aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

loggers: all json tx loggers can share the same loggerid

Browse Source 
This is to avoid the tx logging code that doesn't support LoggerId
values over 31 at this time. The simplest fix for now is to just have
all JSON (eve) loggers use the same ID.

DNP3 is left as-is for now as it needs some extra support in the parser.
pull/8097/head
Jason Ish 4 years ago committed by Victor Julien
parent 9c2939fb33
commit 99cb8c666a
26 changed files with 53 additions and 107 deletions
Show Stats Download Patch File Download Diff File

7
src/output-json-dcerpc.c
Unescape Escape View File

@ -67,10 +67,9 @@ static OutputInitResult DCERPCLogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
void JsonDCERPCLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_DCERPC, "eve-log", "JsonDCERPCLog",
"eve-log.dcerpc", DCERPCLogInitSub, ALPROTO_DCERPC,
JsonDCERPCLogger, JsonLogThreadInit,
JsonLogThreadDeinit, NULL);
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonDCERPCLog", "eve-log.dcerpc",
DCERPCLogInitSub, ALPROTO_DCERPC, JsonDCERPCLogger, JsonLogThreadInit,
JsonLogThreadDeinit, NULL);
SCLogDebug("DCERPC JSON logger registered.");
}

7
src/output-json-dhcp.c
Unescape Escape View File

@ -146,8 +146,7 @@ static TmEcode JsonDHCPLogThreadDeinit(ThreadVars *t, void *data)
void JsonDHCPLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_DHCP, "eve-log", "JsonDHCPLog",
"eve-log.dhcp", OutputDHCPLogInitSub, ALPROTO_DHCP,
JsonDHCPLogger, JsonDHCPLogThreadInit,
JsonDHCPLogThreadDeinit, NULL);
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonDHCPLog", "eve-log.dhcp",
OutputDHCPLogInitSub, ALPROTO_DHCP, JsonDHCPLogger, JsonDHCPLogThreadInit,
JsonDHCPLogThreadDeinit, NULL);
}

2
src/output-json-dns.c
Unescape Escape View File

@ -573,7 +573,7 @@ static OutputInitResult JsonDnsLogInitCtxSub(ConfNode *conf, OutputCtx *parent_c
#define MODULE_NAME "JsonDnsLog"
void JsonDnsLogRegister (void)
{
OutputRegisterTxSubModule(LOGGER_JSON_DNS, "eve-log", MODULE_NAME, "eve-log.dns",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", MODULE_NAME, "eve-log.dns",
JsonDnsLogInitCtxSub, ALPROTO_DNS, JsonDnsLogger, LogDnsLogThreadInit,
LogDnsLogThreadDeinit, NULL);
}

4
src/output-json-ftp.c
Unescape Escape View File

@ -204,10 +204,10 @@ static OutputInitResult OutputFTPLogInitSub(ConfNode *conf,
void JsonFTPLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_FTP, "eve-log", "JsonFTPLog", "eve-log.ftp",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonFTPLog", "eve-log.ftp",
OutputFTPLogInitSub, ALPROTO_FTP, JsonFTPLogger, JsonLogThreadInit, JsonLogThreadDeinit,
NULL);
OutputRegisterTxSubModule(LOGGER_JSON_FTP, "eve-log", "JsonFTPLog", "eve-log.ftp",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonFTPLog", "eve-log.ftp",
OutputFTPLogInitSub, ALPROTO_FTPDATA, JsonFTPLogger, JsonLogThreadInit,
JsonLogThreadDeinit, NULL);

2
src/output-json-http.c
Unescape Escape View File

@ -669,7 +669,7 @@ static TmEcode JsonHttpLogThreadDeinit(ThreadVars *t, void *data)
void JsonHttpLogRegister (void)
{
/* register as child of eve-log */
OutputRegisterTxSubModule(LOGGER_JSON_HTTP, "eve-log", "JsonHttpLog", "eve-log.http",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonHttpLog", "eve-log.http",
OutputHttpLogInitSub, ALPROTO_HTTP1, JsonHttpLogger, JsonHttpLogThreadInit,
JsonHttpLogThreadDeinit, NULL);
}

8
src/output-json-http2.c
Unescape Escape View File

@ -178,9 +178,7 @@ static OutputInitResult OutputHttp2LogInitSub(ConfNode *conf, OutputCtx *parent_
void JsonHttp2LogRegister (void)
{
/* also register as child of eve-log */
OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_HTTP2,
"eve-log", MODULE_NAME, "eve-log.http2",
OutputHttp2LogInitSub, ALPROTO_HTTP2, JsonHttp2Logger,
HTTP2StateClosed, HTTP2StateClosed,
JsonHttp2LogThreadInit, JsonHttp2LogThreadDeinit, NULL);
OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_TX, "eve-log", MODULE_NAME, "eve-log.http2",
OutputHttp2LogInitSub, ALPROTO_HTTP2, JsonHttp2Logger, HTTP2StateClosed,
HTTP2StateClosed, JsonHttp2LogThreadInit, JsonHttp2LogThreadDeinit, NULL);
}

2
src/output-json-ike.c
Unescape Escape View File

@ -182,7 +182,7 @@ static TmEcode JsonIKELogThreadDeinit(ThreadVars *t, void *data)
void JsonIKELogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_IKE, "eve-log", "JsonIKELog", "eve-log.ike",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonIKELog", "eve-log.ike",
OutputIKELogInitSub, ALPROTO_IKE, JsonIKELogger, JsonIKELogThreadInit,
JsonIKELogThreadDeinit, NULL);
}

2
src/output-json-krb5.c
Unescape Escape View File

@ -86,7 +86,7 @@ static OutputInitResult OutputKRB5LogInitSub(ConfNode *conf,
void JsonKRB5LogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_KRB5, "eve-log", "JsonKRB5Log", "eve-log.krb5",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonKRB5Log", "eve-log.krb5",
OutputKRB5LogInitSub, ALPROTO_KRB5, JsonKRB5Logger, JsonLogThreadInit,
JsonLogThreadDeinit, NULL);

2
src/output-json-modbus.c
Unescape Escape View File

@ -152,7 +152,7 @@ bool JsonModbusAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
void JsonModbusLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_MODBUS, "eve-log", "JsonModbusLog", "eve-log.modbus",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonModbusLog", "eve-log.modbus",
OutputModbusLogInitSub, ALPROTO_MODBUS, JsonModbusLogger, JsonModbusLogThreadInit,
JsonModbusLogThreadDeinit, NULL);

7
src/output-json-mqtt.c
Unescape Escape View File

@ -190,8 +190,7 @@ static TmEcode JsonMQTTLogThreadDeinit(ThreadVars *t, void *data)
void JsonMQTTLogRegister(void)
{
OutputRegisterTxSubModule(LOGGER_JSON_MQTT, "eve-log",
"JsonMQTTLog", "eve-log.mqtt",
OutputMQTTLogInitSub, ALPROTO_MQTT, JsonMQTTLogger,
JsonMQTTLogThreadInit, JsonMQTTLogThreadDeinit, NULL);
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonMQTTLog", "eve-log.mqtt",
OutputMQTTLogInitSub, ALPROTO_MQTT, JsonMQTTLogger, JsonMQTTLogThreadInit,
JsonMQTTLogThreadDeinit, NULL);
}

6
src/output-json-nfs.c
Unescape Escape View File

@ -110,10 +110,8 @@ static OutputInitResult NFSLogInitSub(ConfNode *conf,
void JsonNFSLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_NFS, "eve-log", "JsonNFSLog",
"eve-log.nfs", NFSLogInitSub, ALPROTO_NFS,
JsonNFSLogger, JsonLogThreadInit,
JsonLogThreadDeinit, NULL);
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonNFSLog", "eve-log.nfs", NFSLogInitSub,
ALPROTO_NFS, JsonNFSLogger, JsonLogThreadInit, JsonLogThreadDeinit, NULL);
SCLogDebug("NFS JSON logger registered.");
}

2
src/output-json-pgsql.c
Unescape Escape View File

@ -186,7 +186,7 @@ void JsonPgsqlLogRegister(void)
}
/* PGSQL_END_REMOVE */
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_PGSQL, "eve-log", "JsonPgsqlLog", "eve-log.pgsql",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonPgsqlLog", "eve-log.pgsql",
OutputPgsqlLogInitSub, ALPROTO_PGSQL, JsonPgsqlLogger, JsonPgsqlLogThreadInit,
JsonPgsqlLogThreadDeinit, NULL);

2
src/output-json-quic.c
Unescape Escape View File

@ -156,7 +156,7 @@ bool JsonQuicAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
void JsonQuicLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_QUIC, "eve-log", "JsonQuicLog", "eve-log.quic",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonQuicLog", "eve-log.quic",
OutputQuicLogInitSub, ALPROTO_QUIC, JsonQuicLogger, JsonQuicLogThreadInit,
JsonQuicLogThreadDeinit, NULL);

2
src/output-json-rdp.c
Unescape Escape View File

@ -71,7 +71,7 @@ static OutputInitResult OutputRdpLogInitSub(ConfNode *conf,
void JsonRdpLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_RDP, "eve-log", "JsonRdpLog", "eve-log.rdp",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonRdpLog", "eve-log.rdp",
OutputRdpLogInitSub, ALPROTO_RDP, JsonRdpLogger, JsonLogThreadInit, JsonLogThreadDeinit,
NULL);

2
src/output-json-rfb.c
Unescape Escape View File

@ -93,7 +93,7 @@ static OutputInitResult OutputRFBLogInitSub(ConfNode *conf,
void JsonRFBLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_RFB, "eve-log", "JsonRFBLog", "eve-log.rfb",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonRFBLog", "eve-log.rfb",
OutputRFBLogInitSub, ALPROTO_RFB, JsonRFBLogger, JsonLogThreadInit, JsonLogThreadDeinit,
NULL);
}

2
src/output-json-sip.c
Unescape Escape View File

@ -94,7 +94,7 @@ static OutputInitResult OutputSIPLogInitSub(ConfNode *conf,
void JsonSIPLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_SIP, "eve-log", "JsonSIPLog", "eve-log.sip",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonSIPLog", "eve-log.sip",
OutputSIPLogInitSub, ALPROTO_SIP, JsonSIPLogger, JsonLogThreadInit, JsonLogThreadDeinit,
NULL);

6
src/output-json-smb.c
Unescape Escape View File

@ -79,10 +79,8 @@ static OutputInitResult SMBLogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
void JsonSMBLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_SMB, "eve-log", "JsonSMBLog",
"eve-log.smb", SMBLogInitSub, ALPROTO_SMB,
JsonSMBLogger, JsonLogThreadInit,
JsonLogThreadDeinit, NULL);
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonSMBLog", "eve-log.smb", SMBLogInitSub,
ALPROTO_SMB, JsonSMBLogger, JsonLogThreadInit, JsonLogThreadDeinit, NULL);
SCLogDebug("SMB JSON logger registered.");
}

6
src/output-json-smtp.c
Unescape Escape View File

@ -191,7 +191,7 @@ static TmEcode JsonSmtpLogThreadDeinit(ThreadVars *t, void *data)
void JsonSmtpLogRegister (void) {
/* register as child of eve-log */
OutputRegisterTxSubModule(LOGGER_JSON_SMTP, "eve-log", "JsonSmtpLog",
"eve-log.smtp", OutputSmtpLogInitSub, ALPROTO_SMTP, JsonSmtpLogger,
JsonSmtpLogThreadInit, JsonSmtpLogThreadDeinit, NULL);
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonSmtpLog", "eve-log.smtp",
OutputSmtpLogInitSub, ALPROTO_SMTP, JsonSmtpLogger, JsonSmtpLogThreadInit,
JsonSmtpLogThreadDeinit, NULL);
}

2
src/output-json-snmp.c
Unescape Escape View File

@ -85,7 +85,7 @@ static OutputInitResult OutputSNMPLogInitSub(ConfNode *conf,
void JsonSNMPLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_SNMP, "eve-log", "JsonSNMPLog", "eve-log.snmp",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonSNMPLog", "eve-log.snmp",
OutputSNMPLogInitSub, ALPROTO_SNMP, JsonSNMPLogger, JsonLogThreadInit,
JsonLogThreadDeinit, NULL);

2
src/output-json-ssh.c
Unescape Escape View File

@ -85,7 +85,7 @@ static OutputInitResult OutputSshLogInitSub(ConfNode *conf, OutputCtx *parent_ct
void JsonSshLogRegister (void)
{
/* register as child of eve-log */
OutputRegisterTxSubModuleWithCondition(LOGGER_JSON_SSH, "eve-log", "JsonSshLog", "eve-log.ssh",
OutputRegisterTxSubModuleWithCondition(LOGGER_JSON_TX, "eve-log", "JsonSshLog", "eve-log.ssh",
OutputSshLogInitSub, ALPROTO_SSH, JsonSshLogger, SSHTxLogCondition, JsonLogThreadInit,
JsonLogThreadDeinit, NULL);
}

7
src/output-json-template-rust.c
Unescape Escape View File

@ -172,10 +172,9 @@ void JsonTemplateRustLogRegister(void)
}
/* TEMPLATE_END_REMOVE */
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_TEMPLATE_RUST, "eve-log",
"JsonTemplateRustLog", "eve-log.template-rust",
OutputTemplateLogInitSub, ALPROTO_TEMPLATE_RUST, JsonTemplateLogger,
JsonTemplateLogThreadInit, JsonTemplateLogThreadDeinit, NULL);
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonTemplateRustLog",
"eve-log.template-rust", OutputTemplateLogInitSub, ALPROTO_TEMPLATE_RUST,
JsonTemplateLogger, JsonTemplateLogThreadInit, JsonTemplateLogThreadDeinit, NULL);
SCLogNotice("Template JSON logger registered.");
}

7
src/output-json-template.c
Unescape Escape View File

@ -180,10 +180,9 @@ void JsonTemplateLogRegister(void)
}
/* TEMPLATE_END_REMOVE */
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_TEMPLATE, "eve-log", "JsonTemplateLog",
"eve-log.template", OutputTemplateLogInitSub, ALPROTO_TEMPLATE,
JsonTemplateLogger, JsonTemplateLogThreadInit,
JsonTemplateLogThreadDeinit, NULL);
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonTemplateLog", "eve-log.template",
OutputTemplateLogInitSub, ALPROTO_TEMPLATE, JsonTemplateLogger,
JsonTemplateLogThreadInit, JsonTemplateLogThreadDeinit, NULL);
SCLogNotice("Template JSON logger registered.");
}

2
src/output-json-tftp.c
Unescape Escape View File

@ -84,7 +84,7 @@ static OutputInitResult OutputTFTPLogInitSub(ConfNode *conf,
void JsonTFTPLogRegister(void)
{
/* Register as an eve sub-module. */
OutputRegisterTxSubModule(LOGGER_JSON_TFTP, "eve-log", "JsonTFTPLog", "eve-log.tftp",
OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonTFTPLog", "eve-log.tftp",
OutputTFTPLogInitSub, ALPROTO_TFTP, JsonTFTPLogger, JsonLogThreadInit,
JsonLogThreadDeinit, NULL);

7
src/output-json-tls.c
Unescape Escape View File

@ -666,8 +666,7 @@ static OutputInitResult OutputTlsLogInitSub(ConfNode *conf, OutputCtx *parent_ct
void JsonTlsLogRegister (void)
{
/* register as child of eve-log */
OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_TLS, "eve-log",
"JsonTlsLog", "eve-log.tls", OutputTlsLogInitSub, ALPROTO_TLS,
JsonTlsLogger, TLS_HANDSHAKE_DONE, TLS_HANDSHAKE_DONE,
JsonTlsLogThreadInit, JsonTlsLogThreadDeinit, NULL);
OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_TX, "eve-log", "JsonTlsLog", "eve-log.tls",
OutputTlsLogInitSub, ALPROTO_TLS, JsonTlsLogger, TLS_HANDSHAKE_DONE, TLS_HANDSHAKE_DONE,
JsonTlsLogThreadInit, JsonTlsLogThreadDeinit, NULL);
}

33
src/suricata-common.h
Unescape Escape View File

@ -445,38 +445,19 @@ typedef enum {
LOGGER_HTTP,
LOGGER_TLS_STORE,
LOGGER_TLS,
LOGGER_JSON_DNS,
LOGGER_JSON_HTTP,
LOGGER_JSON_SMTP,
LOGGER_JSON_TLS,
LOGGER_JSON_NFS,
LOGGER_JSON_TFTP,
LOGGER_JSON_FTP,
LOGGER_JSON_TX,
/* DNP3 loggers. These ones don't fit the common model of a
transaction logger yet so are left with their own IDs for
now. */
LOGGER_JSON_DNP3_TS,
LOGGER_JSON_DNP3_TC,
LOGGER_JSON_SSH,
LOGGER_JSON_SMB,
LOGGER_JSON_IKE,
LOGGER_JSON_KRB5,
LOGGER_JSON_QUIC,
LOGGER_JSON_MODBUS,
LOGGER_JSON_DHCP,
LOGGER_JSON_SNMP,
LOGGER_JSON_SIP,
LOGGER_JSON_TEMPLATE_RUST,
LOGGER_JSON_RFB,
LOGGER_JSON_MQTT,
LOGGER_JSON_PGSQL,
LOGGER_JSON_TEMPLATE,
LOGGER_JSON_RDP,
LOGGER_JSON_DCERPC,
LOGGER_JSON_HTTP2,
LOGGER_FILE,
LOGGER_FILEDATA,
/** \warning when we exceed what we can express as a u32 flag here we need to update
* LoggerFlags::flags (u32) and `tx_logged` in src/output-tx.c */
/** \warning Note that transaction loggers here with a value > 31
will not work. */
/* non-tx loggers below */

29
src/util-profiling.c
Unescape Escape View File

@ -1263,35 +1263,12 @@ const char * PacketProfileLoggertIdToString(LoggerId id)
CASE_CODE (LOGGER_ALERT_SYSLOG);
CASE_CODE (LOGGER_JSON_ALERT);
CASE_CODE (LOGGER_JSON_ANOMALY);
CASE_CODE (LOGGER_JSON_DROP);
CASE_CODE (LOGGER_JSON_SSH);
CASE_CODE (LOGGER_JSON_SMB);
CASE_CODE (LOGGER_JSON_NFS);
CASE_CODE(LOGGER_JSON_DROP);
CASE_CODE(LOGGER_JSON_FRAME);
CASE_CODE (LOGGER_HTTP);
CASE_CODE(LOGGER_JSON_DNS);
CASE_CODE(LOGGER_JSON_TX);
CASE_CODE (LOGGER_JSON_DNP3_TS);
CASE_CODE (LOGGER_JSON_DNP3_TC);
CASE_CODE (LOGGER_JSON_HTTP);
CASE_CODE(LOGGER_JSON_QUIC);
CASE_CODE (LOGGER_JSON_DHCP);
CASE_CODE (LOGGER_JSON_KRB5);
CASE_CODE(LOGGER_JSON_IKE);
CASE_CODE(LOGGER_JSON_MODBUS);
CASE_CODE (LOGGER_JSON_FTP);
CASE_CODE (LOGGER_JSON_TFTP);
CASE_CODE (LOGGER_JSON_SMTP);
CASE_CODE (LOGGER_JSON_SNMP);
CASE_CODE (LOGGER_JSON_TLS);
CASE_CODE (LOGGER_JSON_SIP);
CASE_CODE (LOGGER_JSON_TEMPLATE_RUST);
CASE_CODE (LOGGER_JSON_RFB);
CASE_CODE (LOGGER_JSON_MQTT);
CASE_CODE(LOGGER_JSON_PGSQL);
CASE_CODE (LOGGER_JSON_TEMPLATE);
CASE_CODE (LOGGER_JSON_RDP);
CASE_CODE (LOGGER_JSON_DCERPC);
CASE_CODE (LOGGER_JSON_HTTP2);
CASE_CODE(LOGGER_JSON_DNP3_TC);
CASE_CODE (LOGGER_TLS_STORE);
CASE_CODE (LOGGER_TLS);
CASE_CODE (LOGGER_FILE_STORE);

Write Preview
Loading…
Cancel
Save