", TCP_GET_RAW_ACK(tcph));
jb_set_uint(js, "tcpwin", TCP_GET_RAW_WINDOW(tcph));
jb_set_bool(js, "syn", TCP_ISSET_FLAG_RAW_SYN(tcph) ? true : false);
jb_set_bool(js, "ack", TCP_ISSET_FLAG_RAW_ACK(tcph) ? true : false);
jb_set_bool(js, "psh", TCP_ISSET_FLAG_RAW_PUSH(tcph) ? true : false);
jb_set_bool(js, "rst", TCP_ISSET_FLAG_RAW_RST(tcph) ? true : false);
jb_set_bool(js, "urg", TCP_ISSET_FLAG_RAW_URG(tcph) ? true : false);
jb_set_bool(js, "fin", TCP_ISSET_FLAG_RAW_FIN(tcph) ? true : false);
jb_set_uint(js, "tcpres", TCP_GET_RAW_X2(tcph));
jb_set_uint(js, "tcpurgp", TCP_GET_RAW_URG_POINTER(tcph));
jb_open_array(js, "flags");
SCJbSetUint(js, "tcpseq", TCP_GET_RAW_SEQ(tcph));
SCJbSetUint(js, "tcpack", TCP_GET_RAW_ACK(tcph));
SCJbSetUint(js, "tcpwin", TCP_GET_RAW_WINDOW(tcph));
SCJbSetBool(js, "syn", TCP_ISSET_FLAG_RAW_SYN(tcph) ? true : false);
SCJbSetBool(js, "ack", TCP_ISSET_FLAG_RAW_ACK(tcph) ? true : false);
SCJbSetBool(js, "psh", TCP_ISSET_FLAG_RAW_PUSH(tcph) ? true : false);
SCJbSetBool(js, "rst", TCP_ISSET_FLAG_RAW_RST(tcph) ? true : false);
SCJbSetBool(js, "urg", TCP_ISSET_FLAG_RAW_URG(tcph) ? true : false);
SCJbSetBool(js, "fin", TCP_ISSET_FLAG_RAW_FIN(tcph) ? true : false);
SCJbSetUint(js, "tcpres", TCP_GET_RAW_X2(tcph));
SCJbSetUint(js, "tcpurgp", TCP_GET_RAW_URG_POINTER(tcph));
SCJbOpenArray(js, "flags");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_RETRANSMISSION)
jb_append_string(js, "retransmission");
SCJbAppendString(js, "retransmission");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_SPURIOUS_RETRANSMISSION)
jb_append_string(js, "spurious_retransmission");
SCJbAppendString(js, "spurious_retransmission");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_KEEPALIVE)
jb_append_string(js, "keepalive");
SCJbAppendString(js, "keepalive");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_KEEPALIVEACK)
jb_append_string(js, "keepalive_ack");
SCJbAppendString(js, "keepalive_ack");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_WINDOWUPDATE)
jb_append_string(js, "window_update");
SCJbAppendString(js, "window_update");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_EVENTSET)
jb_append_string(js, "event_set");
SCJbAppendString(js, "event_set");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_STATE_UPDATE)
jb_append_string(js, "state_update");
SCJbAppendString(js, "state_update");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_DUP_ACK)
jb_append_string(js, "dup_ack");
SCJbAppendString(js, "dup_ack");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_DSACK)
jb_append_string(js, "dsack");
SCJbAppendString(js, "dsack");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_ACK_UNSEEN_DATA)
jb_append_string(js, "ack_unseen_data");
SCJbAppendString(js, "ack_unseen_data");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_TCP_SESSION_REUSE)
jb_append_string(js, "tcp_session_reuse");
SCJbAppendString(js, "tcp_session_reuse");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_TCP_ZERO_WIN_PROBE)
jb_append_string(js, "zero_window_probe");
SCJbAppendString(js, "zero_window_probe");
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_TCP_ZERO_WIN_PROBE_ACK)
jb_append_string(js, "zero_window_probe_ack");
jb_close(js);
SCJbAppendString(js, "zero_window_probe_ack");
SCJbClose(js);
}
jb_close(js);
SCJbClose(js);
jb_open_object(js, "session");
SCJbOpenObject(js, "session");
if (p->flow != NULL && p->flow->protoctx != NULL) {
const TcpSession *ssn = p->flow->protoctx;
const char *tcp_state = StreamTcpStateAsString(ssn->state);
if (tcp_state != NULL)
jb_set_string(js, "state", tcp_state);
SCJbSetString(js, "state", tcp_state);
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_STATE_UPDATE) {
const char *tcp_pstate = StreamTcpStateAsString(ssn->pstate);
if (tcp_pstate != NULL)
jb_set_string(js, "pstate", tcp_pstate);
SCJbSetString(js, "pstate", tcp_pstate);
}
EveAddFlowTcpFlags(ssn, "flags", js);
jb_open_object(js, "client");
SCJbOpenObject(js, "client");
LogStream(&ssn->client, js);
jb_close(js);
jb_open_object(js, "server");
SCJbClose(js);
SCJbOpenObject(js, "server");
LogStream(&ssn->server, js);
jb_close(js);
SCJbClose(js);
}
jb_close(js);
SCJbClose(js);
if (p->l4.vars.tcp.stream_pkt_flags & STREAM_PKT_FLAG_EVENTSET) {
jb_open_array(js, "events");
SCJbOpenArray(js, "events");
for (int i = 0; i < p->events.cnt; i++) {
uint8_t event_code = p->events.events[i];
bool is_decode = EVENT_IS_DECODER_PACKET_ERROR(event_code);
@ -413,21 +413,21 @@ static int EveStreamLogger(ThreadVars *tv, void *thread_data, const Packet *p)
const char *event = DEvents[event_code].event_name;
if (event == NULL)
continue;
jb_append_string(js, event);
SCJbAppendString(js, event);
}
jb_close(js);
SCJbClose(js);
}
if (p->drop_reason != 0) {
const char *str = PacketDropReasonToString(p->drop_reason);
jb_set_string(js, "reason", str);
SCJbSetString(js, "reason", str);
}
/* Close stream. */
jb_close(js);
SCJbClose(js);
OutputJsonBuilderBuffer(tv, p, p->flow, js, td->ctx);
jb_free(js);
SCJbFree(js);
return TM_ECODE_OK;
}

4
src/output-eve-stream.h
Unescape Escape View File

@ -25,7 +25,7 @@
#include "stream-tcp.h"
void EveStreamLogRegister(void);
void EveAddFlowTcpStreamFlags(const TcpStream *stream, const char *name, JsonBuilder *jb);
void EveAddFlowTcpFlags(const TcpSession *ssn, const char *name, JsonBuilder *jb);
void EveAddFlowTcpStreamFlags(const TcpStream *stream, const char *name, SCJsonBuilder *jb);
void EveAddFlowTcpFlags(const TcpSession *ssn, const char *name, SCJsonBuilder *jb);
#endif /* SURICATA_OUTPUT_EVE_STREAM_H */

2
src/output-eve.c
Unescape Escape View File

@ -50,7 +50,7 @@ bool SCEveRegisterCallback(SCEveUserCallbackFn fn, void *user)
return true;
}
void SCEveRunCallbacks(ThreadVars *tv, const Packet *p, Flow *f, JsonBuilder *jb)
void SCEveRunCallbacks(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *jb)
{
EveUserCallback *cb = eve_user_callbacks;
while (cb != NULL) {

12
src/output-eve.h
Unescape Escape View File

@ -178,9 +178,9 @@ SCEveFileType *SCEveFindFileType(const char *name);
*
* The function type for callbacks registered with
* SCEveRegisterCallback. This function will be called with the
* JsonBuilder just prior to the top-level object being closed. New
* SCJsonBuilder just prior to the top-level object being closed. New
* fields maybe added, however there is no way to alter existing
* objects already added to the JsonBuilder.
* objects already added to the SCJsonBuilder.
*
* \param tv The ThreadVars for the thread performing the logging.
* \param p Packet if available.
@ -188,12 +188,12 @@ SCEveFileType *SCEveFindFileType(const char *name);
* \param user User data provided during callback registration.
*/
typedef void (*SCEveUserCallbackFn)(
ThreadVars *tv, const Packet *p, Flow *f, JsonBuilder *jb, void *user);
ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *jb, void *user);
/** \brief Register a callback for adding extra information to EVE logs.
*
* Allow users to register a callback for each EVE log. The callback
* is called just before the root object on the JsonBuilder is to be
* is called just before the root object on the SCJsonBuilder is to be
* closed.
*
* New objects and fields can be append, but exist entries cannot be modified.
@ -202,7 +202,7 @@ typedef void (*SCEveUserCallbackFn)(
* NULL.
*
* Limitations: At this time the callbacks will only be called for EVE
* loggers that use JsonBuilder, notably this means it won't be called
* loggers that use SCJsonBuilder, notably this means it won't be called
* for stats records at this time.
*
* \returns true if callback is registered, false is not due to memory
@ -214,6 +214,6 @@ bool SCEveRegisterCallback(SCEveUserCallbackFn fn, void *user);
*
* Run EVE callbacks.
*/
void SCEveRunCallbacks(ThreadVars *tv, const Packet *p, Flow *f, JsonBuilder *jb);
void SCEveRunCallbacks(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *jb);
#endif

10
src/output-filestore.c
Unescape Escape View File

@ -166,17 +166,17 @@ static void OutputFilestoreFinalizeFiles(ThreadVars *tv, const OutputFilestoreLo
ff->file_store_id) == (int)sizeof(js_metadata_filename)) {
WARN_ONCE(WOT_SNPRINTF, "Failed to write file info record. Output filename truncated.");
} else {
JsonBuilder *js_fileinfo =
SCJsonBuilder *js_fileinfo =
JsonBuildFileInfoRecord(p, ff, tx, tx_id, true, dir, ctx->xff_cfg, NULL);
if (likely(js_fileinfo != NULL)) {
jb_close(js_fileinfo);
SCJbClose(js_fileinfo);
FILE *out = fopen(js_metadata_filename, "w");
if (out != NULL) {
size_t js_len = jb_len(js_fileinfo);
fwrite(jb_ptr(js_fileinfo), js_len, 1, out);
size_t js_len = SCJbLen(js_fileinfo);
fwrite(SCJbPtr(js_fileinfo), js_len, 1, out);
fclose(out);
}
jb_free(js_fileinfo);
SCJbFree(js_fileinfo);
}
}
}

248
src/output-json-alert.c
Unescape Escape View File

@ -111,12 +111,12 @@ typedef struct JsonAlertLogThread_ {
OutputJsonThreadCtx *ctx;
} JsonAlertLogThread;
static void AlertJsonSourceTarget(const Packet *p, const PacketAlert *pa,
JsonBuilder *js, JsonAddrInfo *addr)
static void AlertJsonSourceTarget(
const Packet *p, const PacketAlert *pa, SCJsonBuilder *js, JsonAddrInfo *addr)
{
jb_open_object(js, "source");
SCJbOpenObject(js, "source");
if (pa->s->flags & SIG_FLAG_DEST_IS_TARGET) {
jb_set_string(js, "ip", addr->src_ip);
SCJbSetString(js, "ip", addr->src_ip);
switch (p->proto) {
case IPPROTO_ICMP:
case IPPROTO_ICMPV6:
@ -124,11 +124,11 @@ static void AlertJsonSourceTarget(const Packet *p, const PacketAlert *pa,
case IPPROTO_UDP:
case IPPROTO_TCP:
case IPPROTO_SCTP:
jb_set_uint(js, "port", addr->sp);
SCJbSetUint(js, "port", addr->sp);
break;
}
} else if (pa->s->flags & SIG_FLAG_SRC_IS_TARGET) {
jb_set_string(js, "ip", addr->dst_ip);
SCJbSetString(js, "ip", addr->dst_ip);
switch (p->proto) {
case IPPROTO_ICMP:
case IPPROTO_ICMPV6:
@ -136,15 +136,15 @@ static void AlertJsonSourceTarget(const Packet *p, const PacketAlert *pa,
case IPPROTO_UDP:
case IPPROTO_TCP:
case IPPROTO_SCTP:
jb_set_uint(js, "port", addr->dp);
SCJbSetUint(js, "port", addr->dp);
break;
}
}
jb_close(js);
SCJbClose(js);
jb_open_object(js, "target");
SCJbOpenObject(js, "target");
if (pa->s->flags & SIG_FLAG_DEST_IS_TARGET) {
jb_set_string(js, "ip", addr->dst_ip);
SCJbSetString(js, "ip", addr->dst_ip);
switch (p->proto) {
case IPPROTO_ICMP:
case IPPROTO_ICMPV6:
@ -152,11 +152,11 @@ static void AlertJsonSourceTarget(const Packet *p, const PacketAlert *pa,
case IPPROTO_UDP:
case IPPROTO_TCP:
case IPPROTO_SCTP:
jb_set_uint(js, "port", addr->dp);
SCJbSetUint(js, "port", addr->dp);
break;
}
} else if (pa->s->flags & SIG_FLAG_SRC_IS_TARGET) {
jb_set_string(js, "ip", addr->src_ip);
SCJbSetString(js, "ip", addr->src_ip);
switch (p->proto) {
case IPPROTO_ICMP:
case IPPROTO_ICMPV6:
@ -164,21 +164,21 @@ static void AlertJsonSourceTarget(const Packet *p, const PacketAlert *pa,
case IPPROTO_UDP:
case IPPROTO_TCP:
case IPPROTO_SCTP:
jb_set_uint(js, "port", addr->sp);
SCJbSetUint(js, "port", addr->sp);
break;
}
}
jb_close(js);
SCJbClose(js);
}
static void AlertJsonReference(const PacketAlert *pa, JsonBuilder *jb)
static void AlertJsonReference(const PacketAlert *pa, SCJsonBuilder *jb)
{
if (!pa->s->references) {
return;
}
const DetectReference *kv = pa->s->references;
jb_open_array(jb, "references");
SCJbOpenArray(jb, "references");
while (kv) {
/* Note that the key and reference sizes have been bound
* checked during parsing
@ -186,20 +186,20 @@ static void AlertJsonReference(const PacketAlert *pa, JsonBuilder *jb)
const size_t size_needed = kv->key_len + kv->reference_len + 1;
char kv_store[size_needed];
snprintf(kv_store, size_needed, "%s%s", kv->key, kv->reference);
jb_append_string(jb, kv_store);
SCJbAppendString(jb, kv_store);
kv = kv->next;
}
jb_close(jb);
SCJbClose(jb);
}
static void AlertJsonMetadata(const PacketAlert *pa, JsonBuilder *js)
static void AlertJsonMetadata(const PacketAlert *pa, SCJsonBuilder *js)
{
if (pa->s->metadata && pa->s->metadata->json_str) {
jb_set_formatted(js, pa->s->metadata->json_str);
SCJbSetFormatted(js, pa->s->metadata->json_str);
}
}
void AlertJsonHeader(const Packet *p, const PacketAlert *pa, JsonBuilder *js, uint16_t flags,
void AlertJsonHeader(const Packet *p, const PacketAlert *pa, SCJsonBuilder *js, uint16_t flags,
JsonAddrInfo *addr, char *xff_buffer)
{
const char *action = "allowed";
@ -219,26 +219,26 @@ void AlertJsonHeader(const Packet *p, const PacketAlert *pa, JsonBuilder *js, ui
/* Add tx_id to root element for correlation with other events. */
/* json_object_del(js, "tx_id"); */
if (pa->flags & PACKET_ALERT_FLAG_TX) {
jb_set_uint(js, "tx_id", pa->tx_id);
SCJbSetUint(js, "tx_id", pa->tx_id);
}
if (pa->flags & PACKET_ALERT_FLAG_TX_GUESSED) {
jb_set_bool(js, "tx_guessed", true);
SCJbSetBool(js, "tx_guessed", true);
}
jb_open_object(js, "alert");
SCJbOpenObject(js, "alert");
jb_set_string(js, "action", action);
jb_set_uint(js, "gid", pa->s->gid);
jb_set_uint(js, "signature_id", pa->s->id);
jb_set_uint(js, "rev", pa->s->rev);
/* TODO: JsonBuilder should handle unprintable characters like
SCJbSetString(js, "action", action);
SCJbSetUint(js, "gid", pa->s->gid);
SCJbSetUint(js, "signature_id", pa->s->id);
SCJbSetUint(js, "rev", pa->s->rev);
/* TODO: SCJsonBuilder should handle unprintable characters like
* SCJsonString. */
jb_set_string(js, "signature", pa->s->msg ? pa->s->msg: "");
jb_set_string(js, "category", pa->s->class_msg ? pa->s->class_msg: "");
jb_set_uint(js, "severity", pa->s->prio);
SCJbSetString(js, "signature", pa->s->msg ? pa->s->msg : "");
SCJbSetString(js, "category", pa->s->class_msg ? pa->s->class_msg : "");
SCJbSetUint(js, "severity", pa->s->prio);
if (p->tenant_id > 0) {
jb_set_uint(js, "tenant_id", p->tenant_id);
SCJbSetUint(js, "tenant_id", p->tenant_id);
}
if (addr && pa->s->flags & SIG_FLAG_HAS_TARGET) {
@ -254,22 +254,22 @@ void AlertJsonHeader(const Packet *p, const PacketAlert *pa, JsonBuilder *js, ui
}
if (flags & LOG_JSON_RULE) {
jb_set_string(js, "rule", pa->s->sig_str);
SCJbSetString(js, "rule", pa->s->sig_str);
}
if (xff_buffer && xff_buffer[0]) {
jb_set_string(js, "xff", xff_buffer);
SCJbSetString(js, "xff", xff_buffer);
}
jb_close(js);
SCJbClose(js);
}
static void AlertJsonTunnel(const Packet *p, JsonBuilder *js)
static void AlertJsonTunnel(const Packet *p, SCJsonBuilder *js)
{
if (p->root == NULL) {
return;
}
jb_open_object(js, "tunnel");
SCJbOpenObject(js, "tunnel");
enum PktSrcEnum pkt_src;
uint64_t pcap_cnt;
@ -278,27 +278,27 @@ static void AlertJsonTunnel(const Packet *p, JsonBuilder *js)
pcap_cnt = p->root->pcap_cnt;
pkt_src = p->root->pkt_src;
jb_set_string(js, "src_ip", addr.src_ip);
jb_set_uint(js, "src_port", addr.sp);
jb_set_string(js, "dest_ip", addr.dst_ip);
jb_set_uint(js, "dest_port", addr.dp);
jb_set_string(js, "proto", addr.proto);
SCJbSetString(js, "src_ip", addr.src_ip);
SCJbSetUint(js, "src_port", addr.sp);
SCJbSetString(js, "dest_ip", addr.dst_ip);
SCJbSetUint(js, "dest_port", addr.dp);
SCJbSetString(js, "proto", addr.proto);
jb_set_uint(js, "depth", p->recursion_level);
SCJbSetUint(js, "depth", p->recursion_level);
if (pcap_cnt != 0) {
jb_set_uint(js, "pcap_cnt", pcap_cnt);
SCJbSetUint(js, "pcap_cnt", pcap_cnt);
}
jb_set_string(js, "pkt_src", PktSrcToString(pkt_src));
jb_close(js);
SCJbSetString(js, "pkt_src", PktSrcToString(pkt_src));
SCJbClose(js);
}
static void AlertAddPayload(AlertJsonOutputCtx *json_output_ctx, JsonBuilder *js, const Packet *p)
static void AlertAddPayload(AlertJsonOutputCtx *json_output_ctx, SCJsonBuilder *js, const Packet *p)
{
if (json_output_ctx->flags & LOG_JSON_PAYLOAD_BASE64) {
jb_set_base64(js, "payload", p->payload, p->payload_len);
SCJbSetBase64(js, "payload", p->payload, p->payload_len);
}
if (json_output_ctx->flags & LOG_JSON_PAYLOAD_LENGTH) {
jb_set_uint(js, "payload_length", p->payload_len);
SCJbSetUint(js, "payload_length", p->payload_len);
}
if (json_output_ctx->flags & LOG_JSON_PAYLOAD) {
@ -308,22 +308,22 @@ static void AlertAddPayload(AlertJsonOutputCtx *json_output_ctx, JsonBuilder *js
p->payload_len + 1,
p->payload, p->payload_len);
printable_buf[p->payload_len] = '\0';
jb_set_string(js, "payload_printable", (char *)printable_buf);
SCJbSetString(js, "payload_printable", (char *)printable_buf);
}
}
static void AlertAddAppLayer(const Packet *p, JsonBuilder *jb,
const uint64_t tx_id, const uint16_t option_flags)
static void AlertAddAppLayer(
const Packet *p, SCJsonBuilder *jb, const uint64_t tx_id, const uint16_t option_flags)
{
const AppProto proto = FlowGetAppProtocol(p->flow);
EveJsonSimpleAppLayerLogger *al = SCEveJsonSimpleGetLogger(proto);
JsonBuilderMark mark = { 0, 0, 0 };
SCJsonBuilderMark mark = { 0, 0, 0 };
if (al && al->LogTx) {
void *state = FlowGetAppState(p->flow);
if (state) {
void *tx = AppLayerParserGetTx(p->flow->proto, proto, state, tx_id);
if (tx) {
jb_get_mark(jb, &mark);
SCJbGetMark(jb, &mark);
switch (proto) {
// first check some protocols need special options for alerts logging
case ALPROTO_WEBSOCKET:
@ -332,14 +332,14 @@ static void AlertAddAppLayer(const Packet *p, JsonBuilder *jb,
bool pp = (option_flags & LOG_JSON_WEBSOCKET_PAYLOAD) != 0;
bool pb64 = (option_flags & LOG_JSON_WEBSOCKET_PAYLOAD_BASE64) != 0;
if (!SCWebSocketLogDetails(tx, jb, pp, pb64)) {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
// nothing more to log or do
return;
}
}
if (!al->LogTx(tx, jb)) {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
}
}
@ -348,7 +348,7 @@ static void AlertAddAppLayer(const Packet *p, JsonBuilder *jb,
switch (proto) {
case ALPROTO_HTTP1:
// TODO: Could result in an empty http object being logged.
jb_open_object(jb, "http");
SCJbOpenObject(jb, "http");
if (EveHttpAddMetadata(p->flow, tx_id, jb)) {
if (option_flags & LOG_JSON_HTTP_BODY) {
EveHttpLogJSONBodyPrintable(jb, p->flow, tx_id);
@ -357,55 +357,55 @@ static void AlertAddAppLayer(const Packet *p, JsonBuilder *jb,
EveHttpLogJSONBodyBase64(jb, p->flow, tx_id);
}
}
jb_close(jb);
SCJbClose(jb);
break;
case ALPROTO_SMTP:
jb_get_mark(jb, &mark);
jb_open_object(jb, "smtp");
SCJbGetMark(jb, &mark);
SCJbOpenObject(jb, "smtp");
if (EveSMTPAddMetadata(p->flow, tx_id, jb)) {
jb_close(jb);
SCJbClose(jb);
} else {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
jb_get_mark(jb, &mark);
jb_open_object(jb, "email");
SCJbGetMark(jb, &mark);
SCJbOpenObject(jb, "email");
if (EveEmailAddMetadata(p->flow, tx_id, jb)) {
jb_close(jb);
SCJbClose(jb);
} else {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
break;
case ALPROTO_NFS:
/* rpc */
jb_get_mark(jb, &mark);
jb_open_object(jb, "rpc");
SCJbGetMark(jb, &mark);
SCJbOpenObject(jb, "rpc");
if (EveNFSAddMetadataRPC(p->flow, tx_id, jb)) {
jb_close(jb);
SCJbClose(jb);
} else {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
/* nfs */
jb_get_mark(jb, &mark);
jb_open_object(jb, "nfs");
SCJbGetMark(jb, &mark);
SCJbOpenObject(jb, "nfs");
if (EveNFSAddMetadata(p->flow, tx_id, jb)) {
jb_close(jb);
SCJbClose(jb);
} else {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
break;
case ALPROTO_SMB:
jb_get_mark(jb, &mark);
jb_open_object(jb, "smb");
SCJbGetMark(jb, &mark);
SCJbOpenObject(jb, "smb");
if (EveSMBAddMetadata(p->flow, tx_id, jb)) {
jb_close(jb);
SCJbClose(jb);
} else {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
break;
case ALPROTO_IKE:
jb_get_mark(jb, &mark);
SCJbGetMark(jb, &mark);
if (!EveIKEAddMetadata(p->flow, tx_id, jb)) {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
break;
case ALPROTO_DCERPC: {
@ -413,18 +413,18 @@ static void AlertAddAppLayer(const Packet *p, JsonBuilder *jb,
if (state) {
void *tx = AppLayerParserGetTx(p->flow->proto, proto, state, tx_id);
if (tx) {
jb_get_mark(jb, &mark);
jb_open_object(jb, "dcerpc");
SCJbGetMark(jb, &mark);
SCJbOpenObject(jb, "dcerpc");
if (p->proto == IPPROTO_TCP) {
if (!SCDcerpcLogJsonRecordTcp(state, tx, jb)) {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
} else {
if (!SCDcerpcLogJsonRecordUdp(state, tx, jb)) {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
}
jb_close(jb);
SCJbClose(jb);
}
}
break;
@ -434,7 +434,7 @@ static void AlertAddAppLayer(const Packet *p, JsonBuilder *jb,
}
}
static void AlertAddFiles(const Packet *p, JsonBuilder *jb, const uint64_t tx_id)
static void AlertAddFiles(const Packet *p, SCJsonBuilder *jb, const uint64_t tx_id)
{
const uint8_t direction =
(p->flowflags & FLOW_PKT_TOSERVER) ? STREAM_TOSERVER : STREAM_TOCLIENT;
@ -452,21 +452,21 @@ static void AlertAddFiles(const Packet *p, JsonBuilder *jb, const uint64_t tx_id
while (file) {
if (!isopen) {
isopen = true;
jb_open_array(jb, "files");
SCJbOpenArray(jb, "files");
}
jb_start_object(jb);
SCJbStartObject(jb);
EveFileInfo(jb, file, tx_id, file->flags);
jb_close(jb);
SCJbClose(jb);
file = file->next;
}
if (isopen) {
jb_close(jb);
SCJbClose(jb);
}
}
}
static void AlertAddFrame(
const Packet *p, const int64_t frame_id, JsonBuilder *jb, MemBuffer *buffer)
const Packet *p, const int64_t frame_id, SCJsonBuilder *jb, MemBuffer *buffer)
{
if (p->flow == NULL || (p->proto == IPPROTO_TCP && p->flow->protoctx == NULL))
return;
@ -509,9 +509,9 @@ static void AlertAddFrame(
* \param p Pointer to Packet current being logged
*
*/
void EveAddVerdict(JsonBuilder *jb, const Packet *p)
void EveAddVerdict(SCJsonBuilder *jb, const Packet *p)
{
jb_open_object(jb, "verdict");
SCJbOpenObject(jb, "verdict");
/* add verdict info */
if (PacketCheckAction(p, ACTION_REJECT_ANY)) {
@ -528,18 +528,18 @@ void EveAddVerdict(JsonBuilder *jb, const Packet *p)
} else if (PacketCheckAction(p, ACTION_REJECT_BOTH)) {
JB_SET_STRING(jb, "reject-target", "both");
}
jb_open_array(jb, "reject");
SCJbOpenArray(jb, "reject");
switch (p->proto) {
case IPPROTO_UDP:
case IPPROTO_ICMP:
case IPPROTO_ICMPV6:
jb_append_string(jb, "icmp-prohib");
SCJbAppendString(jb, "icmp-prohib");
break;
case IPPROTO_TCP:
jb_append_string(jb, "tcp-reset");
SCJbAppendString(jb, "tcp-reset");
break;
}
jb_close(jb);
SCJbClose(jb);
} else if (PacketCheckAction(p, ACTION_DROP) && EngineModeIsIPS()) {
JB_SET_STRING(jb, "action", "drop");
@ -551,7 +551,7 @@ void EveAddVerdict(JsonBuilder *jb, const Packet *p)
}
/* Close verdict */
jb_close(jb);
SCJbClose(jb);
}
struct AlertJsonStreamDataCallbackData {
@ -582,7 +582,7 @@ static int AlertJsonStreamDataCallback(
* \retval false stream data not logged
*/
static bool AlertJsonStreamData(const AlertJsonOutputCtx *json_output_ctx, JsonAlertLogThread *aft,
Flow *f, const Packet *p, JsonBuilder *jb)
Flow *f, const Packet *p, SCJsonBuilder *jb)
{
TcpSession *ssn = f->protoctx;
TcpStream *stream = (PKT_IS_TOSERVER(p)) ? &ssn->client : &ssn->server;
@ -595,10 +595,10 @@ static bool AlertJsonStreamData(const AlertJsonOutputCtx *json_output_ctx, JsonA
&unused, false);
if (cbd.payload->offset) {
if (json_output_ctx->flags & LOG_JSON_PAYLOAD_BASE64) {
jb_set_base64(jb, "payload", cbd.payload->buffer, cbd.payload->offset);
SCJbSetBase64(jb, "payload", cbd.payload->buffer, cbd.payload->offset);
}
if (json_output_ctx->flags & LOG_JSON_PAYLOAD_LENGTH) {
jb_set_uint(jb, "payload_length", cbd.payload->offset);
SCJbSetUint(jb, "payload_length", cbd.payload->offset);
}
if (json_output_ctx->flags & LOG_JSON_PAYLOAD) {
@ -606,7 +606,7 @@ static bool AlertJsonStreamData(const AlertJsonOutputCtx *json_output_ctx, JsonA
uint32_t offset = 0;
PrintStringsToBuffer(printable_buf, &offset, cbd.payload->offset + 1,
cbd.payload->buffer, cbd.payload->offset);
jb_set_string(jb, "payload_printable", (char *)printable_buf);
SCJbSetString(jb, "payload_printable", (char *)printable_buf);
}
return true;
}
@ -663,7 +663,7 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
}
}
JsonBuilder *jb =
SCJsonBuilder *jb =
CreateEveHeader(p, LOG_DIR_PACKET, "alert", &addr, json_output_ctx->eve_ctx);
if (unlikely(jb == NULL))
return TM_ECODE_OK;
@ -690,30 +690,30 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
EveAddAppProto(p->flow, jb);
if (p->flowflags & FLOW_PKT_TOSERVER) {
jb_set_string(jb, "direction", "to_server");
SCJbSetString(jb, "direction", "to_server");
} else {
jb_set_string(jb, "direction", "to_client");
SCJbSetString(jb, "direction", "to_client");
}
if (json_output_ctx->flags & LOG_JSON_FLOW) {
jb_open_object(jb, "flow");
SCJbOpenObject(jb, "flow");
EveAddFlow(p->flow, jb);
if (p->flowflags & FLOW_PKT_TOCLIENT) {
jb_set_string(jb, "src_ip", addr.dst_ip);
jb_set_string(jb, "dest_ip", addr.src_ip);
SCJbSetString(jb, "src_ip", addr.dst_ip);
SCJbSetString(jb, "dest_ip", addr.src_ip);
if (addr.sp > 0) {
jb_set_uint(jb, "src_port", addr.dp);
jb_set_uint(jb, "dest_port", addr.sp);
SCJbSetUint(jb, "src_port", addr.dp);
SCJbSetUint(jb, "dest_port", addr.sp);
}
} else {
jb_set_string(jb, "src_ip", addr.src_ip);
jb_set_string(jb, "dest_ip", addr.dst_ip);
SCJbSetString(jb, "src_ip", addr.src_ip);
SCJbSetString(jb, "dest_ip", addr.dst_ip);
if (addr.sp > 0) {
jb_set_uint(jb, "src_port", addr.sp);
jb_set_uint(jb, "dest_port", addr.dp);
SCJbSetUint(jb, "src_port", addr.sp);
SCJbSetUint(jb, "dest_port", addr.dp);
}
}
jb_close(jb);
SCJbClose(jb);
}
}
@ -739,7 +739,7 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
AlertAddPayload(json_output_ctx, jb, p);
}
jb_set_uint(jb, "stream", stream);
SCJbSetUint(jb, "stream", stream);
}
if (pa->flags & PACKET_ALERT_FLAG_FRAME) {
@ -753,7 +753,7 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
char *pcap_filename = PcapLogGetFilename();
if (pcap_filename != NULL) {
jb_set_string(jb, "capture_file", pcap_filename);
SCJbSetString(jb, "capture_file", pcap_filename);
}
if (json_output_ctx->flags & LOG_JSON_VERDICT) {
@ -761,17 +761,17 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
}
OutputJsonBuilderBuffer(tv, p, p->flow, jb, aft->ctx);
jb_free(jb);
SCJbFree(jb);
}
if ((p->flags & PKT_HAS_TAG) && (json_output_ctx->flags &
LOG_JSON_TAGGED_PACKETS)) {
JsonBuilder *packetjs =
SCJsonBuilder *packetjs =
CreateEveHeader(p, LOG_DIR_PACKET, "packet", NULL, json_output_ctx->eve_ctx);
if (unlikely(packetjs != NULL)) {
EvePacket(p, packetjs, 0);
OutputJsonBuilderBuffer(tv, p, p->flow, packetjs, aft->ctx);
jb_free(packetjs);
SCJbFree(packetjs);
}
}
@ -791,7 +791,7 @@ static int AlertJsonDecoderEvent(ThreadVars *tv, JsonAlertLogThread *aft, const
continue;
}
JsonBuilder *jb =
SCJsonBuilder *jb =
CreateEveHeader(p, LOG_DIR_PACKET, "alert", NULL, json_output_ctx->eve_ctx);
if (unlikely(jb == NULL))
return TM_ECODE_OK;
@ -809,7 +809,7 @@ static int AlertJsonDecoderEvent(ThreadVars *tv, JsonAlertLogThread *aft, const
char *pcap_filename = PcapLogGetFilename();
if (pcap_filename != NULL) {
jb_set_string(jb, "capture_file", pcap_filename);
SCJbSetString(jb, "capture_file", pcap_filename);
}
if (json_output_ctx->flags & LOG_JSON_VERDICT) {
@ -817,7 +817,7 @@ static int AlertJsonDecoderEvent(ThreadVars *tv, JsonAlertLogThread *aft, const
}
OutputJsonBuilderBuffer(tv, p, p->flow, jb, aft->ctx);
jb_free(jb);
SCJbFree(jb);
}
return TM_ECODE_OK;

4
src/output-json-alert.h
Unescape Escape View File

@ -28,8 +28,8 @@
#define SURICATA_OUTPUT_JSON_ALERT_H
void JsonAlertLogRegister(void);
void AlertJsonHeader(const Packet *p, const PacketAlert *pa, JsonBuilder *js, uint16_t flags,
void AlertJsonHeader(const Packet *p, const PacketAlert *pa, SCJsonBuilder *js, uint16_t flags,
JsonAddrInfo *addr, char *xff_buffer);
void EveAddVerdict(JsonBuilder *jb, const Packet *p);
void EveAddVerdict(SCJsonBuilder *jb, const Packet *p);
#endif /* SURICATA_OUTPUT_JSON_ALERT_H */

29
src/output-json-anomaly.c
Unescape Escape View File

@ -115,13 +115,13 @@ static int AnomalyDecodeEventJson(ThreadVars *tv, JsonAnomalyLogThread *aft,
if (!is_decode && !log_stream)
continue;
JsonBuilder *js = CreateEveHeader(
SCJsonBuilder *js = CreateEveHeader(
p, LOG_DIR_PACKET, ANOMALY_EVENT_TYPE, NULL, aft->json_output_ctx->eve_ctx);
if (unlikely(js == NULL)) {
return TM_ECODE_OK;
}
jb_open_object(js, ANOMALY_EVENT_TYPE);
SCJbOpenObject(js, ANOMALY_EVENT_TYPE);
if (event_code < DECODE_EVENT_MAX) {
const char *event = DEvents[event_code].event_name;
@ -130,21 +130,21 @@ static int AnomalyDecodeEventJson(ThreadVars *tv, JsonAnomalyLogThread *aft,
} else {
JB_SET_STRING(js, "type", "stream");
}
jb_set_string(js, "event", event);
SCJbSetString(js, "event", event);
} else {
JB_SET_STRING(js, "type", "unknown");
jb_set_uint(js, "code", event_code);
SCJbSetUint(js, "code", event_code);
}
/* Close anomaly object. */
jb_close(js);
SCJbClose(js);
if (aft->json_output_ctx->flags & LOG_JSON_PACKETHDR) {
EvePacket(p, js, GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32);
}
OutputJsonBuilderBuffer(tv, p, p->flow, js, aft->ctx);
jb_free(js);
SCJbFree(js);
}
return TM_ECODE_OK;
@ -162,7 +162,7 @@ static int AnomalyAppLayerDecoderEventJson(ThreadVars *tv, JsonAnomalyLogThread
tx_id != TX_ID_UNUSED ? "tx" : "no-tx");
for (int i = decoder_events->event_last_logged; i < decoder_events->cnt; i++) {
JsonBuilder *js;
SCJsonBuilder *js;
if (tx_id != TX_ID_UNUSED) {
js = CreateEveHeaderWithTxId(p, LOG_DIR_PACKET, ANOMALY_EVENT_TYPE, NULL, tx_id,
aft->json_output_ctx->eve_ctx);
@ -174,10 +174,9 @@ static int AnomalyAppLayerDecoderEventJson(ThreadVars *tv, JsonAnomalyLogThread
return TM_ECODE_OK;
}
SCJbOpenObject(js, ANOMALY_EVENT_TYPE);
jb_open_object(js, ANOMALY_EVENT_TYPE);
jb_set_string(js, "app_proto", alprotoname);
SCJbSetString(js, "app_proto", alprotoname);
const char *event_name = NULL;
uint8_t event_code = decoder_events->events[i];
@ -191,18 +190,18 @@ static int AnomalyAppLayerDecoderEventJson(ThreadVars *tv, JsonAnomalyLogThread
}
if (r == 0) {
JB_SET_STRING(js, "type", "applayer");
jb_set_string(js, "event", event_name);
SCJbSetString(js, "event", event_name);
} else {
JB_SET_STRING(js, "type", "unknown");
jb_set_uint(js, "code", event_code);
SCJbSetUint(js, "code", event_code);
}
jb_set_string(js, "layer", layer);
SCJbSetString(js, "layer", layer);
/* anomaly */
jb_close(js);
SCJbClose(js);
OutputJsonBuilderBuffer(tv, p, p->flow, js, aft->ctx);
jb_free(js);
SCJbFree(js);
/* Current implementation assumes a single owner for this value */
decoder_events->event_last_logged++;

14
src/output-json-arp.c
Unescape Escape View File

@ -73,7 +73,7 @@ static int JsonArpLogger(ThreadVars *tv, void *thread_data, const Packet *p)
char dstip[JSON_ADDR_LEN] = "";
const ARPHdr *arph = PacketGetARP(p);
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "arp", NULL, thread->ctx);
SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "arp", NULL, thread->ctx);
if (unlikely(jb == NULL)) {
return TM_ECODE_OK;
}
@ -81,17 +81,17 @@ static int JsonArpLogger(ThreadVars *tv, void *thread_data, const Packet *p)
PrintInet(AF_INET, arph->source_ip, srcip, sizeof(srcip));
PrintInet(AF_INET, arph->dest_ip, dstip, sizeof(dstip));
jb_open_object(jb, "arp");
SCJbOpenObject(jb, "arp");
JB_SET_STRING(jb, "hw_type", "ethernet");
JB_SET_STRING(jb, "proto_type", "ipv4");
jb_set_string(jb, "opcode", OpcodeToString(ntohs(arph->opcode)));
SCJbSetString(jb, "opcode", OpcodeToString(ntohs(arph->opcode)));
JSONFormatAndAddMACAddr(jb, "src_mac", arph->source_mac, false);
jb_set_string(jb, "src_ip", srcip);
SCJbSetString(jb, "src_ip", srcip);
JSONFormatAndAddMACAddr(jb, "dest_mac", arph->dest_mac, false);
jb_set_string(jb, "dest_ip", dstip);
jb_close(jb); /* arp */
SCJbSetString(jb, "dest_ip", dstip);
SCJbClose(jb); /* arp */
OutputJsonBuilderBuffer(tv, p, p->flow, jb, thread);
jb_free(jb);
SCJbFree(jb);
return TM_ECODE_OK;
}

10
src/output-json-dcerpc.c
Unescape Escape View File

@ -29,12 +29,12 @@ static int JsonDCERPCLogger(ThreadVars *tv, void *thread_data,
{
OutputJsonThreadCtx *thread = thread_data;
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dcerpc", NULL, thread->ctx);
SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dcerpc", NULL, thread->ctx);
if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED;
}
jb_open_object(jb, "dcerpc");
SCJbOpenObject(jb, "dcerpc");
if (p->proto == IPPROTO_TCP) {
if (!SCDcerpcLogJsonRecordTcp(state, tx, jb)) {
goto error;
@ -44,16 +44,16 @@ static int JsonDCERPCLogger(ThreadVars *tv, void *thread_data,
goto error;
}
}
jb_close(jb);
SCJbClose(jb);
MemBufferReset(thread->buffer);
OutputJsonBuilderBuffer(tv, p, p->flow, jb, thread);
jb_free(jb);
SCJbFree(jb);
return TM_ECODE_OK;
error:
jb_free(jb);
SCJbFree(jb);
return TM_ECODE_FAILED;
}

4
src/output-json-dhcp.c
Unescape Escape View File

@ -65,7 +65,7 @@ static int JsonDHCPLogger(ThreadVars *tv, void *thread_data,
return TM_ECODE_OK;
}
JsonBuilder *js = CreateEveHeader((Packet *)p, 0, "dhcp", NULL, ctx->eve_ctx);
SCJsonBuilder *js = CreateEveHeader((Packet *)p, 0, "dhcp", NULL, ctx->eve_ctx);
if (unlikely(js == NULL)) {
return TM_ECODE_FAILED;
}
@ -73,7 +73,7 @@ static int JsonDHCPLogger(ThreadVars *tv, void *thread_data,
SCDhcpLoggerLog(ctx->rs_logger, tx, js);
OutputJsonBuilderBuffer(tv, p, p->flow, js, thread->thread);
jb_free(js);
SCJbFree(js);
return TM_ECODE_OK;
}

1934
src/output-json-dnp3-objects.c
View File

File diff suppressed because it is too large Load Diff

3
src/output-json-dnp3-objects.h
Unescape Escape View File

@ -20,7 +20,6 @@
#include "rust-bindings.h"
void OutputJsonDNP3SetItem(JsonBuilder *js, DNP3Object *object,
DNP3Point *item);
void OutputJsonDNP3SetItem(SCJsonBuilder *js, DNP3Object *object, DNP3Point *item);
#endif /* SURICATA_OUTPUT_JSON_DNP3_OBJECTS_H */

160
src/output-json-dnp3.c
Unescape Escape View File

@ -52,38 +52,38 @@ typedef struct LogDNP3LogThread_ {
OutputJsonThreadCtx *ctx;
} LogDNP3LogThread;
static void JsonDNP3LogLinkControl(JsonBuilder *js, uint8_t lc)
static void JsonDNP3LogLinkControl(SCJsonBuilder *js, uint8_t lc)
{
jb_set_bool(js, "dir", DNP3_LINK_DIR(lc));
jb_set_bool(js, "pri", DNP3_LINK_PRI(lc));
jb_set_bool(js, "fcb", DNP3_LINK_FCB(lc));
jb_set_bool(js, "fcv", DNP3_LINK_FCV(lc));
jb_set_uint(js, "function_code", DNP3_LINK_FC(lc));
SCJbSetBool(js, "dir", DNP3_LINK_DIR(lc));
SCJbSetBool(js, "pri", DNP3_LINK_PRI(lc));
SCJbSetBool(js, "fcb", DNP3_LINK_FCB(lc));
SCJbSetBool(js, "fcv", DNP3_LINK_FCV(lc));
SCJbSetUint(js, "function_code", DNP3_LINK_FC(lc));
}
static void JsonDNP3LogIin(JsonBuilder *js, uint16_t iin)
static void JsonDNP3LogIin(SCJsonBuilder *js, uint16_t iin)
{
if (iin) {
jb_open_array(js, "indicators");
SCJbOpenArray(js, "indicators");
int mapping = 0;
do {
if (iin & DNP3IndicatorsMap[mapping].value) {
jb_append_string(js, DNP3IndicatorsMap[mapping].name);
SCJbAppendString(js, DNP3IndicatorsMap[mapping].name);
}
mapping++;
} while (DNP3IndicatorsMap[mapping].name != NULL);
jb_close(js);
SCJbClose(js);
}
}
static void JsonDNP3LogApplicationControl(JsonBuilder *js, uint8_t ac)
static void JsonDNP3LogApplicationControl(SCJsonBuilder *js, uint8_t ac)
{
jb_set_bool(js, "fir", DNP3_APP_FIR(ac));
jb_set_bool(js, "fin", DNP3_APP_FIN(ac));
jb_set_bool(js, "con", DNP3_APP_CON(ac));
jb_set_bool(js, "uns", DNP3_APP_UNS(ac));
jb_set_uint(js, "sequence", DNP3_APP_SEQ(ac));
SCJbSetBool(js, "fir", DNP3_APP_FIR(ac));
SCJbSetBool(js, "fin", DNP3_APP_FIN(ac));
SCJbSetBool(js, "con", DNP3_APP_CON(ac));
SCJbSetBool(js, "uns", DNP3_APP_UNS(ac));
SCJbSetUint(js, "sequence", DNP3_APP_SEQ(ac));
}
/**
@ -91,21 +91,21 @@ static void JsonDNP3LogApplicationControl(JsonBuilder *js, uint8_t ac)
*
* TODO: Autogenerate this function based on object definitions.
*/
static void JsonDNP3LogObjectItems(JsonBuilder *js, DNP3Object *object)
static void JsonDNP3LogObjectItems(SCJsonBuilder *js, DNP3Object *object)
{
DNP3Point *item;
TAILQ_FOREACH(item, object->points, next) {
jb_start_object(js);
SCJbStartObject(js);
jb_set_uint(js, "prefix", item->prefix);
jb_set_uint(js, "index", item->index);
SCJbSetUint(js, "prefix", item->prefix);
SCJbSetUint(js, "index", item->index);
if (DNP3PrefixIsSize(object->prefix_code)) {
jb_set_uint(js, "size", item->size);
SCJbSetUint(js, "size", item->size);
}
OutputJsonDNP3SetItem(js, object, item);
jb_close(js);
SCJbClose(js);
}
}
@ -113,65 +113,65 @@ static void JsonDNP3LogObjectItems(JsonBuilder *js, DNP3Object *object)
* \brief Log the application layer objects.
*
* \param objects A list of DNP3 objects.
* \param jb A JsonBuilder instance with an open array.
* \param jb A SCJsonBuilder instance with an open array.
*/
static void JsonDNP3LogObjects(JsonBuilder *js, DNP3ObjectList *objects)
static void JsonDNP3LogObjects(SCJsonBuilder *js, DNP3ObjectList *objects)
{
DNP3Object *object;
TAILQ_FOREACH(object, objects, next) {
jb_start_object(js);
jb_set_uint(js, "group", object->group);
jb_set_uint(js, "variation", object->variation);
jb_set_uint(js, "qualifier", object->qualifier);
jb_set_uint(js, "prefix_code", object->prefix_code);
jb_set_uint(js, "range_code", object->range_code);
jb_set_uint(js, "start", object->start);
jb_set_uint(js, "stop", object->stop);
jb_set_uint(js, "count", object->count);
SCJbStartObject(js);
SCJbSetUint(js, "group", object->group);
SCJbSetUint(js, "variation", object->variation);
SCJbSetUint(js, "qualifier", object->qualifier);
SCJbSetUint(js, "prefix_code", object->prefix_code);
SCJbSetUint(js, "range_code", object->range_code);
SCJbSetUint(js, "start", object->start);
SCJbSetUint(js, "stop", object->stop);
SCJbSetUint(js, "count", object->count);
if (object->points != NULL && !TAILQ_EMPTY(object->points)) {
jb_open_array(js, "points");
SCJbOpenArray(js, "points");
JsonDNP3LogObjectItems(js, object);
jb_close(js);
SCJbClose(js);
}
jb_close(js);
SCJbClose(js);
}
}
static void JsonDNP3LogRequest(JsonBuilder *js, DNP3Transaction *dnp3tx)
static void JsonDNP3LogRequest(SCJsonBuilder *js, DNP3Transaction *dnp3tx)
{
JB_SET_STRING(js, "type", "request");
jb_open_object(js, "control");
SCJbOpenObject(js, "control");
JsonDNP3LogLinkControl(js, dnp3tx->lh.control);
jb_close(js);
SCJbClose(js);
jb_set_uint(js, "src", DNP3_SWAP16(dnp3tx->lh.src));
jb_set_uint(js, "dst", DNP3_SWAP16(dnp3tx->lh.dst));
SCJbSetUint(js, "src", DNP3_SWAP16(dnp3tx->lh.src));
SCJbSetUint(js, "dst", DNP3_SWAP16(dnp3tx->lh.dst));
jb_open_object(js, "application");
SCJbOpenObject(js, "application");
jb_open_object(js, "control");
SCJbOpenObject(js, "control");
JsonDNP3LogApplicationControl(js, dnp3tx->ah.control);
jb_close(js);
SCJbClose(js);
jb_set_uint(js, "function_code", dnp3tx->ah.function_code);
SCJbSetUint(js, "function_code", dnp3tx->ah.function_code);
if (!TAILQ_EMPTY(&dnp3tx->objects)) {
jb_open_array(js, "objects");
SCJbOpenArray(js, "objects");
JsonDNP3LogObjects(js, &dnp3tx->objects);
jb_close(js);
SCJbClose(js);
}
jb_set_bool(js, "complete", dnp3tx->complete);
SCJbSetBool(js, "complete", dnp3tx->complete);
/* Close application. */
jb_close(js);
SCJbClose(js);
}
static void JsonDNP3LogResponse(JsonBuilder *js, DNP3Transaction *dnp3tx)
static void JsonDNP3LogResponse(SCJsonBuilder *js, DNP3Transaction *dnp3tx)
{
if (dnp3tx->ah.function_code == DNP3_APP_FC_UNSOLICITED_RESP) {
JB_SET_STRING(js, "type", "unsolicited_response");
@ -179,55 +179,55 @@ static void JsonDNP3LogResponse(JsonBuilder *js, DNP3Transaction *dnp3tx)
JB_SET_STRING(js, "type", "response");
}
jb_open_object(js, "control");
SCJbOpenObject(js, "control");
JsonDNP3LogLinkControl(js, dnp3tx->lh.control);
jb_close(js);
SCJbClose(js);
jb_set_uint(js, "src", DNP3_SWAP16(dnp3tx->lh.src));
jb_set_uint(js, "dst", DNP3_SWAP16(dnp3tx->lh.dst));
SCJbSetUint(js, "src", DNP3_SWAP16(dnp3tx->lh.src));
SCJbSetUint(js, "dst", DNP3_SWAP16(dnp3tx->lh.dst));
jb_open_object(js, "application");
SCJbOpenObject(js, "application");
jb_open_object(js, "control");
SCJbOpenObject(js, "control");
JsonDNP3LogApplicationControl(js, dnp3tx->ah.control);
jb_close(js);
SCJbClose(js);
jb_set_uint(js, "function_code", dnp3tx->ah.function_code);
SCJbSetUint(js, "function_code", dnp3tx->ah.function_code);
if (!TAILQ_EMPTY(&dnp3tx->objects)) {
jb_open_array(js, "objects");
SCJbOpenArray(js, "objects");
JsonDNP3LogObjects(js, &dnp3tx->objects);
jb_close(js);
SCJbClose(js);
}
jb_set_bool(js, "complete", dnp3tx->complete);
SCJbSetBool(js, "complete", dnp3tx->complete);
/* Close application. */
jb_close(js);
SCJbClose(js);
jb_open_object(js, "iin");
SCJbOpenObject(js, "iin");
JsonDNP3LogIin(js, (uint16_t)(dnp3tx->iin.iin1 << 8 | dnp3tx->iin.iin2));
jb_close(js);
SCJbClose(js);
}
bool AlertJsonDnp3(void *vtx, JsonBuilder *js)
bool AlertJsonDnp3(void *vtx, SCJsonBuilder *js)
{
DNP3Transaction *tx = (DNP3Transaction *)vtx;
bool logged = false;
jb_open_object(js, "dnp3");
SCJbOpenObject(js, "dnp3");
if (tx->is_request && tx->done) {
jb_open_object(js, "request");
SCJbOpenObject(js, "request");
JsonDNP3LogRequest(js, tx);
jb_close(js);
SCJbClose(js);
logged = true;
}
if (!tx->is_request && tx->done) {
jb_open_object(js, "response");
SCJbOpenObject(js, "response");
JsonDNP3LogResponse(js, tx);
jb_close(js);
SCJbClose(js);
logged = true;
}
jb_close(js);
SCJbClose(js);
return logged;
}
@ -238,16 +238,17 @@ static int JsonDNP3LoggerToServer(ThreadVars *tv, void *thread_data,
LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data;
DNP3Transaction *tx = vtx;
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL, thread->dnp3log_ctx->eve_ctx);
SCJsonBuilder *js =
CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL, thread->dnp3log_ctx->eve_ctx);
if (unlikely(js == NULL)) {
return TM_ECODE_OK;
}
jb_open_object(js, "dnp3");
SCJbOpenObject(js, "dnp3");
JsonDNP3LogRequest(js, tx);
jb_close(js);
SCJbClose(js);
OutputJsonBuilderBuffer(tv, p, p->flow, js, thread->ctx);
jb_free(js);
SCJbFree(js);
SCReturnInt(TM_ECODE_OK);
}
@ -259,16 +260,17 @@ static int JsonDNP3LoggerToClient(ThreadVars *tv, void *thread_data,
LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data;
DNP3Transaction *tx = vtx;
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL, thread->dnp3log_ctx->eve_ctx);
SCJsonBuilder *js =
CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL, thread->dnp3log_ctx->eve_ctx);
if (unlikely(js == NULL)) {
return TM_ECODE_OK;
}
jb_open_object(js, "dnp3");
SCJbOpenObject(js, "dnp3");
JsonDNP3LogResponse(js, tx);
jb_close(js);
SCJbClose(js);
OutputJsonBuilderBuffer(tv, p, p->flow, js, thread->ctx);
jb_free(js);
SCJbFree(js);
SCReturnInt(TM_ECODE_OK);
}

2
src/output-json-dnp3.h
Unescape Escape View File

@ -21,6 +21,6 @@
#include "app-layer-dnp3.h"
void JsonDNP3LogRegister(void);
bool AlertJsonDnp3(void *vtx, JsonBuilder *js);
bool AlertJsonDnp3(void *vtx, SCJsonBuilder *js);
#endif /* SURICATA_OUTPUT_JSON_DNP3_H */

54
src/output-json-dns.c
Unescape Escape View File

@ -248,21 +248,21 @@ typedef struct LogDnsLogThread_ {
OutputJsonThreadCtx *ctx;
} LogDnsLogThread;
bool AlertJsonDns(void *txptr, JsonBuilder *js)
bool AlertJsonDns(void *txptr, SCJsonBuilder *js)
{
return SCDnsLogJson(
txptr, LOG_FORMAT_DETAILED | LOG_QUERIES | LOG_ANSWERS | LOG_ALL_RRTYPES, js);
}
bool AlertJsonDoh2(void *txptr, JsonBuilder *js)
bool AlertJsonDoh2(void *txptr, SCJsonBuilder *js)
{
JsonBuilderMark mark = { 0, 0, 0 };
SCJsonBuilderMark mark = { 0, 0, 0 };
jb_get_mark(js, &mark);
SCJbGetMark(js, &mark);
// first log HTTP2 part
bool r = rs_http2_log_json(txptr, js);
if (!r) {
jb_restore_mark(js, &mark);
SCJbRestoreMark(js, &mark);
}
// then log one DNS tx if any, preferring the answer
void *tx_dns = DetectGetInnerTx(txptr, ALPROTO_DOH2, ALPROTO_DNS, STREAM_TOCLIENT);
@ -271,10 +271,10 @@ bool AlertJsonDoh2(void *txptr, JsonBuilder *js)
}
bool r2 = false;
if (tx_dns) {
jb_get_mark(js, &mark);
SCJbGetMark(js, &mark);
r2 = AlertJsonDns(tx_dns, js);
if (!r2) {
jb_restore_mark(js, &mark);
SCJbRestoreMark(js, &mark);
}
}
return r || r2;
@ -286,19 +286,19 @@ static int JsonDoh2Logger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
LogDnsLogThread *td = (LogDnsLogThread *)thread_data;
LogDnsFileCtx *dnslog_ctx = td->dnslog_ctx;
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
if (unlikely(jb == NULL)) {
return TM_ECODE_OK;
}
JsonBuilderMark mark = { 0, 0, 0 };
SCJsonBuilderMark mark = { 0, 0, 0 };
jb_get_mark(jb, &mark);
SCJbGetMark(jb, &mark);
// first log HTTP2 part
bool r = rs_http2_log_json(txptr, jb);
if (!r) {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
void *tx_dns = DetectGetInnerTx(txptr, ALPROTO_DOH2, ALPROTO_DNS, STREAM_TOCLIENT);
@ -322,18 +322,18 @@ static int JsonDoh2Logger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
goto out;
}
jb_get_mark(jb, &mark);
SCJbGetMark(jb, &mark);
// log DOH2 with DNS config
r2 = SCDnsLogJson(tx_dns, td->dnslog_ctx->flags, jb);
if (!r2) {
jb_restore_mark(jb, &mark);
SCJbRestoreMark(jb, &mark);
}
}
out:
if (r || r2) {
OutputJsonBuilderBuffer(tv, p, p->flow, jb, td->ctx);
}
jb_free(jb);
SCJbFree(jb);
return TM_ECODE_OK;
}
@ -350,21 +350,21 @@ static int JsonDnsLoggerToServer(ThreadVars *tv, void *thread_data,
}
for (uint16_t i = 0; i < 0xffff; i++) {
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
if (unlikely(jb == NULL)) {
return TM_ECODE_OK;
}
jb_open_object(jb, "dns");
jb_set_int(jb, "version", 2);
SCJbOpenObject(jb, "dns");
SCJbSetInt(jb, "version", 2);
if (!SCDnsLogJsonQuery(txptr, i, td->dnslog_ctx->flags, jb)) {
jb_free(jb);
SCJbFree(jb);
break;
}
jb_close(jb);
SCJbClose(jb);
OutputJsonBuilderBuffer(tv, p, p->flow, jb, td->ctx);
jb_free(jb);
SCJbFree(jb);
}
SCReturnInt(TM_ECODE_OK);
@ -383,17 +383,17 @@ static int JsonDnsLoggerToClient(ThreadVars *tv, void *thread_data,
}
if (SCDnsLogAnswerEnabled(txptr, td->dnslog_ctx->flags)) {
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
if (unlikely(jb == NULL)) {
return TM_ECODE_OK;
}
jb_open_object(jb, "dns");
jb_set_int(jb, "version", 2);
SCJbOpenObject(jb, "dns");
SCJbSetInt(jb, "version", 2);
SCDnsLogJsonAnswer(txptr, td->dnslog_ctx->flags, jb);
jb_close(jb);
SCJbClose(jb);
OutputJsonBuilderBuffer(tv, p, p->flow, jb, td->ctx);
jb_free(jb);
SCJbFree(jb);
}
SCReturnInt(TM_ECODE_OK);
@ -426,7 +426,7 @@ static int JsonDnsLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flo
return TM_ECODE_OK;
}
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "dns", NULL, dnslog_ctx->eve_ctx);
if (unlikely(jb == NULL)) {
return TM_ECODE_OK;
}
@ -434,7 +434,7 @@ static int JsonDnsLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flo
if (SCDnsLogJson(txptr, td->dnslog_ctx->flags, jb)) {
OutputJsonBuilderBuffer(tv, p, p->flow, jb, td->ctx);
}
jb_free(jb);
SCJbFree(jb);
}
return TM_ECODE_OK;
}

4
src/output-json-dns.h
Unescape Escape View File

@ -27,7 +27,7 @@
void JsonDnsLogRegister(void);
void JsonDoh2LogRegister(void);
bool AlertJsonDns(void *vtx, JsonBuilder *js);
bool AlertJsonDoh2(void *vtx, JsonBuilder *js);
bool AlertJsonDns(void *vtx, SCJsonBuilder *js);
bool AlertJsonDoh2(void *vtx, SCJsonBuilder *js);
#endif /* SURICATA_OUTPUT_JSON_DNS_H */

62
src/output-json-drop.c
Unescape Escape View File

@ -92,76 +92,76 @@ static int DropLogJSON(ThreadVars *tv, JsonDropLogThread *aft, const Packet *p)
JsonAddrInfo addr = json_addr_info_zero;
JsonAddrInfoInit(p, LOG_DIR_PACKET, &addr);
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "drop", &addr, drop_ctx->eve_ctx);
SCJsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "drop", &addr, drop_ctx->eve_ctx);
if (unlikely(js == NULL))
return TM_ECODE_OK;
if (p->flow != NULL) {
if (p->flowflags & FLOW_PKT_TOSERVER) {
jb_set_string(js, "direction", "to_server");
SCJbSetString(js, "direction", "to_server");
} else {
jb_set_string(js, "direction", "to_client");
SCJbSetString(js, "direction", "to_client");
}
}
jb_open_object(js, "drop");
SCJbOpenObject(js, "drop");
uint16_t proto = 0;
if (PacketIsIPv4(p)) {
const IPV4Hdr *ip4h = PacketGetIPv4(p);
jb_set_uint(js, "len", IPV4_GET_RAW_IPLEN(ip4h));
jb_set_uint(js, "tos", IPV4_GET_RAW_IPTOS(ip4h));
jb_set_uint(js, "ttl", IPV4_GET_RAW_IPTTL(ip4h));
jb_set_uint(js, "ipid", IPV4_GET_RAW_IPID(ip4h));
SCJbSetUint(js, "len", IPV4_GET_RAW_IPLEN(ip4h));
SCJbSetUint(js, "tos", IPV4_GET_RAW_IPTOS(ip4h));
SCJbSetUint(js, "ttl", IPV4_GET_RAW_IPTTL(ip4h));
SCJbSetUint(js, "ipid", IPV4_GET_RAW_IPID(ip4h));
proto = IPV4_GET_RAW_IPPROTO(ip4h);
} else if (PacketIsIPv6(p)) {
const IPV6Hdr *ip6h = PacketGetIPv6(p);
jb_set_uint(js, "len", IPV6_GET_RAW_PLEN(ip6h));
jb_set_uint(js, "tc", IPV6_GET_RAW_CLASS(ip6h));
jb_set_uint(js, "hoplimit", IPV6_GET_RAW_HLIM(ip6h));
jb_set_uint(js, "flowlbl", IPV6_GET_RAW_FLOW(ip6h));
SCJbSetUint(js, "len", IPV6_GET_RAW_PLEN(ip6h));
SCJbSetUint(js, "tc", IPV6_GET_RAW_CLASS(ip6h));
SCJbSetUint(js, "hoplimit", IPV6_GET_RAW_HLIM(ip6h));
SCJbSetUint(js, "flowlbl", IPV6_GET_RAW_FLOW(ip6h));
proto = IPV6_GET_L4PROTO(p);
}
switch (proto) {
case IPPROTO_TCP:
if (PacketIsTCP(p)) {
const TCPHdr *tcph = PacketGetTCP(p);
jb_set_uint(js, "tcpseq", TCP_GET_RAW_SEQ(tcph));
jb_set_uint(js, "tcpack", TCP_GET_RAW_ACK(tcph));
jb_set_uint(js, "tcpwin", TCP_GET_RAW_WINDOW(tcph));
jb_set_bool(js, "syn", TCP_ISSET_FLAG_RAW_SYN(tcph) ? true : false);
jb_set_bool(js, "ack", TCP_ISSET_FLAG_RAW_ACK(tcph) ? true : false);
jb_set_bool(js, "psh", TCP_ISSET_FLAG_RAW_PUSH(tcph) ? true : false);
jb_set_bool(js, "rst", TCP_ISSET_FLAG_RAW_RST(tcph) ? true : false);
jb_set_bool(js, "urg", TCP_ISSET_FLAG_RAW_URG(tcph) ? true : false);
jb_set_bool(js, "fin", TCP_ISSET_FLAG_RAW_FIN(tcph) ? true : false);
jb_set_uint(js, "tcpres", TCP_GET_RAW_X2(tcph));
jb_set_uint(js, "tcpurgp", TCP_GET_RAW_URG_POINTER(tcph));
SCJbSetUint(js, "tcpseq", TCP_GET_RAW_SEQ(tcph));
SCJbSetUint(js, "tcpack", TCP_GET_RAW_ACK(tcph));
SCJbSetUint(js, "tcpwin", TCP_GET_RAW_WINDOW(tcph));
SCJbSetBool(js, "syn", TCP_ISSET_FLAG_RAW_SYN(tcph) ? true : false);
SCJbSetBool(js, "ack", TCP_ISSET_FLAG_RAW_ACK(tcph) ? true : false);
SCJbSetBool(js, "psh", TCP_ISSET_FLAG_RAW_PUSH(tcph) ? true : false);
SCJbSetBool(js, "rst", TCP_ISSET_FLAG_RAW_RST(tcph) ? true : false);
SCJbSetBool(js, "urg", TCP_ISSET_FLAG_RAW_URG(tcph) ? true : false);
SCJbSetBool(js, "fin", TCP_ISSET_FLAG_RAW_FIN(tcph) ? true : false);
SCJbSetUint(js, "tcpres", TCP_GET_RAW_X2(tcph));
SCJbSetUint(js, "tcpurgp", TCP_GET_RAW_URG_POINTER(tcph));
}
break;
case IPPROTO_UDP:
if (PacketIsUDP(p)) {
const UDPHdr *udph = PacketGetUDP(p);
jb_set_uint(js, "udplen", UDP_GET_RAW_LEN(udph));
SCJbSetUint(js, "udplen", UDP_GET_RAW_LEN(udph));
}
break;
case IPPROTO_ICMP:
if (PacketIsICMPv4(p)) {
jb_set_uint(js, "icmp_id", ICMPV4_GET_ID(p));
jb_set_uint(js, "icmp_seq", ICMPV4_GET_SEQ(p));
SCJbSetUint(js, "icmp_id", ICMPV4_GET_ID(p));
SCJbSetUint(js, "icmp_seq", ICMPV4_GET_SEQ(p));
} else if (PacketIsICMPv6(p)) {
jb_set_uint(js, "icmp_id", ICMPV6_GET_ID(p));
jb_set_uint(js, "icmp_seq", ICMPV6_GET_SEQ(p));
SCJbSetUint(js, "icmp_id", ICMPV6_GET_ID(p));
SCJbSetUint(js, "icmp_seq", ICMPV6_GET_SEQ(p));
}
break;
}
if (p->drop_reason != 0) {
const char *str = PacketDropReasonToString(p->drop_reason);
jb_set_string(js, "reason", str);
SCJbSetString(js, "reason", str);
}
/* Close drop. */
jb_close(js);
SCJbClose(js);
if (aft->drop_ctx->flags & LOG_DROP_VERDICT) {
EveAddVerdict(js, p);
@ -192,7 +192,7 @@ static int DropLogJSON(ThreadVars *tv, JsonDropLogThread *aft, const Packet *p)
}
OutputJsonBuilderBuffer(tv, p, p->flow, js, aft->ctx);
jb_free(js);
SCJbFree(js);
return TM_ECODE_OK;
}

28
src/output-json-email-common.c
Unescape Escape View File

@ -83,7 +83,8 @@ struct {
{ NULL, NULL, LOG_EMAIL_DEFAULT},
};
static void EveEmailLogJSONMd5(OutputJsonEmailCtx *email_ctx, JsonBuilder *js, SMTPTransaction *tx)
static void EveEmailLogJSONMd5(
OutputJsonEmailCtx *email_ctx, SCJsonBuilder *js, SMTPTransaction *tx)
{
if (email_ctx->flags & LOG_EMAIL_SUBJECT_MD5) {
MimeStateSMTP *entity = tx->mime_state;
@ -102,7 +103,8 @@ static void EveEmailLogJSONMd5(OutputJsonEmailCtx *email_ctx, JsonBuilder *js, S
}
}
static void EveEmailLogJSONCustom(OutputJsonEmailCtx *email_ctx, JsonBuilder *js, SMTPTransaction *tx)
static void EveEmailLogJSONCustom(
OutputJsonEmailCtx *email_ctx, SCJsonBuilder *js, SMTPTransaction *tx)
{
int f = 0;
MimeStateSMTP *entity = tx->mime_state;
@ -132,7 +134,8 @@ static void EveEmailLogJSONCustom(OutputJsonEmailCtx *email_ctx, JsonBuilder *js
}
/* JSON format logging */
static bool EveEmailLogJsonData(const Flow *f, void *state, void *vtx, uint64_t tx_id, JsonBuilder *sjs)
static bool EveEmailLogJsonData(
const Flow *f, void *state, void *vtx, uint64_t tx_id, SCJsonBuilder *sjs)
{
SMTPState *smtp_state;
MimeStateSMTP *mime_state;
@ -144,8 +147,8 @@ static bool EveEmailLogJsonData(const Flow *f, void *state, void *vtx, uint64_t
smtp_state = (SMTPState *)state;
if (smtp_state == NULL) {
SCLogDebug("no smtp state, so no request logging");
jb_free(sjs);
SCReturnPtr(NULL, "JsonBuilder");
SCJbFree(sjs);
SCReturnPtr(NULL, "SCJsonBuilder");
}
SMTPTransaction *tx = vtx;
mime_state = tx->mime_state;
@ -164,16 +167,17 @@ static bool EveEmailLogJsonData(const Flow *f, void *state, void *vtx, uint64_t
}
/* JSON format logging */
TmEcode EveEmailLogJson(JsonEmailLogThread *aft, JsonBuilder *js, const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id)
TmEcode EveEmailLogJson(JsonEmailLogThread *aft, SCJsonBuilder *js, const Packet *p, Flow *f,
void *state, void *vtx, uint64_t tx_id)
{
OutputJsonEmailCtx *email_ctx = aft->emaillog_ctx;
SMTPTransaction *tx = (SMTPTransaction *) vtx;
JsonBuilderMark mark = { 0, 0, 0 };
SCJsonBuilderMark mark = { 0, 0, 0 };
jb_get_mark(js, &mark);
jb_open_object(js, "email");
SCJbGetMark(js, &mark);
SCJbOpenObject(js, "email");
if (!EveEmailLogJsonData(f, state, vtx, tx_id, js)) {
jb_restore_mark(js, &mark);
SCJbRestoreMark(js, &mark);
SCReturnInt(TM_ECODE_FAILED);
}
@ -184,11 +188,11 @@ TmEcode EveEmailLogJson(JsonEmailLogThread *aft, JsonBuilder *js, const Packet *
EveEmailLogJSONMd5(email_ctx, js, tx);
}
jb_close(js);
SCJbClose(js);
SCReturnInt(TM_ECODE_OK);
}
bool EveEmailAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
bool EveEmailAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *js)
{
SMTPState *smtp_state = (SMTPState *)FlowGetAppState(f);
if (smtp_state) {

5
src/output-json-email-common.h
Unescape Escape View File

@ -35,8 +35,9 @@ typedef struct JsonEmailLogThread_ {
OutputJsonThreadCtx *ctx;
} JsonEmailLogThread;
TmEcode EveEmailLogJson(JsonEmailLogThread *aft, JsonBuilder *js, const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id);
bool EveEmailAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js);
TmEcode EveEmailLogJson(JsonEmailLogThread *aft, SCJsonBuilder *js, const Packet *p, Flow *f,
void *state, void *vtx, uint64_t tx_id);
bool EveEmailAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *js);
void OutputEmailInitConf(SCConfNode *conf, OutputJsonEmailCtx *email_ctx);

66
src/output-json-file.c
Unescape Escape View File

@ -79,7 +79,7 @@ typedef struct JsonFileLogThread_ {
OutputJsonThreadCtx *ctx;
} JsonFileLogThread;
JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, void *tx,
SCJsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, void *tx,
const uint64_t tx_id, const bool stored, uint8_t dir, HttpXFFCfg *xff_cfg,
OutputJsonCtx *eve_ctx)
{
@ -117,59 +117,59 @@ JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, void *tx,
}
}
JsonBuilder *js = CreateEveHeader(p, fdir, "fileinfo", &addr, eve_ctx);
SCJsonBuilder *js = CreateEveHeader(p, fdir, "fileinfo", &addr, eve_ctx);
if (unlikely(js == NULL))
return NULL;
JsonBuilderMark mark = { 0, 0, 0 };
SCJsonBuilderMark mark = { 0, 0, 0 };
EveJsonSimpleAppLayerLogger *al;
switch (p->flow->alproto) {
case ALPROTO_HTTP1:
jb_open_object(js, "http");
SCJbOpenObject(js, "http");
EveHttpAddMetadata(p->flow, tx_id, js);
jb_close(js);
SCJbClose(js);
break;
case ALPROTO_SMTP:
jb_get_mark(js, &mark);
jb_open_object(js, "smtp");
SCJbGetMark(js, &mark);
SCJbOpenObject(js, "smtp");
if (EveSMTPAddMetadata(p->flow, tx_id, js)) {
jb_close(js);
SCJbClose(js);
} else {
jb_restore_mark(js, &mark);
SCJbRestoreMark(js, &mark);
}
jb_get_mark(js, &mark);
jb_open_object(js, "email");
SCJbGetMark(js, &mark);
SCJbOpenObject(js, "email");
if (EveEmailAddMetadata(p->flow, tx_id, js)) {
jb_close(js);
SCJbClose(js);
} else {
jb_restore_mark(js, &mark);
SCJbRestoreMark(js, &mark);
}
break;
case ALPROTO_NFS:
/* rpc */
jb_get_mark(js, &mark);
jb_open_object(js, "rpc");
SCJbGetMark(js, &mark);
SCJbOpenObject(js, "rpc");
if (EveNFSAddMetadataRPC(p->flow, tx_id, js)) {
jb_close(js);
SCJbClose(js);
} else {
jb_restore_mark(js, &mark);
SCJbRestoreMark(js, &mark);
}
/* nfs */
jb_get_mark(js, &mark);
jb_open_object(js, "nfs");
SCJbGetMark(js, &mark);
SCJbOpenObject(js, "nfs");
if (EveNFSAddMetadata(p->flow, tx_id, js)) {
jb_close(js);
SCJbClose(js);
} else {
jb_restore_mark(js, &mark);
SCJbRestoreMark(js, &mark);
}
break;
case ALPROTO_SMB:
jb_get_mark(js, &mark);
jb_open_object(js, "smb");
SCJbGetMark(js, &mark);
SCJbOpenObject(js, "smb");
if (EveSMBAddMetadata(p->flow, tx_id, js)) {
jb_close(js);
SCJbClose(js);
} else {
jb_restore_mark(js, &mark);
SCJbRestoreMark(js, &mark);
}
break;
default:
@ -179,9 +179,9 @@ JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, void *tx,
if (state) {
tx = AppLayerParserGetTx(p->flow->proto, p->flow->alproto, state, tx_id);
if (tx) {
jb_get_mark(js, &mark);
SCJbGetMark(js, &mark);
if (!al->LogTx(tx, js)) {
jb_restore_mark(js, &mark);
SCJbRestoreMark(js, &mark);
}
}
}
@ -189,9 +189,9 @@ JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, void *tx,
break;
}
jb_set_string(js, "app_proto", AppProtoToString(p->flow->alproto));
SCJbSetString(js, "app_proto", AppProtoToString(p->flow->alproto));
jb_open_object(js, "fileinfo");
SCJbOpenObject(js, "fileinfo");
if (stored) {
// the file has just been stored on disk cf OUTPUT_FILEDATA_FLAG_CLOSE
// but the flag is not set until the loggers have been called
@ -199,11 +199,11 @@ JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, void *tx,
} else {
EveFileInfo(js, ff, tx_id, ff->flags);
}
jb_close(js);
SCJbClose(js);
/* xff header */
if (have_xff_ip && xff_cfg->flags & XFF_EXTRADATA) {
jb_set_string(js, "xff", xff_buffer);
SCJbSetString(js, "xff", xff_buffer);
}
return js;
@ -218,13 +218,13 @@ static void FileWriteJsonRecord(ThreadVars *tv, JsonFileLogThread *aft, const Pa
{
HttpXFFCfg *xff_cfg = aft->filelog_ctx->xff_cfg != NULL ? aft->filelog_ctx->xff_cfg
: aft->filelog_ctx->parent_xff_cfg;
JsonBuilder *js = JsonBuildFileInfoRecord(p, ff, tx, tx_id, false, dir, xff_cfg, eve_ctx);
SCJsonBuilder *js = JsonBuildFileInfoRecord(p, ff, tx, tx_id, false, dir, xff_cfg, eve_ctx);
if (unlikely(js == NULL)) {
return;
}
OutputJsonBuilderBuffer(tv, p, p->flow, js, aft->ctx);
jb_free(js);
SCJbFree(js);
}
static int JsonFileLogger(ThreadVars *tv, void *thread_data, const Packet *p, const File *ff,

2
src/output-json-file.h
Unescape Escape View File

@ -29,7 +29,7 @@
typedef struct OutputJsonCtx_ OutputJsonCtx;
void JsonFileLogRegister(void);
JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, void *tx,
SCJsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, void *tx,
const uint64_t tx_id, const bool stored, uint8_t dir, HttpXFFCfg *xff_cfg,
OutputJsonCtx *eve_ctx);

179
src/output-json-flow.c
Unescape Escape View File

@ -52,13 +52,13 @@
#include "flow-storage.h"
#include "util-exception-policy.h"
static JsonBuilder *CreateEveHeaderFromFlow(const Flow *f)
static SCJsonBuilder *CreateEveHeaderFromFlow(const Flow *f)
{
char timebuf[64];
char srcip[46] = {0}, dstip[46] = {0};
Port sp, dp;
JsonBuilder *jb = jb_new_object();
SCJsonBuilder *jb = SCJbNewObject();
if (unlikely(jb == NULL)) {
return NULL;
}
@ -90,7 +90,7 @@ static JsonBuilder *CreateEveHeaderFromFlow(const Flow *f)
}
/* time */
jb_set_string(jb, "timestamp", timebuf);
SCJbSetString(jb, "timestamp", timebuf);
CreateEveFlowId(jb, (const Flow *)f);
@ -102,191 +102,190 @@ static JsonBuilder *CreateEveHeaderFromFlow(const Flow *f)
/* input interface */
if (f->livedev) {
jb_set_string(jb, "in_iface", f->livedev->dev);
SCJbSetString(jb, "in_iface", f->livedev->dev);
}
JB_SET_STRING(jb, "event_type", "flow");
/* vlan */
if (f->vlan_idx > 0) {
jb_open_array(jb, "vlan");
jb_append_uint(jb, f->vlan_id[0]);
SCJbOpenArray(jb, "vlan");
SCJbAppendUint(jb, f->vlan_id[0]);
if (f->vlan_idx > 1) {
jb_append_uint(jb, f->vlan_id[1]);
SCJbAppendUint(jb, f->vlan_id[1]);
}
if (f->vlan_idx > 2) {
jb_append_uint(jb, f->vlan_id[2]);
SCJbAppendUint(jb, f->vlan_id[2]);
}
jb_close(jb);
SCJbClose(jb);
}
/* tuple */
jb_set_string(jb, "src_ip", srcip);
SCJbSetString(jb, "src_ip", srcip);
switch(f->proto) {
case IPPROTO_ICMP:
break;
case IPPROTO_UDP:
case IPPROTO_TCP:
case IPPROTO_SCTP:
jb_set_uint(jb, "src_port", sp);
SCJbSetUint(jb, "src_port", sp);
break;
}
jb_set_string(jb, "dest_ip", dstip);
SCJbSetString(jb, "dest_ip", dstip);
switch(f->proto) {
case IPPROTO_ICMP:
break;
case IPPROTO_UDP:
case IPPROTO_TCP:
case IPPROTO_SCTP:
jb_set_uint(jb, "dest_port", dp);
SCJbSetUint(jb, "dest_port", dp);
break;
}
if (SCProtoNameValid(f->proto)) {
jb_set_string(jb, "proto", known_proto[f->proto]);
SCJbSetString(jb, "proto", known_proto[f->proto]);
} else {
char proto[4];
snprintf(proto, sizeof(proto), "%"PRIu8"", f->proto);
jb_set_string(jb, "proto", proto);
SCJbSetString(jb, "proto", proto);
}
switch (f->proto) {
case IPPROTO_ICMP:
case IPPROTO_ICMPV6:
jb_set_uint(jb, "icmp_type", f->icmp_s.type);
jb_set_uint(jb, "icmp_code", f->icmp_s.code);
SCJbSetUint(jb, "icmp_type", f->icmp_s.type);
SCJbSetUint(jb, "icmp_code", f->icmp_s.code);
if (f->tosrcpktcnt) {
jb_set_uint(jb, "response_icmp_type", f->icmp_d.type);
jb_set_uint(jb, "response_icmp_code", f->icmp_d.code);
SCJbSetUint(jb, "response_icmp_type", f->icmp_d.type);
SCJbSetUint(jb, "response_icmp_code", f->icmp_d.code);
}
break;
case IPPROTO_ESP:
jb_set_uint(jb, "spi", f->esp.spi);
SCJbSetUint(jb, "spi", f->esp.spi);
break;
}
return jb;
}
void EveAddAppProto(Flow *f, JsonBuilder *js)
void EveAddAppProto(Flow *f, SCJsonBuilder *js)
{
if (f->alproto) {
jb_set_string(js, "app_proto", AppProtoToString(f->alproto));
SCJbSetString(js, "app_proto", AppProtoToString(f->alproto));
}
if (f->alproto_ts && f->alproto_ts != f->alproto) {
jb_set_string(js, "app_proto_ts", AppProtoToString(f->alproto_ts));
SCJbSetString(js, "app_proto_ts", AppProtoToString(f->alproto_ts));
}
if (f->alproto_tc && f->alproto_tc != f->alproto) {
jb_set_string(js, "app_proto_tc", AppProtoToString(f->alproto_tc));
SCJbSetString(js, "app_proto_tc", AppProtoToString(f->alproto_tc));
}
if (f->alproto_orig != f->alproto && f->alproto_orig != ALPROTO_UNKNOWN) {
jb_set_string(js, "app_proto_orig", AppProtoToString(f->alproto_orig));
SCJbSetString(js, "app_proto_orig", AppProtoToString(f->alproto_orig));
}
if (f->alproto_expect != f->alproto && f->alproto_expect != ALPROTO_UNKNOWN) {
jb_set_string(js, "app_proto_expected",
AppProtoToString(f->alproto_expect));
SCJbSetString(js, "app_proto_expected", AppProtoToString(f->alproto_expect));
}
}
void EveAddFlow(Flow *f, JsonBuilder *js)
void EveAddFlow(Flow *f, SCJsonBuilder *js)
{
FlowBypassInfo *fc = FlowGetStorageById(f, GetFlowBypassInfoID());
if (fc) {
jb_set_uint(js, "pkts_toserver", f->todstpktcnt + fc->todstpktcnt);
jb_set_uint(js, "pkts_toclient", f->tosrcpktcnt + fc->tosrcpktcnt);
jb_set_uint(js, "bytes_toserver", f->todstbytecnt + fc->todstbytecnt);
jb_set_uint(js, "bytes_toclient", f->tosrcbytecnt + fc->tosrcbytecnt);
jb_open_object(js, "bypassed");
jb_set_uint(js, "pkts_toserver", fc->todstpktcnt);
jb_set_uint(js, "pkts_toclient", fc->tosrcpktcnt);
jb_set_uint(js, "bytes_toserver", fc->todstbytecnt);
jb_set_uint(js, "bytes_toclient", fc->tosrcbytecnt);
jb_close(js);
SCJbSetUint(js, "pkts_toserver", f->todstpktcnt + fc->todstpktcnt);
SCJbSetUint(js, "pkts_toclient", f->tosrcpktcnt + fc->tosrcpktcnt);
SCJbSetUint(js, "bytes_toserver", f->todstbytecnt + fc->todstbytecnt);
SCJbSetUint(js, "bytes_toclient", f->tosrcbytecnt + fc->tosrcbytecnt);
SCJbOpenObject(js, "bypassed");
SCJbSetUint(js, "pkts_toserver", fc->todstpktcnt);
SCJbSetUint(js, "pkts_toclient", fc->tosrcpktcnt);
SCJbSetUint(js, "bytes_toserver", fc->todstbytecnt);
SCJbSetUint(js, "bytes_toclient", fc->tosrcbytecnt);
SCJbClose(js);
} else {
jb_set_uint(js, "pkts_toserver", f->todstpktcnt);
jb_set_uint(js, "pkts_toclient", f->tosrcpktcnt);
jb_set_uint(js, "bytes_toserver", f->todstbytecnt);
jb_set_uint(js, "bytes_toclient", f->tosrcbytecnt);
SCJbSetUint(js, "pkts_toserver", f->todstpktcnt);
SCJbSetUint(js, "pkts_toclient", f->tosrcpktcnt);
SCJbSetUint(js, "bytes_toserver", f->todstbytecnt);
SCJbSetUint(js, "bytes_toclient", f->tosrcbytecnt);
}
char timebuf1[64];
CreateIsoTimeString(f->startts, timebuf1, sizeof(timebuf1));
jb_set_string(js, "start", timebuf1);
SCJbSetString(js, "start", timebuf1);
}
static void EveExceptionPolicyLog(JsonBuilder *js, uint16_t flag)
static void EveExceptionPolicyLog(SCJsonBuilder *js, uint16_t flag)
{
if (flag & EXCEPTION_TARGET_FLAG_DEFRAG_MEMCAP) {
jb_start_object(js);
jb_set_string(js, "target",
SCJbStartObject(js);
SCJbSetString(js, "target",
ExceptionPolicyTargetFlagToString(EXCEPTION_TARGET_FLAG_DEFRAG_MEMCAP));
jb_set_string(js, "policy",
SCJbSetString(js, "policy",
ExceptionPolicyEnumToString(
ExceptionPolicyTargetPolicy(EXCEPTION_TARGET_FLAG_DEFRAG_MEMCAP), true));
jb_close(js);
SCJbClose(js);
}
if (flag & EXCEPTION_TARGET_FLAG_SESSION_MEMCAP) {
jb_start_object(js);
jb_set_string(js, "target",
SCJbStartObject(js);
SCJbSetString(js, "target",
ExceptionPolicyTargetFlagToString(EXCEPTION_TARGET_FLAG_SESSION_MEMCAP));
jb_set_string(js, "policy",
SCJbSetString(js, "policy",
ExceptionPolicyEnumToString(
ExceptionPolicyTargetPolicy(EXCEPTION_TARGET_FLAG_SESSION_MEMCAP), true));
jb_close(js);
SCJbClose(js);
}
if (flag & EXCEPTION_TARGET_FLAG_REASSEMBLY_MEMCAP) {
jb_start_object(js);
jb_set_string(js, "target",
SCJbStartObject(js);
SCJbSetString(js, "target",
ExceptionPolicyTargetFlagToString(EXCEPTION_TARGET_FLAG_REASSEMBLY_MEMCAP));
jb_set_string(js, "policy",
SCJbSetString(js, "policy",
ExceptionPolicyEnumToString(
ExceptionPolicyTargetPolicy(EXCEPTION_TARGET_FLAG_REASSEMBLY_MEMCAP),
true));
jb_close(js);
SCJbClose(js);
}
if (flag & EXCEPTION_TARGET_FLAG_FLOW_MEMCAP) {
jb_start_object(js);
jb_set_string(
SCJbStartObject(js);
SCJbSetString(
js, "target", ExceptionPolicyTargetFlagToString(EXCEPTION_TARGET_FLAG_FLOW_MEMCAP));
jb_set_string(js, "policy",
SCJbSetString(js, "policy",
ExceptionPolicyEnumToString(
ExceptionPolicyTargetPolicy(EXCEPTION_TARGET_FLAG_FLOW_MEMCAP), true));
jb_close(js);
SCJbClose(js);
}
if (flag & EXCEPTION_TARGET_FLAG_MIDSTREAM) {
jb_start_object(js);
jb_set_string(
SCJbStartObject(js);
SCJbSetString(
js, "target", ExceptionPolicyTargetFlagToString(EXCEPTION_TARGET_FLAG_MIDSTREAM));
jb_set_string(js, "policy",
SCJbSetString(js, "policy",
ExceptionPolicyEnumToString(
ExceptionPolicyTargetPolicy(EXCEPTION_TARGET_FLAG_MIDSTREAM), true));
jb_close(js);
SCJbClose(js);
}
if (flag & EXCEPTION_TARGET_FLAG_APPLAYER_ERROR) {
jb_start_object(js);
jb_set_string(js, "target",
SCJbStartObject(js);
SCJbSetString(js, "target",
ExceptionPolicyTargetFlagToString(EXCEPTION_TARGET_FLAG_APPLAYER_ERROR));
jb_set_string(js, "policy",
SCJbSetString(js, "policy",
ExceptionPolicyEnumToString(
ExceptionPolicyTargetPolicy(EXCEPTION_TARGET_FLAG_APPLAYER_ERROR), true));
jb_close(js);
SCJbClose(js);
}
}
/* Eve format logging */
static void EveFlowLogJSON(OutputJsonThreadCtx *aft, JsonBuilder *jb, Flow *f)
static void EveFlowLogJSON(OutputJsonThreadCtx *aft, SCJsonBuilder *jb, Flow *f)
{
EveAddAppProto(f, jb);
jb_open_object(jb, "flow");
SCJbOpenObject(jb, "flow");
EveAddFlow(f, jb);
char timebuf2[64];
CreateIsoTimeString(f->lastts, timebuf2, sizeof(timebuf2));
jb_set_string(jb, "end", timebuf2);
SCJbSetString(jb, "end", timebuf2);
uint64_t age = (SCTIME_SECS(f->lastts) - SCTIME_SECS(f->startts));
jb_set_uint(jb, "age", age);
SCJbSetUint(jb, "age", age);
if (f->flow_end_flags & FLOW_END_FLAG_EMERGENCY)
JB_SET_TRUE(jb, "emergency");
@ -329,9 +328,9 @@ static void EveFlowLogJSON(OutputJsonThreadCtx *aft, JsonBuilder *jb, Flow *f)
else
reason = "unknown";
jb_set_string(jb, "reason", reason);
SCJbSetString(jb, "reason", reason);
jb_set_bool(jb, "alerted", FlowHasAlerts(f));
SCJbSetBool(jb, "alerted", FlowHasAlerts(f));
if (f->flags & FLOW_WRONG_THREAD)
JB_SET_TRUE(jb, "wrong_thread");
@ -341,41 +340,41 @@ static void EveFlowLogJSON(OutputJsonThreadCtx *aft, JsonBuilder *jb, Flow *f)
JB_SET_STRING(jb, "action", "pass");
}
if (f->applied_exception_policy != 0) {
jb_open_array(jb, "exception_policy");
SCJbOpenArray(jb, "exception_policy");
EveExceptionPolicyLog(jb, f->applied_exception_policy);
jb_close(jb); /* close array */
SCJbClose(jb); /* close array */
}
/* Close flow. */
jb_close(jb);
SCJbClose(jb);
EveAddCommonOptions(&aft->ctx->cfg, NULL, f, jb, LOG_DIR_FLOW);
/* TCP */
if (f->proto == IPPROTO_TCP) {
jb_open_object(jb, "tcp");
SCJbOpenObject(jb, "tcp");
TcpSession *ssn = f->protoctx;
char hexflags[3];
snprintf(hexflags, sizeof(hexflags), "%02x",
ssn ? ssn->tcp_packet_flags : 0);
jb_set_string(jb, "tcp_flags", hexflags);
SCJbSetString(jb, "tcp_flags", hexflags);
snprintf(hexflags, sizeof(hexflags), "%02x",
ssn ? ssn->client.tcp_flags : 0);
jb_set_string(jb, "tcp_flags_ts", hexflags);
SCJbSetString(jb, "tcp_flags_ts", hexflags);
snprintf(hexflags, sizeof(hexflags), "%02x",
ssn ? ssn->server.tcp_flags : 0);
jb_set_string(jb, "tcp_flags_tc", hexflags);
SCJbSetString(jb, "tcp_flags_tc", hexflags);
EveTcpFlags(ssn ? ssn->tcp_packet_flags : 0, jb);
if (ssn) {
const char *tcp_state = StreamTcpStateAsString(ssn->state);
if (tcp_state != NULL)
jb_set_string(jb, "state", tcp_state);
SCJbSetString(jb, "state", tcp_state);
if (ssn->server.flags & STREAMTCP_STREAM_FLAG_HAS_GAP) {
JB_SET_TRUE(jb, "tc_gap");
}
@ -383,17 +382,17 @@ static void EveFlowLogJSON(OutputJsonThreadCtx *aft, JsonBuilder *jb, Flow *f)
JB_SET_TRUE(jb, "ts_gap");
}
jb_set_uint(jb, "ts_max_regions", ssn->client.sb.max_regions);
jb_set_uint(jb, "tc_max_regions", ssn->server.sb.max_regions);
SCJbSetUint(jb, "ts_max_regions", ssn->client.sb.max_regions);
SCJbSetUint(jb, "tc_max_regions", ssn->server.sb.max_regions);
if (ssn->urg_offset_ts)
jb_set_uint(jb, "ts_urgent_oob_data", ssn->urg_offset_ts);
SCJbSetUint(jb, "ts_urgent_oob_data", ssn->urg_offset_ts);
if (ssn->urg_offset_tc)
jb_set_uint(jb, "tc_urgent_oob_data", ssn->urg_offset_tc);
SCJbSetUint(jb, "tc_urgent_oob_data", ssn->urg_offset_tc);
}
/* Close tcp. */
jb_close(jb);
SCJbClose(jb);
}
}
@ -405,7 +404,7 @@ static int JsonFlowLogger(ThreadVars *tv, void *thread_data, Flow *f)
/* reset */
MemBufferReset(thread->buffer);
JsonBuilder *jb = CreateEveHeaderFromFlow(f);
SCJsonBuilder *jb = CreateEveHeaderFromFlow(f);
if (unlikely(jb == NULL)) {
SCReturnInt(TM_ECODE_OK);
}
@ -413,7 +412,7 @@ static int JsonFlowLogger(ThreadVars *tv, void *thread_data, Flow *f)
EveFlowLogJSON(thread, jb, f);
OutputJsonBuilderBuffer(tv, NULL, f, jb, thread);
jb_free(jb);
SCJbFree(jb);
SCReturnInt(TM_ECODE_OK);
}

4
src/output-json-flow.h
Unescape Escape View File

@ -25,7 +25,7 @@
#define SURICATA_OUTPUT_JSON_FLOW_H
void JsonFlowLogRegister(void);
void EveAddFlow(Flow *f, JsonBuilder *js);
void EveAddAppProto(Flow *f, JsonBuilder *js);
void EveAddFlow(Flow *f, SCJsonBuilder *js);
void EveAddAppProto(Flow *f, SCJsonBuilder *js);
#endif /* SURICATA_OUTPUT_JSON_FLOW_H */

52
src/output-json-frame.c
Unescape Escape View File

@ -173,7 +173,7 @@ static int FrameJsonStreamDataCallback(
* \brief try to log frame's stream data into payload/payload_printable
*/
static void FrameAddPayloadTCP(Flow *f, const TcpSession *ssn, const TcpStream *stream,
const Frame *frame, JsonBuilder *jb, MemBuffer *buffer)
const Frame *frame, SCJsonBuilder *jb, MemBuffer *buffer)
{
MemBufferReset(buffer);
@ -199,17 +199,17 @@ static void FrameAddPayloadTCP(Flow *f, const TcpSession *ssn, const TcpStream *
}
if (cbd.payload->offset) {
jb_set_base64(jb, "payload", cbd.payload->buffer, cbd.payload->offset);
SCJbSetBase64(jb, "payload", cbd.payload->buffer, cbd.payload->offset);
uint8_t printable_buf[cbd.payload->offset + 1];
uint32_t offset = 0;
PrintStringsToBuffer(printable_buf, &offset, cbd.payload->offset + 1, cbd.payload->buffer,
cbd.payload->offset);
jb_set_string(jb, "payload_printable", (char *)printable_buf);
jb_set_bool(jb, "complete", complete);
SCJbSetString(jb, "payload_printable", (char *)printable_buf);
SCJbSetBool(jb, "complete", complete);
}
}
static void FrameAddPayloadUDP(JsonBuilder *js, const Packet *p, const Frame *frame)
static void FrameAddPayloadUDP(SCJsonBuilder *js, const Packet *p, const Frame *frame)
{
DEBUG_VALIDATE_BUG_ON(frame->offset >= p->payload_len);
if (frame->offset >= p->payload_len)
@ -231,18 +231,18 @@ static void FrameAddPayloadUDP(JsonBuilder *js, const Packet *p, const Frame *fr
const uint32_t data_len = frame_len;
const uint32_t log_data_len = MIN(data_len, 256);
jb_set_base64(js, "payload", data, log_data_len);
SCJbSetBase64(js, "payload", data, log_data_len);
uint8_t printable_buf[log_data_len + 1];
uint32_t o = 0;
PrintStringsToBuffer(printable_buf, &o, log_data_len + 1, data, log_data_len);
printable_buf[log_data_len] = '\0';
jb_set_string(js, "payload_printable", (char *)printable_buf);
SCJbSetString(js, "payload_printable", (char *)printable_buf);
#if 0
char pretty_buf[data_len * 4 + 1];
pretty_buf[0] = '\0';
PayloadAsHex(data, data_len, pretty_buf, data_len * 4 + 1);
jb_set_string(js, "payload_hex", pretty_buf);
SCJbSetString(js, "payload_hex", pretty_buf);
#endif
}
@ -251,40 +251,40 @@ static void FrameAddPayloadUDP(JsonBuilder *js, const Packet *p, const Frame *fr
* \note ipproto argument is passed to assist static code analyzers
*/
void FrameJsonLogOneFrame(const uint8_t ipproto, const Frame *frame, Flow *f,
const TcpStream *stream, const Packet *p, JsonBuilder *jb, MemBuffer *buffer)
const TcpStream *stream, const Packet *p, SCJsonBuilder *jb, MemBuffer *buffer)
{
DEBUG_VALIDATE_BUG_ON(ipproto != p->proto);
DEBUG_VALIDATE_BUG_ON(ipproto != f->proto);
jb_open_object(jb, "frame");
SCJbOpenObject(jb, "frame");
if (frame->type == FRAME_STREAM_TYPE) {
jb_set_string(jb, "type", "stream");
SCJbSetString(jb, "type", "stream");
} else {
jb_set_string(jb, "type", AppLayerParserGetFrameNameById(ipproto, f->alproto, frame->type));
SCJbSetString(jb, "type", AppLayerParserGetFrameNameById(ipproto, f->alproto, frame->type));
}
jb_set_uint(jb, "id", frame->id);
jb_set_string(jb, "direction", PKT_IS_TOSERVER(p) ? "toserver" : "toclient");
SCJbSetUint(jb, "id", frame->id);
SCJbSetString(jb, "direction", PKT_IS_TOSERVER(p) ? "toserver" : "toclient");
if (ipproto == IPPROTO_TCP) {
DEBUG_VALIDATE_BUG_ON(stream == NULL);
jb_set_uint(jb, "stream_offset", frame->offset);
SCJbSetUint(jb, "stream_offset", frame->offset);
if (frame->len < 0) {
uint64_t usable = StreamTcpGetUsable(stream, true);
uint64_t len = usable - frame->offset;
jb_set_uint(jb, "length", len);
SCJbSetUint(jb, "length", len);
} else {
jb_set_uint(jb, "length", frame->len);
SCJbSetUint(jb, "length", frame->len);
}
FrameAddPayloadTCP(f, f->protoctx, stream, frame, jb, buffer);
} else {
jb_set_uint(jb, "length", frame->len);
SCJbSetUint(jb, "length", frame->len);
FrameAddPayloadUDP(jb, p, frame);
}
if (frame->flags & FRAME_FLAG_TX_ID_SET) {
jb_set_uint(jb, "tx_id", frame->tx_id);
SCJbSetUint(jb, "tx_id", frame->tx_id);
}
jb_close(jb);
SCJbClose(jb);
}
static int FrameJsonUdp(ThreadVars *tv, JsonFrameLogThread *aft, const Packet *p, Flow *f,
@ -308,15 +308,15 @@ static int FrameJsonUdp(ThreadVars *tv, JsonFrameLogThread *aft, const Packet *p
JsonAddrInfo addr = json_addr_info_zero;
JsonAddrInfoInit(p, LOG_DIR_PACKET, &addr);
JsonBuilder *jb =
SCJsonBuilder *jb =
CreateEveHeader(p, LOG_DIR_PACKET, "frame", &addr, json_output_ctx->eve_ctx);
if (unlikely(jb == NULL))
return TM_ECODE_OK;
jb_set_string(jb, "app_proto", AppProtoToString(f->alproto));
SCJbSetString(jb, "app_proto", AppProtoToString(f->alproto));
FrameJsonLogOneFrame(IPPROTO_UDP, frame, p->flow, NULL, p, jb, aft->payload_buffer);
OutputJsonBuilderBuffer(tv, p, p->flow, jb, aft->ctx);
jb_free(jb);
SCJbFree(jb);
frame->flags |= FRAME_FLAG_LOGGED;
}
return TM_ECODE_OK;
@ -382,15 +382,15 @@ static int FrameJson(ThreadVars *tv, JsonFrameLogThread *aft, const Packet *p)
JsonAddrInfo addr = json_addr_info_zero;
JsonAddrInfoInit(p, LOG_DIR_PACKET, &addr);
JsonBuilder *jb =
SCJsonBuilder *jb =
CreateEveHeader(p, LOG_DIR_PACKET, "frame", &addr, json_output_ctx->eve_ctx);
if (unlikely(jb == NULL))
return TM_ECODE_OK;
jb_set_string(jb, "app_proto", AppProtoToString(p->flow->alproto));
SCJbSetString(jb, "app_proto", AppProtoToString(p->flow->alproto));
FrameJsonLogOneFrame(IPPROTO_TCP, frame, p->flow, stream, p, jb, aft->payload_buffer);
OutputJsonBuilderBuffer(tv, p, p->flow, jb, aft->ctx);
jb_free(jb);
SCJbFree(jb);
frame->flags |= FRAME_FLAG_LOGGED;
}
}

2
src/output-json-frame.h
Unescape Escape View File

@ -31,7 +31,7 @@
#include "stream-tcp-private.h"
void FrameJsonLogOneFrame(const uint8_t ipproto, const Frame *frame, Flow *f,
const TcpStream *stream, const Packet *p, JsonBuilder *jb, MemBuffer *);
const TcpStream *stream, const Packet *p, SCJsonBuilder *jb, MemBuffer *);
void JsonFrameLogRegister(void);
#endif /* SURICATA_OUTPUT_JSON_FRAME_H */

31
src/output-json-ftp.c
Unescape Escape View File

@ -46,13 +46,13 @@
#include "app-layer-ftp.h"
#include "output-json-ftp.h"
bool EveFTPLogCommand(void *vtx, JsonBuilder *jb)
bool EveFTPLogCommand(void *vtx, SCJsonBuilder *jb)
{
FTPTransaction *tx = vtx;
/* Preallocate array objects to simplify failure case */
JsonBuilder *js_resplist = NULL;
SCJsonBuilder *js_resplist = NULL;
if (!TAILQ_EMPTY(&tx->response_list)) {
js_resplist = jb_new_array();
js_resplist = SCJbNewArray();
if (unlikely(js_resplist == NULL)) {
return false;
@ -68,12 +68,12 @@ bool EveFTPLogCommand(void *vtx, JsonBuilder *jb)
return false;
}
}
jb_open_object(jb, "ftp");
SCJbOpenObject(jb, "ftp");
if (command_name) {
jb_set_string(jb, "command", command_name);
SCJbSetString(jb, "command", command_name);
uint32_t min_length = command_name_length + 1; /* command + space */
if (tx->request_length > min_length) {
jb_set_string_from_bytes(jb, "command_data", (const uint8_t *)tx->request + min_length,
SCJbSetStringFromBytes(jb, "command_data", (const uint8_t *)tx->request + min_length,
tx->request_length - min_length - 1);
if (tx->request_truncated) {
JB_SET_TRUE(jb, "command_truncated");
@ -109,16 +109,17 @@ bool EveFTPLogCommand(void *vtx, JsonBuilder *jb)
/* Gather the completion code if present */
if (isdigit(where[0]) && isdigit(where[1]) && isdigit(where[2])) {
if (!is_cc_array_open) {
jb_open_array(jb, "completion_code");
SCJbOpenArray(jb, "completion_code");
is_cc_array_open = true;
}
jb_append_string_from_bytes(jb, (const uint8_t *)where, 3);
SCJbAppendStringFromBytes(jb, (const uint8_t *)where, 3);
offset = 4;
}
}
/* move past 3 character completion code */
if (pos >= offset) {
jb_append_string_from_bytes(js_resplist, (const uint8_t *)where + offset, pos - offset);
SCJbAppendStringFromBytes(
js_resplist, (const uint8_t *)where + offset, pos - offset);
resp_cnt++;
}
@ -128,17 +129,17 @@ bool EveFTPLogCommand(void *vtx, JsonBuilder *jb)
}
if (is_cc_array_open) {
jb_close(jb);
SCJbClose(jb);
}
if (resp_cnt) {
jb_close(js_resplist);
jb_set_object(jb, "reply", js_resplist);
SCJbClose(js_resplist);
SCJbSetObject(jb, "reply", js_resplist);
}
jb_free(js_resplist);
SCJbFree(js_resplist);
}
if (tx->dyn_port) {
jb_set_uint(jb, "dynamic_port", tx->dyn_port);
SCJbSetUint(jb, "dynamic_port", tx->dyn_port);
}
if (tx->command_descriptor.command_code == FTP_COMMAND_PORT ||
@ -161,6 +162,6 @@ bool EveFTPLogCommand(void *vtx, JsonBuilder *jb)
} else {
JB_SET_FALSE(jb, "reply_truncated");
}
jb_close(jb);
SCJbClose(jb);
return true;
}

2
src/output-json-ftp.h
Unescape Escape View File

@ -24,6 +24,6 @@
#ifndef SURICATA_OUTPUT_JSON_FTP_H
#define SURICATA_OUTPUT_JSON_FTP_H
bool EveFTPLogCommand(void *vtx, JsonBuilder *js);
bool EveFTPLogCommand(void *vtx, SCJsonBuilder *js);
#endif /* SURICATA_OUTPUT_JSON_FTP_H */

92
src/output-json-http.c
Unescape Escape View File

@ -194,11 +194,11 @@ struct {
{ "x_bluecoat_via", "x-bluecoat-via", LOG_HTTP_REQUEST },
};
static void EveHttpLogJSONBasic(JsonBuilder *js, htp_tx_t *tx)
static void EveHttpLogJSONBasic(SCJsonBuilder *js, htp_tx_t *tx)
{
/* hostname */
if (htp_tx_request_hostname(tx) != NULL) {
jb_set_string_from_bytes(js, "hostname", bstr_ptr(htp_tx_request_hostname(tx)),
SCJbSetStringFromBytes(js, "hostname", bstr_ptr(htp_tx_request_hostname(tx)),
(uint32_t)bstr_len(htp_tx_request_hostname(tx)));
}
@ -209,12 +209,12 @@ static void EveHttpLogJSONBasic(JsonBuilder *js, htp_tx_t *tx)
* port and the TCP destination port of the flow.
*/
if (htp_tx_request_port_number(tx) >= 0) {
jb_set_uint(js, "http_port", htp_tx_request_port_number(tx));
SCJbSetUint(js, "http_port", htp_tx_request_port_number(tx));
}
/* uri */
if (htp_tx_request_uri(tx) != NULL) {
jb_set_string_from_bytes(js, "url", bstr_ptr(htp_tx_request_uri(tx)),
SCJbSetStringFromBytes(js, "url", bstr_ptr(htp_tx_request_uri(tx)),
(uint32_t)bstr_len(htp_tx_request_uri(tx)));
}
@ -222,14 +222,14 @@ static void EveHttpLogJSONBasic(JsonBuilder *js, htp_tx_t *tx)
/* user agent */
const htp_header_t *h_user_agent = htp_tx_request_header(tx, "user-agent");
if (h_user_agent != NULL) {
jb_set_string_from_bytes(js, "http_user_agent", htp_header_value_ptr(h_user_agent),
SCJbSetStringFromBytes(js, "http_user_agent", htp_header_value_ptr(h_user_agent),
(uint32_t)htp_header_value_len(h_user_agent));
}
/* x-forwarded-for */
const htp_header_t *h_x_forwarded_for = htp_tx_request_header(tx, "x-forwarded-for");
if (h_x_forwarded_for != NULL) {
jb_set_string_from_bytes(js, "xff", htp_header_value_ptr(h_x_forwarded_for),
SCJbSetStringFromBytes(js, "xff", htp_header_value_ptr(h_x_forwarded_for),
(uint32_t)htp_header_value_len(h_x_forwarded_for));
}
}
@ -245,28 +245,28 @@ static void EveHttpLogJSONBasic(JsonBuilder *js, htp_tx_t *tx)
char *p = strchr(string, ';');
if (p != NULL)
*p = '\0';
jb_set_string(js, "http_content_type", string);
SCJbSetString(js, "http_content_type", string);
}
const htp_header_t *h_content_range = htp_tx_response_header(tx, "content-range");
if (h_content_range != NULL) {
jb_open_object(js, "content_range");
jb_set_string_from_bytes(js, "raw", htp_header_value_ptr(h_content_range),
SCJbOpenObject(js, "content_range");
SCJbSetStringFromBytes(js, "raw", htp_header_value_ptr(h_content_range),
(uint32_t)htp_header_value_len(h_content_range));
HTTPContentRange crparsed;
if (HTPParseContentRange(htp_header_value(h_content_range), &crparsed) == 0) {
if (crparsed.start >= 0)
jb_set_uint(js, "start", crparsed.start);
SCJbSetUint(js, "start", crparsed.start);
if (crparsed.end >= 0)
jb_set_uint(js, "end", crparsed.end);
SCJbSetUint(js, "end", crparsed.end);
if (crparsed.size >= 0)
jb_set_uint(js, "size", crparsed.size);
SCJbSetUint(js, "size", crparsed.size);
}
jb_close(js);
SCJbClose(js);
}
}
}
static void EveHttpLogJSONExtended(JsonBuilder *js, htp_tx_t *tx)
static void EveHttpLogJSONExtended(SCJsonBuilder *js, htp_tx_t *tx)
{
/* referer */
const htp_header_t *h_referer = NULL;
@ -274,53 +274,53 @@ static void EveHttpLogJSONExtended(JsonBuilder *js, htp_tx_t *tx)
h_referer = htp_tx_request_header(tx, "referer");
}
if (h_referer != NULL) {
jb_set_string_from_bytes(js, "http_refer", htp_header_value_ptr(h_referer),
SCJbSetStringFromBytes(js, "http_refer", htp_header_value_ptr(h_referer),
(uint32_t)htp_header_value_len(h_referer));
}
/* method */
if (htp_tx_request_method(tx) != NULL) {
jb_set_string_from_bytes(js, "http_method", bstr_ptr(htp_tx_request_method(tx)),
SCJbSetStringFromBytes(js, "http_method", bstr_ptr(htp_tx_request_method(tx)),
(uint32_t)bstr_len(htp_tx_request_method(tx)));
}
/* protocol */
if (htp_tx_request_protocol(tx) != NULL) {
jb_set_string_from_bytes(js, "protocol", bstr_ptr(htp_tx_request_protocol(tx)),
SCJbSetStringFromBytes(js, "protocol", bstr_ptr(htp_tx_request_protocol(tx)),
(uint32_t)bstr_len(htp_tx_request_protocol(tx)));
}
/* response status */
const int resp = htp_tx_response_status_number(tx);
if (resp > 0) {
jb_set_uint(js, "status", (uint32_t)resp);
SCJbSetUint(js, "status", (uint32_t)resp);
} else if (htp_tx_response_status(tx) != NULL) {
jb_set_string_from_bytes(js, "status_string", bstr_ptr(htp_tx_response_status(tx)),
SCJbSetStringFromBytes(js, "status_string", bstr_ptr(htp_tx_response_status(tx)),
(uint32_t)bstr_len(htp_tx_response_status(tx)));
}
const htp_header_t *h_location = htp_tx_response_header(tx, "location");
if (h_location != NULL) {
jb_set_string_from_bytes(js, "redirect", htp_header_value_ptr(h_location),
SCJbSetStringFromBytes(js, "redirect", htp_header_value_ptr(h_location),
(uint32_t)htp_header_value_len(h_location));
}
/* length */
jb_set_uint(js, "length", htp_tx_response_message_len(tx));
SCJbSetUint(js, "length", htp_tx_response_message_len(tx));
}
static void EveHttpLogJSONHeaders(
JsonBuilder *js, uint32_t direction, htp_tx_t *tx, LogHttpFileCtx *http_ctx)
SCJsonBuilder *js, uint32_t direction, htp_tx_t *tx, LogHttpFileCtx *http_ctx)
{
const htp_headers_t *headers = direction & LOG_HTTP_REQ_HEADERS ? htp_tx_request_headers(tx)
: htp_tx_response_headers(tx);
char name[MAX_SIZE_HEADER_NAME] = {0};
char value[MAX_SIZE_HEADER_VALUE] = {0};
size_t n = htp_headers_size(headers);
JsonBuilderMark mark = { 0, 0, 0 };
jb_get_mark(js, &mark);
SCJsonBuilderMark mark = { 0, 0, 0 };
SCJbGetMark(js, &mark);
bool array_empty = true;
jb_open_array(js, direction & LOG_HTTP_REQ_HEADERS ? "request_headers" : "response_headers");
SCJbOpenArray(js, direction & LOG_HTTP_REQ_HEADERS ? "request_headers" : "response_headers");
for (size_t i = 0; i < n; i++) {
const htp_header_t *h = htp_headers_get_index(headers, i);
if ((http_ctx->flags & direction) == 0 && http_ctx->fields != 0) {
@ -344,30 +344,30 @@ static void EveHttpLogJSONHeaders(
}
}
array_empty = false;
jb_start_object(js);
SCJbStartObject(js);
size_t size_name = htp_header_name_len(h) < MAX_SIZE_HEADER_NAME - 1
? htp_header_name_len(h)
: MAX_SIZE_HEADER_NAME - 1;
memcpy(name, htp_header_name_ptr(h), size_name);
name[size_name] = '\0';
jb_set_string(js, "name", name);
SCJbSetString(js, "name", name);
size_t size_value = htp_header_value_len(h) < MAX_SIZE_HEADER_VALUE - 1
? htp_header_value_len(h)
: MAX_SIZE_HEADER_VALUE - 1;
memcpy(value, htp_header_value_ptr(h), size_value);
value[size_value] = '\0';
jb_set_string(js, "value", value);
jb_close(js);
SCJbSetString(js, "value", value);
SCJbClose(js);
}
if (array_empty) {
jb_restore_mark(js, &mark);
SCJbRestoreMark(js, &mark);
} else {
// Close array.
jb_close(js);
SCJbClose(js);
}
}
static void BodyPrintableBuffer(JsonBuilder *js, HtpBody *body, const char *key)
static void BodyPrintableBuffer(SCJsonBuilder *js, HtpBody *body, const char *key)
{
if (body->sb != NULL && body->sb->region.buf != NULL) {
uint32_t offset = 0;
@ -383,12 +383,12 @@ static void BodyPrintableBuffer(JsonBuilder *js, HtpBody *body, const char *key)
uint8_t printable_buf[body_data_len + 1];
PrintStringsToBuffer(printable_buf, &offset, body_data_len + 1, body_data, body_data_len);
if (offset > 0) {
jb_set_string(js, key, (char *)printable_buf);
SCJbSetString(js, key, (char *)printable_buf);
}
}
}
void EveHttpLogJSONBodyPrintable(JsonBuilder *js, Flow *f, uint64_t tx_id)
void EveHttpLogJSONBodyPrintable(SCJsonBuilder *js, Flow *f, uint64_t tx_id)
{
HtpState *htp_state = (HtpState *)FlowGetAppState(f);
if (htp_state) {
@ -403,7 +403,7 @@ void EveHttpLogJSONBodyPrintable(JsonBuilder *js, Flow *f, uint64_t tx_id)
}
}
static void BodyBase64Buffer(JsonBuilder *js, HtpBody *body, const char *key)
static void BodyBase64Buffer(SCJsonBuilder *js, HtpBody *body, const char *key)
{
if (body->sb != NULL && body->sb->region.buf != NULL) {
const uint8_t *body_data;
@ -415,11 +415,11 @@ static void BodyBase64Buffer(JsonBuilder *js, HtpBody *body, const char *key)
return;
}
jb_set_base64(js, key, body_data, body_data_len);
SCJbSetBase64(js, key, body_data, body_data_len);
}
}
void EveHttpLogJSONBodyBase64(JsonBuilder *js, Flow *f, uint64_t tx_id)
void EveHttpLogJSONBodyBase64(SCJsonBuilder *js, Flow *f, uint64_t tx_id)
{
HtpState *htp_state = (HtpState *)FlowGetAppState(f);
if (htp_state) {
@ -435,10 +435,10 @@ void EveHttpLogJSONBodyBase64(JsonBuilder *js, Flow *f, uint64_t tx_id)
}
/* JSON format logging */
static void EveHttpLogJSON(JsonHttpLogThread *aft, JsonBuilder *js, htp_tx_t *tx, uint64_t tx_id)
static void EveHttpLogJSON(JsonHttpLogThread *aft, SCJsonBuilder *js, htp_tx_t *tx, uint64_t tx_id)
{
LogHttpFileCtx *http_ctx = aft->httplog_ctx;
jb_open_object(js, "http");
SCJbOpenObject(js, "http");
EveHttpLogJSONBasic(js, tx);
if (http_ctx->flags & LOG_HTTP_EXTENDED)
@ -448,7 +448,7 @@ static void EveHttpLogJSON(JsonHttpLogThread *aft, JsonBuilder *js, htp_tx_t *tx
if (http_ctx->flags & LOG_HTTP_RES_HEADERS || http_ctx->fields != 0)
EveHttpLogJSONHeaders(js, LOG_HTTP_RES_HEADERS, tx, http_ctx);
jb_close(js);
SCJbClose(js);
}
static int JsonHttpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *alstate, void *txptr, uint64_t tx_id)
@ -458,7 +458,7 @@ static int JsonHttpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
htp_tx_t *tx = txptr;
JsonHttpLogThread *jhl = (JsonHttpLogThread *)thread_data;
JsonBuilder *js = CreateEveHeaderWithTxId(
SCJsonBuilder *js = CreateEveHeaderWithTxId(
p, LOG_DIR_FLOW, "http", NULL, tx_id, jhl->httplog_ctx->eve_ctx);
if (unlikely(js == NULL))
return TM_ECODE_OK;
@ -478,25 +478,25 @@ static int JsonHttpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
if (have_xff_ip) {
if (xff_cfg->flags & XFF_EXTRADATA) {
jb_set_string(js, "xff", buffer);
SCJbSetString(js, "xff", buffer);
}
else if (xff_cfg->flags & XFF_OVERWRITE) {
if (p->flowflags & FLOW_PKT_TOCLIENT) {
jb_set_string(js, "dest_ip", buffer);
SCJbSetString(js, "dest_ip", buffer);
} else {
jb_set_string(js, "src_ip", buffer);
SCJbSetString(js, "src_ip", buffer);
}
}
}
}
OutputJsonBuilderBuffer(tv, p, p->flow, js, jhl->ctx);
jb_free(js);
SCJbFree(js);
SCReturnInt(TM_ECODE_OK);
}
bool EveHttpAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
bool EveHttpAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *js)
{
HtpState *htp_state = (HtpState *)FlowGetAppState(f);
if (htp_state) {

6
src/output-json-http.h
Unescape Escape View File

@ -26,8 +26,8 @@
void JsonHttpLogRegister(void);
bool EveHttpAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js);
void EveHttpLogJSONBodyPrintable(JsonBuilder *js, Flow *f, uint64_t tx_id);
void EveHttpLogJSONBodyBase64(JsonBuilder *js, Flow *f, uint64_t tx_id);
bool EveHttpAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *js);
void EveHttpLogJSONBodyPrintable(SCJsonBuilder *js, Flow *f, uint64_t tx_id);
void EveHttpLogJSONBodyBase64(SCJsonBuilder *js, Flow *f, uint64_t tx_id);
#endif /* SURICATA_OUTPUT_JSON_HTTP_H */

8
src/output-json-ike.c
Unescape Escape View File

@ -62,7 +62,7 @@ typedef struct LogIKELogThread_ {
OutputJsonThreadCtx *ctx;
} LogIKELogThread;
bool EveIKEAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
bool EveIKEAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *js)
{
IKEState *state = FlowGetAppState(f);
if (state) {
@ -79,7 +79,7 @@ static int JsonIKELogger(ThreadVars *tv, void *thread_data, const Packet *p, Flo
void *tx, uint64_t tx_id)
{
LogIKELogThread *thread = thread_data;
JsonBuilder *jb =
SCJsonBuilder *jb =
CreateEveHeader((Packet *)p, LOG_DIR_PACKET, "ike", NULL, thread->ikelog_ctx->eve_ctx);
if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED;
@ -92,11 +92,11 @@ static int JsonIKELogger(ThreadVars *tv, void *thread_data, const Packet *p, Flo
OutputJsonBuilderBuffer(tv, p, p->flow, jb, thread->ctx);
jb_free(jb);
SCJbFree(jb);
return TM_ECODE_OK;
error:
jb_free(jb);
SCJbFree(jb);
return TM_ECODE_FAILED;
}

2
src/output-json-ike.h
Unescape Escape View File

@ -26,6 +26,6 @@
void JsonIKELogRegister(void);
bool EveIKEAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js);
bool EveIKEAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *js);
#endif /* SURICATA_OUTPUT_JSON_IKE_H */

4
src/output-json-metadata.c
Unescape Escape View File

@ -65,7 +65,7 @@
static int MetadataJson(ThreadVars *tv, OutputJsonThreadCtx *aft, const Packet *p)
{
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "metadata", NULL, aft->ctx);
SCJsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "metadata", NULL, aft->ctx);
if (unlikely(js == NULL))
return TM_ECODE_OK;
@ -76,7 +76,7 @@ static int MetadataJson(ThreadVars *tv, OutputJsonThreadCtx *aft, const Packet *
}
OutputJsonBuilderBuffer(tv, p, p->flow, js, aft);
jb_free(js);
SCJbFree(js);
return TM_ECODE_OK;
}

8
src/output-json-mqtt.c
Unescape Escape View File

@ -60,7 +60,7 @@ typedef struct LogMQTTLogThread_ {
OutputJsonThreadCtx *ctx;
} LogMQTTLogThread;
bool JsonMQTTAddMetadata(void *vtx, JsonBuilder *js)
bool JsonMQTTAddMetadata(void *vtx, SCJsonBuilder *js)
{
return SCMqttLoggerLog(vtx, MQTT_DEFAULT_FLAGS, MQTT_DEFAULT_MAXLOGLEN, js);
}
@ -77,7 +77,7 @@ static int JsonMQTTLogger(ThreadVars *tv, void *thread_data,
dir = LOG_DIR_FLOW_TOSERVER;
}
JsonBuilder *js = CreateEveHeader(p, dir, "mqtt", NULL, thread->mqttlog_ctx->eve_ctx);
SCJsonBuilder *js = CreateEveHeader(p, dir, "mqtt", NULL, thread->mqttlog_ctx->eve_ctx);
if (unlikely(js == NULL)) {
return TM_ECODE_FAILED;
}
@ -86,12 +86,12 @@ static int JsonMQTTLogger(ThreadVars *tv, void *thread_data,
goto error;
OutputJsonBuilderBuffer(tv, p, p->flow, js, thread->ctx);
jb_free(js);
SCJbFree(js);
return TM_ECODE_OK;
error:
jb_free(js);
SCJbFree(js);
return TM_ECODE_FAILED;
}

2
src/output-json-mqtt.h
Unescape Escape View File

@ -25,6 +25,6 @@
#define SURICATA_OUTPUT_JSON_MQTT_H
void JsonMQTTLogRegister(void);
bool JsonMQTTAddMetadata(void *vtx, JsonBuilder *js);
bool JsonMQTTAddMetadata(void *vtx, SCJsonBuilder *js);
#endif /* SURICATA_OUTPUT_JSON_MQTT_H */

100
src/output-json-netflow.c
Unescape Escape View File

@ -49,13 +49,13 @@
#include "stream-tcp-private.h"
static JsonBuilder *CreateEveHeaderFromNetFlow(const Flow *f, int dir)
static SCJsonBuilder *CreateEveHeaderFromNetFlow(const Flow *f, int dir)
{
char timebuf[64];
char srcip[46] = {0}, dstip[46] = {0};
Port sp, dp;
JsonBuilder *js = jb_new_object();
SCJsonBuilder *js = SCJbNewObject();
if (unlikely(js == NULL))
return NULL;
@ -93,7 +93,7 @@ static JsonBuilder *CreateEveHeaderFromNetFlow(const Flow *f, int dir)
}
/* time */
jb_set_string(js, "timestamp", timebuf);
SCJbSetString(js, "timestamp", timebuf);
CreateEveFlowId(js, (const Flow *)f);
@ -105,52 +105,52 @@ static JsonBuilder *CreateEveHeaderFromNetFlow(const Flow *f, int dir)
/* input interface */
if (f->livedev) {
jb_set_string(js, "in_iface", f->livedev->dev);
SCJbSetString(js, "in_iface", f->livedev->dev);
}
JB_SET_STRING(js, "event_type", "netflow");
/* vlan */
if (f->vlan_idx > 0) {
jb_open_array(js, "vlan");
jb_append_uint(js, f->vlan_id[0]);
SCJbOpenArray(js, "vlan");
SCJbAppendUint(js, f->vlan_id[0]);
if (f->vlan_idx > 1) {
jb_append_uint(js, f->vlan_id[1]);
SCJbAppendUint(js, f->vlan_id[1]);
}
if (f->vlan_idx > 2) {
jb_append_uint(js, f->vlan_id[2]);
SCJbAppendUint(js, f->vlan_id[2]);
}
jb_close(js);
SCJbClose(js);
}
/* tuple */
jb_set_string(js, "src_ip", srcip);
SCJbSetString(js, "src_ip", srcip);
switch(f->proto) {
case IPPROTO_ICMP:
break;
case IPPROTO_UDP:
case IPPROTO_TCP:
case IPPROTO_SCTP:
jb_set_uint(js, "src_port", sp);
SCJbSetUint(js, "src_port", sp);
break;
}
jb_set_string(js, "dest_ip", dstip);
SCJbSetString(js, "dest_ip", dstip);
switch(f->proto) {
case IPPROTO_ICMP:
break;
case IPPROTO_UDP:
case IPPROTO_TCP:
case IPPROTO_SCTP:
jb_set_uint(js, "dest_port", dp);
SCJbSetUint(js, "dest_port", dp);
break;
}
if (SCProtoNameValid(f->proto)) {
jb_set_string(js, "proto", known_proto[f->proto]);
SCJbSetString(js, "proto", known_proto[f->proto]);
} else {
char proto[4];
snprintf(proto, sizeof(proto), "%"PRIu8"", f->proto);
jb_set_string(js, "proto", proto);
SCJbSetString(js, "proto", proto);
}
switch (f->proto) {
@ -163,106 +163,104 @@ static JsonBuilder *CreateEveHeaderFromNetFlow(const Flow *f, int dir)
code = f->icmp_d.code;
}
jb_set_uint(js, "icmp_type", type);
jb_set_uint(js, "icmp_code", code);
SCJbSetUint(js, "icmp_type", type);
SCJbSetUint(js, "icmp_code", code);
break;
}
case IPPROTO_ESP:
jb_set_uint(js, "spi", f->esp.spi);
SCJbSetUint(js, "spi", f->esp.spi);
break;
}
return js;
}
/* JSON format logging */
static void NetFlowLogEveToServer(JsonBuilder *js, Flow *f)
static void NetFlowLogEveToServer(SCJsonBuilder *js, Flow *f)
{
jb_set_string(js, "app_proto",
AppProtoToString(f->alproto_ts ? f->alproto_ts : f->alproto));
SCJbSetString(js, "app_proto", AppProtoToString(f->alproto_ts ? f->alproto_ts : f->alproto));
jb_open_object(js, "netflow");
SCJbOpenObject(js, "netflow");
jb_set_uint(js, "pkts", f->todstpktcnt);
jb_set_uint(js, "bytes", f->todstbytecnt);
SCJbSetUint(js, "pkts", f->todstpktcnt);
SCJbSetUint(js, "bytes", f->todstbytecnt);
char timebuf1[64], timebuf2[64];
CreateIsoTimeString(f->startts, timebuf1, sizeof(timebuf1));
CreateIsoTimeString(f->lastts, timebuf2, sizeof(timebuf2));
jb_set_string(js, "start", timebuf1);
jb_set_string(js, "end", timebuf2);
SCJbSetString(js, "start", timebuf1);
SCJbSetString(js, "end", timebuf2);
uint64_t age = (SCTIME_SECS(f->lastts) - SCTIME_SECS(f->startts));
jb_set_uint(js, "age", age);
SCJbSetUint(js, "age", age);
jb_set_uint(js, "min_ttl", f->min_ttl_toserver);
jb_set_uint(js, "max_ttl", f->max_ttl_toserver);
SCJbSetUint(js, "min_ttl", f->min_ttl_toserver);
SCJbSetUint(js, "max_ttl", f->max_ttl_toserver);
/* Close netflow. */
jb_close(js);
SCJbClose(js);
/* TCP */
if (f->proto == IPPROTO_TCP) {
jb_open_object(js, "tcp");
SCJbOpenObject(js, "tcp");
TcpSession *ssn = f->protoctx;
char hexflags[3];
snprintf(hexflags, sizeof(hexflags), "%02x",
ssn ? ssn->client.tcp_flags : 0);
jb_set_string(js, "tcp_flags", hexflags);
SCJbSetString(js, "tcp_flags", hexflags);
EveTcpFlags(ssn ? ssn->client.tcp_flags : 0, js);
jb_close(js);
SCJbClose(js);
}
}
static void NetFlowLogEveToClient(JsonBuilder *js, Flow *f)
static void NetFlowLogEveToClient(SCJsonBuilder *js, Flow *f)
{
jb_set_string(js, "app_proto",
AppProtoToString(f->alproto_tc ? f->alproto_tc : f->alproto));
SCJbSetString(js, "app_proto", AppProtoToString(f->alproto_tc ? f->alproto_tc : f->alproto));
jb_open_object(js, "netflow");
SCJbOpenObject(js, "netflow");
jb_set_uint(js, "pkts", f->tosrcpktcnt);
jb_set_uint(js, "bytes", f->tosrcbytecnt);
SCJbSetUint(js, "pkts", f->tosrcpktcnt);
SCJbSetUint(js, "bytes", f->tosrcbytecnt);
char timebuf1[64], timebuf2[64];
CreateIsoTimeString(f->startts, timebuf1, sizeof(timebuf1));
CreateIsoTimeString(f->lastts, timebuf2, sizeof(timebuf2));
jb_set_string(js, "start", timebuf1);
jb_set_string(js, "end", timebuf2);
SCJbSetString(js, "start", timebuf1);
SCJbSetString(js, "end", timebuf2);
uint64_t age = (SCTIME_SECS(f->lastts) - SCTIME_SECS(f->startts));
jb_set_uint(js, "age", age);
SCJbSetUint(js, "age", age);
/* To client is zero if we did not see any packet */
if (f->tosrcpktcnt) {
jb_set_uint(js, "min_ttl", f->min_ttl_toclient);
jb_set_uint(js, "max_ttl", f->max_ttl_toclient);
SCJbSetUint(js, "min_ttl", f->min_ttl_toclient);
SCJbSetUint(js, "max_ttl", f->max_ttl_toclient);
}
/* Close netflow. */
jb_close(js);
SCJbClose(js);
/* TCP */
if (f->proto == IPPROTO_TCP) {
jb_open_object(js, "tcp");
SCJbOpenObject(js, "tcp");
TcpSession *ssn = f->protoctx;
char hexflags[3];
snprintf(hexflags, sizeof(hexflags), "%02x",
ssn ? ssn->server.tcp_flags : 0);
jb_set_string(js, "tcp_flags", hexflags);
SCJbSetString(js, "tcp_flags", hexflags);
EveTcpFlags(ssn ? ssn->server.tcp_flags : 0, js);
jb_close(js);
SCJbClose(js);
}
}
@ -271,13 +269,13 @@ static int JsonNetFlowLogger(ThreadVars *tv, void *thread_data, Flow *f)
SCEnter();
OutputJsonThreadCtx *jhl = thread_data;
JsonBuilder *jb = CreateEveHeaderFromNetFlow(f, 0);
SCJsonBuilder *jb = CreateEveHeaderFromNetFlow(f, 0);
if (unlikely(jb == NULL))
return TM_ECODE_OK;
NetFlowLogEveToServer(jb, f);
EveAddCommonOptions(&jhl->ctx->cfg, NULL, f, jb, LOG_DIR_FLOW_TOSERVER);
OutputJsonBuilderBuffer(tv, NULL, f, jb, jhl);
jb_free(jb);
SCJbFree(jb);
/* only log a response record if we actually have seen response packets */
if (f->tosrcpktcnt) {
@ -287,7 +285,7 @@ static int JsonNetFlowLogger(ThreadVars *tv, void *thread_data, Flow *f)
NetFlowLogEveToClient(jb, f);
EveAddCommonOptions(&jhl->ctx->cfg, NULL, f, jb, LOG_DIR_FLOW_TOCLIENT);
OutputJsonBuilderBuffer(tv, NULL, f, jb, jhl);
jb_free(jb);
SCJbFree(jb);
}
SCReturnInt(TM_ECODE_OK);
}

16
src/output-json-nfs.c
Unescape Escape View File

@ -47,7 +47,7 @@
#include "rust.h"
bool EveNFSAddMetadataRPC(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
bool EveNFSAddMetadataRPC(const Flow *f, uint64_t tx_id, SCJsonBuilder *jb)
{
NFSState *state = FlowGetAppState(f);
if (state) {
@ -59,7 +59,7 @@ bool EveNFSAddMetadataRPC(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
return false;
}
bool EveNFSAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
bool EveNFSAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *jb)
{
NFSState *state = FlowGetAppState(f);
if (state) {
@ -80,22 +80,22 @@ static int JsonNFSLogger(ThreadVars *tv, void *thread_data,
if (rs_nfs_tx_logging_is_filtered(state, nfstx))
return TM_ECODE_OK;
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "nfs", NULL, thread->ctx);
SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "nfs", NULL, thread->ctx);
if (unlikely(jb == NULL)) {
return TM_ECODE_OK;
}
jb_open_object(jb, "rpc");
SCJbOpenObject(jb, "rpc");
rs_rpc_log_json_response(tx, jb);
jb_close(jb);
SCJbClose(jb);
jb_open_object(jb, "nfs");
SCJbOpenObject(jb, "nfs");
rs_nfs_log_json_response(state, tx, jb);
jb_close(jb);
SCJbClose(jb);
MemBufferReset(thread->buffer);
OutputJsonBuilderBuffer(tv, p, p->flow, jb, thread);
jb_free(jb);
SCJbFree(jb);
return TM_ECODE_OK;
}

4
src/output-json-nfs.h
Unescape Escape View File

@ -26,7 +26,7 @@
void JsonNFSLogRegister(void);
bool EveNFSAddMetadataRPC(const Flow *f, uint64_t tx_id, JsonBuilder *jb);
bool EveNFSAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *jb);
bool EveNFSAddMetadataRPC(const Flow *f, uint64_t tx_id, SCJsonBuilder *jb);
bool EveNFSAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *jb);
#endif /* SURICATA_OUTPUT_JSON_NFS_H */

8
src/output-json-pgsql.c
Unescape Escape View File

@ -59,7 +59,7 @@ typedef struct LogPgsqlLogThread_ {
OutputJsonThreadCtx *ctx;
} LogPgsqlLogThread;
bool JsonPgsqlAddMetadata(void *vtx, JsonBuilder *jb)
bool JsonPgsqlAddMetadata(void *vtx, SCJsonBuilder *jb)
{
return SCPgsqlLogger(vtx, PGSQL_DEFAULTS, jb);
}
@ -70,7 +70,7 @@ static int JsonPgsqlLogger(ThreadVars *tv, void *thread_data, const Packet *p, F
LogPgsqlLogThread *thread = thread_data;
SCLogDebug("Logging pgsql transaction %" PRIu64 ".", tx_id);
JsonBuilder *jb =
SCJsonBuilder *jb =
CreateEveHeader(p, LOG_DIR_FLOW, "pgsql", NULL, thread->pgsqllog_ctx->eve_ctx);
if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED;
@ -81,12 +81,12 @@ static int JsonPgsqlLogger(ThreadVars *tv, void *thread_data, const Packet *p, F
}
OutputJsonBuilderBuffer(tv, p, p->flow, jb, thread->ctx);
jb_free(jb);
SCJbFree(jb);
return TM_ECODE_OK;
error:
jb_free(jb);
SCJbFree(jb);
return TM_ECODE_FAILED;
}

2
src/output-json-pgsql.h
Unescape Escape View File

@ -25,6 +25,6 @@
#define SURICATA_OUTPUT_JSON_PGSQL_H
void JsonPgsqlLogRegister(void);
bool JsonPgsqlAddMetadata(void *vtx, JsonBuilder *jb);
bool JsonPgsqlAddMetadata(void *vtx, SCJsonBuilder *jb);
#endif /* SURICATA_OUTPUT_JSON_PGSQL_H */

12
src/output-json-smb.c
Unescape Escape View File

@ -31,7 +31,7 @@
#include "output-json-smb.h"
#include "rust.h"
bool EveSMBAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
bool EveSMBAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *jb)
{
SMBState *state = FlowGetAppState(f);
if (state) {
@ -48,24 +48,24 @@ static int JsonSMBLogger(ThreadVars *tv, void *thread_data,
{
OutputJsonThreadCtx *thread = thread_data;
JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "smb", NULL, thread->ctx);
SCJsonBuilder *jb = CreateEveHeader(p, LOG_DIR_FLOW, "smb", NULL, thread->ctx);
if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED;
}
jb_open_object(jb, "smb");
SCJbOpenObject(jb, "smb");
if (!SCSmbLogJsonResponse(jb, state, tx)) {
goto error;
}
jb_close(jb);
SCJbClose(jb);
OutputJsonBuilderBuffer(tv, p, p->flow, jb, thread);
jb_free(jb);
SCJbFree(jb);
return TM_ECODE_OK;
error:
jb_free(jb);
SCJbFree(jb);
return TM_ECODE_FAILED;
}

2
src/output-json-smb.h
Unescape Escape View File

@ -25,6 +25,6 @@
#define SURICATA_OUTPUT_JSON_SMB_H
void JsonSMBLogRegister(void);
bool EveSMBAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *jb);
bool EveSMBAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *jb);
#endif /* SURICATA_OUTPUT_JSON_SMB_H */

22
src/output-json-smtp.c
Unescape Escape View File

@ -51,22 +51,22 @@
#include "output-json-smtp.h"
#include "output-json-email-common.h"
static void EveSmtpDataLogger(void *state, void *vtx, JsonBuilder *js)
static void EveSmtpDataLogger(void *state, void *vtx, SCJsonBuilder *js)
{
SMTPTransaction *tx = vtx;
SMTPString *rcptto_str;
if (((SMTPState *)state)->helo) {
jb_set_string(js, "helo", (const char *)((SMTPState *)state)->helo);
SCJbSetString(js, "helo", (const char *)((SMTPState *)state)->helo);
}
if (tx->mail_from) {
jb_set_string(js, "mail_from", (const char *)tx->mail_from);
SCJbSetString(js, "mail_from", (const char *)tx->mail_from);
}
if (!TAILQ_EMPTY(&tx->rcpt_to_list)) {
jb_open_array(js, "rcpt_to");
SCJbOpenArray(js, "rcpt_to");
TAILQ_FOREACH(rcptto_str, &tx->rcpt_to_list, next) {
jb_append_string(js, (char *)rcptto_str->str);
SCJbAppendString(js, (char *)rcptto_str->str);
}
jb_close(js);
SCJbClose(js);
}
}
@ -75,25 +75,25 @@ static int JsonSmtpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
SCEnter();
JsonEmailLogThread *jhl = (JsonEmailLogThread *)thread_data;
JsonBuilder *jb = CreateEveHeaderWithTxId(
SCJsonBuilder *jb = CreateEveHeaderWithTxId(
p, LOG_DIR_FLOW, "smtp", NULL, tx_id, jhl->emaillog_ctx->eve_ctx);
if (unlikely(jb == NULL))
return TM_ECODE_OK;
jb_open_object(jb, "smtp");
SCJbOpenObject(jb, "smtp");
EveSmtpDataLogger(state, tx, jb);
jb_close(jb);
SCJbClose(jb);
EveEmailLogJson(jhl, jb, p, f, state, tx, tx_id);
OutputJsonBuilderBuffer(tv, p, p->flow, jb, jhl->ctx);
jb_free(jb);
SCJbFree(jb);
SCReturnInt(TM_ECODE_OK);
}
bool EveSMTPAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
bool EveSMTPAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *js)
{
SMTPState *smtp_state = (SMTPState *)FlowGetAppState(f);
if (smtp_state) {

2
src/output-json-smtp.h
Unescape Escape View File

@ -25,6 +25,6 @@
#define SURICATA_OUTPUT_JSON_SMTP_H
void JsonSmtpLogRegister(void);
bool EveSMTPAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js);
bool EveSMTPAddMetadata(const Flow *f, uint64_t tx_id, SCJsonBuilder *js);
#endif /* SURICATA_OUTPUT_JSON_SMTP_H */

138
src/output-json-tls.c
Unescape Escape View File

@ -125,34 +125,32 @@ typedef struct JsonTlsLogThread_ {
OutputJsonThreadCtx *ctx;
} JsonTlsLogThread;
static void JsonTlsLogSubject(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogSubject(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->server_connp.cert0_subject) {
jb_set_string(js, "subject",
ssl_state->server_connp.cert0_subject);
SCJbSetString(js, "subject", ssl_state->server_connp.cert0_subject);
}
}
static void JsonTlsLogIssuer(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogIssuer(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->server_connp.cert0_issuerdn) {
jb_set_string(js, "issuerdn",
ssl_state->server_connp.cert0_issuerdn);
SCJbSetString(js, "issuerdn", ssl_state->server_connp.cert0_issuerdn);
}
}
static void JsonTlsLogSAN(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogSAN(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->server_connp.cert0_sans_len > 0) {
jb_open_array(js, "subjectaltname");
SCJbOpenArray(js, "subjectaltname");
for (uint16_t i = 0; i < ssl_state->server_connp.cert0_sans_len; i++) {
jb_append_string(js, ssl_state->server_connp.cert0_sans[i]);
SCJbAppendString(js, ssl_state->server_connp.cert0_sans[i]);
}
jb_close(js);
SCJbClose(js);
}
}
static void JsonTlsLogSessionResumed(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogSessionResumed(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->flags & SSL_AL_FLAG_SESSION_RESUMED) {
/* Only log a session as 'resumed' if a certificate has not
@ -161,129 +159,122 @@ static void JsonTlsLogSessionResumed(JsonBuilder *js, SSLState *ssl_state)
ssl_state->server_connp.cert0_subject == NULL) &&
(ssl_state->flags & SSL_AL_FLAG_STATE_SERVER_HELLO) &&
((ssl_state->flags & SSL_AL_FLAG_LOG_WITHOUT_CERT) == 0)) {
jb_set_bool(js, "session_resumed", true);
SCJbSetBool(js, "session_resumed", true);
}
}
}
static void JsonTlsLogFingerprint(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogFingerprint(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->server_connp.cert0_fingerprint) {
jb_set_string(js, "fingerprint",
ssl_state->server_connp.cert0_fingerprint);
SCJbSetString(js, "fingerprint", ssl_state->server_connp.cert0_fingerprint);
}
}
static void JsonTlsLogSni(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogSni(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->client_connp.sni) {
jb_set_string(js, "sni",
ssl_state->client_connp.sni);
SCJbSetString(js, "sni", ssl_state->client_connp.sni);
}
}
static void JsonTlsLogSerial(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogSerial(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->server_connp.cert0_serial) {
jb_set_string(js, "serial",
ssl_state->server_connp.cert0_serial);
SCJbSetString(js, "serial", ssl_state->server_connp.cert0_serial);
}
}
static void JsonTlsLogVersion(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogVersion(SCJsonBuilder *js, SSLState *ssl_state)
{
char ssl_version[SSL_VERSION_MAX_STRLEN];
SSLVersionToString(ssl_state->server_connp.version, ssl_version);
jb_set_string(js, "version", ssl_version);
SCJbSetString(js, "version", ssl_version);
}
static void JsonTlsLogNotBefore(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogNotBefore(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->server_connp.cert0_not_before != 0) {
sc_x509_log_timestamp(js, "notbefore", ssl_state->server_connp.cert0_not_before);
}
}
static void JsonTlsLogNotAfter(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogNotAfter(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->server_connp.cert0_not_after != 0) {
sc_x509_log_timestamp(js, "notafter", ssl_state->server_connp.cert0_not_after);
}
}
static void JsonTlsLogJa3Hash(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogJa3Hash(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->client_connp.ja3_hash != NULL) {
jb_set_string(js, "hash",
ssl_state->client_connp.ja3_hash);
SCJbSetString(js, "hash", ssl_state->client_connp.ja3_hash);
}
}
static void JsonTlsLogJa3String(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogJa3String(SCJsonBuilder *js, SSLState *ssl_state)
{
if ((ssl_state->client_connp.ja3_str != NULL) &&
ssl_state->client_connp.ja3_str->data != NULL) {
jb_set_string(js, "string",
ssl_state->client_connp.ja3_str->data);
SCJbSetString(js, "string", ssl_state->client_connp.ja3_str->data);
}
}
static void JsonTlsLogJa3(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogJa3(SCJsonBuilder *js, SSLState *ssl_state)
{
if ((ssl_state->client_connp.ja3_hash != NULL) ||
((ssl_state->client_connp.ja3_str != NULL) &&
ssl_state->client_connp.ja3_str->data != NULL)) {
jb_open_object(js, "ja3");
SCJbOpenObject(js, "ja3");
JsonTlsLogJa3Hash(js, ssl_state);
JsonTlsLogJa3String(js, ssl_state);
jb_close(js);
SCJbClose(js);
}
}
static void JsonTlsLogSCJA4(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogSCJA4(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->client_connp.ja4 != NULL) {
uint8_t buffer[JA4_HEX_LEN];
/* JA4 hash has 36 characters */
SCJA4GetHash(ssl_state->client_connp.ja4, (uint8_t(*)[JA4_HEX_LEN])buffer);
jb_set_string_from_bytes(js, "ja4", buffer, 36);
SCJbSetStringFromBytes(js, "ja4", buffer, 36);
}
}
static void JsonTlsLogJa3SHash(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogJa3SHash(SCJsonBuilder *js, SSLState *ssl_state)
{
if (ssl_state->server_connp.ja3_hash != NULL) {
jb_set_string(js, "hash",
ssl_state->server_connp.ja3_hash);
SCJbSetString(js, "hash", ssl_state->server_connp.ja3_hash);
}
}
static void JsonTlsLogJa3SString(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogJa3SString(SCJsonBuilder *js, SSLState *ssl_state)
{
if ((ssl_state->server_connp.ja3_str != NULL) &&
ssl_state->server_connp.ja3_str->data != NULL) {
jb_set_string(js, "string",
ssl_state->server_connp.ja3_str->data);
SCJbSetString(js, "string", ssl_state->server_connp.ja3_str->data);
}
}
static void JsonTlsLogJa3S(JsonBuilder *js, SSLState *ssl_state)
static void JsonTlsLogJa3S(SCJsonBuilder *js, SSLState *ssl_state)
{
if ((ssl_state->server_connp.ja3_hash != NULL) ||
((ssl_state->server_connp.ja3_str != NULL) &&
ssl_state->server_connp.ja3_str->data != NULL)) {
jb_open_object(js, "ja3s");
SCJbOpenObject(js, "ja3s");
JsonTlsLogJa3SHash(js, ssl_state);
JsonTlsLogJa3SString(js, ssl_state);
jb_close(js);
SCJbClose(js);
}
}
static void JsonTlsLogAlpns(JsonBuilder *js, SSLStateConnp *connp, const char *object)
static void JsonTlsLogAlpns(SCJsonBuilder *js, SSLStateConnp *connp, const char *object)
{
if (TAILQ_EMPTY(&connp->alpns)) {
return;
@ -294,14 +285,14 @@ static void JsonTlsLogAlpns(JsonBuilder *js, SSLStateConnp *connp, const char *o
return;
}
jb_open_array(js, object);
SCJbOpenArray(js, object);
TAILQ_FOREACH (a, &connp->alpns, next) {
jb_append_string_from_bytes(js, a->alpn, a->size);
SCJbAppendStringFromBytes(js, a->alpn, a->size);
}
jb_close(js);
SCJbClose(js);
}
static void JsonTlsLogCertificate(JsonBuilder *js, SSLStateConnp *connp)
static void JsonTlsLogCertificate(SCJsonBuilder *js, SSLStateConnp *connp)
{
if (TAILQ_EMPTY(&connp->certs)) {
return;
@ -312,23 +303,23 @@ static void JsonTlsLogCertificate(JsonBuilder *js, SSLStateConnp *connp)
return;
}
jb_set_base64(js, "certificate", cert->cert_data, cert->cert_len);
SCJbSetBase64(js, "certificate", cert->cert_data, cert->cert_len);
}
static void JsonTlsLogChain(JsonBuilder *js, SSLStateConnp *connp)
static void JsonTlsLogChain(SCJsonBuilder *js, SSLStateConnp *connp)
{
if (TAILQ_EMPTY(&connp->certs)) {
return;
}
jb_open_array(js, "chain");
SCJbOpenArray(js, "chain");
SSLCertsChain *cert;
TAILQ_FOREACH (cert, &connp->certs, next) {
jb_append_base64(js, cert->cert_data, cert->cert_len);
SCJbAppendBase64(js, cert->cert_data, cert->cert_len);
}
jb_close(js);
SCJbClose(js);
}
static bool HasClientCert(SSLStateConnp *connp)
@ -339,31 +330,31 @@ static bool HasClientCert(SSLStateConnp *connp)
}
static void JsonTlsLogClientCert(
JsonBuilder *js, SSLStateConnp *connp, const bool log_cert, const bool log_chain)
SCJsonBuilder *js, SSLStateConnp *connp, const bool log_cert, const bool log_chain)
{
if (connp->cert0_subject != NULL) {
jb_set_string(js, "subject", connp->cert0_subject);
SCJbSetString(js, "subject", connp->cert0_subject);
}
if (connp->cert0_issuerdn != NULL) {
jb_set_string(js, "issuerdn", connp->cert0_issuerdn);
SCJbSetString(js, "issuerdn", connp->cert0_issuerdn);
}
if (connp->cert0_fingerprint) {
jb_set_string(js, "fingerprint", connp->cert0_fingerprint);
SCJbSetString(js, "fingerprint", connp->cert0_fingerprint);
}
if (connp->cert0_serial) {
jb_set_string(js, "serial", connp->cert0_serial);
SCJbSetString(js, "serial", connp->cert0_serial);
}
if (connp->cert0_not_before != 0) {
char timebuf[64];
SCTime_t ts = SCTIME_FROM_SECS(connp->cert0_not_before);
CreateUtcIsoTimeString(ts, timebuf, sizeof(timebuf));
jb_set_string(js, "notbefore", timebuf);
SCJbSetString(js, "notbefore", timebuf);
}
if (connp->cert0_not_after != 0) {
char timebuf[64];
SCTime_t ts = SCTIME_FROM_SECS(connp->cert0_not_after);
CreateUtcIsoTimeString(ts, timebuf, sizeof(timebuf));
jb_set_string(js, "notafter", timebuf);
SCJbSetString(js, "notafter", timebuf);
}
if (log_cert) {
@ -374,7 +365,7 @@ static void JsonTlsLogClientCert(
}
}
static void JsonTlsLogFields(JsonBuilder *js, SSLState *ssl_state, uint64_t fields)
static void JsonTlsLogFields(SCJsonBuilder *js, SSLState *ssl_state, uint64_t fields)
{
/* tls subject */
if (fields & LOG_TLS_FIELD_SUBJECT)
@ -448,19 +439,19 @@ static void JsonTlsLogFields(JsonBuilder *js, SSLState *ssl_state, uint64_t fiel
const bool log_cert = (fields & LOG_TLS_FIELD_CLIENT_CERT) != 0;
const bool log_chain = (fields & LOG_TLS_FIELD_CLIENT_CHAIN) != 0;
if (HasClientCert(&ssl_state->client_connp)) {
jb_open_object(js, "client");
SCJbOpenObject(js, "client");
JsonTlsLogClientCert(js, &ssl_state->client_connp, log_cert, log_chain);
jb_close(js);
SCJbClose(js);
}
}
}
bool JsonTlsLogJSONExtended(void *vtx, JsonBuilder *tjs)
bool JsonTlsLogJSONExtended(void *vtx, SCJsonBuilder *tjs)
{
SSLState *state = (SSLState *)vtx;
jb_open_object(tjs, "tls");
SCJbOpenObject(tjs, "tls");
JsonTlsLogFields(tjs, state, EXTENDED_FIELDS);
return jb_close(tjs);
return SCJbClose(tjs);
}
static int JsonTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p,
@ -482,27 +473,26 @@ static int JsonTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p,
return 0;
}
JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "tls", NULL, aft->tlslog_ctx->eve_ctx);
SCJsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "tls", NULL, aft->tlslog_ctx->eve_ctx);
if (unlikely(js == NULL)) {
return 0;
}
jb_open_object(js, "tls");
SCJbOpenObject(js, "tls");
JsonTlsLogFields(js, ssl_state, tls_ctx->fields);
/* print original application level protocol when it have been changed
because of STARTTLS, HTTP CONNECT, or similar. */
if (f->alproto_orig != ALPROTO_UNKNOWN) {
jb_set_string(js, "from_proto",
AppLayerGetProtoName(f->alproto_orig));
SCJbSetString(js, "from_proto", AppLayerGetProtoName(f->alproto_orig));
}
/* Close the tls object. */
jb_close(js);
SCJbClose(js);
OutputJsonBuilderBuffer(tv, p, p->flow, js, aft->ctx);
jb_free(js);
SCJbFree(js);
return 0;
}

4
src/output-json-tls.h
Unescape Escape View File

@ -26,9 +26,9 @@
void JsonTlsLogRegister(void);
/* For JsonBuilder. */
/* For SCJsonBuilder. */
#include "rust.h"
bool JsonTlsLogJSONExtended(void *vtx, JsonBuilder *js);
bool JsonTlsLogJSONExtended(void *vtx, SCJsonBuilder *js);
#endif /* SURICATA_OUTPUT_JSON_TLS_H */

292
src/output-json.c
Unescape Escape View File

@ -69,9 +69,9 @@
#define MAX_JSON_SIZE 2048
static void OutputJsonDeInitCtx(OutputCtx *);
static void CreateEveCommunityFlowId(JsonBuilder *js, const Flow *f, const uint16_t seed);
static void CreateEveCommunityFlowId(SCJsonBuilder *js, const Flow *f, const uint16_t seed);
static int CreateJSONEther(
JsonBuilder *parent, const Packet *p, const Flow *f, enum OutputJsonLogDirection dir);
SCJsonBuilder *parent, const Packet *p, const Flow *f, enum OutputJsonLogDirection dir);
static const char *TRAFFIC_ID_PREFIX = "traffic/id/";
static const char *TRAFFIC_LABEL_PREFIX = "traffic/label/";
@ -121,31 +121,31 @@ json_t *SCJsonString(const char *val)
/* Default Sensor ID value */
static int64_t sensor_id = -1; /* -1 = not defined */
void EveFileInfo(JsonBuilder *jb, const File *ff, const uint64_t tx_id, const uint16_t flags)
void EveFileInfo(SCJsonBuilder *jb, const File *ff, const uint64_t tx_id, const uint16_t flags)
{
jb_set_string_from_bytes(jb, "filename", ff->name, ff->name_len);
SCJbSetStringFromBytes(jb, "filename", ff->name, ff->name_len);
if (ff->sid_cnt > 0) {
jb_open_array(jb, "sid");
SCJbOpenArray(jb, "sid");
for (uint32_t i = 0; ff->sid != NULL && i < ff->sid_cnt; i++) {
jb_append_uint(jb, ff->sid[i]);
SCJbAppendUint(jb, ff->sid[i]);
}
jb_close(jb);
SCJbClose(jb);
}
#ifdef HAVE_MAGIC
if (ff->magic)
jb_set_string(jb, "magic", (char *)ff->magic);
SCJbSetString(jb, "magic", (char *)ff->magic);
#endif
jb_set_bool(jb, "gaps", ff->flags & FILE_HAS_GAPS);
SCJbSetBool(jb, "gaps", ff->flags & FILE_HAS_GAPS);
switch (ff->state) {
case FILE_STATE_CLOSED:
JB_SET_STRING(jb, "state", "CLOSED");
if (ff->flags & FILE_MD5) {
jb_set_hex(jb, "md5", (uint8_t *)ff->md5, (uint32_t)sizeof(ff->md5));
SCJbSetHex(jb, "md5", (uint8_t *)ff->md5, (uint32_t)sizeof(ff->md5));
}
if (ff->flags & FILE_SHA1) {
jb_set_hex(jb, "sha1", (uint8_t *)ff->sha1, (uint32_t)sizeof(ff->sha1));
SCJbSetHex(jb, "sha1", (uint8_t *)ff->sha1, (uint32_t)sizeof(ff->sha1));
}
break;
case FILE_STATE_TRUNCATED:
@ -160,12 +160,12 @@ void EveFileInfo(JsonBuilder *jb, const File *ff, const uint64_t tx_id, const ui
}
if (ff->flags & FILE_SHA256) {
jb_set_hex(jb, "sha256", (uint8_t *)ff->sha256, (uint32_t)sizeof(ff->sha256));
SCJbSetHex(jb, "sha256", (uint8_t *)ff->sha256, (uint32_t)sizeof(ff->sha256));
}
if (flags & FILE_STORED) {
JB_SET_TRUE(jb, "stored");
jb_set_uint(jb, "file_id", ff->file_store_id);
SCJbSetUint(jb, "file_id", ff->file_store_id);
} else {
JB_SET_FALSE(jb, "stored");
if (flags & FILE_STORE) {
@ -173,15 +173,15 @@ void EveFileInfo(JsonBuilder *jb, const File *ff, const uint64_t tx_id, const ui
}
}
jb_set_uint(jb, "size", FileTrackedSize(ff));
SCJbSetUint(jb, "size", FileTrackedSize(ff));
if (ff->end > 0) {
jb_set_uint(jb, "start", ff->start);
jb_set_uint(jb, "end", ff->end);
SCJbSetUint(jb, "start", ff->start);
SCJbSetUint(jb, "end", ff->end);
}
jb_set_uint(jb, "tx_id", tx_id);
SCJbSetUint(jb, "tx_id", tx_id);
}
static void EveAddPacketVars(const Packet *p, JsonBuilder *js_vars)
static void EveAddPacketVars(const Packet *p, SCJsonBuilder *js_vars)
{
if (p == NULL || p->pktvar == NULL) {
return;
@ -191,10 +191,10 @@ static void EveAddPacketVars(const Packet *p, JsonBuilder *js_vars)
while (pv != NULL) {
if (pv->key || pv->id > 0) {
if (!open) {
jb_open_array(js_vars, "pktvars");
SCJbOpenArray(js_vars, "pktvars");
open = true;
}
jb_start_object(js_vars);
SCJbStartObject(js_vars);
if (pv->key != NULL) {
uint32_t offset = 0;
@ -204,21 +204,21 @@ static void EveAddPacketVars(const Packet *p, JsonBuilder *js_vars)
uint8_t printable_buf[len + 1];
offset = 0;
PrintStringsToBuffer(printable_buf, &offset, len + 1, pv->value, pv->value_len);
jb_set_string(js_vars, (char *)keybuf, (char *)printable_buf);
SCJbSetString(js_vars, (char *)keybuf, (char *)printable_buf);
} else {
const char *varname = VarNameStoreLookupById(pv->id, VAR_TYPE_PKT_VAR);
uint32_t len = pv->value_len;
uint8_t printable_buf[len + 1];
uint32_t offset = 0;
PrintStringsToBuffer(printable_buf, &offset, len + 1, pv->value, pv->value_len);
jb_set_string(js_vars, varname, (char *)printable_buf);
SCJbSetString(js_vars, varname, (char *)printable_buf);
}
jb_close(js_vars);
SCJbClose(js_vars);
}
pv = pv->next;
}
if (open) {
jb_close(js_vars);
SCJbClose(js_vars);
}
}
@ -238,16 +238,16 @@ static bool SCStringHasPrefix(const char *s, const char *prefix)
return false;
}
static void EveAddFlowVars(const Flow *f, JsonBuilder *js_root, JsonBuilder **js_traffic)
static void EveAddFlowVars(const Flow *f, SCJsonBuilder *js_root, SCJsonBuilder **js_traffic)
{
if (f == NULL || f->flowvar == NULL) {
return;
}
JsonBuilder *js_flowvars = NULL;
JsonBuilder *js_traffic_id = NULL;
JsonBuilder *js_traffic_label = NULL;
JsonBuilder *js_flowints = NULL;
JsonBuilder *js_flowbits = NULL;
SCJsonBuilder *js_flowvars = NULL;
SCJsonBuilder *js_traffic_id = NULL;
SCJsonBuilder *js_traffic_label = NULL;
SCJsonBuilder *js_flowints = NULL;
SCJsonBuilder *js_flowbits = NULL;
GenericVar *gv = f->flowvar;
while (gv != NULL) {
if (gv->type == DETECT_FLOWVAR || gv->type == DETECT_FLOWINT) {
@ -257,7 +257,7 @@ static void EveAddFlowVars(const Flow *f, JsonBuilder *js_root, JsonBuilder **js
VAR_TYPE_FLOW_VAR);
if (varname) {
if (js_flowvars == NULL) {
js_flowvars = jb_new_array();
js_flowvars = SCJbNewArray();
if (js_flowvars == NULL)
break;
}
@ -268,13 +268,13 @@ static void EveAddFlowVars(const Flow *f, JsonBuilder *js_root, JsonBuilder **js
PrintStringsToBuffer(printable_buf, &offset, len + 1, fv->data.fv_str.value,
fv->data.fv_str.value_len);
jb_start_object(js_flowvars);
jb_set_string(js_flowvars, varname, (char *)printable_buf);
jb_close(js_flowvars);
SCJbStartObject(js_flowvars);
SCJbSetString(js_flowvars, varname, (char *)printable_buf);
SCJbClose(js_flowvars);
}
} else if (fv->datatype == FLOWVAR_TYPE_STR && fv->key != NULL) {
if (js_flowvars == NULL) {
js_flowvars = jb_new_array();
js_flowvars = SCJbNewArray();
if (js_flowvars == NULL)
break;
}
@ -289,19 +289,19 @@ static void EveAddFlowVars(const Flow *f, JsonBuilder *js_root, JsonBuilder **js
PrintStringsToBuffer(printable_buf, &offset, len + 1, fv->data.fv_str.value,
fv->data.fv_str.value_len);
jb_start_object(js_flowvars);
jb_set_string(js_flowvars, (const char *)keybuf, (char *)printable_buf);
jb_close(js_flowvars);
SCJbStartObject(js_flowvars);
SCJbSetString(js_flowvars, (const char *)keybuf, (char *)printable_buf);
SCJbClose(js_flowvars);
} else if (fv->datatype == FLOWVAR_TYPE_INT) {
const char *varname = VarNameStoreLookupById(fv->idx,
VAR_TYPE_FLOW_INT);
if (varname) {
if (js_flowints == NULL) {
js_flowints = jb_new_object();
js_flowints = SCJbNewObject();
if (js_flowints == NULL)
break;
}
jb_set_uint(js_flowints, varname, fv->data.fv_int.value);
SCJbSetUint(js_flowints, varname, fv->data.fv_int.value);
}
}
@ -312,91 +312,91 @@ static void EveAddFlowVars(const Flow *f, JsonBuilder *js_root, JsonBuilder **js
if (varname) {
if (SCStringHasPrefix(varname, TRAFFIC_ID_PREFIX)) {
if (js_traffic_id == NULL) {
js_traffic_id = jb_new_array();
js_traffic_id = SCJbNewArray();
if (unlikely(js_traffic_id == NULL)) {
break;
}
}
jb_append_string(js_traffic_id, &varname[traffic_id_prefix_len]);
SCJbAppendString(js_traffic_id, &varname[traffic_id_prefix_len]);
} else if (SCStringHasPrefix(varname, TRAFFIC_LABEL_PREFIX)) {
if (js_traffic_label == NULL) {
js_traffic_label = jb_new_array();
js_traffic_label = SCJbNewArray();
if (unlikely(js_traffic_label == NULL)) {
break;
}
}
jb_append_string(js_traffic_label, &varname[traffic_label_prefix_len]);
SCJbAppendString(js_traffic_label, &varname[traffic_label_prefix_len]);
} else {
if (js_flowbits == NULL) {
js_flowbits = jb_new_array();
js_flowbits = SCJbNewArray();
if (unlikely(js_flowbits == NULL))
break;
}
jb_append_string(js_flowbits, varname);
SCJbAppendString(js_flowbits, varname);
}
}
}
gv = gv->next;
}
if (js_flowbits) {
jb_close(js_flowbits);
jb_set_object(js_root, "flowbits", js_flowbits);
jb_free(js_flowbits);
SCJbClose(js_flowbits);
SCJbSetObject(js_root, "flowbits", js_flowbits);
SCJbFree(js_flowbits);
}
if (js_flowints) {
jb_close(js_flowints);
jb_set_object(js_root, "flowints", js_flowints);
jb_free(js_flowints);
SCJbClose(js_flowints);
SCJbSetObject(js_root, "flowints", js_flowints);
SCJbFree(js_flowints);
}
if (js_flowvars) {
jb_close(js_flowvars);
jb_set_object(js_root, "flowvars", js_flowvars);
jb_free(js_flowvars);
SCJbClose(js_flowvars);
SCJbSetObject(js_root, "flowvars", js_flowvars);
SCJbFree(js_flowvars);
}
if (js_traffic_id != NULL || js_traffic_label != NULL) {
*js_traffic = jb_new_object();
*js_traffic = SCJbNewObject();
if (likely(*js_traffic != NULL)) {
if (js_traffic_id != NULL) {
jb_close(js_traffic_id);
jb_set_object(*js_traffic, "id", js_traffic_id);
jb_free(js_traffic_id);
SCJbClose(js_traffic_id);
SCJbSetObject(*js_traffic, "id", js_traffic_id);
SCJbFree(js_traffic_id);
}
if (js_traffic_label != NULL) {
jb_close(js_traffic_label);
jb_set_object(*js_traffic, "label", js_traffic_label);
jb_free(js_traffic_label);
SCJbClose(js_traffic_label);
SCJbSetObject(*js_traffic, "label", js_traffic_label);
SCJbFree(js_traffic_label);
}
jb_close(*js_traffic);
SCJbClose(*js_traffic);
}
}
}
void EveAddMetadata(const Packet *p, const Flow *f, JsonBuilder *js)
void EveAddMetadata(const Packet *p, const Flow *f, SCJsonBuilder *js)
{
if ((p && p->pktvar) || (f && f->flowvar)) {
JsonBuilder *js_vars = jb_new_object();
SCJsonBuilder *js_vars = SCJbNewObject();
if (js_vars) {
if (f && f->flowvar) {
JsonBuilder *js_traffic = NULL;
SCJsonBuilder *js_traffic = NULL;
EveAddFlowVars(f, js_vars, &js_traffic);
if (js_traffic != NULL) {
jb_set_object(js, "traffic", js_traffic);
jb_free(js_traffic);
SCJbSetObject(js, "traffic", js_traffic);
SCJbFree(js_traffic);
}
}
if (p && p->pktvar) {
EveAddPacketVars(p, js_vars);
}
jb_close(js_vars);
jb_set_object(js, "metadata", js_vars);
jb_free(js_vars);
SCJbClose(js_vars);
SCJbSetObject(js, "metadata", js_vars);
SCJbFree(js_vars);
}
}
}
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f,
JsonBuilder *js, enum OutputJsonLogDirection dir)
SCJsonBuilder *js, enum OutputJsonLogDirection dir)
{
if (cfg->include_metadata) {
EveAddMetadata(p, f, js);
@ -408,7 +408,7 @@ void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, c
CreateEveCommunityFlowId(js, f, cfg->community_id_seed);
}
if (f != NULL && f->tenant_id > 0) {
jb_set_uint(js, "tenant_id", f->tenant_id);
SCJbSetUint(js, "tenant_id", f->tenant_id);
}
}
@ -419,32 +419,32 @@ void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, c
* \param js JSON object
* \param max_length If non-zero, restricts the number of packet data bytes handled.
*/
void EvePacket(const Packet *p, JsonBuilder *js, uint32_t max_length)
void EvePacket(const Packet *p, SCJsonBuilder *js, uint32_t max_length)
{
uint32_t max_len = max_length == 0 ? GET_PKT_LEN(p) : max_length;
jb_set_base64(js, "packet", GET_PKT_DATA(p), max_len);
SCJbSetBase64(js, "packet", GET_PKT_DATA(p), max_len);
if (!jb_open_object(js, "packet_info")) {
if (!SCJbOpenObject(js, "packet_info")) {
return;
}
if (!jb_set_uint(js, "linktype", p->datalink)) {
jb_close(js);
if (!SCJbSetUint(js, "linktype", p->datalink)) {
SCJbClose(js);
return;
}
const char *dl_name = DatalinkValueToName(p->datalink);
// Intentionally ignore the return value from jb_set_string and proceed
// Intentionally ignore the return value from SCJbSetString and proceed
// so the jb object is closed
(void)jb_set_string(js, "linktype_name", dl_name == NULL ? "n/a" : dl_name);
(void)SCJbSetString(js, "linktype_name", dl_name == NULL ? "n/a" : dl_name);
jb_close(js);
SCJbClose(js);
}
/** \brief jsonify tcp flags field
* Only add 'true' fields in an attempt to keep things reasonably compact.
*/
void EveTcpFlags(const uint8_t flags, JsonBuilder *js)
void EveTcpFlags(const uint8_t flags, SCJsonBuilder *js)
{
if (flags & TH_SYN)
JB_SET_TRUE(js, "syn");
@ -680,47 +680,47 @@ static bool CalculateCommunityFlowIdv6(const Flow *f,
return false;
}
static void CreateEveCommunityFlowId(JsonBuilder *js, const Flow *f, const uint16_t seed)
static void CreateEveCommunityFlowId(SCJsonBuilder *js, const Flow *f, const uint16_t seed)
{
unsigned char buf[COMMUNITY_ID_BUF_SIZE];
if (f->flags & FLOW_IPV4) {
if (CalculateCommunityFlowIdv4(f, seed, buf)) {
jb_set_string(js, "community_id", (const char *)buf);
SCJbSetString(js, "community_id", (const char *)buf);
}
} else if (f->flags & FLOW_IPV6) {
if (CalculateCommunityFlowIdv6(f, seed, buf)) {
jb_set_string(js, "community_id", (const char *)buf);
SCJbSetString(js, "community_id", (const char *)buf);
}
}
}
void CreateEveFlowId(JsonBuilder *js, const Flow *f)
void CreateEveFlowId(SCJsonBuilder *js, const Flow *f)
{
if (f == NULL) {
return;
}
int64_t flow_id = FlowGetId(f);
jb_set_uint(js, "flow_id", flow_id);
SCJbSetUint(js, "flow_id", flow_id);
if (f->parent_id) {
jb_set_uint(js, "parent_id", f->parent_id);
SCJbSetUint(js, "parent_id", f->parent_id);
}
}
void JSONFormatAndAddMACAddr(JsonBuilder *js, const char *key, const uint8_t *val, bool is_array)
void JSONFormatAndAddMACAddr(SCJsonBuilder *js, const char *key, const uint8_t *val, bool is_array)
{
char eth_addr[19];
(void) snprintf(eth_addr, 19, "%02x:%02x:%02x:%02x:%02x:%02x",
val[0], val[1], val[2], val[3], val[4], val[5]);
if (is_array) {
jb_append_string(js, eth_addr);
SCJbAppendString(js, eth_addr);
} else {
jb_set_string(js, key, eth_addr);
SCJbSetString(js, key, eth_addr);
}
}
/* only required to traverse the MAC address set */
typedef struct JSONMACAddrInfo {
JsonBuilder *src, *dst;
SCJsonBuilder *src, *dst;
} JSONMACAddrInfo;
static int MacSetIterateToJSON(uint8_t *val, MacSetSide side, void *data)
@ -735,14 +735,14 @@ static int MacSetIterateToJSON(uint8_t *val, MacSetSide side, void *data)
}
static int CreateJSONEther(
JsonBuilder *js, const Packet *p, const Flow *f, enum OutputJsonLogDirection dir)
SCJsonBuilder *js, const Packet *p, const Flow *f, enum OutputJsonLogDirection dir)
{
if (p != NULL) {
/* this is a packet context, so we need to add scalar fields */
if (PacketIsEthernet(p)) {
const EthernetHdr *ethh = PacketGetEthernet(p);
jb_open_object(js, "ether");
jb_set_uint(js, "ether_type", ethh->eth_type);
SCJbOpenObject(js, "ether");
SCJbSetUint(js, "ether_type", ethh->eth_type);
const uint8_t *src;
const uint8_t *dst;
switch (dir) {
@ -774,7 +774,7 @@ static int CreateJSONEther(
}
JSONFormatAndAddMACAddr(js, "src_mac", src, false);
JSONFormatAndAddMACAddr(js, "dest_mac", dst, false);
jb_close(js);
SCJbClose(js);
} else if (f != NULL) {
/* When pseudopackets do not have associated ethernet metadata,
use the first set of mac addresses stored with their flow.
@ -785,10 +785,10 @@ static int CreateJSONEther(
uint8_t *src = MacSetGetFirst(ms, MAC_SET_SRC);
uint8_t *dst = MacSetGetFirst(ms, MAC_SET_DST);
if (dst != NULL && src != NULL) {
jb_open_object(js, "ether");
SCJbOpenObject(js, "ether");
JSONFormatAndAddMACAddr(js, "src_mac", src, false);
JSONFormatAndAddMACAddr(js, "dest_mac", dst, false);
jb_close(js);
SCJbClose(js);
}
}
}
@ -797,84 +797,84 @@ static int CreateJSONEther(
append to arrays */
MacSet *ms = FlowGetStorageById(f, MacSetGetFlowStorageID());
if (ms != NULL && MacSetSize(ms) > 0) {
jb_open_object(js, "ether");
SCJbOpenObject(js, "ether");
JSONMACAddrInfo info;
info.dst = jb_new_array();
info.src = jb_new_array();
info.dst = SCJbNewArray();
info.src = SCJbNewArray();
int ret = MacSetForEach(ms, MacSetIterateToJSON, &info);
if (unlikely(ret != 0)) {
/* should not happen, JSONFlowAppendMACAddrs is sane */
jb_free(info.dst);
jb_free(info.src);
jb_close(js);
SCJbFree(info.dst);
SCJbFree(info.src);
SCJbClose(js);
return ret;
}
jb_close(info.dst);
jb_close(info.src);
SCJbClose(info.dst);
SCJbClose(info.src);
/* case is handling netflow too so may need to revert */
if (dir == LOG_DIR_FLOW_TOCLIENT) {
jb_set_object(js, "dest_macs", info.src);
jb_set_object(js, "src_macs", info.dst);
SCJbSetObject(js, "dest_macs", info.src);
SCJbSetObject(js, "src_macs", info.dst);
} else {
DEBUG_VALIDATE_BUG_ON(dir != LOG_DIR_FLOW_TOSERVER && dir != LOG_DIR_FLOW);
jb_set_object(js, "dest_macs", info.dst);
jb_set_object(js, "src_macs", info.src);
SCJbSetObject(js, "dest_macs", info.dst);
SCJbSetObject(js, "src_macs", info.src);
}
jb_free(info.dst);
jb_free(info.src);
jb_close(js);
SCJbFree(info.dst);
SCJbFree(info.src);
SCJbClose(js);
}
}
return 0;
}
JsonBuilder *CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir,
SCJsonBuilder *CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir,
const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
{
char timebuf[64];
const Flow *f = (const Flow *)p->flow;
JsonBuilder *js = jb_new_object();
SCJsonBuilder *js = SCJbNewObject();
if (unlikely(js == NULL)) {
return NULL;
}
CreateIsoTimeString(p->ts, timebuf, sizeof(timebuf));
jb_set_string(js, "timestamp", timebuf);
SCJbSetString(js, "timestamp", timebuf);
CreateEveFlowId(js, f);
/* sensor id */
if (sensor_id >= 0) {
jb_set_uint(js, "sensor_id", sensor_id);
SCJbSetUint(js, "sensor_id", sensor_id);
}
/* input interface */
if (p->livedev) {
jb_set_string(js, "in_iface", p->livedev->dev);
SCJbSetString(js, "in_iface", p->livedev->dev);
}
/* pcap_cnt */
if (p->pcap_cnt != 0) {
jb_set_uint(js, "pcap_cnt", p->pcap_cnt);
SCJbSetUint(js, "pcap_cnt", p->pcap_cnt);
}
if (event_type) {
jb_set_string(js, "event_type", event_type);
SCJbSetString(js, "event_type", event_type);
}
/* vlan */
if (p->vlan_idx > 0) {
jb_open_array(js, "vlan");
jb_append_uint(js, p->vlan_id[0]);
SCJbOpenArray(js, "vlan");
SCJbAppendUint(js, p->vlan_id[0]);
if (p->vlan_idx > 1) {
jb_append_uint(js, p->vlan_id[1]);
SCJbAppendUint(js, p->vlan_id[1]);
}
if (p->vlan_idx > 2) {
jb_append_uint(js, p->vlan_id[2]);
SCJbAppendUint(js, p->vlan_id[2]);
}
jb_close(js);
SCJbClose(js);
}
/* 5-tuple */
@ -884,38 +884,38 @@ JsonBuilder *CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir,
addr = &addr_info;
}
if (addr->src_ip[0] != '\0') {
jb_set_string(js, "src_ip", addr->src_ip);
SCJbSetString(js, "src_ip", addr->src_ip);
}
if (addr->log_port) {
jb_set_uint(js, "src_port", addr->sp);
SCJbSetUint(js, "src_port", addr->sp);
}
if (addr->dst_ip[0] != '\0') {
jb_set_string(js, "dest_ip", addr->dst_ip);
SCJbSetString(js, "dest_ip", addr->dst_ip);
}
if (addr->log_port) {
jb_set_uint(js, "dest_port", addr->dp);
SCJbSetUint(js, "dest_port", addr->dp);
}
if (addr->proto[0] != '\0') {
jb_set_string(js, "proto", addr->proto);
SCJbSetString(js, "proto", addr->proto);
}
/* icmp */
switch (p->proto) {
case IPPROTO_ICMP:
if (PacketIsICMPv4(p)) {
jb_set_uint(js, "icmp_type", p->icmp_s.type);
jb_set_uint(js, "icmp_code", p->icmp_s.code);
SCJbSetUint(js, "icmp_type", p->icmp_s.type);
SCJbSetUint(js, "icmp_code", p->icmp_s.code);
}
break;
case IPPROTO_ICMPV6:
if (PacketIsICMPv6(p)) {
jb_set_uint(js, "icmp_type", PacketGetICMPv6(p)->type);
jb_set_uint(js, "icmp_code", PacketGetICMPv6(p)->code);
SCJbSetUint(js, "icmp_type", PacketGetICMPv6(p)->type);
SCJbSetUint(js, "icmp_code", PacketGetICMPv6(p)->code);
}
break;
}
jb_set_string(js, "pkt_src", PktSrcToString(p->pkt_src));
SCJbSetString(js, "pkt_src", PktSrcToString(p->pkt_src));
if (eve_ctx != NULL) {
EveAddCommonOptions(&eve_ctx->cfg, p, f, js, dir);
@ -924,15 +924,15 @@ JsonBuilder *CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir,
return js;
}
JsonBuilder *CreateEveHeaderWithTxId(const Packet *p, enum OutputJsonLogDirection dir,
SCJsonBuilder *CreateEveHeaderWithTxId(const Packet *p, enum OutputJsonLogDirection dir,
const char *event_type, JsonAddrInfo *addr, uint64_t tx_id, OutputJsonCtx *eve_ctx)
{
JsonBuilder *js = CreateEveHeader(p, dir, event_type, addr, eve_ctx);
SCJsonBuilder *js = CreateEveHeader(p, dir, event_type, addr, eve_ctx);
if (unlikely(js == NULL))
return NULL;
/* tx id for correlation with other events */
jb_set_uint(js, "tx_id", tx_id);
SCJbSetUint(js, "tx_id", tx_id);
return js;
}
@ -987,21 +987,21 @@ void OutputJsonFlush(OutputJsonThreadCtx *ctx)
}
void OutputJsonBuilderBuffer(
ThreadVars *tv, const Packet *p, Flow *f, JsonBuilder *js, OutputJsonThreadCtx *ctx)
ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *js, OutputJsonThreadCtx *ctx)
{
LogFileCtx *file_ctx = ctx->file_ctx;
MemBuffer **buffer = &ctx->buffer;
if (file_ctx->sensor_name) {
jb_set_string(js, "host", file_ctx->sensor_name);
SCJbSetString(js, "host", file_ctx->sensor_name);
}
if (file_ctx->is_pcap_offline) {
jb_set_string(js, "pcap_filename", PcapFileGetFilename());
SCJbSetString(js, "pcap_filename", PcapFileGetFilename());
}
SCEveRunCallbacks(tv, p, f, js);
jb_close(js);
SCJbClose(js);
MemBufferReset(*buffer);
@ -1009,8 +1009,8 @@ void OutputJsonBuilderBuffer(
MemBufferWriteRaw((*buffer), (const uint8_t *)file_ctx->prefix, file_ctx->prefix_len);
}
size_t jslen = jb_len(js);
DEBUG_VALIDATE_BUG_ON(jb_len(js) > UINT32_MAX);
size_t jslen = SCJbLen(js);
DEBUG_VALIDATE_BUG_ON(SCJbLen(js) > UINT32_MAX);
size_t remaining = MEMBUFFER_SIZE(*buffer) - MEMBUFFER_OFFSET(*buffer);
if (jslen >= remaining) {
size_t expand_by = jslen + 1 - remaining;
@ -1020,7 +1020,7 @@ void OutputJsonBuilderBuffer(
* message to hopefully identify the event_type. */
char partial[120];
size_t partial_len = MIN(sizeof(partial), jslen);
memcpy(partial, jb_ptr(js), partial_len - 1);
memcpy(partial, SCJbPtr(js), partial_len - 1);
partial[partial_len - 1] = '\0';
SCLogWarning("Formatted JSON EVE record too large, will be dropped: %s", partial);
ctx->too_large_warning = true;
@ -1029,7 +1029,7 @@ void OutputJsonBuilderBuffer(
}
}
MemBufferWriteRaw((*buffer), jb_ptr(js), (uint32_t)jslen);
MemBufferWriteRaw((*buffer), SCJbPtr(js), (uint32_t)jslen);
LogFileWrite(file_ctx, *buffer);
}

20
src/output-json.h
Unescape Escape View File

@ -95,17 +95,17 @@ typedef struct OutputJsonThreadCtx_ {
json_t *SCJsonString(const char *val);
void CreateEveFlowId(JsonBuilder *js, const Flow *f);
void EveFileInfo(JsonBuilder *js, const File *file, const uint64_t tx_id, const uint16_t flags);
void EveTcpFlags(uint8_t flags, JsonBuilder *js);
void EvePacket(const Packet *p, JsonBuilder *js, uint32_t max_length);
JsonBuilder *CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir,
void CreateEveFlowId(SCJsonBuilder *js, const Flow *f);
void EveFileInfo(SCJsonBuilder *js, const File *file, const uint64_t tx_id, const uint16_t flags);
void EveTcpFlags(uint8_t flags, SCJsonBuilder *js);
void EvePacket(const Packet *p, SCJsonBuilder *js, uint32_t max_length);
SCJsonBuilder *CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir,
const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx);
JsonBuilder *CreateEveHeaderWithTxId(const Packet *p, enum OutputJsonLogDirection dir,
SCJsonBuilder *CreateEveHeaderWithTxId(const Packet *p, enum OutputJsonLogDirection dir,
const char *event_type, JsonAddrInfo *addr, uint64_t tx_id, OutputJsonCtx *eve_ctx);
int OutputJSONBuffer(json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer);
void OutputJsonBuilderBuffer(
ThreadVars *tv, const Packet *p, Flow *f, JsonBuilder *js, OutputJsonThreadCtx *ctx);
ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *js, OutputJsonThreadCtx *ctx);
OutputInitResult OutputJsonInitCtx(SCConfNode *);
OutputInitResult OutputJsonLogInitSub(SCConfNode *conf, OutputCtx *parent_ctx);
@ -113,15 +113,15 @@ TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data);
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data);
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f,
JsonBuilder *js, enum OutputJsonLogDirection dir);
SCJsonBuilder *js, enum OutputJsonLogDirection dir);
int OutputJsonLogFlush(ThreadVars *tv, void *thread_data, const Packet *p);
void EveAddMetadata(const Packet *p, const Flow *f, JsonBuilder *js);
void EveAddMetadata(const Packet *p, const Flow *f, SCJsonBuilder *js);
int OutputJSONMemBufferCallback(const char *str, size_t size, void *data);
OutputJsonThreadCtx *CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx);
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx);
void JSONFormatAndAddMACAddr(JsonBuilder *js, const char *key, const uint8_t *val, bool is_array);
void JSONFormatAndAddMACAddr(SCJsonBuilder *js, const char *key, const uint8_t *val, bool is_array);
void OutputJsonFlush(OutputJsonThreadCtx *ctx);
#endif /* SURICATA_OUTPUT_JSON_H */

6
src/output.c
Unescape Escape View File

@ -937,7 +937,7 @@ static int JsonGenericLogger(ThreadVars *tv, void *thread_data, const Packet *p,
return TM_ECODE_FAILED;
}
JsonBuilder *js = CreateEveHeader(p, dir, al->name, NULL, thread->ctx);
SCJsonBuilder *js = CreateEveHeader(p, dir, al->name, NULL, thread->ctx);
if (unlikely(js == NULL)) {
return TM_ECODE_FAILED;
}
@ -947,12 +947,12 @@ static int JsonGenericLogger(ThreadVars *tv, void *thread_data, const Packet *p,
}
OutputJsonBuilderBuffer(tv, p, p->flow, js, thread);
jb_free(js);
SCJbFree(js);
return TM_ECODE_OK;
error:
jb_free(js);
SCJbFree(js);
return TM_ECODE_FAILED;
}

2
src/output.h
Unescape Escape View File

@ -172,7 +172,7 @@ void OutputLoggerExitPrintStats(ThreadVars *, void *);
void OutputSetupActiveLoggers(void);
void OutputClearActiveLoggers(void);
typedef bool (*EveJsonSimpleTxLogFunc)(void *, struct JsonBuilder *);
typedef bool (*EveJsonSimpleTxLogFunc)(void *, struct SCJsonBuilder *);
typedef struct EveJsonSimpleAppLayerLogger {
EveJsonSimpleTxLogFunc LogTx;

6
src/rust.h
Unescape Escape View File

@ -23,8 +23,8 @@ typedef struct HttpRangeContainerBlock HttpRangeContainerBlock;
#include "rust-context.h"
#include "rust-bindings.h"
#define JB_SET_STRING(jb, key, val) jb_set_formatted((jb), "\"" key "\":\"" val "\"")
#define JB_SET_TRUE(jb, key) jb_set_formatted((jb), "\"" key "\":true")
#define JB_SET_FALSE(jb, key) jb_set_formatted((jb), "\"" key "\":false")
#define JB_SET_STRING(jb, key, val) SCJbSetFormatted((jb), "\"" key "\":\"" val "\"")
#define JB_SET_TRUE(jb, key) SCJbSetFormatted((jb), "\"" key "\":true")
#define JB_SET_FALSE(jb, key) SCJbSetFormatted((jb), "\"" key "\":false")
#endif /* !SURICATA_RUST_H */

28
src/util-debug.c
Unescape Escape View File

@ -199,29 +199,29 @@ static int SCLogMessageJSON(SCTime_t tval, char *buffer, size_t buffer_size, SCL
const char *file, unsigned line, const char *function, const char *module,
const char *message)
{
JsonBuilder *js = jb_new_object();
SCJsonBuilder *js = SCJbNewObject();
if (unlikely(js == NULL))
goto error;
char timebuf[64];
CreateIsoTimeString(tval, timebuf, sizeof(timebuf));
jb_set_string(js, "timestamp", timebuf);
SCJbSetString(js, "timestamp", timebuf);
const char *s = SCMapEnumValueToName(log_level, sc_log_level_map);
if (s != NULL) {
jb_set_string(js, "log_level", s);
SCJbSetString(js, "log_level", s);
} else {
JB_SET_STRING(js, "log_level", "INVALID");
}
JB_SET_STRING(js, "event_type", "engine");
jb_open_object(js, "engine");
SCJbOpenObject(js, "engine");
if (message)
jb_set_string(js, "message", message);
SCJbSetString(js, "message", message);
if (t_thread_name[0] != '\0') {
jb_set_string(js, "thread_name", t_thread_name);
SCJbSetString(js, "thread_name", t_thread_name);
}
if (module) {
@ -229,25 +229,25 @@ static int SCLogMessageJSON(SCTime_t tval, char *buffer, size_t buffer_size, SCL
int dn_len = 0;
const char *dn_name;
dn_name = SCTransformModule(module, &dn_len);
jb_set_string(js, "module", dn_name);
SCJbSetString(js, "module", dn_name);
}
if (log_level >= SC_LOG_DEBUG) {
if (function)
jb_set_string(js, "function", function);
SCJbSetString(js, "function", function);
if (file)
jb_set_string(js, "file", file);
SCJbSetString(js, "file", file);
if (line > 0)
jb_set_uint(js, "line", line);
SCJbSetUint(js, "line", line);
}
jb_close(js); // engine
SCJbClose(js); // engine
jb_close(js);
memcpy(buffer, jb_ptr(js), MIN(buffer_size, jb_len(js)));
SCJbClose(js);
memcpy(buffer, SCJbPtr(js), MIN(buffer_size, SCJbLen(js)));
jb_free(js);
SCJbFree(js);
return 0;

Write Preview
Loading…
Cancel
Save