From 67c4621bdb70853ae9f0912803ea8c1adee8e300 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Fri, 26 Mar 2021 15:55:10 -0600 Subject: [PATCH] eve/ftp: use generic json context The FTP logger contained no extra data in its context so the generic json context can be used. --- src/output-json-ftp.c | 115 ++++-------------------------------------- 1 file changed, 10 insertions(+), 105 deletions(-) diff --git a/src/output-json-ftp.c b/src/output-json-ftp.c index 103828cbe3..bef33a1d0d 100644 --- a/src/output-json-ftp.c +++ b/src/output-json-ftp.c @@ -48,16 +48,6 @@ #include "app-layer-ftp.h" #include "output-json-ftp.h" -typedef struct LogFTPFileCtx_ { - OutputJsonCtx *eve_ctx; -} LogFTPFileCtx; - -typedef struct LogFTPLogThread_ { - LogFileCtx *file_ctx; - LogFTPFileCtx *ftplog_ctx; - MemBuffer *buffer; -} LogFTPLogThread; - static void EveFTPLogCommand(Flow *f, FTPTransaction *tx, JsonBuilder *jb) { /* Preallocate array objects to simplify failure case */ @@ -149,6 +139,7 @@ static int JsonFTPLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id) { SCEnter(); + OutputJsonThreadCtx *thread = thread_data; const char *event_type; if (f->alproto == ALPROTO_FTPDATA) { @@ -157,11 +148,9 @@ static int JsonFTPLogger(ThreadVars *tv, void *thread_data, event_type = "ftp"; } FTPTransaction *tx = vtx; - LogFTPLogThread *thread = thread_data; - LogFTPFileCtx *ftp_ctx = thread->ftplog_ctx; - JsonBuilder *jb = CreateEveHeaderWithTxId( - p, LOG_DIR_FLOW, event_type, NULL, tx_id, thread->ftplog_ctx->eve_ctx); + JsonBuilder *jb = + CreateEveHeaderWithTxId(p, LOG_DIR_FLOW, event_type, NULL, tx_id, thread->ctx); if (likely(jb)) { jb_open_object(jb, event_type); if (f->alproto == ALPROTO_FTPDATA) { @@ -186,107 +175,23 @@ fail: return TM_ECODE_FAILED; } -static void OutputFTPLogDeInitCtxSub(OutputCtx *output_ctx) -{ - LogFTPFileCtx *ftplog_ctx = (LogFTPFileCtx *)output_ctx->data; - SCFree(ftplog_ctx); - SCFree(output_ctx); -} - - static OutputInitResult OutputFTPLogInitSub(ConfNode *conf, OutputCtx *parent_ctx) { - OutputInitResult result = { NULL, false }; - OutputJsonCtx *ajt = parent_ctx->data; - - LogFTPFileCtx *ftplog_ctx = SCCalloc(1, sizeof(*ftplog_ctx)); - if (unlikely(ftplog_ctx == NULL)) { - return result; - } - ftplog_ctx->eve_ctx = ajt; - - OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); - if (unlikely(output_ctx == NULL)) { - SCFree(ftplog_ctx); - return result; - } - output_ctx->data = ftplog_ctx; - output_ctx->DeInit = OutputFTPLogDeInitCtxSub; - - SCLogDebug("FTP log sub-module initialized."); - AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_FTP); AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_FTPDATA); - - result.ctx = output_ctx; - result.ok = true; - return result; -} - -static TmEcode JsonFTPLogThreadInit(ThreadVars *t, const void *initdata, void **data) -{ - LogFTPLogThread *thread = SCCalloc(1, sizeof(*thread)); - if (unlikely(thread == NULL)) { - return TM_ECODE_FAILED; - } - - if (initdata == NULL) { - SCLogDebug("Error getting context for EveLogFTP. \"initdata\" is NULL."); - goto error_exit; - } - - thread->buffer = MemBufferCreateNew(JSON_OUTPUT_BUFFER_SIZE); - if (unlikely(thread->buffer == NULL)) { - goto error_exit; - } - - thread->ftplog_ctx = ((OutputCtx *)initdata)->data; - thread->file_ctx = LogFileEnsureExists(thread->ftplog_ctx->eve_ctx->file_ctx, t->id); - if (!thread->file_ctx) { - goto error_exit; - } - - *data = (void *)thread; - - return TM_ECODE_OK; - -error_exit: - if (thread->buffer != NULL) { - MemBufferFree(thread->buffer); - } - SCFree(thread); - return TM_ECODE_FAILED; -} - -static TmEcode JsonFTPLogThreadDeinit(ThreadVars *t, void *data) -{ - LogFTPLogThread *thread = (LogFTPLogThread *)data; - if (thread == NULL) { - return TM_ECODE_OK; - } - if (thread->buffer != NULL) { - MemBufferFree(thread->buffer); - } - /* clear memory */ - memset(thread, 0, sizeof(LogFTPLogThread)); - SCFree(thread); - return TM_ECODE_OK; + return OutputJsonLogInitSub(conf, parent_ctx); } void JsonFTPLogRegister(void) { /* Register as an eve sub-module. */ - OutputRegisterTxSubModule(LOGGER_JSON_FTP, "eve-log", "JsonFTPLog", - "eve-log.ftp", OutputFTPLogInitSub, - ALPROTO_FTP, JsonFTPLogger, - JsonFTPLogThreadInit, JsonFTPLogThreadDeinit, - NULL); - OutputRegisterTxSubModule(LOGGER_JSON_FTP, "eve-log", "JsonFTPLog", - "eve-log.ftp", OutputFTPLogInitSub, - ALPROTO_FTPDATA, JsonFTPLogger, - JsonFTPLogThreadInit, JsonFTPLogThreadDeinit, - NULL); + OutputRegisterTxSubModule(LOGGER_JSON_FTP, "eve-log", "JsonFTPLog", "eve-log.ftp", + OutputFTPLogInitSub, ALPROTO_FTP, JsonFTPLogger, JsonLogThreadInit, JsonLogThreadDeinit, + NULL); + OutputRegisterTxSubModule(LOGGER_JSON_FTP, "eve-log", "JsonFTPLog", "eve-log.ftp", + OutputFTPLogInitSub, ALPROTO_FTPDATA, JsonFTPLogger, JsonLogThreadInit, + JsonLogThreadDeinit, NULL); SCLogDebug("FTP JSON logger registered."); }