eve/ftp: use generic json context

The FTP logger contained no extra data in its context so the
generic json context can be used.
pull/6006/head
Jason Ish 4 years ago
parent 2d78afe4b0
commit 67c4621bdb

@ -48,16 +48,6 @@
#include "app-layer-ftp.h"
#include "output-json-ftp.h"
typedef struct LogFTPFileCtx_ {
OutputJsonCtx *eve_ctx;
} LogFTPFileCtx;
typedef struct LogFTPLogThread_ {
LogFileCtx *file_ctx;
LogFTPFileCtx *ftplog_ctx;
MemBuffer *buffer;
} LogFTPLogThread;
static void EveFTPLogCommand(Flow *f, FTPTransaction *tx, JsonBuilder *jb)
{
/* Preallocate array objects to simplify failure case */
@ -149,6 +139,7 @@ static int JsonFTPLogger(ThreadVars *tv, void *thread_data,
const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id)
{
SCEnter();
OutputJsonThreadCtx *thread = thread_data;
const char *event_type;
if (f->alproto == ALPROTO_FTPDATA) {
@ -157,11 +148,9 @@ static int JsonFTPLogger(ThreadVars *tv, void *thread_data,
event_type = "ftp";
}
FTPTransaction *tx = vtx;
LogFTPLogThread *thread = thread_data;
LogFTPFileCtx *ftp_ctx = thread->ftplog_ctx;
JsonBuilder *jb = CreateEveHeaderWithTxId(
p, LOG_DIR_FLOW, event_type, NULL, tx_id, thread->ftplog_ctx->eve_ctx);
JsonBuilder *jb =
CreateEveHeaderWithTxId(p, LOG_DIR_FLOW, event_type, NULL, tx_id, thread->ctx);
if (likely(jb)) {
jb_open_object(jb, event_type);
if (f->alproto == ALPROTO_FTPDATA) {
@ -186,107 +175,23 @@ fail:
return TM_ECODE_FAILED;
}
static void OutputFTPLogDeInitCtxSub(OutputCtx *output_ctx)
{
LogFTPFileCtx *ftplog_ctx = (LogFTPFileCtx *)output_ctx->data;
SCFree(ftplog_ctx);
SCFree(output_ctx);
}
static OutputInitResult OutputFTPLogInitSub(ConfNode *conf,
OutputCtx *parent_ctx)
{
OutputInitResult result = { NULL, false };
OutputJsonCtx *ajt = parent_ctx->data;
LogFTPFileCtx *ftplog_ctx = SCCalloc(1, sizeof(*ftplog_ctx));
if (unlikely(ftplog_ctx == NULL)) {
return result;
}
ftplog_ctx->eve_ctx = ajt;
OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
if (unlikely(output_ctx == NULL)) {
SCFree(ftplog_ctx);
return result;
}
output_ctx->data = ftplog_ctx;
output_ctx->DeInit = OutputFTPLogDeInitCtxSub;
SCLogDebug("FTP log sub-module initialized.");
AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_FTP);
AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_FTPDATA);
result.ctx = output_ctx;
result.ok = true;
return result;
}
static TmEcode JsonFTPLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
LogFTPLogThread *thread = SCCalloc(1, sizeof(*thread));
if (unlikely(thread == NULL)) {
return TM_ECODE_FAILED;
}
if (initdata == NULL) {
SCLogDebug("Error getting context for EveLogFTP. \"initdata\" is NULL.");
goto error_exit;
}
thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE);
if (unlikely(thread->buffer == NULL)) {
goto error_exit;
}
thread->ftplog_ctx = ((OutputCtx *)initdata)->data;
thread->file_ctx = LogFileEnsureExists(thread->ftplog_ctx->eve_ctx->file_ctx, t->id);
if (!thread->file_ctx) {
goto error_exit;
}
*data = (void *)thread;
return TM_ECODE_OK;
error_exit:
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
SCFree(thread);
return TM_ECODE_FAILED;
}
static TmEcode JsonFTPLogThreadDeinit(ThreadVars *t, void *data)
{
LogFTPLogThread *thread = (LogFTPLogThread *)data;
if (thread == NULL) {
return TM_ECODE_OK;
}
if (thread->buffer != NULL) {
MemBufferFree(thread->buffer);
}
/* clear memory */
memset(thread, 0, sizeof(LogFTPLogThread));
SCFree(thread);
return TM_ECODE_OK;
return OutputJsonLogInitSub(conf, parent_ctx);
}
void JsonFTPLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_FTP, "eve-log", "JsonFTPLog",
"eve-log.ftp", OutputFTPLogInitSub,
ALPROTO_FTP, JsonFTPLogger,
JsonFTPLogThreadInit, JsonFTPLogThreadDeinit,
NULL);
OutputRegisterTxSubModule(LOGGER_JSON_FTP, "eve-log", "JsonFTPLog",
"eve-log.ftp", OutputFTPLogInitSub,
ALPROTO_FTPDATA, JsonFTPLogger,
JsonFTPLogThreadInit, JsonFTPLogThreadDeinit,
NULL);
OutputRegisterTxSubModule(LOGGER_JSON_FTP, "eve-log", "JsonFTPLog", "eve-log.ftp",
OutputFTPLogInitSub, ALPROTO_FTP, JsonFTPLogger, JsonLogThreadInit, JsonLogThreadDeinit,
NULL);
OutputRegisterTxSubModule(LOGGER_JSON_FTP, "eve-log", "JsonFTPLog", "eve-log.ftp",
OutputFTPLogInitSub, ALPROTO_FTPDATA, JsonFTPLogger, JsonLogThreadInit,
JsonLogThreadDeinit, NULL);
SCLogDebug("FTP JSON logger registered.");
}

Loading…
Cancel
Save