suricata
log-tlslog.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Roliers Jean-Paul <popof.fpn@gmail.co>
22  * \author Eric Leblond <eric@regit.org>
23  * \author Victor Julien <victor@inliniac.net>
24  * \author Paulo Pacheco <fooinha@gmail.com>
25  *
26  * Implements TLS logging portion of the engine.
27  */
28 
29 #include "suricata-common.h"
30 #include "debug.h"
31 #include "detect.h"
32 #include "pkt-var.h"
33 #include "conf.h"
34 
35 #include "threads.h"
36 #include "threadvars.h"
37 #include "tm-threads.h"
38 
39 #include "util-print.h"
40 #include "util-unittest.h"
41 
42 #include "util-debug.h"
43 
44 #include "output.h"
45 #include "log-tlslog.h"
46 #include "app-layer-ssl.h"
47 #include "app-layer.h"
48 #include "app-layer-parser.h"
49 #include "util-privs.h"
50 #include "util-buffer.h"
51 
52 #include "util-logopenfile.h"
53 #include "util-crypt.h"
54 #include "util-time.h"
55 #include "log-cf-common.h"
56 
57 #define DEFAULT_LOG_FILENAME "tls.log"
58 
59 #define MODULE_NAME "LogTlsLog"
60 
61 #define PRINT_BUF_LEN 46
62 
63 #define OUTPUT_BUFFER_SIZE 65535
64 #define CERT_ENC_BUFFER_SIZE 2048
65 
66 #define LOG_TLS_DEFAULT 0
67 #define LOG_TLS_EXTENDED 1
68 #define LOG_TLS_CUSTOM 2
69 
70 #define LOG_TLS_SESSION_RESUMPTION 4
71 
72 #define LOG_TLS_CF_VERSION 'v'
73 #define LOG_TLS_CF_DATE_NOT_BEFORE 'd'
74 #define LOG_TLS_CF_DATE_NOT_AFTER 'D'
75 #define LOG_TLS_CF_SHA1 'f'
76 #define LOG_TLS_CF_SNI 'n'
77 #define LOG_TLS_CF_SUBJECT 's'
78 #define LOG_TLS_CF_ISSUER 'i'
79 #define LOG_TLS_CF_EXTENDED 'E'
80 
81 typedef struct LogTlsFileCtx_ {
83  uint32_t flags; /** Store mode */
86 
87 typedef struct LogTlsLogThread_ {
89 
90  /* LogTlsFileCtx has the pointer to the file and a mutex to allow
91  multithreading. */
92  uint32_t tls_cnt;
93 
96 
97 int TLSGetIPInformations(const Packet *p, char* srcip, size_t srcip_len,
98  Port* sp, char* dstip, size_t dstip_len, Port* dp,
99  int ipproto)
100 {
101  if ((PKT_IS_TOSERVER(p))) {
102  switch (ipproto) {
103  case AF_INET:
104  PrintInet(AF_INET, (const void *) GET_IPV4_SRC_ADDR_PTR(p),
105  srcip, srcip_len);
106  PrintInet(AF_INET, (const void *) GET_IPV4_DST_ADDR_PTR(p),
107  dstip, dstip_len);
108  break;
109  case AF_INET6:
110  PrintInet(AF_INET6, (const void *) GET_IPV6_SRC_ADDR(p), srcip,
111  srcip_len);
112  PrintInet(AF_INET6, (const void *) GET_IPV6_DST_ADDR(p), dstip,
113  dstip_len);
114  break;
115  default:
116  return 0;
117  }
118  *sp = p->sp;
119  *dp = p->dp;
120  } else {
121  switch (ipproto) {
122  case AF_INET:
123  PrintInet(AF_INET, (const void *) GET_IPV4_DST_ADDR_PTR(p),
124  srcip, srcip_len);
125  PrintInet(AF_INET, (const void *) GET_IPV4_SRC_ADDR_PTR(p),
126  dstip, dstip_len);
127  break;
128  case AF_INET6:
129  PrintInet(AF_INET6, (const void *) GET_IPV6_DST_ADDR(p), srcip,
130  srcip_len);
131  PrintInet(AF_INET6, (const void *) GET_IPV6_SRC_ADDR(p), dstip,
132  dstip_len);
133  break;
134  default:
135  return 0;
136  }
137  *sp = p->dp;
138  *dp = p->sp;
139  }
140  return 1;
141 }
142 
143 static TmEcode LogTlsLogThreadInit(ThreadVars *t, const void *initdata,
144  void **data)
145 {
146  LogTlsLogThread *aft = SCMalloc(sizeof(LogTlsLogThread));
147  if (unlikely(aft == NULL))
148  return TM_ECODE_FAILED;
149 
150  memset(aft, 0, sizeof(LogTlsLogThread));
151 
152  if (initdata == NULL) {
153  SCLogDebug("Error getting context for TLSLog. \"initdata\" argument NULL");
154  SCFree(aft);
155  return TM_ECODE_FAILED;
156  }
157 
159  if (aft->buffer == NULL) {
160  SCFree(aft);
161  return TM_ECODE_FAILED;
162  }
163 
164  /* Use the Output Context (file pointer and mutex) */
165  aft->tlslog_ctx = ((OutputCtx *) initdata)->data;
166 
167  *data = (void *)aft;
168  return TM_ECODE_OK;
169 }
170 
171 static TmEcode LogTlsLogThreadDeinit(ThreadVars *t, void *data)
172 {
173  LogTlsLogThread *aft = (LogTlsLogThread *)data;
174  if (aft == NULL) {
175  return TM_ECODE_OK;
176  }
177 
178  MemBufferFree(aft->buffer);
179  memset(aft, 0, sizeof(LogTlsLogThread));
180 
181  SCFree(aft);
182  return TM_ECODE_OK;
183 }
184 
185 static void LogTlsLogDeInitCtx(OutputCtx *output_ctx)
186 {
187  LogTlsFileCtx *tlslog_ctx = (LogTlsFileCtx *) output_ctx->data;
188  LogFileFreeCtx(tlslog_ctx->file_ctx);
189  LogCustomFormatFree(tlslog_ctx->cf);
190  SCFree(tlslog_ctx);
191  SCFree(output_ctx);
192 }
193 
194 static void LogTlsLogExitPrintStats(ThreadVars *tv, void *data)
195 {
196  LogTlsLogThread *aft = (LogTlsLogThread *)data;
197  if (aft == NULL) {
198  return;
199  }
200 
201  SCLogInfo("TLS logger logged %" PRIu32 " requests", aft->tls_cnt);
202 }
203 
204 /** \brief Create a new tls log LogFileCtx.
205  * \param conf Pointer to ConfNode containing this loggers configuration.
206  * \return NULL if failure, LogFileCtx* to the file_ctx if succesful
207  * */
208 static OutputInitResult LogTlsLogInitCtx(ConfNode *conf)
209 {
210  OutputInitResult result = { NULL, false };
212 
213  if (file_ctx == NULL) {
214  SCLogError(SC_ERR_TLS_LOG_GENERIC, "LogTlsLogInitCtx: Couldn't "
215  "create new file_ctx");
216  return result;
217  }
218 
219  if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) {
220  goto filectx_error;
221  }
222 
223  LogTlsFileCtx *tlslog_ctx = SCCalloc(1, sizeof(LogTlsFileCtx));
224  if (unlikely(tlslog_ctx == NULL)) {
225  goto filectx_error;
226  }
227  tlslog_ctx->file_ctx = file_ctx;
228 
229  const char *extended = ConfNodeLookupChildValue(conf, "extended");
230  const char *custom = ConfNodeLookupChildValue(conf, "custom");
231  const char *customformat = ConfNodeLookupChildValue(conf, "customformat");
232 
233  /* If custom logging format is selected, lets parse it */
234  if (custom != NULL && customformat != NULL && ConfValIsTrue(custom)) {
235  tlslog_ctx->cf = LogCustomFormatAlloc();
236  if (!tlslog_ctx->cf) {
237  goto tlslog_error;
238  }
239 
240  tlslog_ctx->flags |= LOG_TLS_CUSTOM;
241 
242  if (!LogCustomFormatParse(tlslog_ctx->cf, customformat)) {
243  goto parser_error;
244  }
245  } else {
246  if (extended == NULL) {
247  tlslog_ctx->flags |= LOG_TLS_DEFAULT;
248  } else {
249  if (ConfValIsTrue(extended)) {
250  tlslog_ctx->flags |= LOG_TLS_EXTENDED;
251  }
252  }
253  }
254 
255  const char *resumption = ConfNodeLookupChildValue(conf,
256  "session-resumption");
257  if (resumption == NULL || ConfValIsTrue(resumption)) {
258  tlslog_ctx->flags |= LOG_TLS_SESSION_RESUMPTION;
259  }
260 
261  OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
262  if (unlikely(output_ctx == NULL)) {
263  goto tlslog_error;
264  }
265  output_ctx->data = tlslog_ctx;
266  output_ctx->DeInit = LogTlsLogDeInitCtx;
267 
268  SCLogDebug("TLS log output initialized");
269 
270  /* Enable the logger for the app layer */
272 
273  result.ctx = output_ctx;
274  result.ok = true;
275  return result;
276 
277 parser_error:
278  SCLogError(SC_ERR_INVALID_ARGUMENT, "Syntax error in custom tls log "
279  "format string.");
280 tlslog_error:
281  LogCustomFormatFree(tlslog_ctx->cf);
282  SCFree(tlslog_ctx);
283 filectx_error:
284  LogFileFreeCtx(file_ctx);
285  return result;
286 }
287 
288 static void LogTlsLogVersion(MemBuffer *buffer, uint16_t version)
289 {
290  char ssl_version[SSL_VERSION_MAX_STRLEN];
291  SSLVersionToString(version, ssl_version);
292  MemBufferWriteString(buffer, "VERSION='%s'", ssl_version);
293 }
294 
295 static void LogTlsLogDate(MemBuffer *buffer, const char *title, time_t *date)
296 {
297  char timebuf[64] = {0};
298  struct timeval tv;
299  tv.tv_sec = *date;
300  tv.tv_usec = 0;
301  CreateUtcIsoTimeString(&tv, timebuf, sizeof(timebuf));
302  MemBufferWriteString(buffer, "%s='%s'", title, timebuf);
303 }
304 
305 static void LogTlsLogString(MemBuffer *buffer, const char *title,
306  const char *value)
307 {
308  MemBufferWriteString(buffer, "%s='%s'", title, value);
309 }
310 
311 static void LogTlsLogBasic(LogTlsLogThread *aft, SSLState *ssl_state,
312  const struct timeval *ts, char *srcip, Port sp,
313  char *dstip, Port dp)
314 {
315  char timebuf[64];
316  CreateTimeString(ts, timebuf, sizeof(timebuf));
318  "%s %s:%d -> %s:%d TLS:",
319  timebuf, srcip, sp, dstip, dp);
320 
321  if (ssl_state->server_connp.cert0_subject != NULL) {
322  MemBufferWriteString(aft->buffer, " Subject='%s'",
323  ssl_state->server_connp.cert0_subject);
324  }
325 
326  if (ssl_state->server_connp.cert0_issuerdn != NULL) {
327  MemBufferWriteString(aft->buffer, " Issuerdn='%s'",
328  ssl_state->server_connp.cert0_issuerdn);
329  }
330 
331  if (ssl_state->flags & SSL_AL_FLAG_SESSION_RESUMED) {
332  /* Only log a session as 'resumed' if a certificate has not
333  been seen. */
334  if ((ssl_state->server_connp.cert0_issuerdn == NULL) &&
335  (ssl_state->server_connp.cert0_subject == NULL) &&
336  (ssl_state->flags & SSL_AL_FLAG_STATE_SERVER_HELLO) &&
337  ((ssl_state->flags & SSL_AL_FLAG_LOG_WITHOUT_CERT) == 0)) {
338  MemBufferWriteString(aft->buffer, " Session='resumed'");
339  }
340  }
341 }
342 
343 static void LogTlsLogExtended(LogTlsLogThread *aft, SSLState *ssl_state,
344  const struct timeval *ts, char *srcip, Port sp,
345  char *dstip, Port dp)
346 {
347  if (ssl_state->server_connp.cert0_fingerprint != NULL) {
349  LogTlsLogString(aft->buffer, "SHA1",
350  ssl_state->server_connp.cert0_fingerprint);
351  }
352  if (ssl_state->client_connp.sni != NULL) {
354  LogTlsLogString(aft->buffer, "SNI", ssl_state->client_connp.sni);
355  }
356  if (ssl_state->server_connp.cert0_serial != NULL) {
358  LogTlsLogString(aft->buffer, "SERIAL",
359  ssl_state->server_connp.cert0_serial);
360  }
361 
363  LogTlsLogVersion(aft->buffer, ssl_state->server_connp.version);
364 
365  if (ssl_state->server_connp.cert0_not_before != 0) {
367  LogTlsLogDate(aft->buffer, "NOTBEFORE",
368  &ssl_state->server_connp.cert0_not_before);
369  }
370  if (ssl_state->server_connp.cert0_not_after != 0) {
372  LogTlsLogDate(aft->buffer, "NOTAFTER",
373  &ssl_state->server_connp.cert0_not_after);
374  }
375 }
376 
377 /* Custom format logging */
378 static void LogTlsLogCustom(LogTlsLogThread *aft, SSLState *ssl_state,
379  const struct timeval *ts, char *srcip, Port sp,
380  char *dstip, Port dp)
381 {
382  LogTlsFileCtx *tlslog_ctx = aft->tlslog_ctx;
383  uint32_t i;
384  char buf[64];
385 
386  for (i = 0; i < tlslog_ctx->cf->cf_n; i++)
387  {
388  LogCustomFormatNode *node = tlslog_ctx->cf->cf_nodes[i];
389  if (!node) /* Should never happen */
390  continue;
391 
392  switch (node->type) {
393  case LOG_CF_LITERAL:
394  /* LITERAL */
395  MemBufferWriteString(aft->buffer, "%s", node->data);
396  break;
397  case LOG_CF_TIMESTAMP:
398  /* TIMESTAMP */
400  break;
401  case LOG_CF_TIMESTAMP_U:
402  /* TIMESTAMP USECONDS */
403  snprintf(buf, sizeof(buf), "%06u", (unsigned int) ts->tv_usec);
404  PrintRawUriBuf((char *)aft->buffer->buffer,
405  &aft->buffer->offset,
406  aft->buffer->size, (uint8_t *)buf,
407  MIN(strlen(buf),6));
408  break;
409  case LOG_CF_CLIENT_IP:
410  /* CLIENT IP ADDRESS */
411  PrintRawUriBuf((char *)aft->buffer->buffer,
412  &aft->buffer->offset, aft->buffer->size,
413  (uint8_t *)srcip,strlen(srcip));
414  break;
415  case LOG_CF_SERVER_IP:
416  /* SERVER IP ADDRESS */
417  PrintRawUriBuf((char *)aft->buffer->buffer,
418  &aft->buffer->offset, aft->buffer->size,
419  (uint8_t *)dstip, strlen(dstip));
420  break;
421  case LOG_CF_CLIENT_PORT:
422  /* CLIENT PORT */
423  MemBufferWriteString(aft->buffer, "%" PRIu16 "", sp);
424  break;
425  case LOG_CF_SERVER_PORT:
426  /* SERVER PORT */
427  MemBufferWriteString(aft->buffer, "%" PRIu16 "", dp);
428  break;
429  case LOG_TLS_CF_VERSION:
430  LogTlsLogVersion(aft->buffer, ssl_state->server_connp.version);
431  break;
433  LogTlsLogDate(aft->buffer, "NOTBEFORE",
434  &ssl_state->server_connp.cert0_not_before);
435  break;
437  LogTlsLogDate(aft->buffer, "NOTAFTER",
438  &ssl_state->server_connp.cert0_not_after);
439  break;
440  case LOG_TLS_CF_SHA1:
441  if (ssl_state->server_connp.cert0_fingerprint != NULL) {
442  MemBufferWriteString(aft->buffer, "%s",
443  ssl_state->server_connp.cert0_fingerprint);
444  } else {
446  }
447  break;
448  case LOG_TLS_CF_SNI:
449  if (ssl_state->client_connp.sni != NULL) {
450  MemBufferWriteString(aft->buffer, "%s",
451  ssl_state->client_connp.sni);
452  } else {
454  }
455  break;
456  case LOG_TLS_CF_SUBJECT:
457  if (ssl_state->server_connp.cert0_subject != NULL) {
458  MemBufferWriteString(aft->buffer, "%s",
459  ssl_state->server_connp.cert0_subject);
460  } else {
462  }
463  break;
464  case LOG_TLS_CF_ISSUER:
465  if (ssl_state->server_connp.cert0_issuerdn != NULL) {
466  MemBufferWriteString(aft->buffer, "%s",
467  ssl_state->server_connp.cert0_issuerdn);
468  } else {
470  }
471  break;
472  case LOG_TLS_CF_EXTENDED:
473  /* Extended format */
474  LogTlsLogExtended(aft, ssl_state, ts, srcip, sp, dstip, dp);
475  break;
476  default:
477  /* NO MATCH */
479  SCLogDebug("No matching parameter %%%c for custom tls log.",
480  node->type);
481  break;
482  }
483  }
484 }
485 
486 
487 static int LogTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p,
488  Flow *f, void *state, void *tx, uint64_t tx_id)
489 {
490  LogTlsLogThread *aft = (LogTlsLogThread *)thread_data;
491  LogTlsFileCtx *hlog = aft->tlslog_ctx;
492  int ipproto = (PKT_IS_IPV4(p)) ? AF_INET : AF_INET6;
493 
494  SSLState *ssl_state = (SSLState *)state;
495  if (unlikely(ssl_state == NULL)) {
496  return 0;
497  }
498 
499  if (((hlog->flags & LOG_TLS_SESSION_RESUMPTION) == 0 ||
500  (ssl_state->flags & SSL_AL_FLAG_SESSION_RESUMED) == 0) &&
501  (ssl_state->server_connp.cert0_issuerdn == NULL ||
502  ssl_state->server_connp.cert0_subject == NULL) &&
503  ((ssl_state->flags & SSL_AL_FLAG_LOG_WITHOUT_CERT) == 0)) {
504  return 0;
505  }
506 
507  char srcip[PRINT_BUF_LEN], dstip[PRINT_BUF_LEN];
508 
509  Port sp, dp;
510  if (!TLSGetIPInformations(p, srcip, PRINT_BUF_LEN, &sp, dstip,
511  PRINT_BUF_LEN, &dp, ipproto)) {
512  return 0;
513  }
514 
515  MemBufferReset(aft->buffer);
516 
517  if (hlog->flags & LOG_TLS_CUSTOM) {
518  LogTlsLogCustom(aft, ssl_state, &p->ts, srcip, sp, dstip, dp);
519  } else if (hlog->flags & LOG_TLS_EXTENDED) {
520  LogTlsLogBasic(aft, ssl_state, &p->ts, srcip, sp, dstip, dp);
521  LogTlsLogExtended(aft, ssl_state, &p->ts, srcip, sp, dstip, dp);
522  } else {
523  LogTlsLogBasic(aft, ssl_state, &p->ts, srcip, sp, dstip, dp);
524  }
525 
526  MemBufferWriteString(aft->buffer, "\n");
527 
528  aft->tls_cnt++;
529 
530  hlog->file_ctx->Write((const char *)MEMBUFFER_BUFFER(aft->buffer),
531  MEMBUFFER_OFFSET(aft->buffer), hlog->file_ctx);
532 
533  return 0;
534 }
535 
537 {
539  LogTlsLogInitCtx, ALPROTO_TLS, LogTlsLogger, TLS_HANDSHAKE_DONE,
540  TLS_HANDSHAKE_DONE, LogTlsLogThreadInit, LogTlsLogThreadDeinit,
541  LogTlsLogExitPrintStats);
542 }
#define LOG_TLS_CF_DATE_NOT_AFTER
Definition: log-tlslog.c:74
struct LogTlsLogThread_ LogTlsLogThread
#define SSL_AL_FLAG_SESSION_RESUMED
uint32_t flags
Definition: log-tlslog.c:83
MemBuffer * MemBufferCreateNew(uint32_t size)
Definition: util-buffer.c:32
#define GET_IPV4_SRC_ADDR_PTR(p)
Definition: decode.h:214
#define SSL_AL_FLAG_STATE_SERVER_HELLO
Definition: app-layer-ssl.h:84
char * cert0_subject
time_t cert0_not_before
#define SCLogDebug(...)
Definition: util-debug.h:335
uint32_t flags
int LogCustomFormatParse(LogCustomFormat *cf, const char *format)
Parses and saves format nodes for custom format.
Definition: log-cf-common.c:94
#define LOG_CF_LITERAL
Definition: log-cf-common.h:40
#define MemBufferWriteString(dst,...)
Write a string buffer to the Membuffer dst.
Definition: util-buffer.h:162
#define LOG_TLS_DEFAULT
Definition: log-tlslog.c:66
char data[LOG_NODE_STRLEN]
Definition: log-cf-common.h:69
#define LOG_TLS_EXTENDED
Definition: log-tlslog.c:67
#define LOG_CF_WRITE_SPACE_SEPARATOR(buffer)
Definition: log-cf-common.h:56
#define LOG_TLS_CF_VERSION
Definition: log-tlslog.c:72
uint16_t version
#define unlikely(expr)
Definition: util-optimize.h:35
LogCustomFormat * cf
Definition: log-tlslog.c:84
#define GET_IPV4_DST_ADDR_PTR(p)
Definition: decode.h:215
Port sp
Definition: decode.h:415
char * cert0_fingerprint
#define MemBufferReset(mem_buffer)
Reset the mem buffer.
Definition: util-buffer.h:42
Port dp
Definition: decode.h:423
SSLStateConnp server_connp
#define MIN(x, y)
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
#define LOG_TLS_CF_SUBJECT
Definition: log-tlslog.c:77
time_t cert0_not_after
MemBuffer * buffer
Definition: log-tlslog.c:94
void CreateUtcIsoTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:203
#define LOG_CF_CLIENT_PORT
Definition: log-cf-common.h:45
uint32_t tls_cnt
Definition: log-tlslog.c:92
#define PKT_IS_IPV4(p)
Definition: decode.h:251
void SSLVersionToString(uint16_t version, char *buffer)
#define SSL_VERSION_MAX_STRLEN
#define LOG_TLS_CF_EXTENDED
Definition: log-tlslog.c:79
LogFileCtx * file_ctx
Definition: log-tlslog.c:82
SSLv[2.0|3.[0|1|2|3]] state structure.
#define SCCalloc(nm, a)
Definition: util-mem.h:253
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
Definition: conf.c:843
#define LOG_CF_SERVER_PORT
Definition: log-cf-common.h:46
LogCustomFormatNode * cf_nodes[LOG_MAXN_NODES]
Definition: log-cf-common.h:75
LogTlsFileCtx * tlslog_ctx
Definition: log-tlslog.c:88
struct LogTlsFileCtx_ LogTlsFileCtx
#define LOG_TLS_CF_SNI
Definition: log-tlslog.c:76
int TLSGetIPInformations(const Packet *p, char *srcip, size_t srcip_len, Port *sp, char *dstip, size_t dstip_len, Port *dp, int ipproto)
Definition: log-tlslog.c:97
#define LOG_TLS_CF_SHA1
Definition: log-tlslog.c:75
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:220
uint32_t size
Definition: util-buffer.h:29
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
#define LOG_CF_WRITE_UNKNOWN_VALUE(buffer)
Definition: log-cf-common.h:59
#define LOG_CF_TIMESTAMP_U
Definition: log-cf-common.h:42
#define LOG_TLS_CF_ISSUER
Definition: log-tlslog.c:78
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
void OutputRegisterTxModuleWithProgress(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a tx output module with progress.
Definition: output.c:360
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
uint8_t * buffer
Definition: util-buffer.h:28
#define PKT_IS_TOSERVER(p)
Definition: decode.h:257
#define DEFAULT_LOG_FILENAME
Definition: log-tlslog.c:57
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:267
#define LOG_TLS_CF_DATE_NOT_BEFORE
Definition: log-tlslog.c:73
#define LOG_TLS_SESSION_RESUMPTION
Definition: log-tlslog.c:70
uint16_t Port
Definition: decode.h:235
#define LOG_TLS_CUSTOM
Definition: log-tlslog.c:68
#define LOG_CF_CLIENT_IP
Definition: log-cf-common.h:43
#define LOG_CF_TIMESTAMP
Definition: log-cf-common.h:41
#define MEMBUFFER_BUFFER(mem_buffer)
Get the MemBuffers underlying buffer.
Definition: util-buffer.h:50
int ConfValIsTrue(const char *val)
Check if a value is true.
Definition: conf.c:566
void PrintRawUriBuf(char *retbuf, uint32_t *offset, uint32_t retbuflen, uint8_t *buf, uint32_t buflen)
Definition: util-print.c:118
Definition: conf.h:32
int(* Write)(const char *buffer, int buffer_len, struct LogFileCtx_ *fp)
OutputCtx * ctx
Definition: output.h:42
#define SCMalloc(a)
Definition: util-mem.h:222
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:219
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:254
#define OUTPUT_BUFFER_SIZE
Definition: log-tlslog.c:63
uint8_t version
Definition: decode-gre.h:405
#define SCFree(a)
Definition: util-mem.h:322
uint16_t tx_id
#define MEMBUFFER_OFFSET(mem_buffer)
Get the MemBuffers current offset.
Definition: util-buffer.h:55
#define MODULE_NAME
Definition: log-tlslog.c:59
uint64_t ts
void * data
Definition: tm-modules.h:81
#define PRINT_BUF_LEN
Definition: log-tlslog.c:61
#define LOG_CF_SERVER_IP
Definition: log-cf-common.h:44
Per thread variable structure.
Definition: threadvars.h:57
struct timeval ts
Definition: decode.h:451
#define LOG_CF_NONE
Definition: log-cf-common.h:39
void LogCustomFormatWriteTimestamp(MemBuffer *buffer, const char *fmt, const struct timeval *ts)
Writes a timestamp with given format into a MemBuffer.
#define SSL_AL_FLAG_LOG_WITHOUT_CERT
uint32_t offset
Definition: util-buffer.h:30
void LogTlsLogRegister(void)
Definition: log-tlslog.c:536
Flow data structure.
Definition: flow.h:325
SSLStateConnp client_connp
char * cert0_issuerdn
void MemBufferFree(MemBuffer *buffer)
Definition: util-buffer.c:82
void LogCustomFormatFree(LogCustomFormat *cf)
Frees memory held by a custom format.
Definition: log-cf-common.c:78
void CreateTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:245
LogCustomFormat * LogCustomFormatAlloc()
Creates a custom format.
Definition: log-cf-common.c:52