eve: add common options to loggers missing it

So that we get community id for RFB for instance

Ticket: #5723
pull/8238/head
Philippe Antoine 4 years ago committed by Victor Julien
parent d607c9295b
commit 1be913d49c

@ -170,8 +170,8 @@ static void OutputFilestoreFinalizeFiles(ThreadVars *tv,
WARN_ONCE(SC_ERR_SPRINTF,
"Failed to write file info record. Output filename truncated.");
} else {
JsonBuilder *js_fileinfo = JsonBuildFileInfoRecord(p, ff, true, dir,
ctx->xff_cfg);
JsonBuilder *js_fileinfo =
JsonBuildFileInfoRecord(p, ff, true, dir, ctx->xff_cfg, NULL);
if (likely(js_fileinfo != NULL)) {
jb_close(js_fileinfo);
FILE *out = fopen(js_metadata_filename, "w");

@ -50,6 +50,7 @@ static int JsonDCERPCLogger(ThreadVars *tv, void *thread_data,
if (unlikely(jb == NULL)) {
return TM_ECODE_FAILED;
}
EveAddCommonOptions(&thread->ctx->cfg, p, f, jb);
jb_open_object(jb, "dcerpc");
if (p->proto == IPPROTO_TCP) {

@ -74,6 +74,7 @@ typedef struct OutputFileCtx_ {
uint32_t file_cnt;
HttpXFFCfg *xff_cfg;
HttpXFFCfg *parent_xff_cfg;
OutputJsonCommonSettings cfg;
} OutputFileCtx;
typedef struct JsonFileLogThread_ {
@ -82,8 +83,8 @@ typedef struct JsonFileLogThread_ {
MemBuffer *buffer;
} JsonFileLogThread;
JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff,
const bool stored, uint8_t dir, HttpXFFCfg *xff_cfg)
JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, const bool stored,
uint8_t dir, HttpXFFCfg *xff_cfg, OutputJsonCommonSettings *cfg)
{
enum OutputJsonLogDirection fdir = LOG_DIR_FLOW;
@ -122,6 +123,9 @@ JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff,
JsonBuilder *js = CreateEveHeader(p, fdir, "fileinfo", &addr);
if (unlikely(js == NULL))
return NULL;
if (cfg != NULL) {
EveAddCommonOptions(cfg, p, p->flow, js);
}
JsonBuilderMark mark = { 0, 0, 0 };
switch (p->flow->alproto) {
@ -207,8 +211,8 @@ static void FileWriteJsonRecord(JsonFileLogThread *aft, const Packet *p,
{
HttpXFFCfg *xff_cfg = aft->filelog_ctx->xff_cfg != NULL ?
aft->filelog_ctx->xff_cfg : aft->filelog_ctx->parent_xff_cfg;;
JsonBuilder *js = JsonBuildFileInfoRecord(p, ff,
ff->flags & FILE_STORED ? true : false, dir, xff_cfg);
JsonBuilder *js = JsonBuildFileInfoRecord(
p, ff, ff->flags & FILE_STORED ? true : false, dir, xff_cfg, &aft->filelog_ctx->cfg);
if (unlikely(js == NULL)) {
return;
}
@ -313,6 +317,7 @@ static OutputInitResult OutputFileLogInitSub(ConfNode *conf, OutputCtx *parent_c
}
output_file_ctx->file_ctx = ojc->file_ctx;
output_file_ctx->cfg = ojc->cfg;
if (conf) {
const char *force_filestore = ConfNodeLookupChildValue(conf, "force-filestore");

@ -25,9 +25,10 @@
#define __OUTPUT_JSON_FILE_H__
#include "app-layer-htp-xff.h"
#include "output-json.h"
void JsonFileLogRegister(void);
JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff,
const bool stored, uint8_t dir, HttpXFFCfg *xff_cfg);
JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff, const bool stored,
uint8_t dir, HttpXFFCfg *xff_cfg, OutputJsonCommonSettings *cfg);
#endif /* __OUTPUT_JSON_FILE_H__ */

@ -52,6 +52,7 @@
typedef struct LogMQTTFileCtx_ {
LogFileCtx *file_ctx;
uint32_t flags;
OutputJsonCommonSettings cfg;
} LogMQTTFileCtx;
typedef struct LogMQTTLogThread_ {
@ -90,6 +91,7 @@ static int JsonMQTTLogger(ThreadVars *tv, void *thread_data,
if (unlikely(js == NULL)) {
return TM_ECODE_FAILED;
}
EveAddCommonOptions(&thread->mqttlog_ctx->cfg, p, f, js);
if (!rs_mqtt_logger_log(state, tx, thread->mqttlog_ctx->flags, js))
goto error;
@ -137,6 +139,7 @@ static OutputInitResult OutputMQTTLogInitSub(ConfNode *conf,
return result;
}
mqttlog_ctx->file_ctx = ajt->file_ctx;
mqttlog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) {

@ -49,6 +49,7 @@
typedef struct LogRFBFileCtx_ {
LogFileCtx *file_ctx;
uint32_t flags;
OutputJsonCommonSettings cfg;
} LogRFBFileCtx;
typedef struct LogRFBLogThread_ {
@ -80,6 +81,8 @@ static int JsonRFBLogger(ThreadVars *tv, void *thread_data,
return TM_ECODE_FAILED;
}
EveAddCommonOptions(&thread->rfblog_ctx->cfg, p, f, js);
if (!rs_rfb_logger_log(NULL, tx, js)) {
goto error;
}
@ -113,6 +116,7 @@ static OutputInitResult OutputRFBLogInitSub(ConfNode *conf,
return result;
}
rfblog_ctx->file_ctx = ajt->file_ctx;
rfblog_ctx->cfg = ajt->cfg;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) {

Loading…
Cancel
Save