Go to the documentation of this file.
60 #define MODULE_NAME "JsonAnomalyLog"
62 #define ANOMALY_EVENT_TYPE "anomaly"
63 #define LOG_JSON_DECODE_TYPE BIT_U16(0)
64 #define LOG_JSON_STREAM_TYPE BIT_U16(1)
65 #define LOG_JSON_APPLAYER_TYPE BIT_U16(2)
66 #define LOG_JSON_PACKETHDR BIT_U16(3)
68 #define LOG_JSON_PACKET_TYPE (LOG_JSON_DECODE_TYPE | LOG_JSON_STREAM_TYPE)
69 #define ANOMALY_DEFAULTS LOG_JSON_APPLAYER_TYPE
71 #define TX_ID_UNUSED UINT64_MAX
87 #define MAX_ANOMALY_LOGGERS 1
88 static int anomaly_loggers = 0;
89 static bool OutputAnomalyLoggerEnable(
void)
98 static void OutputAnomalyLoggerDisable(
void)
111 for (
int i = 0; i < p->
events.
cnt; i++) {
114 if (is_decode && !log_decode)
116 if (!is_decode && !log_stream)
134 jb_set_string(js,
"event", event);
137 jb_set_uint(js,
"code", event_code);
156 bool is_pktlayer,
const char *layer, uint64_t tx_id)
160 SCLogDebug(
"decoder_events %p event_count %d (last logged %d) %s",
161 decoder_events, decoder_events->
cnt,
181 jb_set_string(js,
"app_proto", alprotoname);
183 const char *event_name = NULL;
184 uint8_t event_code = decoder_events->
events[i];
191 event_code, &event_name, &event_type);
195 jb_set_string(js,
"event", event_name);
198 jb_set_uint(js,
"code", event_code);
201 jb_set_string(js,
"layer", layer);
216 Flow *f,
void *state,
void *tx, uint64_t tx_id)
226 SCLogDebug(
"state %p, tx: %p, tx_id: %"PRIu64, state, tx, tx_id);
227 AnomalyAppLayerDecoderEventJson(aft, p, decoder_events,
false,
228 "proto_parser", tx_id);
233 static inline bool AnomalyHasParserEvents(
const Packet *p)
239 static inline bool AnomalyHasPacketAppLayerEvents(
const Packet *p)
251 rc = AnomalyDecodeEventJson(
tv, aft, p);
258 if (rc ==
TM_ECODE_OK && AnomalyHasPacketAppLayerEvents(p)) {
264 if (rc ==
TM_ECODE_OK && AnomalyHasParserEvents(p)) {
268 rc = AnomalyAppLayerDecoderEventJson(aft, p, parser_events,
280 return AnomalyJson(
tv, aft, p);
283 static int JsonAnomalyLogCondition(
ThreadVars *
tv,
void *thread_data,
const Packet *p)
287 AnomalyHasParserEvents(p);
290 static TmEcode JsonAnomalyLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
297 if (initdata == NULL) {
298 SCLogDebug(
"Error getting context for EveLogAnomaly. \"initdata\" argument NULL");
335 static void JsonAnomalyLogDeInitCtxSubHelper(
OutputCtx *output_ctx)
337 SCLogDebug(
"cleaning up sub output_ctx %p", output_ctx);
341 if (json_output_ctx != NULL) {
347 static void JsonAnomalyLogDeInitCtxSub(
OutputCtx *output_ctx)
349 OutputAnomalyLoggerDisable();
351 JsonAnomalyLogDeInitCtxSubHelper(output_ctx);
354 #define DEFAULT_LOG_FILENAME "anomaly.json"
355 static void SetFlag(
const ConfNode *conf,
const char *name, uint16_t flag, uint16_t *out_flags)
359 if (setting != NULL) {
371 static bool warn_no_flags =
false;
372 static bool warn_no_packet =
false;
377 if (typeconf != NULL) {
386 "type logging has not been selected. Packet headers will not be logged.");
387 warn_no_packet =
true;
391 if (
flags == 0 && !warn_no_flags) {
393 "have been selected. Select one or more logging types.");
394 warn_no_flags =
true;
410 if (
unlikely(json_output_ctx == NULL)) {
414 JsonAnomalyLogConf(json_output_ctx, conf);
415 json_output_ctx->
eve_ctx = ajt;
417 output_ctx->
data = json_output_ctx;
418 output_ctx->
DeInit = JsonAnomalyLogDeInitCtxSubHelper;
420 result.
ctx = output_ctx;
438 if (!OutputAnomalyLoggerEnable()) {
447 result.
ctx->
DeInit = JsonAnomalyLogDeInitCtxSub;
456 "eve-log.anomaly", JsonAnomalyLogInitCtxSub, JsonAnomalyLogger,
457 JsonAnomalyLogCondition, JsonAnomalyLogThreadInit, JsonAnomalyLogThreadDeinit,
462 JsonAnomalyTxLogger, JsonAnomalyLogThreadInit,
463 JsonAnomalyLogThreadDeinit, NULL);
#define LOG_JSON_PACKET_TYPE
uint8_t events[PACKET_ENGINE_EVENT_MAX]
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx)
#define MAX_ANOMALY_LOGGERS
enum AppLayerEventType_ AppLayerEventType
uint8_t event_last_logged
int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx)
OutputJsonThreadCtx * CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
#define LOG_JSON_APPLAYER_TYPE
OutputJsonThreadCtx * ctx
Data structure to store app layer decoder events.
AppLayerDecoderEvents * app_layer_events
PacketEngineEvents events
int ConfValIsTrue(const char *val)
Check if a value is true.
#define ANOMALY_EVENT_TYPE
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id, const char **event_name, AppLayerEventType *event_type)
AppLayerParserState * alparser
#define LOG_JSON_PACKETHDR
void JsonAnomalyLogRegister(void)
#define JB_SET_STRING(jb, key, val)
const struct DecodeEvents_ DEvents[]
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Per thread variable structure.
int AppLayerGetEventInfoById(int event_id, const char **event_name, AppLayerEventType *event_type)
JsonBuilder * CreateEveHeaderWithTxId(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, uint64_t tx_id, OutputJsonCtx *eve_ctx)
struct JsonAnomalyLogThread_ JsonAnomalyLogThread
#define LOG_JSON_STREAM_TYPE
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
void(* DeInit)(struct OutputCtx_ *)
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output sub-module.
AnomalyJsonOutputCtx * json_output_ctx
#define LOG_JSON_DECODE_TYPE
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
void EvePacket(const Packet *p, JsonBuilder *js, unsigned long max_length)
Jsonify a packet.
void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
AppProto alproto
application level protocol
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
#define DEBUG_VALIDATE_BUG_ON(exp)
struct AnomalyJsonOutputCtx_ AnomalyJsonOutputCtx
#define EVENT_IS_DECODER_PACKET_ERROR(e)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.