eve: add common options to loggers missing it

So that we get community id for RFB for instance

Ticket: #5723
pull/8238/head
Philippe Antoine 4 years ago committed by Victor Julien
parent d607c9295b
commit 1be913d49c

@ -170,8 +170,8 @@ static void OutputFilestoreFinalizeFiles(ThreadVars *tv,
WARN_ONCE(SC_ERR_SPRINTF, WARN_ONCE(SC_ERR_SPRINTF,
"Failed to write file info record. Output filename truncated."); "Failed to write file info record. Output filename truncated.");
} else { } else {
JsonBuilder *js_fileinfo = JsonBuildFileInfoRecord(p, ff, true, dir, JsonBuilder *js_fileinfo =
ctx->xff_cfg); JsonBuildFileInfoRecord(p, ff, true, dir, ctx->xff_cfg, NULL);
if (likely(js_fileinfo != NULL)) { if (likely(js_fileinfo != NULL)) {
jb_close(js_fileinfo); jb_close(js_fileinfo);
FILE *out = fopen(js_metadata_filename, "w"); FILE *out = fopen(js_metadata_filename, "w");

@ -50,6 +50,7 @@ static int JsonDCERPCLogger(ThreadVars *tv, void *thread_data,
if (unlikely(jb == NULL)) { if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
EveAddCommonOptions(&thread->ctx->cfg, p, f, jb);
jb_open_object(jb, "dcerpc"); jb_open_object(jb, "dcerpc");
if (p->proto == IPPROTO_TCP) { if (p->proto == IPPROTO_TCP) {

@ -74,6 +74,7 @@ typedef struct OutputFileCtx_ {
uint32_t file_cnt; uint32_t file_cnt;
HttpXFFCfg *xff_cfg; HttpXFFCfg *xff_cfg;
HttpXFFCfg *parent_xff_cfg; HttpXFFCfg *parent_xff_cfg;
OutputJsonCommonSettings cfg;
} OutputFileCtx; } OutputFileCtx;
typedef struct JsonFileLogThread_ { typedef struct JsonFileLogThread_ {
@ -82,8 +83,8 @@ typedef struct JsonFileLogThread_ {
MemBuffer *buffer; MemBuffer *buffer;
} JsonFileLogThread; } JsonFileLogThread;
JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, const bool stored,
const bool stored, uint8_t dir, HttpXFFCfg *xff_cfg) uint8_t dir, HttpXFFCfg *xff_cfg, OutputJsonCommonSettings *cfg)
{ {
enum OutputJsonLogDirection fdir = LOG_DIR_FLOW; enum OutputJsonLogDirection fdir = LOG_DIR_FLOW;
@ -122,6 +123,9 @@ JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff,
JsonBuilder *js = CreateEveHeader(p, fdir, "fileinfo", &addr); JsonBuilder *js = CreateEveHeader(p, fdir, "fileinfo", &addr);
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return NULL; return NULL;
if (cfg != NULL) {
EveAddCommonOptions(cfg, p, p->flow, js);
}
JsonBuilderMark mark = { 0, 0, 0 }; JsonBuilderMark mark = { 0, 0, 0 };
switch (p->flow->alproto) { switch (p->flow->alproto) {
@ -207,8 +211,8 @@ static void FileWriteJsonRecord(JsonFileLogThread *aft, const Packet *p,
{ {
HttpXFFCfg *xff_cfg = aft->filelog_ctx->xff_cfg != NULL ? HttpXFFCfg *xff_cfg = aft->filelog_ctx->xff_cfg != NULL ?
aft->filelog_ctx->xff_cfg : aft->filelog_ctx->parent_xff_cfg;; aft->filelog_ctx->xff_cfg : aft->filelog_ctx->parent_xff_cfg;;
JsonBuilder *js = JsonBuildFileInfoRecord(p, ff, JsonBuilder *js = JsonBuildFileInfoRecord(
ff->flags & FILE_STORED ? true : false, dir, xff_cfg); p, ff, ff->flags & FILE_STORED ? true : false, dir, xff_cfg, &aft->filelog_ctx->cfg);
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return; return;
} }
@ -313,6 +317,7 @@ static OutputInitResult OutputFileLogInitSub(ConfNode *conf, OutputCtx *parent_c
} }
output_file_ctx->file_ctx = ojc->file_ctx; output_file_ctx->file_ctx = ojc->file_ctx;
output_file_ctx->cfg = ojc->cfg;
if (conf) { if (conf) {
const char *force_filestore = ConfNodeLookupChildValue(conf, "force-filestore"); const char *force_filestore = ConfNodeLookupChildValue(conf, "force-filestore");

@ -25,9 +25,10 @@
#define __OUTPUT_JSON_FILE_H__ #define __OUTPUT_JSON_FILE_H__
#include "app-layer-htp-xff.h" #include "app-layer-htp-xff.h"
#include "output-json.h"
void JsonFileLogRegister(void); void JsonFileLogRegister(void);
JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, const bool stored,
const bool stored, uint8_t dir, HttpXFFCfg *xff_cfg); uint8_t dir, HttpXFFCfg *xff_cfg, OutputJsonCommonSettings *cfg);
#endif /* __OUTPUT_JSON_FILE_H__ */ #endif /* __OUTPUT_JSON_FILE_H__ */

@ -52,6 +52,7 @@
typedef struct LogMQTTFileCtx_ { typedef struct LogMQTTFileCtx_ {
LogFileCtx *file_ctx; LogFileCtx *file_ctx;
uint32_t flags; uint32_t flags;
OutputJsonCommonSettings cfg;
} LogMQTTFileCtx; } LogMQTTFileCtx;
typedef struct LogMQTTLogThread_ { typedef struct LogMQTTLogThread_ {
@ -90,6 +91,7 @@ static int JsonMQTTLogger(ThreadVars *tv, void *thread_data,
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
EveAddCommonOptions(&thread->mqttlog_ctx->cfg, p, f, js);
if (!rs_mqtt_logger_log(state, tx, thread->mqttlog_ctx->flags, js)) if (!rs_mqtt_logger_log(state, tx, thread->mqttlog_ctx->flags, js))
goto error; goto error;
@ -137,6 +139,7 @@ static OutputInitResult OutputMQTTLogInitSub(ConfNode *conf,
return result; return result;
} }
mqttlog_ctx->file_ctx = ajt->file_ctx; mqttlog_ctx->file_ctx = ajt->file_ctx;
mqttlog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) { if (unlikely(output_ctx == NULL)) {

@ -49,6 +49,7 @@
typedef struct LogRFBFileCtx_ { typedef struct LogRFBFileCtx_ {
LogFileCtx *file_ctx; LogFileCtx *file_ctx;
uint32_t flags; uint32_t flags;
OutputJsonCommonSettings cfg;
} LogRFBFileCtx; } LogRFBFileCtx;
typedef struct LogRFBLogThread_ { typedef struct LogRFBLogThread_ {
@ -80,6 +81,8 @@ static int JsonRFBLogger(ThreadVars *tv, void *thread_data,
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
EveAddCommonOptions(&thread->rfblog_ctx->cfg, p, f, js);
if (!rs_rfb_logger_log(NULL, tx, js)) { if (!rs_rfb_logger_log(NULL, tx, js)) {
goto error; goto error;
} }
@ -113,6 +116,7 @@ static OutputInitResult OutputRFBLogInitSub(ConfNode *conf,
return result; return result;
} }
rfblog_ctx->file_ctx = ajt->file_ctx; rfblog_ctx->file_ctx = ajt->file_ctx;
rfblog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) { if (unlikely(output_ctx == NULL)) {

Loading…
Cancel
Save