aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

eve/json: handle common options in central function

Browse Source
pull/3504/head
Victor Julien 8 years ago
parent df1ec82b55
commit e956b484c5
16 changed files with 41 additions and 54 deletions
Show Stats Download Patch File Download Diff File

4
src/output-json-alert.c
Unescape Escape View File

@ -424,9 +424,7 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
if (json_output_ctx->cfg.include_metadata) { JsonAddCommonOptions(&json_output_ctx->cfg, p, p->flow, js);
JsonAddMetadata(p, p->flow, js);
}
for (i = 0; i < p->alerts.cnt; i++) { for (i = 0; i < p->alerts.cnt; i++) {
const PacketAlert *pa = &p->alerts.alerts[i]; const PacketAlert *pa = &p->alerts.alerts[i];

12
src/output-json-dnp3.c
Unescape Escape View File

@ -316,9 +316,9 @@ static int JsonDNP3LoggerToServer(ThreadVars *tv, void *thread_data,
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
if (thread->dnp3log_ctx->cfg.include_metadata) {
JsonAddMetadata(p, f, js); JsonAddCommonOptions(&thread->dnp3log_ctx->cfg, p, f, js);
}
json_t *dnp3js = JsonDNP3LogRequest(tx); json_t *dnp3js = JsonDNP3LogRequest(tx);
if (dnp3js != NULL) { if (dnp3js != NULL) {
json_object_set_new(js, "dnp3", dnp3js); json_object_set_new(js, "dnp3", dnp3js);
@ -345,9 +345,9 @@ static int JsonDNP3LoggerToClient(ThreadVars *tv, void *thread_data,
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
if (thread->dnp3log_ctx->cfg.include_metadata) {
JsonAddMetadata(p, f, js); JsonAddCommonOptions(&thread->dnp3log_ctx->cfg, p, f, js);
}
json_t *dnp3js = JsonDNP3LogResponse(tx); json_t *dnp3js = JsonDNP3LogResponse(tx);
if (dnp3js != NULL) { if (dnp3js != NULL) {
json_object_set_new(js, "dnp3", dnp3js); json_object_set_new(js, "dnp3", dnp3js);

14
src/output-json-dns.c
Unescape Escape View File

@ -1029,9 +1029,8 @@ static int JsonDnsLoggerToServer(ThreadVars *tv, void *thread_data,
if (unlikely(js == NULL)) { if (unlikely(js == NULL)) {
return TM_ECODE_OK; return TM_ECODE_OK;
} }
if (dnslog_ctx->cfg.include_metadata) { JsonAddCommonOptions(&dnslog_ctx->cfg, p, f, js);
JsonAddMetadata(p, f, js);
}
json_t *dns = rs_dns_log_json_query(txptr, i, td->dnslog_ctx->flags); json_t *dns = rs_dns_log_json_query(txptr, i, td->dnslog_ctx->flags);
if (unlikely(dns == NULL)) { if (unlikely(dns == NULL)) {
json_decref(js); json_decref(js);
@ -1049,9 +1048,8 @@ static int JsonDnsLoggerToServer(ThreadVars *tv, void *thread_data,
js = CreateJSONHeader(p, LOG_DIR_PACKET, "dns"); js = CreateJSONHeader(p, LOG_DIR_PACKET, "dns");
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
if (dnslog_ctx->include_metadata) {
JsonAddMetadata(p, f, js); JsonAddCommonOptions(&dnslog_ctx->cfg, p, f, js);
}
LogQuery(td, js, tx, tx_id, query); LogQuery(td, js, tx, tx_id, query);
@ -1078,9 +1076,7 @@ static int JsonDnsLoggerToClient(ThreadVars *tv, void *thread_data,
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
if (dnslog_ctx->cfg.include_metadata) { JsonAddCommonOptions(&dnslog_ctx->cfg, p, f, js);
JsonAddMetadata(p, f, js);
}
#if HAVE_RUST #if HAVE_RUST
if (td->dnslog_ctx->version == DNS_VERSION_2) { if (td->dnslog_ctx->version == DNS_VERSION_2) {

4
src/output-json-drop.c
Unescape Escape View File

@ -93,9 +93,7 @@ static int DropLogJSON (JsonDropLogThread *aft, const Packet *p)
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
if (drop_ctx->cfg.include_metadata) { JsonAddCommonOptions(&drop_ctx->cfg, p, p->flow, js);
JsonAddMetadata(p, p->flow, js);
}
json_t *djs = json_object(); json_t *djs = json_object();
if (unlikely(djs == NULL)) { if (unlikely(djs == NULL)) {

4
src/output-json-flow.c
Unescape Escape View File

@ -277,9 +277,7 @@ static void JsonFlowLogJSON(JsonFlowLogThread *aft, json_t *js, Flow *f)
json_object_set_new(js, "flow", hjs); json_object_set_new(js, "flow", hjs);
if (flow_ctx->cfg.include_metadata) { JsonAddCommonOptions(&flow_ctx->cfg, NULL, f, js);
JsonAddMetadata(NULL, f, js);
}
/* TCP */ /* TCP */
if (f->proto == IPPROTO_TCP) { if (f->proto == IPPROTO_TCP) {

4
src/output-json-http.c
Unescape Escape View File

@ -471,9 +471,7 @@ static int JsonHttpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
if (jhl->httplog_ctx->cfg.include_metadata) { JsonAddCommonOptions(&jhl->httplog_ctx->cfg, p, f, js);
JsonAddMetadata(p, f, js);
}
SCLogDebug("got a HTTP request and now logging !!"); SCLogDebug("got a HTTP request and now logging !!");

4
src/output-json-ikev2.c
Unescape Escape View File

@ -75,9 +75,7 @@ static int JsonIKEv2Logger(ThreadVars *tv, void *thread_data,
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
if (thread->ikev2log_ctx->cfg.include_metadata) { JsonAddCommonOptions(&thread->ikev2log_ctx->cfg, p, f, js);
JsonAddMetadata(p, f, js);
}
ikev2js = rs_ikev2_log_json_response(state, ikev2tx); ikev2js = rs_ikev2_log_json_response(state, ikev2tx);
if (unlikely(ikev2js == NULL)) { if (unlikely(ikev2js == NULL)) {

4
src/output-json-krb5.c
Unescape Escape View File

@ -75,9 +75,7 @@ static int JsonKRB5Logger(ThreadVars *tv, void *thread_data,
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
if (thread->krb5log_ctx->cfg.include_metadata) { JsonAddCommonOptions(&thread->krb5log_ctx->cfg, p, f, js);
JsonAddMetadata(p, f, js);
}
krb5js = rs_krb5_log_json_response(state, krb5tx); krb5js = rs_krb5_log_json_response(state, krb5tx);
if (unlikely(krb5js == NULL)) { if (unlikely(krb5js == NULL)) {

7
src/output-json-metadata.c
Unescape Escape View File

@ -71,6 +71,7 @@
typedef struct MetadataJsonOutputCtx_ { typedef struct MetadataJsonOutputCtx_ {
LogFileCtx* file_ctx; LogFileCtx* file_ctx;
OutputJsonCommonSettings cfg;
} MetadataJsonOutputCtx; } MetadataJsonOutputCtx;
typedef struct JsonMetadataLogThread_ { typedef struct JsonMetadataLogThread_ {
@ -86,7 +87,7 @@ static int MetadataJson(ThreadVars *tv, JsonMetadataLogThread *aft, const Packet
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
JsonAddMetadata(p, p->flow, js); JsonAddCommonOptions(&aft->json_output_ctx->cfg, p, p->flow, js);
OutputJSONBuffer(js, aft->file_ctx, &aft->json_buffer); OutputJSONBuffer(js, aft->file_ctx, &aft->json_buffer);
json_object_del(js, "metadata"); json_object_del(js, "metadata");
json_object_clear(js); json_object_clear(js);
@ -214,6 +215,7 @@ static OutputInitResult JsonMetadataLogInitCtx(ConfNode *conf)
memset(json_output_ctx, 0, sizeof(MetadataJsonOutputCtx)); memset(json_output_ctx, 0, sizeof(MetadataJsonOutputCtx));
json_output_ctx->file_ctx = logfile_ctx; json_output_ctx->file_ctx = logfile_ctx;
json_output_ctx->cfg.include_metadata = true;
output_ctx->data = json_output_ctx; output_ctx->data = json_output_ctx;
output_ctx->DeInit = JsonMetadataLogDeInitCtx; output_ctx->DeInit = JsonMetadataLogDeInitCtx;
@ -245,6 +247,9 @@ static OutputInitResult JsonMetadataLogInitCtxSub(ConfNode *conf, OutputCtx *par
memset(json_output_ctx, 0, sizeof(MetadataJsonOutputCtx)); memset(json_output_ctx, 0, sizeof(MetadataJsonOutputCtx));
json_output_ctx->file_ctx = ajt->file_ctx; json_output_ctx->file_ctx = ajt->file_ctx;
json_output_ctx->cfg = ajt->cfg;
/* override config setting as this logger is about metadata */
json_output_ctx->cfg.include_metadata = true;
output_ctx->data = json_output_ctx; output_ctx->data = json_output_ctx;
output_ctx->DeInit = JsonMetadataLogDeInitCtxSub; output_ctx->DeInit = JsonMetadataLogDeInitCtxSub;

8
src/output-json-netflow.c
Unescape Escape View File

@ -313,9 +313,7 @@ static int JsonNetFlowLogger(ThreadVars *tv, void *thread_data, Flow *f)
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
JsonNetFlowLogJSONToServer(jhl, js, f); JsonNetFlowLogJSONToServer(jhl, js, f);
if (netflow_ctx->cfg.include_metadata) { JsonAddCommonOptions(&netflow_ctx->cfg, NULL, f, js);
JsonAddMetadata(NULL, f, js);
}
OutputJSONBuffer(js, jhl->flowlog_ctx->file_ctx, &jhl->buffer); OutputJSONBuffer(js, jhl->flowlog_ctx->file_ctx, &jhl->buffer);
json_object_del(js, "netflow"); json_object_del(js, "netflow");
json_object_clear(js); json_object_clear(js);
@ -329,9 +327,7 @@ static int JsonNetFlowLogger(ThreadVars *tv, void *thread_data, Flow *f)
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
JsonNetFlowLogJSONToClient(jhl, js, f); JsonNetFlowLogJSONToClient(jhl, js, f);
if (netflow_ctx->cfg.include_metadata) { JsonAddCommonOptions(&netflow_ctx->cfg, NULL, f, js);
JsonAddMetadata(NULL, f, js);
}
OutputJSONBuffer(js, jhl->flowlog_ctx->file_ctx, &jhl->buffer); OutputJSONBuffer(js, jhl->flowlog_ctx->file_ctx, &jhl->buffer);
json_object_del(js, "netflow"); json_object_del(js, "netflow");
json_object_clear(js); json_object_clear(js);

4
src/output-json-nfs.c
Unescape Escape View File

@ -91,9 +91,7 @@ static int JsonNFSLogger(ThreadVars *tv, void *thread_data,
return TM_ECODE_FAILED; return TM_ECODE_FAILED;
} }
if (thread->ctx->cfg.include_metadata) { JsonAddCommonOptions(&thread->ctx->cfg, p, f, js);
JsonAddMetadata(p, f, js);
}
json_t *rpcjs = rs_rpc_log_json_response(tx); json_t *rpcjs = rs_rpc_log_json_response(tx);
if (unlikely(rpcjs == NULL)) { if (unlikely(rpcjs == NULL)) {

4
src/output-json-smtp.c
Unescape Escape View File

@ -95,9 +95,7 @@ static int JsonSmtpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
/* reset */ /* reset */
MemBufferReset(jhl->buffer); MemBufferReset(jhl->buffer);
if (jhl->emaillog_ctx->cfg.include_metadata) { JsonAddCommonOptions(&jhl->emaillog_ctx->cfg, p, f, js);
JsonAddMetadata(p, f, js);
}
json_t *sjs = JsonSmtpDataLogger(f, state, tx, tx_id); json_t *sjs = JsonSmtpDataLogger(f, state, tx, tx_id);
if (sjs) { if (sjs) {

4
src/output-json-ssh.c
Unescape Escape View File

@ -109,9 +109,7 @@ static int JsonSshLogger(ThreadVars *tv, void *thread_data, const Packet *p,
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return 0; return 0;
if (ssh_ctx->cfg.include_metadata) { JsonAddCommonOptions(&ssh_ctx->cfg, p, f, js);
JsonAddMetadata(p, f, js);
}
json_t *tjs = json_object(); json_t *tjs = json_object();
if (tjs == NULL) { if (tjs == NULL) {

4
src/output-json-tls.c
Unescape Escape View File

@ -382,9 +382,7 @@ static int JsonTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p,
return 0; return 0;
} }
if (tls_ctx->cfg.include_metadata) { JsonAddCommonOptions(&tls_ctx->cfg, p, f, js);
JsonAddMetadata(p, f, js);
}
json_t *tjs = json_object(); json_t *tjs = json_object();
if (tjs == NULL) { if (tjs == NULL) {

10
src/output-json.c
Unescape Escape View File

@ -364,7 +364,7 @@ static void JsonAddFlowVars(const Flow *f, json_t *js_root, json_t **js_traffic)
/** /**
* \brief Add top-level metadata to the eve json object. * \brief Add top-level metadata to the eve json object.
*/ */
void JsonAddMetadata(const Packet *p, const Flow *f, json_t *js) static void JsonAddMetadata(const Packet *p, const Flow *f, json_t *js)
{ {
if ((p && p->pktvar) || (f && f->flowvar)) { if ((p && p->pktvar) || (f && f->flowvar)) {
json_t *js_vars = json_object(); json_t *js_vars = json_object();
@ -385,6 +385,14 @@ void JsonAddMetadata(const Packet *p, const Flow *f, json_t *js)
} }
} }
void JsonAddCommonOptions(const OutputJsonCommonSettings *cfg,
const Packet *p, const Flow *f, json_t *js)
{
if (cfg->include_metadata) {
JsonAddMetadata(p, f, js);
}
}
/** \brief jsonify tcp flags field /** \brief jsonify tcp flags field
* Only add 'true' fields in an attempt to keep things reasonably compact. * Only add 'true' fields in an attempt to keep things reasonably compact.
*/ */

4
src/output-json.h
Unescape Escape View File

@ -50,7 +50,6 @@ typedef struct OutputJSONMemBufferWrapper_ {
int OutputJSONMemBufferCallback(const char *str, size_t size, void *data); int OutputJSONMemBufferCallback(const char *str, size_t size, void *data);
void JsonAddMetadata(const Packet *p, const Flow *f, json_t *js);
void CreateJSONFlowId(json_t *js, const Flow *f); void CreateJSONFlowId(json_t *js, const Flow *f);
void JsonTcpFlags(uint8_t flags, json_t *js); void JsonTcpFlags(uint8_t flags, json_t *js);
void JsonFiveTuple(const Packet *, enum OutputJsonLogDirection, json_t *); void JsonFiveTuple(const Packet *, enum OutputJsonLogDirection, json_t *);
@ -88,6 +87,9 @@ json_t *SCJsonBool(int val);
json_t *SCJsonString(const char *val); json_t *SCJsonString(const char *val);
void SCJsonDecref(json_t *js); void SCJsonDecref(json_t *js);
void JsonAddCommonOptions(const OutputJsonCommonSettings *cfg,
const Packet *p, const Flow *f, json_t *js);
#endif /* HAVE_LIBJANSSON */ #endif /* HAVE_LIBJANSSON */
#endif /* __OUTPUT_JSON_H__ */ #endif /* __OUTPUT_JSON_H__ */

Write Preview
Loading…
Cancel
Save