mirror of https://github.com/OISF/suricata
eve/filetypes: remove from plugin context
Remove EVE filetypes from plugin context as they are not only used from plugins. Plugins allow user code to register filetypes, but we also have internal file types that use this api including the null output and syslog. Additionally library users can use this API to register filetypes, and they are not plugins. Ideally this code would go in "output-json.[ch]" as the "primary" eve API, however there are currently some include circular include issues there, so start new cleaned up EVE API in "output-eve.[ch]" which is "clean" with respect to includes, and as we cleanup existing EVE API for "public" use, it can be moved here. Ticket: #6838pull/10652/head
Jason Ish
1 year ago
committed by
Victor Julien
parent
3bf92bb14f
commit
ead09c2497
@ -0,0 +1,82 @@
|
||||
/* Copyright (C) 2024 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
#include "output-eve.h"
|
||||
#include "util-debug.h"
|
||||
|
||||
static TAILQ_HEAD(, SCEveFileType_) output_types = TAILQ_HEAD_INITIALIZER(output_types);
|
||||
|
||||
static bool IsBuiltinTypeName(const char *name)
|
||||
{
|
||||
const char *builtin[] = {
|
||||
"regular",
|
||||
"unix_dgram",
|
||||
"unix_stream",
|
||||
"redis",
|
||||
NULL,
|
||||
};
|
||||
for (int i = 0;; i++) {
|
||||
if (builtin[i] == NULL) {
|
||||
break;
|
||||
}
|
||||
if (strcmp(builtin[i], name) == 0) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
SCEveFileType *SCEveFindFileType(const char *name)
|
||||
{
|
||||
SCEveFileType *plugin = NULL;
|
||||
TAILQ_FOREACH (plugin, &output_types, entries) {
|
||||
if (strcmp(name, plugin->name) == 0) {
|
||||
return plugin;
|
||||
}
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Register an Eve file type.
|
||||
*
|
||||
* \retval true if registered successfully, false if the file type name
|
||||
* conflicts with a built-in or previously registered
|
||||
* file type.
|
||||
*/
|
||||
bool SCRegisterEveFileType(SCEveFileType *plugin)
|
||||
{
|
||||
/* First check that the name doesn't conflict with a built-in filetype. */
|
||||
if (IsBuiltinTypeName(plugin->name)) {
|
||||
SCLogError("Eve file type name conflicts with built-in type: %s", plugin->name);
|
||||
return false;
|
||||
}
|
||||
|
||||
/* Now check against previously registered file types. */
|
||||
SCEveFileType *existing = NULL;
|
||||
TAILQ_FOREACH (existing, &output_types, entries) {
|
||||
if (strcmp(existing->name, plugin->name) == 0) {
|
||||
SCLogError("Eve file type name conflicts with previously registered type: %s",
|
||||
plugin->name);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
SCLogDebug("Registering EVE file type plugin %s", plugin->name);
|
||||
TAILQ_INSERT_TAIL(&output_types, plugin, entries);
|
||||
return true;
|
||||
}
|
||||
@ -0,0 +1,63 @@
|
||||
/* Copyright (C) 2024 Open Information Security Foundation
|
||||
*
|
||||
* You can copy, redistribute or modify this Program under the terms of
|
||||
* the GNU General Public License version 2 as published by the Free
|
||||
* Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* version 2 along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
||||
* 02110-1301, USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* \file
|
||||
*
|
||||
* \brief EVE logging subsystem
|
||||
*
|
||||
* This file will attempt to the main module for EVE logging
|
||||
* sub-system. Currently most of the API resides in output-json.[ch],
|
||||
* but due to some circular dependencies between EVE, and LogFileCtx,
|
||||
* it made it hard to add EVE filetype modules there until some
|
||||
* include issues are figured out.
|
||||
*/
|
||||
|
||||
#ifndef SURICATA_OUTPUT_EVE_H
|
||||
#define SURICATA_OUTPUT_EVE_H
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "conf.h"
|
||||
|
||||
typedef uint32_t ThreadId;
|
||||
|
||||
/**
|
||||
* Structure used to define an Eve output file type plugin.
|
||||
*/
|
||||
typedef struct SCEveFileType_ {
|
||||
/* The name of the output, used to specify the output in the filetype section
|
||||
* of the eve-log configuration. */
|
||||
const char *name;
|
||||
/* Init Called on first access */
|
||||
int (*Init)(ConfNode *conf, bool threaded, void **init_data);
|
||||
/* Write - Called on each write to the object */
|
||||
int (*Write)(const char *buffer, int buffer_len, void *init_data, void *thread_data);
|
||||
/* Close - Called on final close */
|
||||
void (*Deinit)(void *init_data);
|
||||
/* ThreadInit - Called for each thread using file object; non-zero thread_ids correlate
|
||||
* to Suricata's worker threads; 0 correlates to the Suricata main thread */
|
||||
int (*ThreadInit)(void *init_data, ThreadId thread_id, void **thread_data);
|
||||
/* ThreadDeinit - Called for each thread using file object */
|
||||
int (*ThreadDeinit)(void *init_data, void *thread_data);
|
||||
TAILQ_ENTRY(SCEveFileType_) entries;
|
||||
} SCEveFileType;
|
||||
|
||||
bool SCRegisterEveFileType(SCEveFileType *);
|
||||
|
||||
SCEveFileType *SCEveFindFileType(const char *name);
|
||||
|
||||
#endif
|
||||
Loading…
Reference in New Issue