suricata
log-httplog.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Ignacio Sanchez <sanchezmartin.ji@gmail.com>
23  *
24  * Implements http logging portion of the engine.
25  */
26 
27 #include "suricata-common.h"
28 #include "detect.h"
29 #include "pkt-var.h"
30 #include "conf.h"
31 
32 #include "threads.h"
33 #include "threadvars.h"
34 #include "tm-threads.h"
35 
36 #include "util-print.h"
37 #include "util-unittest.h"
38 
39 #include "util-debug.h"
40 
41 #include "output.h"
42 #include "log-httplog.h"
43 #include "app-layer-htp.h"
44 #include "app-layer.h"
45 #include "app-layer-parser.h"
46 #include "util-privs.h"
47 #include "util-buffer.h"
48 
49 #include "util-logopenfile.h"
50 #include "util-time.h"
51 #include "log-cf-common.h"
52 
53 #define DEFAULT_LOG_FILENAME "http.log"
54 
55 #define MODULE_NAME "LogHttpLog"
56 
57 #define OUTPUT_BUFFER_SIZE 65535
58 
59 TmEcode LogHttpLogThreadInit(ThreadVars *, const void *, void **);
61 static void LogHttpLogDeInitCtx(OutputCtx *);
62 
63 int LogHttpLogger(ThreadVars *tv, void *thread_data, const Packet *, Flow *f, void *state, void *tx, uint64_t tx_id);
64 
65 void LogHttpLogRegister (void)
66 {
69 }
70 
71 #define LOG_HTTP_CF_REQUEST_HOST 'h'
72 #define LOG_HTTP_CF_REQUEST_PROTOCOL 'H'
73 #define LOG_HTTP_CF_REQUEST_METHOD 'm'
74 #define LOG_HTTP_CF_REQUEST_URI 'u'
75 #define LOG_HTTP_CF_REQUEST_TIME 't'
76 #define LOG_HTTP_CF_REQUEST_HEADER 'i'
77 #define LOG_HTTP_CF_REQUEST_COOKIE 'C'
78 #define LOG_HTTP_CF_REQUEST_LEN 'b'
79 #define LOG_HTTP_CF_RESPONSE_STATUS 's'
80 #define LOG_HTTP_CF_RESPONSE_HEADER 'o'
81 #define LOG_HTTP_CF_RESPONSE_LEN 'B'
82 
83 
84 typedef struct LogHttpFileCtx_ {
86  uint32_t flags; /** Store mode */
89 
90 #define LOG_HTTP_DEFAULT 0
91 #define LOG_HTTP_EXTENDED 1
92 #define LOG_HTTP_CUSTOM 2
93 
94 typedef struct LogHttpLogThread_ {
96  /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
97  uint32_t uri_cnt;
98 
101 
102 /* Retrieves the selected cookie value */
103 static uint32_t GetCookieValue(uint8_t *rawcookies, uint32_t rawcookies_len, char *cookiename,
104  uint8_t **cookievalue)
105 {
106  uint8_t *p = rawcookies;
107  uint8_t *cn = p; /* ptr to cookie name start */
108  uint8_t *cv = NULL; /* ptr to cookie value start */
109  while (p < rawcookies + rawcookies_len) {
110  if (cv == NULL && *p == '=') {
111  cv = p + 1;
112  } else if (cv != NULL && (*p == ';' || p == rawcookies + rawcookies_len - 1) ) {
113  /* Found end of cookie */
114  p++;
115  if (strlen(cookiename) == (unsigned int) (cv-cn-1) &&
116  strncmp(cookiename, (char *) cn, cv-cn-1) == 0) {
117  *cookievalue = cv;
118  return (uint32_t) (p-cv);
119  }
120  cv = NULL;
121  cn = p + 1;
122  }
123  p++;
124  }
125  return 0;
126 }
127 
128 /* Custom format logging */
129 static void LogHttpLogCustom(LogHttpLogThread *aft, htp_tx_t *tx, const SCTime_t ts, char *srcip,
130  Port sp, char *dstip, Port dp)
131 {
132  LogHttpFileCtx *httplog_ctx = aft->httplog_ctx;
133  uint32_t i;
134  uint32_t datalen;
135  char buf[128];
136 
137  uint8_t *cvalue = NULL;
138  uint32_t cvalue_len = 0;
139 
140  htp_header_t *h_request_hdr;
141  htp_header_t *h_response_hdr;
142 
143  for (i = 0; i < httplog_ctx->cf->cf_n; i++) {
144  h_request_hdr = NULL;
145  h_response_hdr = NULL;
146 
147  LogCustomFormatNode * node = httplog_ctx->cf->cf_nodes[i];
148  if (! node) /* Should never happen */
149  continue;
150 
151  switch (node->type){
152  case LOG_CF_LITERAL:
153  /* LITERAL */
154  MemBufferWriteString(aft->buffer, "%s", node->data);
155  break;
156  case LOG_CF_TIMESTAMP:
157  /* TIMESTAMP */
159  break;
160  case LOG_CF_TIMESTAMP_U:
161  /* TIMESTAMP USECONDS */
162  snprintf(buf, sizeof(buf), "%06u", (unsigned int)SCTIME_USECS(ts));
163  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
164  (uint8_t *)buf, MIN(strlen(buf), 6));
165  break;
166  case LOG_CF_CLIENT_IP:
167  /* CLIENT IP ADDRESS */
168  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
169  aft->buffer->size, (uint8_t *)srcip,strlen(srcip));
170  break;
171  case LOG_CF_SERVER_IP:
172  /* SERVER IP ADDRESS */
173  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
174  aft->buffer->size, (uint8_t *)dstip,strlen(dstip));
175  break;
176  case LOG_CF_CLIENT_PORT:
177  /* CLIENT PORT */
178  MemBufferWriteString(aft->buffer, "%" PRIu16 "", sp);
179  break;
180  case LOG_CF_SERVER_PORT:
181  /* SERVER PORT */
182  MemBufferWriteString(aft->buffer, "%" PRIu16 "", dp);
183  break;
185  /* METHOD */
186  if (tx->request_method != NULL) {
187  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
188  aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_method),
189  bstr_len(tx->request_method));
190  } else {
192  }
193  break;
195  /* URI */
196  if (tx->request_uri != NULL) {
197  datalen = node->maxlen;
198  if (datalen == 0 || datalen > bstr_len(tx->request_uri)) {
199  datalen = bstr_len(tx->request_uri);
200  }
201  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
202  aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_uri),
203  datalen);
204  } else {
206  }
207  break;
209  /* HOSTNAME */
210  if (tx->request_hostname != NULL)
211  {
212  datalen = node->maxlen;
213  if (datalen == 0 || datalen > bstr_len(tx->request_hostname)) {
214  datalen = bstr_len(tx->request_hostname);
215  }
216  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
217  aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_hostname),
218  datalen);
219  } else {
221  }
222  break;
224  /* PROTOCOL */
225  if (tx->request_protocol != NULL) {
226  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
227  aft->buffer->size, (uint8_t *)bstr_ptr(tx->request_protocol),
228  bstr_len(tx->request_protocol));
229  } else {
231  }
232  break;
234  /* REQUEST HEADER */
235  if (tx->request_headers != NULL) {
236  h_request_hdr = htp_table_get_c(tx->request_headers, node->data);
237  }
238  if (h_request_hdr != NULL) {
239  datalen = node->maxlen;
240  if (datalen == 0 || datalen > bstr_len(h_request_hdr->value)) {
241  datalen = bstr_len(h_request_hdr->value);
242  }
243  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
244  aft->buffer->size, (uint8_t *)bstr_ptr(h_request_hdr->value),
245  datalen);
246  } else {
248  }
249  break;
251  /* REQUEST COOKIE */
252  if (tx->request_headers != NULL) {
253  h_request_hdr = htp_table_get_c(tx->request_headers, "Cookie");
254  if (h_request_hdr != NULL) {
255  cvalue_len = GetCookieValue((uint8_t *) bstr_ptr(h_request_hdr->value),
256  bstr_len(h_request_hdr->value), (char *) node->data,
257  &cvalue);
258  }
259  }
260  if (cvalue_len > 0 && cvalue != NULL) {
261  datalen = node->maxlen;
262  if (datalen == 0 || datalen > cvalue_len) {
263  datalen = cvalue_len;
264  }
265  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
266  aft->buffer->size, cvalue, datalen);
267  } else {
269  }
270  break;
272  /* REQUEST LEN */
273  MemBufferWriteString(aft->buffer, "%"PRIuMAX"", (uintmax_t)tx->request_message_len);
274  break;
276  /* RESPONSE STATUS */
277  if (tx->response_status != NULL) {
278  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
279  aft->buffer->size, (uint8_t *)bstr_ptr(tx->response_status),
280  bstr_len(tx->response_status));
281  } else {
283  }
284  break;
286  /* RESPONSE HEADER */
287  if (tx->response_headers != NULL) {
288  h_response_hdr = htp_table_get_c(tx->response_headers,
289  node->data);
290  }
291  if (h_response_hdr != NULL) {
292  datalen = node->maxlen;
293  if (datalen == 0 || datalen > bstr_len(h_response_hdr->value)) {
294  datalen = bstr_len(h_response_hdr->value);
295  }
296  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset,
297  aft->buffer->size, (uint8_t *)bstr_ptr(h_response_hdr->value),
298  datalen);
299  } else {
301  }
302  break;
304  /* RESPONSE LEN */
305  MemBufferWriteString(aft->buffer, "%"PRIuMAX"", (uintmax_t)tx->response_message_len);
306  break;
307  default:
308  /* NO MATCH */
310  SCLogDebug("No matching parameter %%%c for custom http log.", node->type);
311  break;
312  }
313  }
314  MemBufferWriteString(aft->buffer, "\n");
315 }
316 
317 static void LogHttpLogExtended(LogHttpLogThread *aft, htp_tx_t *tx)
318 {
320 
321  /* referer */
322  htp_header_t *h_referer = NULL;
323  if (tx->request_headers != NULL) {
324  h_referer = htp_table_get_c(tx->request_headers, "referer");
325  }
326  if (h_referer != NULL) {
327  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
328  (uint8_t *)bstr_ptr(h_referer->value),
329  bstr_len(h_referer->value));
330  } else {
331  MemBufferWriteString(aft->buffer, "<no referer>");
332  }
333 
335 
336  /* method */
337  if (tx->request_method != NULL) {
338  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
339  (uint8_t *)bstr_ptr(tx->request_method),
340  bstr_len(tx->request_method));
341  }
343 
344  /* protocol */
345  if (tx->request_protocol != NULL) {
346  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
347  (uint8_t *)bstr_ptr(tx->request_protocol),
348  bstr_len(tx->request_protocol));
349  } else {
350  MemBufferWriteString(aft->buffer, "<no protocol>");
351  }
353 
354  /* response status */
355  if (tx->response_status != NULL) {
356  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
357  (uint8_t *)bstr_ptr(tx->response_status),
358  bstr_len(tx->response_status));
359  /* Redirect? */
360  if ((tx->response_status_number > 300) && ((tx->response_status_number) < 303)) {
361  htp_header_t *h_location = htp_table_get_c(tx->response_headers, "location");
362  if (h_location != NULL) {
363  MemBufferWriteString(aft->buffer, " => ");
364 
365  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
366  (uint8_t *)bstr_ptr(h_location->value),
367  bstr_len(h_location->value));
368  }
369  }
370  } else {
371  MemBufferWriteString(aft->buffer, "<no status>");
372  }
373 
374  /* length */
376  MemBufferWriteString(aft->buffer, "%"PRIuMAX" bytes", (uintmax_t)tx->response_message_len);
377 }
378 
379 static TmEcode LogHttpLogIPWrapper(ThreadVars *tv, void *data, const Packet *p, Flow *f, HtpState *htp_state, htp_tx_t *tx, uint64_t tx_id, int ipproto)
380 {
381  SCEnter();
382 
383  LogHttpLogThread *aft = (LogHttpLogThread *)data;
384  LogHttpFileCtx *hlog = aft->httplog_ctx;
385  char timebuf[64];
386 
387  /* check if we have HTTP state or not */
388  CreateTimeString(p->ts, timebuf, sizeof(timebuf));
389 
390  char srcip[46], dstip[46];
391  Port sp, dp;
392  if ((PKT_IS_TOSERVER(p))) {
393  switch (ipproto) {
394  case AF_INET:
395  PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
396  PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
397  break;
398  case AF_INET6:
399  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
400  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
401  break;
402  default:
403  goto end;
404  }
405  sp = p->sp;
406  dp = p->dp;
407  } else {
408  switch (ipproto) {
409  case AF_INET:
410  PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), srcip, sizeof(srcip));
411  PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), dstip, sizeof(dstip));
412  break;
413  case AF_INET6:
414  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), srcip, sizeof(srcip));
415  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), dstip, sizeof(dstip));
416  break;
417  default:
418  goto end;
419  }
420  sp = p->dp;
421  dp = p->sp;
422  }
423 
424  SCLogDebug("got a HTTP request and now logging !!");
425 
426  /* reset */
427  MemBufferReset(aft->buffer);
428 
429  if (hlog->flags & LOG_HTTP_CUSTOM) {
430  LogHttpLogCustom(aft, tx, p->ts, srcip, sp, dstip, dp);
431  } else {
432  /* time */
433  MemBufferWriteString(aft->buffer, "%s ", timebuf);
434 
435  /* hostname */
436  if (tx->request_hostname != NULL) {
437  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
438  (uint8_t *)bstr_ptr(tx->request_hostname),
439  bstr_len(tx->request_hostname));
440  } else {
441  MemBufferWriteString(aft->buffer, "<hostname unknown>");
442  }
444 
445  /* uri */
446  if (tx->request_uri != NULL) {
447  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
448  (uint8_t *)bstr_ptr(tx->request_uri),
449  bstr_len(tx->request_uri));
450  }
452 
453  /* user agent */
454  htp_header_t *h_user_agent = NULL;
455  if (tx->request_headers != NULL) {
456  h_user_agent = htp_table_get_c(tx->request_headers, "user-agent");
457  }
458  if (h_user_agent != NULL) {
459  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
460  (uint8_t *)bstr_ptr(h_user_agent->value),
461  bstr_len(h_user_agent->value));
462  } else {
463  MemBufferWriteString(aft->buffer, "<useragent unknown>");
464  }
465  if (hlog->flags & LOG_HTTP_EXTENDED) {
466  LogHttpLogExtended(aft, tx);
467  }
468 
469  /* ip/tcp header info */
472  "%s:%" PRIu16 " -> %s:%" PRIu16 "\n",
473  srcip, sp, dstip, dp);
474  }
475 
476  aft->uri_cnt ++;
477 
478  hlog->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),
479  MEMBUFFER_OFFSET(aft->buffer), hlog->file_ctx);
480 
481 end:
482  SCReturnInt(0);
483 
484 }
485 
486 int LogHttpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
487 {
488  SCEnter();
489 
490  if (!(PKT_IS_TCP(p))) {
492  }
493 
494  int r = 0;
495  if (PKT_IS_IPV4(p)) {
496  r = LogHttpLogIPWrapper(tv, thread_data, p, f, (HtpState *)state, (htp_tx_t *)tx, tx_id, AF_INET);
497  } else if (PKT_IS_IPV6(p)) {
498  r = LogHttpLogIPWrapper(tv, thread_data, p, f, (HtpState *)state, (htp_tx_t *)tx, tx_id, AF_INET6);
499  }
500 
501  SCReturnInt(r);
502 }
503 
504 TmEcode LogHttpLogThreadInit(ThreadVars *t, const void *initdata, void **data)
505 {
507  if (unlikely(aft == NULL))
508  return TM_ECODE_FAILED;
509  memset(aft, 0, sizeof(LogHttpLogThread));
510 
511  if(initdata == NULL)
512  {
513  SCLogDebug("Error getting context for LogHTTPLog. \"initdata\" argument NULL");
514  SCFree(aft);
515  return TM_ECODE_FAILED;
516  }
517 
519  if (aft->buffer == NULL) {
520  SCFree(aft);
521  return TM_ECODE_FAILED;
522  }
523 
524  /* Use the Ouptut Context (file pointer and mutex) */
525  aft->httplog_ctx= ((OutputCtx *)initdata)->data;
526 
527  *data = (void *)aft;
528  return TM_ECODE_OK;
529 }
530 
532 {
533  LogHttpLogThread *aft = (LogHttpLogThread *)data;
534  if (aft == NULL) {
535  return TM_ECODE_OK;
536  }
537 
538  MemBufferFree(aft->buffer);
539  /* clear memory */
540  memset(aft, 0, sizeof(LogHttpLogThread));
541 
542  SCFree(aft);
543  return TM_ECODE_OK;
544 }
545 
546 /** \brief Create a new http log LogFileCtx.
547  * \param conf Pointer to ConfNode containing this loggers configuration.
548  * \return NULL if failure, LogFileCtx* to the file_ctx if succesful
549  * */
551 {
552  OutputInitResult result = { NULL, false };
553  LogFileCtx* file_ctx = LogFileNewCtx();
554  if(file_ctx == NULL) {
555  SCLogError("couldn't create new file_ctx");
556  return result;
557  }
558 
559  if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) {
560  LogFileFreeCtx(file_ctx);
561  return result;
562  }
563 
564  LogHttpFileCtx *httplog_ctx = SCMalloc(sizeof(LogHttpFileCtx));
565  if (unlikely(httplog_ctx == NULL)) {
566  LogFileFreeCtx(file_ctx);
567  return result;
568  }
569  memset(httplog_ctx, 0x00, sizeof(LogHttpFileCtx));
570 
571  httplog_ctx->file_ctx = file_ctx;
572 
573  const char *extended = ConfNodeLookupChildValue(conf, "extended");
574  const char *custom = ConfNodeLookupChildValue(conf, "custom");
575  const char *customformat = ConfNodeLookupChildValue(conf, "customformat");
576 
577  /* If custom logging format is selected, lets parse it */
578  if (custom != NULL && customformat != NULL && ConfValIsTrue(custom)) {
579 
580  httplog_ctx->cf = LogCustomFormatAlloc();
581  if (!httplog_ctx->cf) {
582  goto errorfree;
583  }
584 
585  httplog_ctx->flags |= LOG_HTTP_CUSTOM;
586 
587  /* Parsing */
588  if ( ! LogCustomFormatParse(httplog_ctx->cf, customformat)) {
589  goto parsererror;
590  }
591  } else {
592  if (extended == NULL) {
593  httplog_ctx->flags |= LOG_HTTP_DEFAULT;
594  } else {
595  if (ConfValIsTrue(extended)) {
596  httplog_ctx->flags |= LOG_HTTP_EXTENDED;
597  }
598  }
599  }
600 
601  OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
602  if (unlikely(output_ctx == NULL)) {
603  goto parsererror;
604  }
605 
606  output_ctx->data = httplog_ctx;
607  output_ctx->DeInit = LogHttpLogDeInitCtx;
608 
609  SCLogDebug("HTTP log output initialized");
610 
611  /* enable the logger for the app layer */
613 
614  result.ctx = output_ctx;
615  result.ok = true;
616  return result;
617 
618 parsererror:
619  SCLogError("Syntax error in custom http log format string.");
620 errorfree:
621  LogCustomFormatFree(httplog_ctx->cf);
622  LogFileFreeCtx(file_ctx);
623  SCFree(httplog_ctx);
624  return result;
625 
626 }
627 
628 static void LogHttpLogDeInitCtx(OutputCtx *output_ctx)
629 {
630  LogHttpFileCtx *httplog_ctx = (LogHttpFileCtx *)output_ctx->data;
631  LogCustomFormatFree(httplog_ctx->cf);
632  LogFileFreeCtx(httplog_ctx->file_ctx);
633  SCFree(httplog_ctx);
634  SCFree(output_ctx);
635 }
LogHttpLogThread
struct LogHttpLogThread_ LogHttpLogThread
LogCustomFormatFree
void LogCustomFormatFree(LogCustomFormat *cf)
Frees memory held by a custom format.
Definition: log-cf-common.c:80
tm-threads.h
LOG_HTTP_CF_RESPONSE_STATUS
#define LOG_HTTP_CF_RESPONSE_STATUS
Definition: log-httplog.c:79
ts
uint64_t ts
Definition: source-erf-file.c:55
LOG_HTTP_CF_RESPONSE_HEADER
#define LOG_HTTP_CF_RESPONSE_HEADER
Definition: log-httplog.c:80
PKT_IS_IPV6
#define PKT_IS_IPV6(p)
Definition: decode.h:246
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
OUTPUT_BUFFER_SIZE
#define OUTPUT_BUFFER_SIZE
Definition: log-httplog.c:57
LOG_CF_WRITE_STAR_SEPATATOR
#define LOG_CF_WRITE_STAR_SEPATATOR(buffer)
Definition: log-cf-common.h:53
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:672
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
LOG_HTTP_EXTENDED
#define LOG_HTTP_EXTENDED
Definition: log-httplog.c:91
threads.h
Flow_
Flow data structure.
Definition: flow.h:357
LogFileCtx_
Definition: util-logopenfile.h:73
LOG_CF_LITERAL
#define LOG_CF_LITERAL
Definition: log-cf-common.h:40
LogHttpLogInitCtx
OutputInitResult LogHttpLogInitCtx(ConfNode *conf)
Create a new http log LogFileCtx.
Definition: log-httplog.c:550
LogHttpLogThread_::uri_cnt
uint32_t uri_cnt
Definition: log-httplog.c:97
OutputRegisterTxModule
void OutputRegisterTxModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a tx output module.
Definition: output.c:399
MIN
#define MIN(x, y)
Definition: suricata-common.h:380
util-privs.h
LogFileCtx_::Write
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:89
LOG_HTTP_CF_REQUEST_URI
#define LOG_HTTP_CF_REQUEST_URI
Definition: log-httplog.c:74
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
LogCustomFormatWriteTimestamp
void LogCustomFormatWriteTimestamp(MemBuffer *buffer, const char *fmt, const SCTime_t ts)
Writes a timestamp with given format into a MemBuffer.
Definition: log-cf-common.c:211
LOG_CF_CLIENT_PORT
#define LOG_CF_CLIENT_PORT
Definition: log-cf-common.h:45
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:214
util-unittest.h
MemBuffer_::offset
uint32_t offset
Definition: util-buffer.h:30
LOG_HTTP_CF_REQUEST_LEN
#define LOG_HTTP_CF_REQUEST_LEN
Definition: log-httplog.c:78
HtpState_
Definition: app-layer-htp.h:244
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:531
OutputCtx_::data
void * data
Definition: tm-modules.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
OutputCtx_
Definition: tm-modules.h:78
SCConfLogOpenGeneric
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
Definition: util-logopenfile.c:465
LogCustomFormat_::cf_n
uint32_t cf_n
Definition: log-cf-common.h:74
LogCustomFormatNode_
Definition: log-cf-common.h:66
LOGGER_HTTP
@ LOGGER_HTTP
Definition: suricata-common.h:453
PKT_IS_TCP
#define PKT_IS_TCP(p)
Definition: decode.h:247
LogHttpLogRegister
void LogHttpLogRegister(void)
Definition: log-httplog.c:65
LogCustomFormatNode_::type
uint32_t type
Definition: log-cf-common.h:67
app-layer-htp.h
util-debug.h
GET_IPV4_DST_ADDR_PTR
#define GET_IPV4_DST_ADDR_PTR(p)
Definition: decode.h:209
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:251
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:47
Packet_::ts
SCTime_t ts
Definition: decode.h:471
LOG_CF_CLIENT_IP
#define LOG_CF_CLIENT_IP
Definition: log-cf-common.h:43
LOG_CF_TIMESTAMP
#define LOG_CF_TIMESTAMP
Definition: log-cf-common.h:41
LOG_HTTP_CF_REQUEST_HEADER
#define LOG_HTTP_CF_REQUEST_HEADER
Definition: log-httplog.c:76
AppLayerParserRegisterLogger
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:477
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:274
pkt-var.h
LogHttpLogThreadInit
TmEcode LogHttpLogThreadInit(ThreadVars *, const void *, void **)
Definition: log-httplog.c:504
Packet_::sp
Port sp
Definition: decode.h:435
DEFAULT_LOG_FILENAME
#define DEFAULT_LOG_FILENAME
Definition: log-httplog.c:53
LOG_CF_SERVER_PORT
#define LOG_CF_SERVER_PORT
Definition: log-cf-common.h:46
util-time.h
OutputInitResult_::ok
bool ok
Definition: output.h:48
app-layer-parser.h
Packet_
Definition: decode.h:428
LOG_HTTP_CUSTOM
#define LOG_HTTP_CUSTOM
Definition: log-httplog.c:92
LOG_CF_TIMESTAMP_U
#define LOG_CF_TIMESTAMP_U
Definition: log-cf-common.h:42
LogHttpFileCtx_::file_ctx
LogFileCtx * file_ctx
Definition: log-httplog.c:85
conf.h
Port
uint16_t Port
Definition: decode.h:229
SCTime_t
Definition: util-time.h:40
TmEcode
TmEcode
Definition: tm-threads-common.h:83
LogCustomFormatNode_::maxlen
uint32_t maxlen
Definition: log-cf-common.h:68
LogHttpFileCtx_::cf
LogCustomFormat * cf
Definition: log-httplog.c:87
MemBuffer_
Definition: util-buffer.h:27
LogCustomFormat_
Definition: log-cf-common.h:73
LogHttpLogThread_::buffer
MemBuffer * buffer
Definition: log-httplog.c:99
LogHttpLogThreadDeinit
TmEcode LogHttpLogThreadDeinit(ThreadVars *, void *)
Definition: log-httplog.c:531
LOG_HTTP_CF_REQUEST_METHOD
#define LOG_HTTP_CF_REQUEST_METHOD
Definition: log-httplog.c:73
LogCustomFormatNode_::data
char data[LOG_NODE_STRLEN]
Definition: log-cf-common.h:69
MemBufferReset
#define MemBufferReset(mem_buffer)
Reset the mem buffer.
Definition: util-buffer.h:42
OutputInitResult_
Definition: output.h:46
LogHttpLogThread_
Definition: log-httplog.c:94
GET_IPV4_SRC_ADDR_PTR
#define GET_IPV4_SRC_ADDR_PTR(p)
Definition: decode.h:208
suricata-common.h
LOG_HTTP_CF_REQUEST_PROTOCOL
#define LOG_HTTP_CF_REQUEST_PROTOCOL
Definition: log-httplog.c:72
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:30
MemBufferFree
void MemBufferFree(MemBuffer *buffer)
Definition: util-buffer.c:87
MemBufferWriteString
#define MemBufferWriteString(dst,...)
Write a string buffer to the Membuffer dst.
Definition: util-buffer.h:162
LOG_HTTP_CF_REQUEST_HOST
#define LOG_HTTP_CF_REQUEST_HOST
Definition: log-httplog.c:71
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:899
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
log-httplog.h
threadvars.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
log-cf-common.h
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:213
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
util-logopenfile.h
util-buffer.h
LogCustomFormat_::cf_nodes
LogCustomFormatNode * cf_nodes[LOG_MAXN_NODES]
Definition: log-cf-common.h:75
LOG_HTTP_DEFAULT
#define LOG_HTTP_DEFAULT
Definition: log-httplog.c:90
LOG_CF_SERVER_IP
#define LOG_CF_SERVER_IP
Definition: log-cf-common.h:44
LogHttpFileCtx
struct LogHttpFileCtx_ LogHttpFileCtx
LOG_HTTP_CF_RESPONSE_LEN
#define LOG_HTTP_CF_RESPONSE_LEN
Definition: log-httplog.c:81
LOG_CF_NONE
#define LOG_CF_NONE
Definition: log-cf-common.h:39
LogHttpLogThread_::httplog_ctx
LogHttpFileCtx * httplog_ctx
Definition: log-httplog.c:95
PrintRawUriBuf
void PrintRawUriBuf(char *retbuf, uint32_t *offset, uint32_t retbuflen, uint8_t *buf, uint32_t buflen)
Definition: util-print.c:120
MemBuffer_::size
uint32_t size
Definition: util-buffer.h:29
MEMBUFFER_BUFFER
#define MEMBUFFER_BUFFER(mem_buffer)
Get the MemBuffers underlying buffer.
Definition: util-buffer.h:50
MemBuffer_::buffer
uint8_t * buffer
Definition: util-buffer.h:28
LogCustomFormatAlloc
LogCustomFormat * LogCustomFormatAlloc(void)
Creates a custom format.
Definition: log-cf-common.c:54
LogHttpFileCtx_::flags
uint32_t flags
Definition: log-httplog.c:86
LogHttpLogger
int LogHttpLogger(ThreadVars *tv, void *thread_data, const Packet *, Flow *f, void *state, void *tx, uint64_t tx_id)
Definition: log-httplog.c:486
MEMBUFFER_OFFSET
#define MEMBUFFER_OFFSET(mem_buffer)
Get the MemBuffers current offset.
Definition: util-buffer.h:55
LogHttpFileCtx_
Definition: log-httplog.c:84
Packet_::dp
Port dp
Definition: decode.h:443
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
MODULE_NAME
#define MODULE_NAME
Definition: log-httplog.c:55
LOG_HTTP_CF_REQUEST_COOKIE
#define LOG_HTTP_CF_REQUEST_COOKIE
Definition: log-httplog.c:77
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:245
CreateTimeString
void CreateTimeString(const SCTime_t ts, char *str, size_t size)
Definition: util-time.c:272
MemBufferCreateNew
MemBuffer * MemBufferCreateNew(uint32_t size)
Definition: util-buffer.c:32
output.h
LogCustomFormatParse
int LogCustomFormatParse(LogCustomFormat *cf, const char *format)
Parses and saves format nodes for custom format.
Definition: log-cf-common.c:96
app-layer.h
SCTIME_USECS
#define SCTIME_USECS(t)
Definition: util-time.h:50
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:808