Go to the documentation of this file.
58 #define MODULE_NAME "EveStreamLog"
70 static TmEcode EveStreamLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
76 if (initdata == NULL) {
77 SCLogDebug(
"Error getting context for EveLogDrop. \"initdata\" argument NULL");
106 memset(aft, 0,
sizeof(*aft));
119 static void EveStreamLogDeInitCtxSub(
OutputCtx *output_ctx)
125 SCLogDebug(
"cleaning up sub output_ctx %p", output_ctx);
129 static uint16_t SetFlag(
SCConfNode *conf,
const char *opt,
const uint16_t inflag)
149 EveStreamOutputCtxFree(
ctx);
158 ctx->trigger_flags |=
162 ctx->trigger_flags |= SetFlag(conf,
"all", 0xFFFF);
168 output_ctx->
DeInit = EveStreamLogDeInitCtxSub;
170 result.
ctx = output_ctx;
173 SCLogWarning(
"eve.stream facility is EXPERIMENTAL and can change w/o notice");
179 SCJbOpenArray(jb,
name);
181 SCJbAppendString(jb,
"has_gap");
183 SCJbAppendString(jb,
"noreassembly");
185 SCJbAppendString(jb,
"keepalive");
187 SCJbAppendString(jb,
"depth_reached");
189 SCJbAppendString(jb,
"trigger_raw");
191 SCJbAppendString(jb,
"timestamp");
193 SCJbAppendString(jb,
"zero_timestamp");
195 SCJbAppendString(jb,
"appproto_detection_completed");
197 SCJbAppendString(jb,
"appproto_detection_skipped");
199 SCJbAppendString(jb,
"new_raw_disabled");
201 SCJbAppendString(jb,
"disable_raw");
203 SCJbAppendString(jb,
"rst_recv");
209 SCJbOpenObject(jb,
"flags");
211 SCJbOpenArray(jb,
name);
213 SCJbAppendString(jb,
"midstream");
216 SCJbAppendString(jb,
"midstream_established");
219 SCJbAppendString(jb,
"midstream_synack");
222 SCJbAppendString(jb,
"timestamp");
225 SCJbAppendString(jb,
"server_wscale");
228 SCJbAppendString(jb,
"closed_by_rst");
231 SCJbAppendString(jb,
"4whs");
234 SCJbAppendString(jb,
"detect_evasion_attempt");
237 SCJbAppendString(jb,
"client_sackok");
240 SCJbAppendString(jb,
"sackok");
243 SCJbAppendString(jb,
"3whs_confirmed");
246 SCJbAppendString(jb,
"app_layer_disabled");
249 SCJbAppendString(jb,
"bypass");
252 SCJbAppendString(jb,
"tcp_fast_open");
255 SCJbAppendString(jb,
"tfo_data_ignored");
266 static void LogStream(
const TcpStream *stream, SCJsonBuilder *js)
268 SCJbSetUint(js,
"isn", stream->
isn);
269 SCJbSetUint(js,
"next_seq", stream->
next_seq);
270 SCJbSetUint(js,
"last_ack", stream->
last_ack);
271 SCJbSetUint(js,
"next_win", stream->
next_win);
273 SCJbSetUint(js,
"base_seq", stream->
base_seq);
276 SCJbSetUint(js,
"window", stream->
window);
277 SCJbSetUint(js,
"wscale", stream->
wscale);
287 SCJbSetUint(js,
"seg_cnt", segs);
288 LogStreamSB(&stream->
sb, js);
312 if (p->
flow != NULL) {
314 SCJbSetString(js,
"direction",
"to_server");
316 SCJbSetString(js,
"direction",
"to_client");
320 SCJbOpenObject(js,
"stream_tcp");
321 SCJbOpenObject(js,
"packet");
323 if (PacketIsIPv4(p)) {
324 const IPV4Hdr *ip4h = PacketGetIPv4(p);
329 }
else if (PacketIsIPv6(p)) {
330 const IPV6Hdr *ip6h = PacketGetIPv6(p);
336 if (PacketIsTCP(p)) {
337 const TCPHdr *tcph = PacketGetTCP(p);
350 SCJbOpenArray(js,
"flags");
352 SCJbAppendString(js,
"retransmission");
354 SCJbAppendString(js,
"spurious_retransmission");
356 SCJbAppendString(js,
"keepalive");
358 SCJbAppendString(js,
"keepalive_ack");
360 SCJbAppendString(js,
"window_update");
363 SCJbAppendString(js,
"event_set");
365 SCJbAppendString(js,
"state_update");
367 SCJbAppendString(js,
"dup_ack");
369 SCJbAppendString(js,
"dsack");
371 SCJbAppendString(js,
"ack_unseen_data");
373 SCJbAppendString(js,
"tcp_session_reuse");
375 SCJbAppendString(js,
"zero_window_probe");
377 SCJbAppendString(js,
"zero_window_probe_ack");
382 SCJbOpenObject(js,
"session");
386 if (tcp_state != NULL)
387 SCJbSetString(js,
"state", tcp_state);
390 if (tcp_pstate != NULL)
391 SCJbSetString(js,
"pstate", tcp_pstate);
395 SCJbOpenObject(js,
"client");
396 LogStream(&ssn->
client, js);
398 SCJbOpenObject(js,
"server");
399 LogStream(&ssn->
server, js);
405 SCJbOpenArray(js,
"events");
406 for (
int i = 0; i < p->
events.
cnt; i++) {
416 SCJbAppendString(js, event);
423 SCJbSetString(js,
"reason",
str);
448 return (p->
proto == IPPROTO_TCP &&
449 (
ctx->trigger_flags == 0xffff ||
458 .ConditionFunc = EveStreamLogCondition,
459 .ThreadInitFunc = EveStreamLogThreadInit,
460 .ThreadDeinitFunc = EveStreamLogThreadDeinit,
461 .ThreadExitPrintStatsFunc = NULL,
465 EveStreamLogInitCtxSub, &output_logger_functions);
#define TCP_GET_RAW_SEQ(tcph)
#define IPV4_GET_RAW_IPID(ip4h)
int OutputJsonLogFlush(ThreadVars *tv, void *thread_data, const Packet *p)
#define STREAMTCP_FLAG_CLIENT_SACKOK
int SCConfValIsTrue(const char *val)
Check if a value is true.
#define TCP_GET_RAW_X2(tcph)
#define IPV6_GET_RAW_PLEN(ip6h)
#define IPV6_GET_RAW_HLIM(ip6h)
#define STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT
const char * PacketDropReasonToString(enum PacketDropReason r)
uint8_t events[PACKET_ENGINE_EVENT_MAX]
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx)
#define STREAM_PKT_FLAG_DUP_ACK
SCJsonBuilder * CreateEveHeader(const Packet *p, enum SCOutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
#define STREAM_PKT_FLAG_KEEPALIVEACK
#define STREAM_PKT_FLAG_DSACK
#define IPV6_GET_RAW_CLASS(ip6h)
OutputJsonThreadCtx * CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
#define STREAM_PKT_FLAG_RETRANSMISSION
const JsonAddrInfo json_addr_info_zero
#define FLOW_PKT_TOSERVER
#define STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED
#define STREAMTCP_STREAM_FLAG_KEEPALIVE
void OutputJsonBuilderBuffer(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *js, OutputJsonThreadCtx *ctx)
const char * SCConfNodeLookupChildValue(const SCConfNode *node, const char *name)
Lookup the value of a child configuration node by name.
#define TCP_GET_RAW_WINDOW(tcph)
#define STREAMTCP_STREAM_FLAG_DEPTH_REACHED
PacketEngineEvents events
#define STREAMTCP_FLAG_TFO_DATA_IGNORED
#define STREAMTCP_FLAG_MIDSTREAM
void JsonAddrInfoInit(const Packet *p, enum SCOutputJsonLogDirection dir, JsonAddrInfo *addr)
#define IPV4_GET_RAW_IPTOS(ip4h)
const struct DecodeEvents_ DEvents[]
#define STREAMTCP_FLAG_BYPASS
#define TCP_ISSET_FLAG_RAW_ACK(tcph)
#define TCP_ISSET_FLAG_RAW_RST(tcph)
struct EveStreamLogThread_ EveStreamLogThread
#define STREAMTCP_STREAM_FLAG_RST_RECV
Per thread variable structure.
#define STREAM_PKT_FLAG_TCP_ZERO_WIN_PROBE_ACK
#define SCLogWarning(...)
Macro used to log WARNING messages.
#define STREAM_PKT_FLAG_STATE_UPDATE
#define STREAMTCP_STREAM_FLAG_TIMESTAMP
#define RB_FOREACH(x, name, head)
#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED
#define IPV4_GET_RAW_IPTTL(ip4h)
uint16_t stream_pkt_flags
#define TCP_ISSET_FLAG_RAW_FIN(tcph)
#define STREAMTCP_STREAM_FLAG_HAS_GAP
#define STREAM_PKT_FLAG_TCP_SESSION_REUSE
void EveAddFlowTcpStreamFlags(const TcpStream *stream, const char *name, SCJsonBuilder *jb)
void EveStreamLogRegister(void)
#define STREAM_PKT_FLAG_KEEPALIVE
EveStreamOutputCtx * stream_ctx
#define STREAMTCP_FLAG_CLOSED_BY_RST
#define STREAMTCP_FLAG_TIMESTAMP
#define STREAM_PKT_FLAG_EVENTSET
#define STREAM_PKT_FLAG_TCP_ZERO_WIN_PROBE
void(* DeInit)(struct OutputCtx_ *)
#define IPV6_GET_RAW_FLOW(ip6h)
#define STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED
#define STREAMTCP_FLAG_MIDSTREAM_SYNACK
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, OutputPacketLoggerFunctions *output_logger_functions)
Register a packet output sub-module.
#define STREAM_PKT_FLAG_ACK_UNSEEN_DATA
OutputJsonThreadCtx * ctx
#define STREAM_PKT_FLAG_SPURIOUS_RETRANSMISSION
#define STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP
#define STREAMTCP_FLAG_APP_LAYER_DISABLED
#define STREAMTCP_STREAM_FLAG_NOREASSEMBLY
const char * StreamTcpStateAsString(const enum TcpState state)
#define STREAMTCP_FLAG_3WHS_CONFIRMED
#define IPV4_GET_RAW_IPLEN(ip4h)
#define TCP_ISSET_FLAG_RAW_SYN(tcph)
#define STREAMTCP_STREAM_FLAG_DISABLE_RAW
#define STREAMTCP_FLAG_4WHS
struct EveStreamOutputCtx_ EveStreamOutputCtx
#define TCP_GET_RAW_URG_POINTER(tcph)
StreamingBufferRegion region
#define STREAMTCP_STREAM_FLAG_TRIGGER_RAW
#define TCP_GET_RAW_ACK(tcph)
#define TCP_ISSET_FLAG_RAW_URG(tcph)
#define STREAM_PKT_FLAG_WINDOWUPDATE
union PacketL4::L4Vars vars
#define STREAMTCP_FLAG_TCP_FAST_OPEN
void EveAddFlowTcpFlags(const TcpSession *ssn, const char *name, SCJsonBuilder *jb)
#define STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED
void OutputDropLoggerDisable(void)
#define TCP_ISSET_FLAG_RAW_PUSH(tcph)
#define STREAMTCP_FLAG_SERVER_WSCALE
#define EVENT_IS_DECODER_PACKET_ERROR(e)