Go to the documentation of this file.
58 #define MODULE_NAME "EveStreamLog"
60 #define LOG_DROP_ALERTS 1
72 static TmEcode EveStreamLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
78 if (initdata == NULL) {
79 SCLogDebug(
"Error getting context for EveLogDrop. \"initdata\" argument NULL");
108 memset(aft, 0,
sizeof(*aft));
121 static void EveStreamLogDeInitCtxSub(
OutputCtx *output_ctx)
127 SCLogDebug(
"cleaning up sub output_ctx %p", output_ctx);
131 static uint16_t SetFlag(
ConfNode *conf,
const char *opt,
const uint16_t inflag)
151 EveStreamOutputCtxFree(ctx);
168 output_ctx->
data = ctx;
169 output_ctx->
DeInit = EveStreamLogDeInitCtxSub;
171 result.
ctx = output_ctx;
174 SCLogWarning(
"eve.stream facility is EXPERIMENTAL and can change w/o notice");
180 jb_open_array(jb, name);
182 jb_append_string(jb,
"has_gap");
184 jb_append_string(jb,
"noreassembly");
186 jb_append_string(jb,
"keepalive");
188 jb_append_string(jb,
"depth_reached");
190 jb_append_string(jb,
"trigger_raw");
192 jb_append_string(jb,
"timestamp");
194 jb_append_string(jb,
"zero_timestamp");
196 jb_append_string(jb,
"appproto_detection_completed");
198 jb_append_string(jb,
"appproto_detection_skipped");
200 jb_append_string(jb,
"new_raw_disabled");
202 jb_append_string(jb,
"disable_raw");
204 jb_append_string(jb,
"rst_recv");
210 jb_open_object(jb,
"flags");
212 jb_open_array(jb, name);
214 jb_append_string(jb,
"midstream");
217 jb_append_string(jb,
"midstream_established");
220 jb_append_string(jb,
"midstream_synack");
223 jb_append_string(jb,
"timestamp");
226 jb_append_string(jb,
"server_wscale");
229 jb_append_string(jb,
"closed_by_rst");
232 jb_append_string(jb,
"4whs");
235 jb_append_string(jb,
"detect_evasion_attempt");
238 jb_append_string(jb,
"client_sackok");
241 jb_append_string(jb,
"sackok");
244 jb_append_string(jb,
"3whs_confirmed");
247 jb_append_string(jb,
"app_layer_disabled");
250 jb_append_string(jb,
"bypass");
253 jb_append_string(jb,
"tcp_fast_open");
256 jb_append_string(jb,
"tfo_data_ignored");
262 static void LogStream(
const TcpStream *stream, JsonBuilder *js)
264 jb_set_uint(js,
"isn", stream->
isn);
265 jb_set_uint(js,
"next_seq", stream->
next_seq);
266 jb_set_uint(js,
"last_ack", stream->
last_ack);
267 jb_set_uint(js,
"next_win", stream->
next_win);
269 jb_set_uint(js,
"base_seq", stream->
base_seq);
272 jb_set_uint(js,
"window", stream->
window);
273 jb_set_uint(js,
"wscale", stream->
wscale);
299 if (p->
flow != NULL) {
301 jb_set_string(js,
"direction",
"to_server");
303 jb_set_string(js,
"direction",
"to_client");
307 jb_open_object(js,
"stream_tcp");
308 jb_open_object(js,
"packet");
334 jb_open_array(js,
"flags");
336 jb_append_string(js,
"retransmission");
338 jb_append_string(js,
"spurious_retransmission");
340 jb_append_string(js,
"keepalive");
342 jb_append_string(js,
"keepalive_ack");
344 jb_append_string(js,
"window_update");
347 jb_append_string(js,
"event_set");
349 jb_append_string(js,
"state_update");
351 jb_append_string(js,
"dup_ack");
353 jb_append_string(js,
"dsack");
355 jb_append_string(js,
"ack_unseen_data");
357 jb_append_string(js,
"tcp_port_reuse");
359 jb_append_string(js,
"zero_window_probe");
361 jb_append_string(js,
"zero_window_probe_ack");
366 jb_open_object(js,
"session");
370 if (tcp_state != NULL)
371 jb_set_string(js,
"state", tcp_state);
374 if (tcp_pstate != NULL)
375 jb_set_string(js,
"pstate", tcp_pstate);
379 jb_open_object(js,
"client");
380 LogStream(&ssn->
client, js);
382 jb_open_object(js,
"server");
383 LogStream(&ssn->
server, js);
389 jb_open_array(js,
"events");
390 for (
int i = 0; i < p->
events.
cnt; i++) {
400 jb_append_string(js, event);
407 jb_set_string(js,
"reason",
str);
432 return (p->
proto == IPPROTO_TCP &&
440 EveStreamLogInitCtxSub, EveStreamLogger, EveStreamLogCondition, EveStreamLogThreadInit,
441 EveStreamLogThreadDeinit, NULL);
#define STREAMTCP_FLAG_CLIENT_SACKOK
#define TCP_GET_RAW_X2(tcph)
#define STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT
const char * PacketDropReasonToString(enum PacketDropReason r)
uint8_t events[PACKET_ENGINE_EVENT_MAX]
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx)
#define STREAM_PKT_FLAG_DUP_ACK
#define STREAM_PKT_FLAG_KEEPALIVEACK
#define STREAM_PKT_FLAG_DSACK
int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx)
void EveAddFlowTcpStreamFlags(const TcpStream *stream, const char *name, JsonBuilder *jb)
OutputJsonThreadCtx * CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
#define STREAM_PKT_FLAG_RETRANSMISSION
const JsonAddrInfo json_addr_info_zero
#define FLOW_PKT_TOSERVER
#define STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED
#define STREAMTCP_STREAM_FLAG_KEEPALIVE
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
PacketEngineEvents events
int ConfValIsTrue(const char *val)
Check if a value is true.
#define STREAMTCP_FLAG_TFO_DATA_IGNORED
#define STREAMTCP_FLAG_MIDSTREAM
#define TCP_GET_WINDOW(p)
#define TCP_ISSET_FLAG_SYN(p)
#define STREAM_PKT_FLAG_TCP_PORT_REUSE
const struct DecodeEvents_ DEvents[]
#define STREAMTCP_FLAG_BYPASS
struct EveStreamLogThread_ EveStreamLogThread
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
#define STREAMTCP_STREAM_FLAG_RST_RECV
Per thread variable structure.
#define IPV4_GET_IPLEN(p)
#define TCP_ISSET_FLAG_URG(p)
#define STREAM_PKT_FLAG_TCP_ZERO_WIN_PROBE_ACK
#define SCLogWarning(...)
Macro used to log WARNING messages.
#define STREAM_PKT_FLAG_STATE_UPDATE
#define STREAMTCP_STREAM_FLAG_TIMESTAMP
#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED
uint16_t stream_pkt_flags
#define STREAMTCP_STREAM_FLAG_HAS_GAP
void EveStreamLogRegister(void)
#define STREAM_PKT_FLAG_KEEPALIVE
EveStreamOutputCtx * stream_ctx
#define STREAMTCP_FLAG_CLOSED_BY_RST
#define STREAMTCP_FLAG_TIMESTAMP
#define IPV6_GET_CLASS(p)
#define STREAM_PKT_FLAG_EVENTSET
#define STREAM_PKT_FLAG_TCP_ZERO_WIN_PROBE
void(* DeInit)(struct OutputCtx_ *)
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output sub-module.
#define TCP_ISSET_FLAG_ACK(p)
#define STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED
#define STREAMTCP_FLAG_MIDSTREAM_SYNACK
#define TCP_ISSET_FLAG_RST(p)
#define STREAM_PKT_FLAG_ACK_UNSEEN_DATA
#define IPV4_GET_IPTOS(p)
OutputJsonThreadCtx * ctx
void EveAddFlowTcpFlags(const TcpSession *ssn, const char *name, JsonBuilder *jb)
#define STREAM_PKT_FLAG_SPURIOUS_RETRANSMISSION
#define TCP_ISSET_FLAG_FIN(p)
#define STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP
#define STREAMTCP_FLAG_APP_LAYER_DISABLED
#define STREAMTCP_STREAM_FLAG_NOREASSEMBLY
#define TCP_GET_URG_POINTER(p)
const char * StreamTcpStateAsString(const enum TcpState state)
#define STREAMTCP_FLAG_3WHS_CONFIRMED
void JsonAddrInfoInit(const Packet *p, enum OutputJsonLogDirection dir, JsonAddrInfo *addr)
#define STREAMTCP_STREAM_FLAG_DISABLE_RAW
#define STREAMTCP_FLAG_4WHS
struct EveStreamOutputCtx_ EveStreamOutputCtx
#define STREAMTCP_STREAM_FLAG_TRIGGER_RAW
#define STREAM_PKT_FLAG_WINDOWUPDATE
#define STREAMTCP_FLAG_TCP_FAST_OPEN
#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED
#define IPV4_GET_IPTTL(p)
void OutputDropLoggerDisable(void)
#define TCP_ISSET_FLAG_PUSH(p)
#define STREAMTCP_FLAG_SERVER_WSCALE
#define EVENT_IS_DECODER_PACKET_ERROR(e)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.