Go to the documentation of this file.
59 #define MODULE_NAME "JsonAnomalyLog"
61 #define ANOMALY_EVENT_TYPE "anomaly"
62 #define LOG_JSON_DECODE_TYPE BIT_U16(0)
63 #define LOG_JSON_STREAM_TYPE BIT_U16(1)
64 #define LOG_JSON_APPLAYER_TYPE BIT_U16(2)
65 #define LOG_JSON_PACKETHDR BIT_U16(3)
67 #define LOG_JSON_PACKET_TYPE (LOG_JSON_DECODE_TYPE | LOG_JSON_STREAM_TYPE)
68 #define ANOMALY_DEFAULTS LOG_JSON_APPLAYER_TYPE
70 #define TX_ID_UNUSED UINT64_MAX
86 #define MAX_ANOMALY_LOGGERS 1
87 static int anomaly_loggers = 0;
88 static bool OutputAnomalyLoggerEnable(
void)
97 static void OutputAnomalyLoggerDisable(
void)
110 for (
int i = 0; i < p->
events.
cnt; i++) {
113 if (is_decode && !log_decode)
115 if (!is_decode && !log_stream)
133 jb_set_string(js,
"event", event);
136 jb_set_uint(js,
"code", event_code);
155 bool is_pktlayer,
const char *layer, uint64_t tx_id)
159 SCLogDebug(
"decoder_events %p event_count %d (last logged %d) %s",
160 decoder_events, decoder_events->
cnt,
180 jb_set_string(js,
"app_proto", alprotoname);
182 const char *event_name = NULL;
183 uint8_t event_code = decoder_events->
events[i];
184 AppLayerEventType event_type;
190 event_code, &event_name, &event_type);
194 jb_set_string(js,
"event", event_name);
197 jb_set_uint(js,
"code", event_code);
200 jb_set_string(js,
"layer", layer);
215 Flow *f,
void *state,
void *tx, uint64_t tx_id)
225 SCLogDebug(
"state %p, tx: %p, tx_id: %"PRIu64, state, tx, tx_id);
226 AnomalyAppLayerDecoderEventJson(aft, p, decoder_events,
false,
227 "proto_parser", tx_id);
232 static inline bool AnomalyHasParserEvents(
const Packet *p)
238 static inline bool AnomalyHasPacketAppLayerEvents(
const Packet *p)
250 rc = AnomalyDecodeEventJson(
tv, aft, p);
257 if (rc ==
TM_ECODE_OK && AnomalyHasPacketAppLayerEvents(p)) {
263 if (rc ==
TM_ECODE_OK && AnomalyHasParserEvents(p)) {
267 rc = AnomalyAppLayerDecoderEventJson(aft, p, parser_events,
279 return AnomalyJson(
tv, aft, p);
282 static bool JsonAnomalyLogCondition(
ThreadVars *
tv,
void *thread_data,
const Packet *p)
286 AnomalyHasParserEvents(p);
289 static TmEcode JsonAnomalyLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
296 if (initdata == NULL) {
297 SCLogDebug(
"Error getting context for EveLogAnomaly. \"initdata\" argument NULL");
334 static void JsonAnomalyLogDeInitCtxSubHelper(
OutputCtx *output_ctx)
336 SCLogDebug(
"cleaning up sub output_ctx %p", output_ctx);
340 if (json_output_ctx != NULL) {
346 static void JsonAnomalyLogDeInitCtxSub(
OutputCtx *output_ctx)
348 OutputAnomalyLoggerDisable();
350 JsonAnomalyLogDeInitCtxSubHelper(output_ctx);
353 static void SetFlag(
const ConfNode *conf,
const char *name, uint16_t flag, uint16_t *out_flags)
357 if (setting != NULL) {
369 static bool warn_no_flags =
false;
370 static bool warn_no_packet =
false;
375 if (typeconf != NULL) {
383 SCLogWarning(
"Anomaly logging configured to include packet headers, however decode "
384 "type logging has not been selected. Packet headers will not be logged.");
385 warn_no_packet =
true;
389 if (
flags == 0 && !warn_no_flags) {
390 SCLogWarning(
"Anomaly logging has been configured; however, no logging types "
391 "have been selected. Select one or more logging types.");
392 warn_no_flags =
true;
408 if (
unlikely(json_output_ctx == NULL)) {
412 JsonAnomalyLogConf(json_output_ctx, conf);
413 json_output_ctx->
eve_ctx = ajt;
415 output_ctx->
data = json_output_ctx;
416 output_ctx->
DeInit = JsonAnomalyLogDeInitCtxSubHelper;
418 result.
ctx = output_ctx;
436 if (!OutputAnomalyLoggerEnable()) {
445 result.
ctx->
DeInit = JsonAnomalyLogDeInitCtxSub;
454 JsonAnomalyLogInitCtxSub, JsonAnomalyLogger, JsonAnomalyLogCondition,
455 JsonAnomalyLogThreadInit, JsonAnomalyLogThreadDeinit);
459 JsonAnomalyLogThreadInit, JsonAnomalyLogThreadDeinit);
#define LOG_JSON_PACKET_TYPE
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet output sub-module.
uint8_t events[PACKET_ENGINE_EVENT_MAX]
AppLayerDecoderEvents * AppLayerParserGetEventsByTx(uint8_t ipproto, AppProto alproto, void *tx)
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx)
#define MAX_ANOMALY_LOGGERS
uint8_t event_last_logged
int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx)
OutputJsonThreadCtx * CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
#define LOG_JSON_APPLAYER_TYPE
OutputJsonThreadCtx * ctx
Data structure to store app layer decoder events.
AppLayerDecoderEvents * app_layer_events
PacketEngineEvents events
int ConfValIsTrue(const char *val)
Check if a value is true.
#define ANOMALY_EVENT_TYPE
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, int event_id, const char **event_name, AppLayerEventType *event_type)
AppLayerParserState * alparser
#define LOG_JSON_PACKETHDR
void JsonAnomalyLogRegister(void)
#define JB_SET_STRING(jb, key, val)
const struct DecodeEvents_ DEvents[]
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Per thread variable structure.
int AppLayerGetEventInfoById(int event_id, const char **event_name, AppLayerEventType *event_type)
#define SCLogWarning(...)
Macro used to log WARNING messages.
JsonBuilder * CreateEveHeaderWithTxId(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, uint64_t tx_id, OutputJsonCtx *eve_ctx)
struct JsonAnomalyLogThread_ JsonAnomalyLogThread
#define LOG_JSON_STREAM_TYPE
ConfNode * ConfNodeLookupChild(const ConfNode *node, const char *name)
Lookup a child configuration node by name.
void(* DeInit)(struct OutputCtx_ *)
AnomalyJsonOutputCtx * json_output_ctx
#define LOG_JSON_DECODE_TYPE
void EvePacket(const Packet *p, JsonBuilder *js, unsigned long max_length)
Jsonify a packet.
#define SCLogError(...)
Macro used to log ERROR messages.
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
AppProto alproto
application level protocol
bool AppLayerParserHasDecoderEvents(AppLayerParserState *pstate)
#define DEBUG_VALIDATE_BUG_ON(exp)
struct AnomalyJsonOutputCtx_ AnomalyJsonOutputCtx
#define EVENT_IS_DECODER_PACKET_ERROR(e)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.