suricata

Commit Graph

Author	SHA1	Message	Date
Jeff Lucovsky	ff29345527	output: Remove unused output functions This commit removes registration, initialization, and de-initialization functions no longer needed	5 years ago
Jeff Lucovsky	15caf3eea5	log: Remove standalone output registration Remove standalone output logger registration since eve is multi-instance.	5 years ago
Jeff Lucovsky	abc8bd11b9	output/ssh: Use correct file context This commit corrects an issue with the SSH output module that resulted in a SEGV when SSH output is logged.	5 years ago
Jeff Lucovsky	30ae98f658	output/json: Multi-threaded EVE logging support This commit modifies the JSON loggers with changes necessary to support multi-threaded EVE output. Each "thread-init" function sets up the per-thread log file context for subsequent calls to the JSON output to buffer function.	5 years ago
Victor Julien	085eb9fc8e	eve/ssh: minor cleanup	5 years ago
Vadym Malakhatko	126597144c	eve: add Hassh fields to SSH JSON logger and add ssh log condition	5 years ago
Philippe Antoine	baf5f52f22	ssh/eve: convert to jsonbuilder	5 years ago
Jason Ish	99f460aa5a	eve/fivetuple: use intermediate address struct (jsonbuilder prep) Currently alert logging relies on the ability to change existing values in the json_t structure to overwrite addresses with xff data. This feature is also used for the "target" logging. As we can't do this with JsonBuilder, create a new struct to hold the 5 tuple, with the values swapped as needed, and overwritten with XFF data if needed. This struct will now be used to write out the 5 tuple, as well as cache the information for log fields to be written out later on in the log path.	5 years ago
Philippe Antoine	69b4fffdae	parse: move SSH parser from C to Rust	5 years ago
Victor Julien	edd2cd626f	jansson: remove HAVE_LIBJANSSON guards	6 years ago
Jeff Lucovsky	3d5eccf084	output/json: Refactor output buffer size macro	6 years ago
Victor Julien	e956b484c5	eve/json: handle common options in central function	7 years ago
Victor Julien	df1ec82b55	eve/json: move common settings into it's own struct	7 years ago
Maurizio Abba	bf4398b15d	output-json: ensure string is json-encodable Substitute json_string with SCJsonString custom function. SCJsonString will ensure string passed is json-encodable (utf-8). If it's not, the string will be converted in such a way that any non-printable character will be encoded in its hex form. The resulting json object will be returned. rust modification will encode any non-printable character during its conversion in to_cstring.	7 years ago
Victor Julien	710c7b821f	output/json: update callers to use explicit directions	7 years ago
Victor Julien	44c4008f77	output/json: clean up CreateJSONHeader calls	7 years ago
Jason Ish	32da579239	eve: ssh: respect global metadata config	8 years ago
Jason Ish	00e6cd4ced	output: introduce init return type The new OutputInitResult is a struct return type that allows logger init functions to return a NULL context without raising error. Instead of returning NULL to signal error, the "ok" field will be set to false. If ok, but the ctx is NULL, then silently move on to the next logger. Use case: multiple versions of a specific logger, and one implementation decides the configuration is not for that implemenation. It can return NULL, ok.	8 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	8 years ago
Victor Julien	c412352474	ssh: remove single logger limit	9 years ago
Victor Julien	3ee4989ba7	ssh: convert app-layer parser to be tx aware Like with SSL, there is only a single 'tx'.	9 years ago
Jason Ish	3fab684f97	logging: don't log that json is disabled in each logger A warning log is already emitted if eve-log is enabled in the configuration but json support is not built so the logger registration functions can be silent.	9 years ago
Jason Ish	00b6e628d1	logging: hook into flow worker thread	9 years ago
Jason Ish	1b4ba4496c	logging: rename registration functions to not have tmm As the logging modules are no longer threading modules, rename them so they don't look like they are being registered as threading modules. Also, move the registration to the output.c which will handle registration of the loggers.	9 years ago
Jason Ish	fa27a76462	logging: add profiling back for non-tmm loggers The loggers moved away from a TMM required a new profiling support.	9 years ago
Jason Ish	3fea12d7b3	logging: convert json ssh output to non-thread module	9 years ago
Jason Ish	ad15ac8297	logging: convert json alert output to non-thread module	9 years ago
Jason Ish	b1200dba54	logging: convert fast log to a non-thread module	9 years ago
maxtors	06d74b5775	Module specific error code for init ctx error.	9 years ago
maxtors	69863f7b1c	Corrected and unified debugmessages for init data errors in *ThreadInit.	9 years ago
Victor Julien	c446abeb47	jansson: include in suricata-common.h	10 years ago
Victor Julien	8bb1cf08ef	eve: fix mishandling of big messages When the string representation of a JSON message grew bigger than 64k, the JSON record would just be truncated. This lead to errors in the parser(s) of the JSON stream. This patch changes the buffer logic to grow the buffer on demand.	10 years ago
Jason Ish	b512580bbe	logging: integrate rotation into SCConfLogOpenGeneric. Addresses issue 1492, and will make it harder to omit rotation on new outputs.	10 years ago
Eric Leblond	39d667ff56	output-json: fix type of data parameter The cast of data to AlertJsonThread was not correct as the real type of the void pointer is a OutputJsonCtx. This was working by luck because they both have a file_ctx as first element.	10 years ago
Eric Leblond	c1970a3655	json-ssh: export logging function It will be use in alert logging to display SSH information.	10 years ago
Ken Steele	8f1d75039a	Enforce function coding standard Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	11 years ago
Victor Julien	90c4834709	ssh-json: add clean up functions Add clean up functions for the SSH json logger.	11 years ago
Tom DeCanio	4085f08602	json: somewhere along the way IP/port pairs had gotten swapped in http and ssh eve logs	11 years ago
Victor Julien	b877cf6158	ssh: add json logger Sub module of eve-log, but can also run separately as ssh-json-log. Only one at a time though.	12 years ago

39 Commits (c41e64d637fc0ce7a95e68c2de08f4d4ea24f49f)