mirror of https://github.com/OISF/suricata
http-log: remove support for http-log
http-log was deprecated in Suricata 8, and marked for removal in Suricata 9.0. Ticket: #7232pull/15509/head
Jason Ish
5 months ago
committed by
Victor Julien
parent
6368f6401b
commit
865b7243a0
@ -1,53 +0,0 @@
|
||||
Custom http logging
|
||||
===================
|
||||
|
||||
.. attention:: http-log is deprecated in Suricata 8.0 and will be
|
||||
removed in Suricata 9.0.
|
||||
|
||||
In your Suricata.yaml, find the http-log section and edit as follows:
|
||||
|
||||
|
||||
::
|
||||
|
||||
|
||||
- http-log:
|
||||
enabled: yes
|
||||
filename: http.log
|
||||
custom: yes # enable the custom logging format (defined by custom format)
|
||||
customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %{User-agent}i %H %m %h %u %s %B %a:%p -> %A:%P"
|
||||
append: no
|
||||
#extended: yes # enable this for extended logging information
|
||||
#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
|
||||
|
||||
And in your http.log file you would get the following, for example:
|
||||
|
||||
::
|
||||
|
||||
8/28/12-22:14:21.101619 - Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:11.0) Gecko/20100101 Firefox/11.0 HTTP/1.1 GET us.cnn.com /video/data/3.0/video/world/2012/08/28/hancocks-korea-typhoon-bolavan.cnn/index.xml 200 16856 192.168.1.91:45111 -> 157.166.255.18:80
|
||||
|
||||
::
|
||||
|
||||
08/28/12-22:14:30.693856 - Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:11.0) Gecko/20100101 Firefox/11.0 HTTP/1.1 GET us.cnn.com /video/data/3.0/video/showbiz/2012/08/28/conan-reports-from-rnc-convention.teamcoco/index.xml 200 15789 192.168.1.91:45108 -> 157.166.255.18:80
|
||||
|
||||
The list of supported format strings is the following:
|
||||
|
||||
* %h - Host HTTP Header (remote host name). ie: google.com
|
||||
* %H - Request Protocol. ie: HTTP/1.1
|
||||
* %m - Request Method. ie: GET
|
||||
* %u - URL including query string. ie: /search?q=suricata
|
||||
* %{header_name}i - contents of the defined HTTP Request Header name. ie:
|
||||
|
||||
* %{User-agent}i: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:11.0) Gecko/20100101 Firefox/11.0
|
||||
* %{X-Forwarded-For}i: outputs the IP address contained in the X-Forwarded-For HTTP header (inserted by a reverse proxy)
|
||||
|
||||
* %s - return status code. In the case of 301 and 302 it will print the url in brackets. ie: 200
|
||||
* %B - response size in bytes. ie: 15789
|
||||
* %{header_name}o - contents of the defined HTTP Response Header name
|
||||
* %{strftime_format]t - timestamp of the HTTP transaction in the selected strftime format. ie: 08/28/12-22:14:30
|
||||
* %z - precision time in useconds. ie: 693856
|
||||
* %a - client IP address
|
||||
* %p - client port number
|
||||
* %A - server IP address
|
||||
* %P - server port number
|
||||
|
||||
Any non printable character will be represented by its byte value in hexadecimal format (\|XX\|, where XX is the hex code)
|
||||
@ -1,620 +0,0 @@
|
||||
/* Copyright (C) 2007-2013 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
* \author Ignacio Sanchez <sanchezmartin.ji@gmail.com>
|
||||
*
|
||||
* Implements http logging portion of the engine.
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "detect.h"
|
||||
#include "pkt-var.h"
|
||||
#include "conf.h"
|
||||
|
||||
#include "threads.h"
|
||||
#include "threadvars.h"
|
||||
#include "tm-threads.h"
|
||||
|
||||
#include "util-print.h"
|
||||
#include "util-unittest.h"
|
||||
|
||||
#include "util-debug.h"
|
||||
|
||||
#include "output.h"
|
||||
#include "log-httplog.h"
|
||||
#include "app-layer-htp.h"
|
||||
#include "app-layer.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "util-privs.h"
|
||||
#include "util-buffer.h"
|
||||
|
||||
#include "util-logopenfile.h"
|
||||
#include "util-time.h"
|
||||
#include "log-cf-common.h"
|
||||
|
||||
#define DEFAULT_LOG_FILENAME "http.log"
|
||||
|
||||
#define MODULE_NAME "LogHttpLog"
|
||||
|
||||
#define OUTPUT_BUFFER_SIZE 65535
|
||||
|
||||
TmEcode LogHttpLogThreadInit(ThreadVars *, const void *, void **);
|
||||
TmEcode LogHttpLogThreadDeinit(ThreadVars *, void *);
|
||||
static void LogHttpLogDeInitCtx(OutputCtx *);
|
||||
|
||||
int LogHttpLogger(ThreadVars *tv, void *thread_data, const Packet *, Flow *f, void *state, void *tx, uint64_t tx_id);
|
||||
|
||||
void LogHttpLogRegister (void)
|
||||
{
|
||||
OutputRegisterTxModule(LOGGER_HTTP, MODULE_NAME, "http-log", LogHttpLogInitCtx, ALPROTO_HTTP1,
|
||||
LogHttpLogger, LogHttpLogThreadInit, LogHttpLogThreadDeinit);
|
||||
}
|
||||
|
||||
#define LOG_HTTP_CF_REQUEST_HOST 'h'
|
||||
#define LOG_HTTP_CF_REQUEST_PROTOCOL 'H'
|
||||
#define LOG_HTTP_CF_REQUEST_METHOD 'm'
|
||||
#define LOG_HTTP_CF_REQUEST_URI 'u'
|
||||
#define LOG_HTTP_CF_REQUEST_HEADER 'i'
|
||||
#define LOG_HTTP_CF_REQUEST_COOKIE 'C'
|
||||
#define LOG_HTTP_CF_REQUEST_LEN 'b'
|
||||
#define LOG_HTTP_CF_RESPONSE_STATUS 's'
|
||||
#define LOG_HTTP_CF_RESPONSE_HEADER 'o'
|
||||
#define LOG_HTTP_CF_RESPONSE_LEN 'B'
|
||||
|
||||
|
||||
typedef struct LogHttpFileCtx_ {
|
||||
LogFileCtx *file_ctx;
|
||||
uint32_t flags; /** Store mode */
|
||||
LogCustomFormat *cf;
|
||||
} LogHttpFileCtx;
|
||||
|
||||
#define LOG_HTTP_DEFAULT 0
|
||||
#define LOG_HTTP_EXTENDED 1
|
||||
#define LOG_HTTP_CUSTOM 2
|
||||
|
||||
typedef struct LogHttpLogThread_ {
|
||||
LogHttpFileCtx *httplog_ctx;
|
||||
/** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
|
||||
uint32_t uri_cnt;
|
||||
|
||||
MemBuffer *buffer;
|
||||
} LogHttpLogThread;
|
||||
|
||||
/* Retrieves the selected cookie value */
|
||||
static uint32_t GetCookieValue(const uint8_t *rawcookies, uint32_t rawcookies_len, char *cookiename,
|
||||
const uint8_t **cookievalue)
|
||||
{
|
||||
const uint8_t *p = rawcookies;
|
||||
const uint8_t *cn = p; /* ptr to cookie name start */
|
||||
const uint8_t *cv = NULL; /* ptr to cookie value start */
|
||||
while (p < rawcookies + rawcookies_len) {
|
||||
if (cv == NULL && *p == '=') {
|
||||
cv = p + 1;
|
||||
} else if (cv != NULL && (*p == ';' || p == rawcookies + rawcookies_len - 1) ) {
|
||||
/* Found end of cookie */
|
||||
p++;
|
||||
if (strlen(cookiename) == (unsigned int) (cv-cn-1) &&
|
||||
strncmp(cookiename, (char *) cn, cv-cn-1) == 0) {
|
||||
*cookievalue = cv;
|
||||
return (uint32_t) (p-cv);
|
||||
}
|
||||
cv = NULL;
|
||||
cn = p + 1;
|
||||
}
|
||||
p++;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Custom format logging */
|
||||
static void LogHttpLogCustom(LogHttpLogThread *aft, htp_tx_t *tx, const SCTime_t ts, char *srcip,
|
||||
Port sp, char *dstip, Port dp)
|
||||
{
|
||||
LogHttpFileCtx *httplog_ctx = aft->httplog_ctx;
|
||||
uint32_t i;
|
||||
size_t datalen;
|
||||
char buf[128];
|
||||
|
||||
const uint8_t *cvalue = NULL;
|
||||
uint32_t cvalue_len = 0;
|
||||
|
||||
const htp_header_t *h_request_hdr;
|
||||
const htp_header_t *h_response_hdr;
|
||||
|
||||
for (i = 0; i < httplog_ctx->cf->cf_n; i++) {
|
||||
h_request_hdr = NULL;
|
||||
h_response_hdr = NULL;
|
||||
|
||||
LogCustomFormatNode * node = httplog_ctx->cf->cf_nodes[i];
|
||||
if (! node) /* Should never happen */
|
||||
continue;
|
||||
|
||||
switch (node->type){
|
||||
case LOG_CF_LITERAL:
|
||||
/* LITERAL */
|
||||
MemBufferWriteString(aft->buffer, "%s", node->data);
|
||||
break;
|
||||
case LOG_CF_TIMESTAMP:
|
||||
/* TIMESTAMP */
|
||||
LogCustomFormatWriteTimestamp(aft->buffer, node->data, ts);
|
||||
break;
|
||||
case LOG_CF_TIMESTAMP_U:
|
||||
/* TIMESTAMP USECONDS */
|
||||
snprintf(buf, sizeof(buf), "%06u", (unsigned int)SCTIME_USECS(ts));
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
(uint8_t *)buf, MIN(strlen(buf), 6));
|
||||
break;
|
||||
case LOG_CF_CLIENT_IP:
|
||||
/* CLIENT IP ADDRESS */
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
|
||||
aft->buffer->size, (uint8_t *)srcip,strlen(srcip));
|
||||
break;
|
||||
case LOG_CF_SERVER_IP:
|
||||
/* SERVER IP ADDRESS */
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
|
||||
aft->buffer->size, (uint8_t *)dstip,strlen(dstip));
|
||||
break;
|
||||
case LOG_CF_CLIENT_PORT:
|
||||
/* CLIENT PORT */
|
||||
MemBufferWriteString(aft->buffer, "%" PRIu16 "", sp);
|
||||
break;
|
||||
case LOG_CF_SERVER_PORT:
|
||||
/* SERVER PORT */
|
||||
MemBufferWriteString(aft->buffer, "%" PRIu16 "", dp);
|
||||
break;
|
||||
case LOG_HTTP_CF_REQUEST_METHOD:
|
||||
/* METHOD */
|
||||
if (htp_tx_request_method(tx) != NULL) {
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
(uint8_t *)bstr_ptr(htp_tx_request_method(tx)),
|
||||
bstr_len(htp_tx_request_method(tx)));
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, LOG_CF_NONE);
|
||||
}
|
||||
break;
|
||||
case LOG_HTTP_CF_REQUEST_URI:
|
||||
/* URI */
|
||||
if (htp_tx_request_uri(tx) != NULL) {
|
||||
datalen = node->maxlen;
|
||||
if (datalen == 0 || datalen > bstr_len(htp_tx_request_uri(tx))) {
|
||||
datalen = bstr_len(htp_tx_request_uri(tx));
|
||||
}
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
(uint8_t *)bstr_ptr(htp_tx_request_uri(tx)), datalen);
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, LOG_CF_NONE);
|
||||
}
|
||||
break;
|
||||
case LOG_HTTP_CF_REQUEST_HOST:
|
||||
/* HOSTNAME */
|
||||
if (htp_tx_request_hostname(tx) != NULL) {
|
||||
datalen = node->maxlen;
|
||||
if (datalen == 0 || datalen > bstr_len(htp_tx_request_hostname(tx))) {
|
||||
datalen = bstr_len(htp_tx_request_hostname(tx));
|
||||
}
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
(uint8_t *)bstr_ptr(htp_tx_request_hostname(tx)), datalen);
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, LOG_CF_NONE);
|
||||
}
|
||||
break;
|
||||
case LOG_HTTP_CF_REQUEST_PROTOCOL:
|
||||
/* PROTOCOL */
|
||||
if (htp_tx_request_protocol(tx) != NULL) {
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
(uint8_t *)bstr_ptr(htp_tx_request_protocol(tx)),
|
||||
bstr_len(htp_tx_request_protocol(tx)));
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, LOG_CF_NONE);
|
||||
}
|
||||
break;
|
||||
case LOG_HTTP_CF_REQUEST_HEADER:
|
||||
/* REQUEST HEADER */
|
||||
h_request_hdr = htp_tx_request_header(tx, node->data);
|
||||
if (h_request_hdr != NULL) {
|
||||
datalen = node->maxlen;
|
||||
if (datalen == 0 || datalen > htp_header_value_len(h_request_hdr)) {
|
||||
datalen = htp_header_value_len(h_request_hdr);
|
||||
}
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
htp_header_value_ptr(h_request_hdr), datalen);
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, LOG_CF_NONE);
|
||||
}
|
||||
break;
|
||||
case LOG_HTTP_CF_REQUEST_COOKIE:
|
||||
/* REQUEST COOKIE */
|
||||
if (htp_tx_request_headers(tx) != NULL) {
|
||||
h_request_hdr = htp_tx_request_header(tx, "Cookie");
|
||||
if (h_request_hdr != NULL) {
|
||||
cvalue_len = GetCookieValue(htp_header_value_ptr(h_request_hdr),
|
||||
(uint32_t)htp_header_value_len(h_request_hdr), (char *)node->data,
|
||||
&cvalue);
|
||||
}
|
||||
}
|
||||
if (cvalue_len > 0 && cvalue != NULL) {
|
||||
datalen = node->maxlen;
|
||||
if (datalen == 0 || datalen > cvalue_len) {
|
||||
datalen = cvalue_len;
|
||||
}
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
|
||||
aft->buffer->size, cvalue, datalen);
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, LOG_CF_NONE);
|
||||
}
|
||||
break;
|
||||
case LOG_HTTP_CF_REQUEST_LEN:
|
||||
/* REQUEST LEN */
|
||||
MemBufferWriteString(
|
||||
aft->buffer, "%" PRIuMAX "", (uintmax_t)htp_tx_request_message_len(tx));
|
||||
break;
|
||||
case LOG_HTTP_CF_RESPONSE_STATUS:
|
||||
/* RESPONSE STATUS */
|
||||
if (htp_tx_response_status(tx) != NULL) {
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
(uint8_t *)bstr_ptr(htp_tx_response_status(tx)),
|
||||
bstr_len(htp_tx_response_status(tx)));
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, LOG_CF_NONE);
|
||||
}
|
||||
break;
|
||||
case LOG_HTTP_CF_RESPONSE_HEADER:
|
||||
/* RESPONSE HEADER */
|
||||
if (htp_tx_response_headers(tx) != NULL) {
|
||||
h_response_hdr = htp_tx_response_header(tx, node->data);
|
||||
}
|
||||
if (h_response_hdr != NULL) {
|
||||
datalen = node->maxlen;
|
||||
if (datalen == 0 || datalen > htp_header_value_len(h_response_hdr)) {
|
||||
datalen = htp_header_value_len(h_response_hdr);
|
||||
}
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
|
||||
aft->buffer->size, htp_header_value_ptr(h_response_hdr), datalen);
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, LOG_CF_NONE);
|
||||
}
|
||||
break;
|
||||
case LOG_HTTP_CF_RESPONSE_LEN:
|
||||
/* RESPONSE LEN */
|
||||
MemBufferWriteString(
|
||||
aft->buffer, "%" PRIuMAX "", (uintmax_t)htp_tx_response_message_len(tx));
|
||||
break;
|
||||
default:
|
||||
/* NO MATCH */
|
||||
MemBufferWriteString(aft->buffer, LOG_CF_NONE);
|
||||
SCLogDebug("No matching parameter %%%c for custom http log.", node->type);
|
||||
break;
|
||||
}
|
||||
}
|
||||
MemBufferWriteString(aft->buffer, "\n");
|
||||
}
|
||||
|
||||
static void LogHttpLogExtended(LogHttpLogThread *aft, htp_tx_t *tx)
|
||||
{
|
||||
LOG_CF_WRITE_STAR_SEPARATOR(aft->buffer);
|
||||
|
||||
/* referer */
|
||||
const htp_header_t *h_referer = htp_tx_request_header(tx, "referer");
|
||||
|
||||
if (h_referer != NULL) {
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
htp_header_value_ptr(h_referer), htp_header_value_len(h_referer));
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, "<no referer>");
|
||||
}
|
||||
|
||||
LOG_CF_WRITE_STAR_SEPARATOR(aft->buffer);
|
||||
|
||||
/* method */
|
||||
if (htp_tx_request_method(tx) != NULL) {
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
(uint8_t *)bstr_ptr(htp_tx_request_method(tx)),
|
||||
bstr_len(htp_tx_request_method(tx)));
|
||||
}
|
||||
LOG_CF_WRITE_STAR_SEPARATOR(aft->buffer);
|
||||
|
||||
/* protocol */
|
||||
if (htp_tx_request_protocol(tx) != NULL) {
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
(uint8_t *)bstr_ptr(htp_tx_request_protocol(tx)),
|
||||
bstr_len(htp_tx_request_protocol(tx)));
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, "<no protocol>");
|
||||
}
|
||||
LOG_CF_WRITE_STAR_SEPARATOR(aft->buffer);
|
||||
|
||||
/* response status */
|
||||
if (htp_tx_response_status(tx) != NULL) {
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
(uint8_t *)bstr_ptr(htp_tx_response_status(tx)),
|
||||
bstr_len(htp_tx_response_status(tx)));
|
||||
/* Redirect? */
|
||||
if ((htp_tx_response_status_number(tx) > 300) &&
|
||||
((htp_tx_response_status_number(tx)) < 303)) {
|
||||
const htp_header_t *h_location = htp_tx_response_header(tx, "location");
|
||||
if (h_location != NULL) {
|
||||
MemBufferWriteString(aft->buffer, " => ");
|
||||
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
htp_header_value_ptr(h_location), htp_header_value_len(h_location));
|
||||
}
|
||||
}
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, "<no status>");
|
||||
}
|
||||
|
||||
/* length */
|
||||
LOG_CF_WRITE_STAR_SEPARATOR(aft->buffer);
|
||||
MemBufferWriteString(
|
||||
aft->buffer, "%" PRIuMAX " bytes", (uintmax_t)htp_tx_response_message_len(tx));
|
||||
}
|
||||
|
||||
static TmEcode LogHttpLogIPWrapper(ThreadVars *tv, void *data, const Packet *p, Flow *f, HtpState *htp_state, htp_tx_t *tx, uint64_t tx_id, int ipproto)
|
||||
{
|
||||
SCEnter();
|
||||
|
||||
LogHttpLogThread *aft = (LogHttpLogThread *)data;
|
||||
LogHttpFileCtx *hlog = aft->httplog_ctx;
|
||||
char timebuf[64];
|
||||
|
||||
/* check if we have HTTP state or not */
|
||||
CreateTimeString(p->ts, timebuf, sizeof(timebuf));
|
||||
|
||||
char srcip[46], dstip[46];
|
||||
Port sp, dp;
|
||||
if ((PKT_IS_TOSERVER(p))) {
|
||||
switch (ipproto) {
|
||||
case AF_INET:
|
||||
PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
|
||||
PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
|
||||
break;
|
||||
case AF_INET6:
|
||||
PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
|
||||
PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
|
||||
break;
|
||||
default:
|
||||
goto end;
|
||||
}
|
||||
sp = p->sp;
|
||||
dp = p->dp;
|
||||
} else {
|
||||
switch (ipproto) {
|
||||
case AF_INET:
|
||||
PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), srcip, sizeof(srcip));
|
||||
PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), dstip, sizeof(dstip));
|
||||
break;
|
||||
case AF_INET6:
|
||||
PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), srcip, sizeof(srcip));
|
||||
PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), dstip, sizeof(dstip));
|
||||
break;
|
||||
default:
|
||||
goto end;
|
||||
}
|
||||
sp = p->dp;
|
||||
dp = p->sp;
|
||||
}
|
||||
|
||||
SCLogDebug("got a HTTP request and now logging !!");
|
||||
|
||||
/* reset */
|
||||
MemBufferReset(aft->buffer);
|
||||
|
||||
if (hlog->flags & LOG_HTTP_CUSTOM) {
|
||||
LogHttpLogCustom(aft, tx, p->ts, srcip, sp, dstip, dp);
|
||||
} else {
|
||||
/* time */
|
||||
MemBufferWriteString(aft->buffer, "%s ", timebuf);
|
||||
|
||||
/* hostname */
|
||||
if (htp_tx_request_hostname(tx) != NULL) {
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
(uint8_t *)bstr_ptr(htp_tx_request_hostname(tx)),
|
||||
bstr_len(htp_tx_request_hostname(tx)));
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, "<hostname unknown>");
|
||||
}
|
||||
LOG_CF_WRITE_STAR_SEPARATOR(aft->buffer);
|
||||
|
||||
/* uri */
|
||||
if (htp_tx_request_uri(tx) != NULL) {
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
(uint8_t *)bstr_ptr(htp_tx_request_uri(tx)), bstr_len(htp_tx_request_uri(tx)));
|
||||
}
|
||||
LOG_CF_WRITE_STAR_SEPARATOR(aft->buffer);
|
||||
|
||||
/* user agent */
|
||||
const htp_header_t *h_user_agent = htp_tx_request_header(tx, "user-agent");
|
||||
if (h_user_agent != NULL) {
|
||||
PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
|
||||
htp_header_value_ptr(h_user_agent), htp_header_value_len(h_user_agent));
|
||||
} else {
|
||||
MemBufferWriteString(aft->buffer, "<useragent unknown>");
|
||||
}
|
||||
if (hlog->flags & LOG_HTTP_EXTENDED) {
|
||||
LogHttpLogExtended(aft, tx);
|
||||
}
|
||||
|
||||
/* ip/tcp header info */
|
||||
LOG_CF_WRITE_STAR_SEPARATOR(aft->buffer);
|
||||
MemBufferWriteString(aft->buffer,
|
||||
"%s:%" PRIu16 " -> %s:%" PRIu16 "\n",
|
||||
srcip, sp, dstip, dp);
|
||||
}
|
||||
|
||||
aft->uri_cnt ++;
|
||||
|
||||
hlog->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),
|
||||
MEMBUFFER_OFFSET(aft->buffer), hlog->file_ctx);
|
||||
|
||||
end:
|
||||
SCReturnInt(0);
|
||||
|
||||
}
|
||||
|
||||
int LogHttpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
|
||||
{
|
||||
SCEnter();
|
||||
|
||||
if (!(PacketIsTCP(p))) {
|
||||
SCReturnInt(TM_ECODE_OK);
|
||||
}
|
||||
|
||||
int r = 0;
|
||||
if (PacketIsIPv4(p)) {
|
||||
r = LogHttpLogIPWrapper(tv, thread_data, p, f, (HtpState *)state, (htp_tx_t *)tx, tx_id, AF_INET);
|
||||
} else if (PacketIsIPv6(p)) {
|
||||
r = LogHttpLogIPWrapper(tv, thread_data, p, f, (HtpState *)state, (htp_tx_t *)tx, tx_id, AF_INET6);
|
||||
}
|
||||
|
||||
SCReturnInt(r);
|
||||
}
|
||||
|
||||
TmEcode LogHttpLogThreadInit(ThreadVars *t, const void *initdata, void **data)
|
||||
{
|
||||
LogHttpLogThread *aft = SCCalloc(1, sizeof(LogHttpLogThread));
|
||||
if (unlikely(aft == NULL))
|
||||
return TM_ECODE_FAILED;
|
||||
|
||||
if(initdata == NULL)
|
||||
{
|
||||
SCLogDebug("Error getting context for LogHTTPLog. \"initdata\" argument NULL");
|
||||
SCFree(aft);
|
||||
return TM_ECODE_FAILED;
|
||||
}
|
||||
|
||||
aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE);
|
||||
if (aft->buffer == NULL) {
|
||||
SCFree(aft);
|
||||
return TM_ECODE_FAILED;
|
||||
}
|
||||
|
||||
/* Use the Output Context (file pointer and mutex) */
|
||||
aft->httplog_ctx= ((OutputCtx *)initdata)->data;
|
||||
|
||||
*data = (void *)aft;
|
||||
return TM_ECODE_OK;
|
||||
}
|
||||
|
||||
TmEcode LogHttpLogThreadDeinit(ThreadVars *t, void *data)
|
||||
{
|
||||
LogHttpLogThread *aft = (LogHttpLogThread *)data;
|
||||
if (aft == NULL) {
|
||||
return TM_ECODE_OK;
|
||||
}
|
||||
|
||||
MemBufferFree(aft->buffer);
|
||||
/* clear memory */
|
||||
memset(aft, 0, sizeof(LogHttpLogThread));
|
||||
|
||||
SCFree(aft);
|
||||
return TM_ECODE_OK;
|
||||
}
|
||||
|
||||
/** \brief Create a new http log LogFileCtx.
|
||||
* \param conf Pointer to ConfNode containing this loggers configuration.
|
||||
* \return NULL if failure, LogFileCtx* to the file_ctx if succesful
|
||||
* */
|
||||
OutputInitResult LogHttpLogInitCtx(SCConfNode *conf)
|
||||
{
|
||||
SCLogWarning("The http-log output has been deprecated and will be removed in Suricata 9.0.");
|
||||
OutputInitResult result = { NULL, false };
|
||||
LogFileCtx* file_ctx = LogFileNewCtx();
|
||||
if(file_ctx == NULL) {
|
||||
SCLogError("couldn't create new file_ctx");
|
||||
return result;
|
||||
}
|
||||
|
||||
if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) {
|
||||
LogFileFreeCtx(file_ctx);
|
||||
return result;
|
||||
}
|
||||
|
||||
LogHttpFileCtx *httplog_ctx = SCCalloc(1, sizeof(LogHttpFileCtx));
|
||||
if (unlikely(httplog_ctx == NULL)) {
|
||||
LogFileFreeCtx(file_ctx);
|
||||
return result;
|
||||
}
|
||||
|
||||
httplog_ctx->file_ctx = file_ctx;
|
||||
|
||||
const char *extended = SCConfNodeLookupChildValue(conf, "extended");
|
||||
const char *custom = SCConfNodeLookupChildValue(conf, "custom");
|
||||
const char *customformat = SCConfNodeLookupChildValue(conf, "customformat");
|
||||
|
||||
/* If custom logging format is selected, lets parse it */
|
||||
if (custom != NULL && customformat != NULL && SCConfValIsTrue(custom)) {
|
||||
|
||||
httplog_ctx->cf = LogCustomFormatAlloc();
|
||||
if (!httplog_ctx->cf) {
|
||||
goto errorfree;
|
||||
}
|
||||
|
||||
httplog_ctx->flags |= LOG_HTTP_CUSTOM;
|
||||
|
||||
/* Parsing */
|
||||
if ( ! LogCustomFormatParse(httplog_ctx->cf, customformat)) {
|
||||
goto parsererror;
|
||||
}
|
||||
} else {
|
||||
if (extended == NULL) {
|
||||
httplog_ctx->flags |= LOG_HTTP_DEFAULT;
|
||||
} else {
|
||||
if (SCConfValIsTrue(extended)) {
|
||||
httplog_ctx->flags |= LOG_HTTP_EXTENDED;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
|
||||
if (unlikely(output_ctx == NULL)) {
|
||||
goto parsererror;
|
||||
}
|
||||
|
||||
output_ctx->data = httplog_ctx;
|
||||
output_ctx->DeInit = LogHttpLogDeInitCtx;
|
||||
|
||||
SCLogDebug("HTTP log output initialized");
|
||||
|
||||
/* enable the logger for the app layer */
|
||||
SCAppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_HTTP1);
|
||||
|
||||
result.ctx = output_ctx;
|
||||
result.ok = true;
|
||||
return result;
|
||||
|
||||
parsererror:
|
||||
SCLogError("Syntax error in custom http log format string.");
|
||||
errorfree:
|
||||
LogCustomFormatFree(httplog_ctx->cf);
|
||||
LogFileFreeCtx(file_ctx);
|
||||
SCFree(httplog_ctx);
|
||||
return result;
|
||||
|
||||
}
|
||||
|
||||
static void LogHttpLogDeInitCtx(OutputCtx *output_ctx)
|
||||
{
|
||||
LogHttpFileCtx *httplog_ctx = (LogHttpFileCtx *)output_ctx->data;
|
||||
LogCustomFormatFree(httplog_ctx->cf);
|
||||
LogFileFreeCtx(httplog_ctx->file_ctx);
|
||||
SCFree(httplog_ctx);
|
||||
SCFree(output_ctx);
|
||||
}
|
||||
@ -1,30 +0,0 @@
|
||||
/* Copyright (C) 2007-2010 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \author Victor Julien <victor@inliniac.net>
|
||||
*/
|
||||
|
||||
#ifndef SURICATA_LOG_HTTPLOG_H
|
||||
#define SURICATA_LOG_HTTPLOG_H
|
||||
|
||||
void LogHttpLogRegister(void);
|
||||
OutputInitResult LogHttpLogInitCtx(SCConfNode *);
|
||||
|
||||
#endif /* SURICATA_LOG_HTTPLOG_H */
|
||||
Loading…
Reference in New Issue