suricata
log-tlslog.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Roliers Jean-Paul <popof.fpn@gmail.co>
22  * \author Eric Leblond <eric@regit.org>
23  * \author Victor Julien <victor@inliniac.net>
24  * \author Paulo Pacheco <fooinha@gmail.com>
25  *
26  * Implements TLS logging portion of the engine.
27  */
28 
29 #include "suricata-common.h"
30 #include "detect.h"
31 #include "pkt-var.h"
32 #include "conf.h"
33 
34 #include "threads.h"
35 #include "threadvars.h"
36 #include "tm-threads.h"
37 
38 #include "util-print.h"
39 #include "util-unittest.h"
40 
41 #include "util-debug.h"
42 
43 #include "output.h"
44 #include "log-tlslog.h"
45 #include "app-layer-ssl.h"
46 #include "app-layer.h"
47 #include "app-layer-parser.h"
48 #include "util-privs.h"
49 #include "util-buffer.h"
50 
51 #include "util-logopenfile.h"
52 #include "util-time.h"
53 #include "log-cf-common.h"
54 
55 #define DEFAULT_LOG_FILENAME "tls.log"
56 
57 #define MODULE_NAME "LogTlsLog"
58 
59 #define PRINT_BUF_LEN 46
60 
61 #define OUTPUT_BUFFER_SIZE 65535
62 #define CERT_ENC_BUFFER_SIZE 2048
63 
64 #define LOG_TLS_DEFAULT 0
65 #define LOG_TLS_EXTENDED 1
66 #define LOG_TLS_CUSTOM 2
67 
68 #define LOG_TLS_SESSION_RESUMPTION 4
69 
70 #define LOG_TLS_CF_VERSION 'v'
71 #define LOG_TLS_CF_DATE_NOT_BEFORE 'd'
72 #define LOG_TLS_CF_DATE_NOT_AFTER 'D'
73 #define LOG_TLS_CF_SHA1 'f'
74 #define LOG_TLS_CF_SNI 'n'
75 #define LOG_TLS_CF_SUBJECT 's'
76 #define LOG_TLS_CF_ISSUER 'i'
77 #define LOG_TLS_CF_EXTENDED 'E'
78 
79 typedef struct LogTlsFileCtx_ {
81  uint32_t flags; /** Store mode */
84 
85 typedef struct LogTlsLogThread_ {
87 
88  /* LogTlsFileCtx has the pointer to the file and a mutex to allow
89  multithreading. */
90  uint32_t tls_cnt;
91 
94 
95 int TLSGetIPInformations(const Packet *p, char* srcip, size_t srcip_len,
96  Port* sp, char* dstip, size_t dstip_len, Port* dp,
97  int ipproto)
98 {
99  if ((PKT_IS_TOSERVER(p))) {
100  switch (ipproto) {
101  case AF_INET:
102  PrintInet(AF_INET, (const void *) GET_IPV4_SRC_ADDR_PTR(p),
103  srcip, srcip_len);
104  PrintInet(AF_INET, (const void *) GET_IPV4_DST_ADDR_PTR(p),
105  dstip, dstip_len);
106  break;
107  case AF_INET6:
108  PrintInet(AF_INET6, (const void *) GET_IPV6_SRC_ADDR(p), srcip,
109  srcip_len);
110  PrintInet(AF_INET6, (const void *) GET_IPV6_DST_ADDR(p), dstip,
111  dstip_len);
112  break;
113  default:
114  return 0;
115  }
116  *sp = p->sp;
117  *dp = p->dp;
118  } else {
119  switch (ipproto) {
120  case AF_INET:
121  PrintInet(AF_INET, (const void *) GET_IPV4_DST_ADDR_PTR(p),
122  srcip, srcip_len);
123  PrintInet(AF_INET, (const void *) GET_IPV4_SRC_ADDR_PTR(p),
124  dstip, dstip_len);
125  break;
126  case AF_INET6:
127  PrintInet(AF_INET6, (const void *) GET_IPV6_DST_ADDR(p), srcip,
128  srcip_len);
129  PrintInet(AF_INET6, (const void *) GET_IPV6_SRC_ADDR(p), dstip,
130  dstip_len);
131  break;
132  default:
133  return 0;
134  }
135  *sp = p->dp;
136  *dp = p->sp;
137  }
138  return 1;
139 }
140 
141 static TmEcode LogTlsLogThreadInit(ThreadVars *t, const void *initdata,
142  void **data)
143 {
144  LogTlsLogThread *aft = SCMalloc(sizeof(LogTlsLogThread));
145  if (unlikely(aft == NULL))
146  return TM_ECODE_FAILED;
147 
148  memset(aft, 0, sizeof(LogTlsLogThread));
149 
150  if (initdata == NULL) {
151  SCLogDebug("Error getting context for TLSLog. \"initdata\" argument NULL");
152  SCFree(aft);
153  return TM_ECODE_FAILED;
154  }
155 
157  if (aft->buffer == NULL) {
158  SCFree(aft);
159  return TM_ECODE_FAILED;
160  }
161 
162  /* Use the Output Context (file pointer and mutex) */
163  aft->tlslog_ctx = ((OutputCtx *) initdata)->data;
164 
165  *data = (void *)aft;
166  return TM_ECODE_OK;
167 }
168 
169 static TmEcode LogTlsLogThreadDeinit(ThreadVars *t, void *data)
170 {
171  LogTlsLogThread *aft = (LogTlsLogThread *)data;
172  if (aft == NULL) {
173  return TM_ECODE_OK;
174  }
175 
176  MemBufferFree(aft->buffer);
177  memset(aft, 0, sizeof(LogTlsLogThread));
178 
179  SCFree(aft);
180  return TM_ECODE_OK;
181 }
182 
183 static void LogTlsLogDeInitCtx(OutputCtx *output_ctx)
184 {
185  LogTlsFileCtx *tlslog_ctx = (LogTlsFileCtx *) output_ctx->data;
186  LogFileFreeCtx(tlslog_ctx->file_ctx);
187  LogCustomFormatFree(tlslog_ctx->cf);
188  SCFree(tlslog_ctx);
189  SCFree(output_ctx);
190 }
191 
192 static void LogTlsLogExitPrintStats(ThreadVars *tv, void *data)
193 {
194  LogTlsLogThread *aft = (LogTlsLogThread *)data;
195  if (aft == NULL) {
196  return;
197  }
198 
199  SCLogInfo("TLS logger logged %" PRIu32 " requests", aft->tls_cnt);
200 }
201 
202 /** \brief Create a new tls log LogFileCtx.
203  * \param conf Pointer to ConfNode containing this loggers configuration.
204  * \return NULL if failure, LogFileCtx* to the file_ctx if succesful
205  * */
206 static OutputInitResult LogTlsLogInitCtx(ConfNode *conf)
207 {
208  OutputInitResult result = { NULL, false };
209  LogFileCtx* file_ctx = LogFileNewCtx();
210 
211  if (file_ctx == NULL) {
212  SCLogError("LogTlsLogInitCtx: Couldn't "
213  "create new file_ctx");
214  return result;
215  }
216 
217  if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) {
218  goto filectx_error;
219  }
220 
221  LogTlsFileCtx *tlslog_ctx = SCCalloc(1, sizeof(LogTlsFileCtx));
222  if (unlikely(tlslog_ctx == NULL)) {
223  goto filectx_error;
224  }
225  tlslog_ctx->file_ctx = file_ctx;
226 
227  const char *extended = ConfNodeLookupChildValue(conf, "extended");
228  const char *custom = ConfNodeLookupChildValue(conf, "custom");
229  const char *customformat = ConfNodeLookupChildValue(conf, "customformat");
230 
231  /* If custom logging format is selected, lets parse it */
232  if (custom != NULL && customformat != NULL && ConfValIsTrue(custom)) {
233  tlslog_ctx->cf = LogCustomFormatAlloc();
234  if (!tlslog_ctx->cf) {
235  goto tlslog_error;
236  }
237 
238  tlslog_ctx->flags |= LOG_TLS_CUSTOM;
239 
240  if (!LogCustomFormatParse(tlslog_ctx->cf, customformat)) {
241  goto parser_error;
242  }
243  } else {
244  if (extended == NULL) {
245  tlslog_ctx->flags |= LOG_TLS_DEFAULT;
246  } else {
247  if (ConfValIsTrue(extended)) {
248  tlslog_ctx->flags |= LOG_TLS_EXTENDED;
249  }
250  }
251  }
252 
253  const char *resumption = ConfNodeLookupChildValue(conf,
254  "session-resumption");
255  if (resumption == NULL || ConfValIsTrue(resumption)) {
256  tlslog_ctx->flags |= LOG_TLS_SESSION_RESUMPTION;
257  }
258 
259  OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
260  if (unlikely(output_ctx == NULL)) {
261  goto tlslog_error;
262  }
263  output_ctx->data = tlslog_ctx;
264  output_ctx->DeInit = LogTlsLogDeInitCtx;
265 
266  SCLogDebug("TLS log output initialized");
267 
268  /* Enable the logger for the app layer */
270 
271  result.ctx = output_ctx;
272  result.ok = true;
273  return result;
274 
275 parser_error:
276  SCLogError("Syntax error in custom tls log "
277  "format string.");
278 tlslog_error:
279  LogCustomFormatFree(tlslog_ctx->cf);
280  SCFree(tlslog_ctx);
281 filectx_error:
282  LogFileFreeCtx(file_ctx);
283  return result;
284 }
285 
286 static void LogTlsLogVersion(MemBuffer *buffer, uint16_t version)
287 {
288  char ssl_version[SSL_VERSION_MAX_STRLEN];
289  SSLVersionToString(version, ssl_version);
290  MemBufferWriteString(buffer, "VERSION='%s'", ssl_version);
291 }
292 
293 static void LogTlsLogDate(MemBuffer *buffer, const char *title, int64_t *date)
294 {
295  char timebuf[64] = {0};
296  if (sc_x509_format_timestamp(*date, timebuf, sizeof(timebuf))) {
297  MemBufferWriteString(buffer, "%s='%s'", title, timebuf);
298  }
299 }
300 
301 static void LogTlsLogString(MemBuffer *buffer, const char *title,
302  const char *value)
303 {
304  MemBufferWriteString(buffer, "%s='%s'", title, value);
305 }
306 
307 static void LogTlsLogBasic(LogTlsLogThread *aft, SSLState *ssl_state, const SCTime_t ts,
308  char *srcip, Port sp, char *dstip, Port dp)
309 {
310  char timebuf[64];
311  CreateTimeString(ts, timebuf, sizeof(timebuf));
313  "%s %s:%d -> %s:%d TLS:",
314  timebuf, srcip, sp, dstip, dp);
315 
316  if (ssl_state->server_connp.cert0_subject != NULL) {
317  MemBufferWriteString(aft->buffer, " Subject='%s'",
318  ssl_state->server_connp.cert0_subject);
319  }
320 
321  if (ssl_state->server_connp.cert0_issuerdn != NULL) {
322  MemBufferWriteString(aft->buffer, " Issuerdn='%s'",
323  ssl_state->server_connp.cert0_issuerdn);
324  }
325 
326  if (ssl_state->flags & SSL_AL_FLAG_SESSION_RESUMED) {
327  /* Only log a session as 'resumed' if a certificate has not
328  been seen. */
329  if ((ssl_state->server_connp.cert0_issuerdn == NULL) &&
330  (ssl_state->server_connp.cert0_subject == NULL) &&
331  (ssl_state->flags & SSL_AL_FLAG_STATE_SERVER_HELLO) &&
332  ((ssl_state->flags & SSL_AL_FLAG_LOG_WITHOUT_CERT) == 0)) {
333  MemBufferWriteString(aft->buffer, " Session='resumed'");
334  }
335  }
336 }
337 
338 static void LogTlsLogExtended(LogTlsLogThread *aft, SSLState *ssl_state, const SCTime_t ts,
339  char *srcip, Port sp, char *dstip, Port dp)
340 {
341  if (ssl_state->server_connp.cert0_fingerprint != NULL) {
343  LogTlsLogString(aft->buffer, "SHA1",
344  ssl_state->server_connp.cert0_fingerprint);
345  }
346  if (ssl_state->client_connp.sni != NULL) {
348  LogTlsLogString(aft->buffer, "SNI", ssl_state->client_connp.sni);
349  }
350  if (ssl_state->server_connp.cert0_serial != NULL) {
352  LogTlsLogString(aft->buffer, "SERIAL",
353  ssl_state->server_connp.cert0_serial);
354  }
355 
357  LogTlsLogVersion(aft->buffer, ssl_state->server_connp.version);
358 
359  if (ssl_state->server_connp.cert0_not_before != 0) {
361  LogTlsLogDate(aft->buffer, "NOTBEFORE",
362  &ssl_state->server_connp.cert0_not_before);
363  }
364  if (ssl_state->server_connp.cert0_not_after != 0) {
366  LogTlsLogDate(aft->buffer, "NOTAFTER",
367  &ssl_state->server_connp.cert0_not_after);
368  }
369 }
370 
371 /* Custom format logging */
372 static void LogTlsLogCustom(LogTlsLogThread *aft, SSLState *ssl_state, const SCTime_t ts,
373  char *srcip, Port sp, char *dstip, Port dp)
374 {
375  LogTlsFileCtx *tlslog_ctx = aft->tlslog_ctx;
376  uint32_t i;
377  char buf[64];
378 
379  for (i = 0; i < tlslog_ctx->cf->cf_n; i++)
380  {
381  LogCustomFormatNode *node = tlslog_ctx->cf->cf_nodes[i];
382  if (!node) /* Should never happen */
383  continue;
384 
385  switch (node->type) {
386  case LOG_CF_LITERAL:
387  /* LITERAL */
388  MemBufferWriteString(aft->buffer, "%s", node->data);
389  break;
390  case LOG_CF_TIMESTAMP:
391  /* TIMESTAMP */
393  break;
394  case LOG_CF_TIMESTAMP_U:
395  /* TIMESTAMP USECONDS */
396  snprintf(buf, sizeof(buf), "%06u", (unsigned int)SCTIME_USECS(ts));
397  PrintRawUriBuf((char *)aft->buffer->buffer, &aft->buffer->offset, aft->buffer->size,
398  (uint8_t *)buf, MIN(strlen(buf), 6));
399  break;
400  case LOG_CF_CLIENT_IP:
401  /* CLIENT IP ADDRESS */
402  PrintRawUriBuf((char *)aft->buffer->buffer,
403  &aft->buffer->offset, aft->buffer->size,
404  (uint8_t *)srcip,strlen(srcip));
405  break;
406  case LOG_CF_SERVER_IP:
407  /* SERVER IP ADDRESS */
408  PrintRawUriBuf((char *)aft->buffer->buffer,
409  &aft->buffer->offset, aft->buffer->size,
410  (uint8_t *)dstip, strlen(dstip));
411  break;
412  case LOG_CF_CLIENT_PORT:
413  /* CLIENT PORT */
414  MemBufferWriteString(aft->buffer, "%" PRIu16 "", sp);
415  break;
416  case LOG_CF_SERVER_PORT:
417  /* SERVER PORT */
418  MemBufferWriteString(aft->buffer, "%" PRIu16 "", dp);
419  break;
420  case LOG_TLS_CF_VERSION:
421  LogTlsLogVersion(aft->buffer, ssl_state->server_connp.version);
422  break;
424  LogTlsLogDate(aft->buffer, "NOTBEFORE",
425  &ssl_state->server_connp.cert0_not_before);
426  break;
428  LogTlsLogDate(aft->buffer, "NOTAFTER",
429  &ssl_state->server_connp.cert0_not_after);
430  break;
431  case LOG_TLS_CF_SHA1:
432  if (ssl_state->server_connp.cert0_fingerprint != NULL) {
433  MemBufferWriteString(aft->buffer, "%s",
434  ssl_state->server_connp.cert0_fingerprint);
435  } else {
437  }
438  break;
439  case LOG_TLS_CF_SNI:
440  if (ssl_state->client_connp.sni != NULL) {
441  MemBufferWriteString(aft->buffer, "%s",
442  ssl_state->client_connp.sni);
443  } else {
445  }
446  break;
447  case LOG_TLS_CF_SUBJECT:
448  if (ssl_state->server_connp.cert0_subject != NULL) {
449  MemBufferWriteString(aft->buffer, "%s",
450  ssl_state->server_connp.cert0_subject);
451  } else {
453  }
454  break;
455  case LOG_TLS_CF_ISSUER:
456  if (ssl_state->server_connp.cert0_issuerdn != NULL) {
457  MemBufferWriteString(aft->buffer, "%s",
458  ssl_state->server_connp.cert0_issuerdn);
459  } else {
461  }
462  break;
463  case LOG_TLS_CF_EXTENDED:
464  /* Extended format */
465  LogTlsLogExtended(aft, ssl_state, ts, srcip, sp, dstip, dp);
466  break;
467  default:
468  /* NO MATCH */
470  SCLogDebug("No matching parameter %%%c for custom tls log.",
471  node->type);
472  break;
473  }
474  }
475 }
476 
477 
478 static int LogTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p,
479  Flow *f, void *state, void *tx, uint64_t tx_id)
480 {
481  LogTlsLogThread *aft = (LogTlsLogThread *)thread_data;
482  LogTlsFileCtx *hlog = aft->tlslog_ctx;
483  int ipproto = (PKT_IS_IPV4(p)) ? AF_INET : AF_INET6;
484 
485  SSLState *ssl_state = (SSLState *)state;
486  if (unlikely(ssl_state == NULL)) {
487  return 0;
488  }
489 
490  if (((hlog->flags & LOG_TLS_SESSION_RESUMPTION) == 0 ||
491  (ssl_state->flags & SSL_AL_FLAG_SESSION_RESUMED) == 0) &&
492  (ssl_state->server_connp.cert0_issuerdn == NULL ||
493  ssl_state->server_connp.cert0_subject == NULL) &&
494  ((ssl_state->flags & SSL_AL_FLAG_LOG_WITHOUT_CERT) == 0)) {
495  return 0;
496  }
497 
498  char srcip[PRINT_BUF_LEN], dstip[PRINT_BUF_LEN];
499 
500  Port sp, dp;
501  if (!TLSGetIPInformations(p, srcip, PRINT_BUF_LEN, &sp, dstip,
502  PRINT_BUF_LEN, &dp, ipproto)) {
503  return 0;
504  }
505 
506  MemBufferReset(aft->buffer);
507 
508  if (hlog->flags & LOG_TLS_CUSTOM) {
509  LogTlsLogCustom(aft, ssl_state, p->ts, srcip, sp, dstip, dp);
510  } else if (hlog->flags & LOG_TLS_EXTENDED) {
511  LogTlsLogBasic(aft, ssl_state, p->ts, srcip, sp, dstip, dp);
512  LogTlsLogExtended(aft, ssl_state, p->ts, srcip, sp, dstip, dp);
513  } else {
514  LogTlsLogBasic(aft, ssl_state, p->ts, srcip, sp, dstip, dp);
515  }
516 
517  MemBufferWriteString(aft->buffer, "\n");
518 
519  aft->tls_cnt++;
520 
521  hlog->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),
522  MEMBUFFER_OFFSET(aft->buffer), hlog->file_ctx);
523 
524  return 0;
525 }
526 
528 {
530  LogTlsLogInitCtx, ALPROTO_TLS, LogTlsLogger, TLS_HANDSHAKE_DONE,
531  TLS_HANDSHAKE_DONE, LogTlsLogThreadInit, LogTlsLogThreadDeinit,
532  LogTlsLogExitPrintStats);
533 }
LogCustomFormatFree
void LogCustomFormatFree(LogCustomFormat *cf)
Frees memory held by a custom format.
Definition: log-cf-common.c:80
tm-threads.h
SSLStateConnp_::cert0_subject
char * cert0_subject
Definition: app-layer-ssl.h:248
SSLState_
SSLv[2.0|3.[0|1|2|3]] state structure.
Definition: app-layer-ssl.h:284
ts
uint64_t ts
Definition: source-erf-file.c:55
LOG_TLS_SESSION_RESUMPTION
#define LOG_TLS_SESSION_RESUMPTION
Definition: log-tlslog.c:68
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SSLState_::client_connp
SSLStateConnp client_connp
Definition: app-layer-ssl.h:302
ALPROTO_TLS
@ ALPROTO_TLS
Definition: app-layer-protos.h:33
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:660
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
LogTlsFileCtx_::flags
uint32_t flags
Definition: log-tlslog.c:81
OUTPUT_BUFFER_SIZE
#define OUTPUT_BUFFER_SIZE
Definition: log-tlslog.c:61
DEFAULT_LOG_FILENAME
#define DEFAULT_LOG_FILENAME
Definition: log-tlslog.c:55
SSLState_::server_connp
SSLStateConnp server_connp
Definition: app-layer-ssl.h:303
SSLStateConnp_::cert0_not_before
int64_t cert0_not_before
Definition: app-layer-ssl.h:251
SSL_AL_FLAG_SESSION_RESUMED
#define SSL_AL_FLAG_SESSION_RESUMED
Definition: app-layer-ssl.h:116
threads.h
Flow_
Flow data structure.
Definition: flow.h:347
LogTlsLogRegister
void LogTlsLogRegister(void)
Definition: log-tlslog.c:527
SSL_AL_FLAG_STATE_SERVER_HELLO
#define SSL_AL_FLAG_STATE_SERVER_HELLO
Definition: app-layer-ssl.h:99
LogTlsLogThread_::buffer
MemBuffer * buffer
Definition: log-tlslog.c:92
LogFileCtx_
Definition: util-logopenfile.h:72
LOG_CF_LITERAL
#define LOG_CF_LITERAL
Definition: log-cf-common.h:39
SSL_VERSION_MAX_STRLEN
#define SSL_VERSION_MAX_STRLEN
Definition: app-layer-ssl.h:152
LogTlsFileCtx_::file_ctx
LogFileCtx * file_ctx
Definition: log-tlslog.c:80
LOG_TLS_CUSTOM
#define LOG_TLS_CUSTOM
Definition: log-tlslog.c:66
MIN
#define MIN(x, y)
Definition: suricata-common.h:386
util-privs.h
LogFileCtx_::Write
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
Definition: util-logopenfile.h:88
SSLStateConnp_::sni
char * sni
Definition: app-layer-ssl.h:256
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
LogCustomFormatWriteTimestamp
void LogCustomFormatWriteTimestamp(MemBuffer *buffer, const char *fmt, const SCTime_t ts)
Writes a timestamp with given format into a MemBuffer.
Definition: log-cf-common.c:211
LOG_CF_CLIENT_PORT
#define LOG_CF_CLIENT_PORT
Definition: log-cf-common.h:44
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:215
util-unittest.h
MemBuffer_::offset
uint32_t offset
Definition: util-buffer.h:30
SSLStateConnp_::cert0_issuerdn
char * cert0_issuerdn
Definition: app-layer-ssl.h:249
ConfValIsTrue
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:537
OutputCtx_::data
void * data
Definition: tm-modules.h:87
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
OutputCtx_
Definition: tm-modules.h:84
SCConfLogOpenGeneric
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
Definition: util-logopenfile.c:453
SSLStateConnp_::cert0_not_after
int64_t cert0_not_after
Definition: app-layer-ssl.h:252
LogCustomFormat_::cf_n
uint32_t cf_n
Definition: log-cf-common.h:72
LogCustomFormatNode_
Definition: log-cf-common.h:64
PRINT_BUF_LEN
#define PRINT_BUF_LEN
Definition: log-tlslog.c:59
LOG_TLS_DEFAULT
#define LOG_TLS_DEFAULT
Definition: log-tlslog.c:64
LogCustomFormatNode_::type
uint32_t type
Definition: log-cf-common.h:65
LOG_TLS_CF_DATE_NOT_AFTER
#define LOG_TLS_CF_DATE_NOT_AFTER
Definition: log-tlslog.c:72
MODULE_NAME
#define MODULE_NAME
Definition: log-tlslog.c:57
LOG_TLS_CF_SUBJECT
#define LOG_TLS_CF_SUBJECT
Definition: log-tlslog.c:75
util-debug.h
GET_IPV4_DST_ADDR_PTR
#define GET_IPV4_DST_ADDR_PTR(p)
Definition: decode.h:210
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:251
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:47
Packet_::ts
SCTime_t ts
Definition: decode.h:475
LOG_CF_CLIENT_IP
#define LOG_CF_CLIENT_IP
Definition: log-cf-common.h:42
LOG_CF_TIMESTAMP
#define LOG_CF_TIMESTAMP
Definition: log-cf-common.h:40
TLS_HANDSHAKE_DONE
@ TLS_HANDSHAKE_DONE
Definition: app-layer-ssl.h:79
AppLayerParserRegisterLogger
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:477
LogTlsLogThread
struct LogTlsLogThread_ LogTlsLogThread
util-print.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:274
pkt-var.h
Packet_::sp
Port sp
Definition: decode.h:437
LOG_CF_SERVER_PORT
#define LOG_CF_SERVER_PORT
Definition: log-cf-common.h:45
SSLVersionToString
void SSLVersionToString(uint16_t version, char *buffer)
Definition: app-layer-ssl.c:340
util-time.h
OutputInitResult_::ok
bool ok
Definition: output.h:48
log-tlslog.h
LOGGER_TLS
@ LOGGER_TLS
Definition: suricata-common.h:461
app-layer-parser.h
Packet_
Definition: decode.h:430
LOG_CF_TIMESTAMP_U
#define LOG_CF_TIMESTAMP_U
Definition: log-cf-common.h:41
conf.h
Port
uint16_t Port
Definition: decode.h:229
SCTime_t
Definition: util-time.h:40
TmEcode
TmEcode
Definition: tm-threads-common.h:83
LOG_CF_WRITE_UNKNOWN_VALUE
#define LOG_CF_WRITE_UNKNOWN_VALUE(buffer)
Definition: log-cf-common.h:57
MemBuffer_
Definition: util-buffer.h:27
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
LogCustomFormat_
Definition: log-cf-common.h:71
LOG_TLS_CF_VERSION
#define LOG_TLS_CF_VERSION
Definition: log-tlslog.c:70
LogCustomFormatNode_::data
char data[LOG_NODE_STRLEN]
Definition: log-cf-common.h:67
MemBufferReset
#define MemBufferReset(mem_buffer)
Reset the mem buffer.
Definition: util-buffer.h:42
OutputInitResult_
Definition: output.h:46
GET_IPV4_SRC_ADDR_PTR
#define GET_IPV4_SRC_ADDR_PTR(p)
Definition: decode.h:209
LogTlsFileCtx
struct LogTlsFileCtx_ LogTlsFileCtx
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:90
MemBufferFree
void MemBufferFree(MemBuffer *buffer)
Definition: util-buffer.c:87
MemBufferWriteString
#define MemBufferWriteString(dst,...)
Write a string buffer to the Membuffer dst.
Definition: util-buffer.h:162
version
uint8_t version
Definition: decode-gre.h:1
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:862
LogTlsLogThread_::tls_cnt
uint32_t tls_cnt
Definition: log-tlslog.c:90
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
threadvars.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
log-cf-common.h
LogTlsLogThread_::tlslog_ctx
LogTlsFileCtx * tlslog_ctx
Definition: log-tlslog.c:86
LOG_TLS_CF_SNI
#define LOG_TLS_CF_SNI
Definition: log-tlslog.c:74
TLSGetIPInformations
int TLSGetIPInformations(const Packet *p, char *srcip, size_t srcip_len, Port *sp, char *dstip, size_t dstip_len, Port *dp, int ipproto)
Definition: log-tlslog.c:95
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:214
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
util-logopenfile.h
LOG_TLS_CF_DATE_NOT_BEFORE
#define LOG_TLS_CF_DATE_NOT_BEFORE
Definition: log-tlslog.c:71
util-buffer.h
LogCustomFormat_::cf_nodes
LogCustomFormatNode * cf_nodes[LOG_MAXN_NODES]
Definition: log-cf-common.h:73
OutputRegisterTxModuleWithProgress
void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a tx output module with progress.
Definition: output.c:369
LOG_CF_SERVER_IP
#define LOG_CF_SERVER_IP
Definition: log-cf-common.h:43
LOG_TLS_CF_ISSUER
#define LOG_TLS_CF_ISSUER
Definition: log-tlslog.c:76
LOG_CF_NONE
#define LOG_CF_NONE
Definition: log-cf-common.h:38
LOG_TLS_EXTENDED
#define LOG_TLS_EXTENDED
Definition: log-tlslog.c:65
PrintRawUriBuf
void PrintRawUriBuf(char *retbuf, uint32_t *offset, uint32_t retbuflen, uint8_t *buf, uint32_t buflen)
Definition: util-print.c:120
MemBuffer_::size
uint32_t size
Definition: util-buffer.h:29
MEMBUFFER_BUFFER
#define MEMBUFFER_BUFFER(mem_buffer)
Get the MemBuffers underlying buffer.
Definition: util-buffer.h:50
MemBuffer_::buffer
uint8_t * buffer
Definition: util-buffer.h:28
SSLStateConnp_::cert0_fingerprint
char * cert0_fingerprint
Definition: app-layer-ssl.h:253
LogCustomFormatAlloc
LogCustomFormat * LogCustomFormatAlloc(void)
Creates a custom format.
Definition: log-cf-common.c:54
MEMBUFFER_OFFSET
#define MEMBUFFER_OFFSET(mem_buffer)
Get the MemBuffers current offset.
Definition: util-buffer.h:55
Packet_::dp
Port dp
Definition: decode.h:445
LOG_CF_WRITE_SPACE_SEPARATOR
#define LOG_CF_WRITE_SPACE_SEPARATOR(buffer)
Definition: log-cf-common.h:54
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
LogTlsFileCtx_::cf
LogCustomFormat * cf
Definition: log-tlslog.c:82
PKT_IS_IPV4
#define PKT_IS_IPV4(p)
Definition: decode.h:245
SSLStateConnp_::cert0_serial
char * cert0_serial
Definition: app-layer-ssl.h:250
app-layer-ssl.h
LOG_TLS_CF_SHA1
#define LOG_TLS_CF_SHA1
Definition: log-tlslog.c:73
SSL_AL_FLAG_LOG_WITHOUT_CERT
#define SSL_AL_FLAG_LOG_WITHOUT_CERT
Definition: app-layer-ssl.h:123
CreateTimeString
void CreateTimeString(const SCTime_t ts, char *str, size_t size)
Definition: util-time.c:272
MemBufferCreateNew
MemBuffer * MemBufferCreateNew(uint32_t size)
Definition: util-buffer.c:32
LOG_TLS_CF_EXTENDED
#define LOG_TLS_CF_EXTENDED
Definition: log-tlslog.c:77
output.h
LogTlsFileCtx_
Definition: log-tlslog.c:79
LogCustomFormatParse
int LogCustomFormatParse(LogCustomFormat *cf, const char *format)
Parses and saves format nodes for custom format.
Definition: log-cf-common.c:96
app-layer.h
SCTIME_USECS
#define SCTIME_USECS(t)
Definition: util-time.h:56
LogTlsLogThread_
Definition: log-tlslog.c:85
SSLState_::flags
uint32_t flags
Definition: app-layer-ssl.h:291
SSLStateConnp_::version
uint16_t version
Definition: app-layer-ssl.h:237
ConfNodeLookupChildValue
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:814