|
|
|
@ -561,90 +561,6 @@ bool EveHttpAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void OutputHttpLogDeinit(OutputCtx *output_ctx)
|
|
|
|
|
{
|
|
|
|
|
LogHttpFileCtx *http_ctx = output_ctx->data;
|
|
|
|
|
LogFileCtx *logfile_ctx = http_ctx->file_ctx;
|
|
|
|
|
LogFileFreeCtx(logfile_ctx);
|
|
|
|
|
if (http_ctx->xff_cfg) {
|
|
|
|
|
SCFree(http_ctx->xff_cfg);
|
|
|
|
|
}
|
|
|
|
|
SCFree(http_ctx);
|
|
|
|
|
SCFree(output_ctx);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#define DEFAULT_LOG_FILENAME "http.json"
|
|
|
|
|
static OutputInitResult OutputHttpLogInit(ConfNode *conf)
|
|
|
|
|
{
|
|
|
|
|
OutputInitResult result = { NULL, false };
|
|
|
|
|
LogFileCtx *file_ctx = LogFileNewCtx();
|
|
|
|
|
if(file_ctx == NULL) {
|
|
|
|
|
SCLogError(SC_ERR_HTTP_LOG_GENERIC, "couldn't create new file_ctx");
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) {
|
|
|
|
|
LogFileFreeCtx(file_ctx);
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
LogHttpFileCtx *http_ctx = SCMalloc(sizeof(LogHttpFileCtx));
|
|
|
|
|
if (unlikely(http_ctx == NULL)) {
|
|
|
|
|
LogFileFreeCtx(file_ctx);
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
|
|
|
|
|
if (unlikely(output_ctx == NULL)) {
|
|
|
|
|
LogFileFreeCtx(file_ctx);
|
|
|
|
|
SCFree(http_ctx);
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
http_ctx->file_ctx = file_ctx;
|
|
|
|
|
http_ctx->flags = LOG_HTTP_DEFAULT;
|
|
|
|
|
|
|
|
|
|
if (conf) {
|
|
|
|
|
const char *extended = ConfNodeLookupChildValue(conf, "extended");
|
|
|
|
|
|
|
|
|
|
if (extended != NULL) {
|
|
|
|
|
if (ConfValIsTrue(extended)) {
|
|
|
|
|
http_ctx->flags = LOG_HTTP_EXTENDED;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
const char *all_headers = ConfNodeLookupChildValue(
|
|
|
|
|
conf, "dump-all-headers");
|
|
|
|
|
if (all_headers != NULL) {
|
|
|
|
|
if (strcmp(all_headers, "both") == 0) {
|
|
|
|
|
http_ctx->flags |= LOG_HTTP_REQ_HEADERS;
|
|
|
|
|
http_ctx->flags |= LOG_HTTP_RES_HEADERS;
|
|
|
|
|
} else if (strcmp(all_headers, "request") == 0) {
|
|
|
|
|
http_ctx->flags |= LOG_HTTP_REQ_HEADERS;
|
|
|
|
|
} else if (strcmp(all_headers, "response") == 0) {
|
|
|
|
|
http_ctx->flags |= LOG_HTTP_RES_HEADERS;
|
|
|
|
|
} else if (strcmp(all_headers, "none") != 0) {
|
|
|
|
|
SCLogWarning(SC_WARN_ANOMALY_CONFIG,
|
|
|
|
|
"unhandled value for dump-all-headers configuration : %s",
|
|
|
|
|
all_headers);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
http_ctx->xff_cfg = SCCalloc(1, sizeof(HttpXFFCfg));
|
|
|
|
|
if (http_ctx->xff_cfg != NULL) {
|
|
|
|
|
HttpXFFGetCfg(conf, http_ctx->xff_cfg);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
output_ctx->data = http_ctx;
|
|
|
|
|
output_ctx->DeInit = OutputHttpLogDeinit;
|
|
|
|
|
|
|
|
|
|
/* enable the logger for the app layer */
|
|
|
|
|
AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_HTTP);
|
|
|
|
|
|
|
|
|
|
result.ctx = output_ctx;
|
|
|
|
|
result.ok = true;
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void OutputHttpLogDeinitSub(OutputCtx *output_ctx)
|
|
|
|
|
{
|
|
|
|
|
LogHttpFileCtx *http_ctx = output_ctx->data;
|
|
|
|
|