aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

eve/alert: clean up state logging

Browse Source
pull/15846/head
Victor Julien 2 weeks ago
parent 110e74642e
commit f02a427059
1 changed files with 54 additions and 73 deletions
Show Stats Download Patch File Download Diff File

77
src/output-json-alert.c
Unescape Escape View File

@ -324,40 +324,48 @@ static void AlertAddPayload(AlertJsonOutputCtx *json_output_ctx, SCJsonBuilder *
}
}
static void AlertAddAppLayer(const Packet *p, SCJsonBuilder *jb, const uint64_t tx_id,
const uint8_t sub_state, const uint16_t option_flags)
static void AlertAddAppLayerStates(const Packet *p, const AppProto alproto, const uint8_t sub_state,
void *tx, SCJsonBuilder *jb)
{
const AppProto proto = SCFlowGetAppProtocol(p->flow);
EveJsonSimpleAppLayerLogger *al = SCEveJsonSimpleGetLogger(proto);
SCJsonBuilderMark mark = { 0, 0, 0 };
if (al && al->LogTx) {
void *state = FlowGetAppState(p->flow);
if (state) {
void *tx = AppLayerParserGetTx(p->flow->proto, proto, state, tx_id);
if (tx) {
const int ts =
AppLayerParserGetStateProgress(p->flow->proto, proto, tx, STREAM_TOSERVER);
const int tc =
AppLayerParserGetStateProgress(p->flow->proto, proto, tx, STREAM_TOCLIENT);
const int ts = AppLayerParserGetStateProgress(p->flow->proto, alproto, tx, STREAM_TOSERVER);
const int tc = AppLayerParserGetStateProgress(p->flow->proto, alproto, tx, STREAM_TOCLIENT);
SCJbSetString(jb, "ts_progress",
AppLayerParserGetStateNameById(p->flow->proto, proto, ts, STREAM_TOSERVER));
AppLayerParserGetStateNameById(p->flow->proto, alproto, ts, STREAM_TOSERVER));
SCJbSetString(jb, "tc_progress",
AppLayerParserGetStateNameById(p->flow->proto, proto, tc, STREAM_TOCLIENT));
AppLayerParserGetStateNameById(p->flow->proto, alproto, tc, STREAM_TOCLIENT));
if (sub_state) {
const char *sname = AppLayerParserGetSubStateName(proto, sub_state);
const char *sname = AppLayerParserGetSubStateName(alproto, sub_state);
if (sname != NULL) {
SCJbSetString(jb, "sub_state", sname);
}
}
}
static void AlertAddAppLayer(const Packet *p, SCJsonBuilder *jb, const uint64_t tx_id,
const uint8_t sub_state, const uint16_t option_flags)
{
const AppProto proto = SCFlowGetAppProtocol(p->flow);
EveJsonSimpleAppLayerLogger *al = SCEveJsonSimpleGetLogger(proto);
void *state = FlowGetAppState(p->flow);
void *tx = NULL;
if (state) {
tx = AppLayerParserGetTx(p->flow->proto, proto, state, tx_id);
}
if (tx == NULL)
return;
AlertAddAppLayerStates(p, proto, sub_state, tx, jb);
SCJsonBuilderMark mark = { 0, 0, 0 };
if (al && al->LogTx) {
SCJbGetMark(jb, &mark);
switch (proto) {
// first check some protocols need special options for alerts logging
case ALPROTO_WEBSOCKET:
if (option_flags &
(LOG_JSON_WEBSOCKET_PAYLOAD | LOG_JSON_WEBSOCKET_PAYLOAD_BASE64)) {
bool pp = (option_flags & LOG_JSON_WEBSOCKET_PAYLOAD) != 0;
bool pb64 = (option_flags & LOG_JSON_WEBSOCKET_PAYLOAD_BASE64) != 0;
const bool pp = (option_flags & LOG_JSON_WEBSOCKET_PAYLOAD) != 0;
const bool pb64 = (option_flags & LOG_JSON_WEBSOCKET_PAYLOAD_BASE64) != 0;
if (!SCWebSocketLogDetails(tx, jb, pp, pb64)) {
SCJbRestoreMark(jb, &mark);
}
@ -368,30 +376,9 @@ static void AlertAddAppLayer(const Packet *p, SCJsonBuilder *jb, const uint64_t
if (!al->LogTx(tx, jb)) {
SCJbRestoreMark(jb, &mark);
}
}
}
return;
}
void *state = FlowGetAppState(p->flow);
if (state) {
void *tx = AppLayerParserGetTx(p->flow->proto, proto, state, tx_id);
if (tx) {
const int ts =
AppLayerParserGetStateProgress(p->flow->proto, proto, tx, STREAM_TOSERVER);
const int tc =
AppLayerParserGetStateProgress(p->flow->proto, proto, tx, STREAM_TOCLIENT);
SCJbSetString(jb, "ts_progress",
AppLayerParserGetStateNameById(p->flow->proto, proto, ts, STREAM_TOSERVER));
SCJbSetString(jb, "tc_progress",
AppLayerParserGetStateNameById(p->flow->proto, proto, tc, STREAM_TOCLIENT));
if (sub_state) {
const char *sname = AppLayerParserGetSubStateName(proto, sub_state);
if (sname != NULL) {
SCJbSetString(jb, "sub_state", sname);
}
}
}
}
switch (proto) {
case ALPROTO_HTTP1:
// TODO: Could result in an empty http object being logged.
@ -455,10 +442,7 @@ static void AlertAddAppLayer(const Packet *p, SCJsonBuilder *jb, const uint64_t
SCJbRestoreMark(jb, &mark);
}
break;
case ALPROTO_DCERPC: {
if (state) {
void *tx = AppLayerParserGetTx(p->flow->proto, proto, state, tx_id);
if (tx) {
case ALPROTO_DCERPC:
SCJbGetMark(jb, &mark);
SCJbOpenObject(jb, "dcerpc");
if (p->proto == IPPROTO_TCP) {
@ -471,10 +455,7 @@ static void AlertAddAppLayer(const Packet *p, SCJsonBuilder *jb, const uint64_t
}
}
SCJbClose(jb);
}
}
break;
}
default:
break;
}

Write Preview
Loading…
Cancel
Save