Go to the documentation of this file.
70 #define MODULE_NAME "JsonAlertLog"
72 #define LOG_JSON_PAYLOAD BIT_U16(0)
73 #define LOG_JSON_PACKET BIT_U16(1)
74 #define LOG_JSON_PAYLOAD_BASE64 BIT_U16(2)
75 #define LOG_JSON_TAGGED_PACKETS BIT_U16(3)
76 #define LOG_JSON_APP_LAYER BIT_U16(4)
77 #define LOG_JSON_FLOW BIT_U16(5)
78 #define LOG_JSON_HTTP_BODY BIT_U16(6)
79 #define LOG_JSON_HTTP_BODY_BASE64 BIT_U16(7)
80 #define LOG_JSON_RULE_METADATA BIT_U16(8)
81 #define LOG_JSON_RULE BIT_U16(9)
82 #define LOG_JSON_VERDICT BIT_U16(10)
83 #define LOG_JSON_WEBSOCKET_PAYLOAD BIT_U16(11)
84 #define LOG_JSON_WEBSOCKET_PAYLOAD_BASE64 BIT_U16(12)
85 #define LOG_JSON_PAYLOAD_LENGTH BIT_U16(13)
87 #define METADATA_DEFAULTS ( LOG_JSON_FLOW | \
88 LOG_JSON_APP_LAYER | \
89 LOG_JSON_RULE_METADATA)
91 #define JSON_BODY_LOGGING \
92 (LOG_JSON_HTTP_BODY | LOG_JSON_HTTP_BODY_BASE64 | LOG_JSON_WEBSOCKET_PAYLOAD | \
93 LOG_JSON_WEBSOCKET_PAYLOAD_BASE64)
95 #define JSON_STREAM_BUFFER_SIZE 4096
115 jb_open_object(js,
"source");
117 jb_set_string(js,
"ip", addr->
src_ip);
125 jb_set_uint(js,
"port", addr->
sp);
129 jb_set_string(js,
"ip", addr->
dst_ip);
137 jb_set_uint(js,
"port", addr->
dp);
143 jb_open_object(js,
"target");
145 jb_set_string(js,
"ip", addr->
dst_ip);
153 jb_set_uint(js,
"port", addr->
dp);
157 jb_set_string(js,
"ip", addr->
src_ip);
165 jb_set_uint(js,
"port", addr->
sp);
184 const char *action =
"allowed";
201 jb_set_uint(js,
"tx_id", pa->
tx_id);
204 jb_open_object(js,
"alert");
206 jb_set_string(js,
"action", action);
207 jb_set_uint(js,
"gid", pa->
s->
gid);
208 jb_set_uint(js,
"signature_id", pa->
s->
id);
209 jb_set_uint(js,
"rev", pa->
s->
rev);
212 jb_set_string(js,
"signature", pa->
s->
msg ? pa->
s->
msg:
"");
214 jb_set_uint(js,
"severity", pa->
s->
prio);
217 jb_set_uint(js,
"tenant_id", p->
tenant_id);
221 AlertJsonSourceTarget(p, pa, js, addr);
225 AlertJsonMetadata(json_output_ctx, pa, js);
229 jb_set_string(js,
"rule", pa->
s->
sig_str);
231 if (xff_buffer && xff_buffer[0]) {
232 jb_set_string(js,
"xff", xff_buffer);
238 static void AlertJsonTunnel(
const Packet *p, JsonBuilder *js)
240 if (p->
root == NULL) {
244 jb_open_object(js,
"tunnel");
253 jb_set_string(js,
"src_ip", addr.
src_ip);
254 jb_set_uint(js,
"src_port", addr.
sp);
255 jb_set_string(js,
"dest_ip", addr.
dst_ip);
256 jb_set_uint(js,
"dest_port", addr.
dp);
257 jb_set_string(js,
"proto", addr.
proto);
261 jb_set_uint(js,
"pcap_cnt", pcap_cnt);
283 jb_set_string(js,
"payload_printable", (
char *)printable_buf);
287 static void AlertAddAppLayer(
const Packet *p, JsonBuilder *jb,
288 const uint64_t tx_id,
const uint16_t option_flags)
292 JsonBuilderMark mark = { 0, 0, 0 };
293 if (al && al->
LogTx) {
294 void *state = FlowGetAppState(p->
flow);
298 jb_get_mark(jb, &mark);
306 if (!SCWebSocketLogDetails(tx, jb, pp, pb64)) {
307 jb_restore_mark(jb, &mark);
313 if (!al->
LogTx(tx, jb)) {
314 jb_restore_mark(jb, &mark);
323 jb_open_object(jb,
"http");
335 jb_get_mark(jb, &mark);
336 jb_open_object(jb,
"smtp");
340 jb_restore_mark(jb, &mark);
342 jb_get_mark(jb, &mark);
343 jb_open_object(jb,
"email");
347 jb_restore_mark(jb, &mark);
352 jb_get_mark(jb, &mark);
353 jb_open_object(jb,
"rpc");
357 jb_restore_mark(jb, &mark);
360 jb_get_mark(jb, &mark);
361 jb_open_object(jb,
"nfs");
365 jb_restore_mark(jb, &mark);
369 jb_get_mark(jb, &mark);
370 jb_open_object(jb,
"smb");
374 jb_restore_mark(jb, &mark);
378 jb_get_mark(jb, &mark);
380 jb_restore_mark(jb, &mark);
384 void *state = FlowGetAppState(p->
flow);
388 jb_get_mark(jb, &mark);
389 jb_open_object(jb,
"dcerpc");
390 if (p->
proto == IPPROTO_TCP) {
391 if (!rs_dcerpc_log_json_record_tcp(state, tx, jb)) {
392 jb_restore_mark(jb, &mark);
395 if (!rs_dcerpc_log_json_record_udp(state, tx, jb)) {
396 jb_restore_mark(jb, &mark);
409 static void AlertAddFiles(
const Packet *p, JsonBuilder *jb,
const uint64_t tx_id)
411 const uint8_t direction =
427 jb_open_array(jb,
"files");
440 static void AlertAddFrame(
441 const Packet *p,
const int64_t frame_id, JsonBuilder *jb,
MemBuffer *buffer)
447 if (frames_container == NULL)
452 if (p->
proto == IPPROTO_TCP) {
456 frames = &frames_container->
toserver;
459 frames = &frames_container->
toclient;
465 }
else if (p->
proto == IPPROTO_UDP) {
467 frames = &frames_container->
toserver;
469 frames = &frames_container->
toclient;
486 jb_open_object(jb,
"verdict");
503 jb_open_array(jb,
"reject");
508 jb_append_string(jb,
"icmp-prohib");
511 jb_append_string(jb,
"tcp-reset");
534 static int AlertJsonStreamDataCallback(
535 void *cb_data,
const uint8_t *input,
const uint32_t input_len,
const uint64_t input_offset)
538 if (input_offset > cbd->
last_re) {
540 cbd->
payload,
"[%" PRIu64
" bytes missing]", input_offset - cbd->
last_re);
545 if (written < input_len)
547 cbd->
last_re = input_offset + input_len;
581 jb_set_string(jb,
"payload_printable", (
char *)printable_buf);
595 for (
int i = 0; i < p->
alerts.
cnt; i++) {
647 if (PacketIsTunnel(p)) {
648 AlertJsonTunnel(p, jb);
651 if (p->
flow != NULL) {
654 AlertAddAppLayer(p, jb, pa->
tx_id, json_output_ctx->
flags);
658 AlertAddFiles(p, jb, pa->
tx_id);
665 jb_set_string(jb,
"direction",
"to_server");
667 jb_set_string(jb,
"direction",
"to_client");
671 jb_open_object(jb,
"flow");
674 jb_set_string(jb,
"src_ip", addr.
dst_ip);
675 jb_set_string(jb,
"dest_ip", addr.
src_ip);
677 jb_set_uint(jb,
"src_port", addr.
dp);
678 jb_set_uint(jb,
"dest_port", addr.
sp);
681 jb_set_string(jb,
"src_ip", addr.
src_ip);
682 jb_set_string(jb,
"dest_ip", addr.
dst_ip);
684 jb_set_uint(jb,
"src_port", addr.
sp);
685 jb_set_uint(jb,
"dest_port", addr.
dp);
693 if (json_output_ctx->
flags &
695 int stream = (p->
proto == IPPROTO_TCP) ?
702 if (stream && p->
flow != NULL) {
703 const bool stream_data_logged =
704 AlertJsonStreamData(json_output_ctx, aft, p->
flow, p, jb);
707 AlertAddPayload(json_output_ctx, jb, p);
711 AlertAddPayload(json_output_ctx, jb, p);
714 jb_set_uint(jb,
"stream", stream);
741 JsonBuilder *packetjs =
763 for (
int i = 0; i < p->
alerts.
cnt; i++) {
769 JsonBuilder *jb = jb_new_object();
775 jb_set_string(jb,
"timestamp", timebuf);
790 if (PacketIsIPv4(p) || PacketIsIPv6(p)) {
791 return AlertJson(
tv, aft, p);
793 return AlertJsonDecoderEvent(
tv, aft, p);
803 static TmEcode JsonAlertLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
809 if (initdata == NULL)
811 SCLogDebug(
"Error getting context for EveLogAlert. \"initdata\" argument NULL");
857 static void JsonAlertLogDeInitCtxSub(
OutputCtx *output_ctx)
859 SCLogDebug(
"cleaning up sub output_ctx %p", output_ctx);
863 if (json_output_ctx != NULL) {
865 if (xff_cfg != NULL) {
873 static void SetFlag(
const ConfNode *conf,
const char *name, uint16_t flag, uint16_t *out_flags)
877 if (setting != NULL) {
889 static bool warn_no_meta =
false;
896 if (metadata != NULL) {
924 static const char *deprecated_flags[] = {
"http",
"tls",
"ssh",
"smtp",
"dnp3",
"app-layer",
926 for (
int i = 0; deprecated_flags[i] != NULL; i++) {
928 SCLogWarning(
"Found deprecated eve-log.alert flag \"%s\", this flag has no effect",
929 deprecated_flags[i]);
935 if (payload_buffer_value != NULL) {
939 "payload-buffer-size - %s. Killing engine",
940 payload_buffer_value);
943 payload_buffer_size = value;
949 SCLogWarning(
"HTTP body logging has been configured, however, "
950 "metadata logging has not been enabled. HTTP body logging will be "
971 if (
likely(xff_cfg != NULL)) {
994 if (
unlikely(json_output_ctx == NULL)) {
999 json_output_ctx->
eve_ctx = ajt;
1001 JsonAlertLogSetupMetadata(json_output_ctx, conf);
1002 json_output_ctx->
xff_cfg = JsonAlertLogGetXffCfg(conf);
1003 if (json_output_ctx->
xff_cfg == NULL) {
1007 output_ctx->
data = json_output_ctx;
1008 output_ctx->
DeInit = JsonAlertLogDeInitCtxSub;
1010 result.
ctx = output_ctx;
1015 if (json_output_ctx != NULL) {
1018 if (output_ctx != NULL) {
1028 JsonAlertLogInitCtxSub, JsonAlertLogger, JsonAlertLogCondition, JsonAlertLogThreadInit,
1029 JsonAlertLogThreadDeinit);
bool PacketCheckAction(const Packet *p, const uint8_t a)
#define PACKET_ALERT_FLAG_STREAM_MATCH
bool EveSMTPAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
const struct Signature_ * s
void EveHttpLogJSONBodyPrintable(JsonBuilder *js, Flow *f, uint64_t tx_id)
#define PACKET_ALERT_FLAG_TX
void CreateIsoTimeString(const SCTime_t ts, char *str, size_t size)
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet output sub-module.
HttpXFFCfg * parent_xff_cfg
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx)
#define SIG_FLAG_DEST_IS_TARGET
EveJsonSimpleAppLayerLogger * SCEveJsonSimpleGetLogger(AppProto alproto)
bool EveNFSAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx)
OutputJsonThreadCtx * CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
const JsonAddrInfo json_addr_info_zero
#define FLOW_PKT_TOSERVER
#define ACTION_REJECT_ANY
void EveFileInfo(JsonBuilder *jb, const File *ff, const uint64_t tx_id, const uint16_t flags)
#define ACTION_DROP_REJECT
bool EveHttpAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
int ConfValIsTrue(const char *val)
Check if a value is true.
int HttpXFFGetIP(const Flow *f, HttpXFFCfg *xff_cfg, char *dstbuf, int dstbuflen)
Function to return XFF IP if any. The caller needs to lock the flow.
char * PcapLogGetFilename(void)
void PrintStringsToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32_t dst_buf_size, const uint8_t *src_buf, const uint32_t src_buf_len)
AppLayerGetFileState AppLayerParserGetTxFiles(const Flow *f, void *tx, const uint8_t direction)
size_t strlcpy(char *dst, const char *src, size_t siz)
#define JSON_BODY_LOGGING
#define ACTION_REJECT_DST
OutputJsonThreadCtx * ctx
#define JB_SET_STRING(jb, key, val)
#define PKT_IS_TOSERVER(p)
#define LOG_JSON_APP_LAYER
#define LOG_JSON_WEBSOCKET_PAYLOAD
Frame * FrameGetById(Frames *frames, const int64_t id)
bool EveIKEAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
#define STREAM_BASE_OFFSET(stream)
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Per thread variable structure.
const char * PktSrcToString(enum PktSrcEnum pkt_src)
struct JsonAlertLogThread_ JsonAlertLogThread
#define SCLogWarning(...)
Macro used to log WARNING messages.
void EveHttpLogJSONBodyBase64(JsonBuilder *js, Flow *f, uint64_t tx_id)
FramesContainer * AppLayerFramesGetContainer(Flow *f)
#define JSON_STREAM_BUFFER_SIZE
#define LOG_JSON_PAYLOAD_BASE64
#define SIG_FLAG_HAS_TARGET
#define LOG_JSON_PAYLOAD_LENGTH
#define SIG_FLAG_SRC_IS_TARGET
bool EveNFSAddMetadataRPC(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
void AlertJsonHeader(void *ctx, const Packet *p, const PacketAlert *pa, JsonBuilder *js, uint16_t flags, JsonAddrInfo *addr, char *xff_buffer)
uint32_t payload_buffer_size
bool ConfNodeHasChildren(const ConfNode *node)
Check if a node has any children.
#define FLOW_PKT_TOCLIENT
#define LOG_JSON_TAGGED_PACKETS
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
bool EveEmailAddMetadata(const Flow *f, uint32_t tx_id, JsonBuilder *js)
char proto[JSON_PROTO_LEN]
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
#define ACTION_REJECT_BOTH
#define PACKET_ALERT_RATE_FILTER_MODIFIED
#define LOG_JSON_WEBSOCKET_PAYLOAD_BASE64
void(* DeInit)(struct OutputCtx_ *)
char pcap_filename[PATH_MAX]
EveJsonSimpleTxLogFunc LogTx
AlertJsonOutputCtx * json_output_ctx
void EveAddVerdict(JsonBuilder *jb, const Packet *p)
Build verdict object.
void MemBufferFree(MemBuffer *buffer)
void EveAddAppProto(Flow *f, JsonBuilder *js)
void EvePacket(const Packet *p, JsonBuilder *js, unsigned long max_length)
Jsonify a packet.
int ParseSizeStringU32(const char *size, uint32_t *res)
char src_ip[JSON_ADDR_LEN]
DetectMetadataHead * metadata
#define PACKET_ALERT_FLAG_FRAME
#define SCLogError(...)
Macro used to log ERROR messages.
struct AlertJsonOutputCtx_ AlertJsonOutputCtx
MemBuffer * payload_buffer
#define LOG_JSON_HTTP_BODY_BASE64
int ConfValIsFalse(const char *val)
Check if a value is false.
void FrameJsonLogOneFrame(const uint8_t ipproto, const Frame *frame, Flow *f, const TcpStream *stream, const Packet *p, JsonBuilder *jb, MemBuffer *buffer)
log a single frame
char dst_ip[JSON_ADDR_LEN]
#define LOG_JSON_HTTP_BODY
#define METADATA_DEFAULTS
int EngineModeIsIPS(void)
uint32_t MemBufferWriteRaw(MemBuffer *dst, const uint8_t *raw, const uint32_t raw_len)
Write a raw buffer to the MemBuffer dst.
void MemBufferWriteString(MemBuffer *dst, const char *fmt,...)
void JsonAddrInfoInit(const Packet *p, enum OutputJsonLogDirection dir, JsonAddrInfo *addr)
void HttpXFFGetCfg(ConfNode *conf, HttpXFFCfg *result)
Function to return XFF configuration from a configuration node.
int HttpXFFGetIPFromTx(const Flow *f, uint64_t tx_id, HttpXFFCfg *xff_cfg, char *dstbuf, int dstbuflen)
Function to return XFF IP if any in the selected transaction. The caller needs to lock the flow.
void DetectEngineSetParseMetadata(void)
bool EveSMBAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *jb)
AppProto alproto
application level protocol
int StreamReassembleLog(const TcpSession *ssn, const TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, const uint64_t progress_in, uint64_t *progress_out, const bool eof)
#define LOG_JSON_RULE_METADATA
#define PACKET_ALERT_FLAG_STATE_MATCH
#define DEBUG_VALIDATE_BUG_ON(exp)
MemBuffer * MemBufferCreateNew(uint32_t size)
void JsonAlertLogRegister(void)
void EveAddFlow(Flow *f, JsonBuilder *js)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.