suricata
output-json-arp.c
Go to the documentation of this file.
1 /* Copyright (C) 2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Giuseppe Longo <giuseppe@glongo.it>
22  *
23  * Implement JSON/eve logging for ARP Protocol.
24  */
25 
26 #include "suricata-common.h"
27 #include "detect.h"
28 #include "flow.h"
29 #include "conf.h"
30 
31 #include "threads.h"
32 #include "tm-threads.h"
33 #include "threadvars.h"
34 #include "util-debug.h"
35 
36 #include "decode-ipv4.h"
37 #include "detect-parse.h"
38 #include "detect-engine.h"
39 #include "detect-reference.h"
40 
41 #include "output.h"
42 #include "output-json.h"
43 #include "output-json-arp.h"
44 
46 #include "util-privs.h"
47 #include "util-print.h"
48 #include "util-proto-name.h"
49 #include "util-logopenfile.h"
50 #include "util-time.h"
51 #include "util-buffer.h"
52 
53 static const char *OpcodeToString(uint16_t opcode)
54 {
55  switch (opcode) {
56  case 1:
57  return "request";
58  case 2:
59  return "reply";
60  case 3:
61  return "request_reverse";
62  case 4:
63  return "reply_reverse";
64  default:
65  return "unknown";
66  }
67 }
68 
69 static int JsonArpLogger(ThreadVars *tv, void *thread_data, const Packet *p)
70 {
71  OutputJsonThreadCtx *thread = thread_data;
72  char srcip[JSON_ADDR_LEN] = "";
73  char dstip[JSON_ADDR_LEN] = "";
74  const ARPHdr *arph = PacketGetARP(p);
75 
76  JsonBuilder *jb = CreateEveHeader(p, LOG_DIR_PACKET, "arp", NULL, thread->ctx);
77  if (unlikely(jb == NULL)) {
78  return TM_ECODE_OK;
79  }
80 
81  PrintInet(AF_INET, arph->source_ip, srcip, sizeof(srcip));
82  PrintInet(AF_INET, arph->dest_ip, dstip, sizeof(dstip));
83 
84  jb_open_object(jb, "arp");
85  JB_SET_STRING(jb, "hw_type", "ethernet");
86  JB_SET_STRING(jb, "proto_type", "ipv4");
87  jb_set_string(jb, "opcode", OpcodeToString(ntohs(arph->opcode)));
88  JSONFormatAndAddMACAddr(jb, "src_mac", arph->source_mac, false);
89  jb_set_string(jb, "src_ip", srcip);
90  JSONFormatAndAddMACAddr(jb, "dest_mac", arph->dest_mac, false);
91  jb_set_string(jb, "dest_ip", dstip);
92  jb_close(jb); /* arp */
93  OutputJsonBuilderBuffer(tv, p, p->flow, jb, thread);
94  jb_free(jb);
95 
96  return TM_ECODE_OK;
97 }
98 
99 static bool JsonArpLogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
100 {
101  return PacketIsARP(p);
102 }
103 
105 {
106  OutputRegisterPacketSubModule(LOGGER_JSON_ARP, "eve-log", "JsonArpLog", "eve-log.arp",
107  OutputJsonLogInitSub, JsonArpLogger, JsonArpLogCondition, JsonLogThreadInit,
109 
110  SCLogDebug("ARP JSON logger registered.");
111 }
JSONFormatAndAddMACAddr
void JSONFormatAndAddMACAddr(JsonBuilder *js, const char *key, const uint8_t *val, bool is_array)
Definition: output-json.c:701
tm-threads.h
OutputJsonLogInitSub
OutputInitResult OutputJsonLogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
Definition: output-json-common.c:73
detect-engine.h
OutputJsonThreadCtx_::ctx
OutputJsonCtx * ctx
Definition: output-json.h:90
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
OutputRegisterPacketSubModule
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a packet output sub-module.
Definition: output.c:206
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
opcode
uint16_t opcode
Definition: decode-arp.h:4
JsonLogThreadInit
TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data)
Definition: output-json-common.c:90
threads.h
LOGGER_JSON_ARP
@ LOGGER_JSON_ARP
Definition: suricata-common.h:494
OutputJsonBuilderBuffer
void OutputJsonBuilderBuffer(ThreadVars *tv, const Packet *p, Flow *f, JsonBuilder *js, OutputJsonThreadCtx *ctx)
Definition: output-json.c:958
output-json-arp.h
util-privs.h
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
OutputJsonThreadCtx_
Definition: output-json.h:89
detect-reference.h
util-debug.h
JB_SET_STRING
#define JB_SET_STRING(jb, key, val)
Definition: rust.h:26
output-json.h
CreateEveHeader
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Definition: output-json.c:806
util-print.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:230
util-time.h
Packet_
Definition: decode.h:476
conf.h
util-proto-name.h
decode-ipv4.h
Packet_::flow
struct Flow_ * flow
Definition: decode.h:515
LOG_DIR_PACKET
@ LOG_DIR_PACKET
Definition: output-json.h:37
suricata-common.h
JSON_ADDR_LEN
#define JSON_ADDR_LEN
Definition: output-json.h:43
util-classification-config.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
threadvars.h
util-logopenfile.h
detect-parse.h
util-buffer.h
JsonArpLogRegister
void JsonArpLogRegister(void)
Definition: output-json-arp.c:104
JsonLogThreadDeinit
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data)
Definition: output-json-common.c:123
flow.h
output.h