58 #define LOG_QUERIES BIT_U64(0)
59 #define LOG_ANSWERS BIT_U64(1)
61 #define LOG_A BIT_U64(2)
62 #define LOG_NS BIT_U64(3)
63 #define LOG_MD BIT_U64(4)
64 #define LOG_MF BIT_U64(5)
65 #define LOG_CNAME BIT_U64(6)
66 #define LOG_SOA BIT_U64(7)
67 #define LOG_MB BIT_U64(8)
68 #define LOG_MG BIT_U64(9)
69 #define LOG_MR BIT_U64(10)
70 #define LOG_NULL BIT_U64(11)
71 #define LOG_WKS BIT_U64(12)
72 #define LOG_PTR BIT_U64(13)
73 #define LOG_HINFO BIT_U64(14)
74 #define LOG_MINFO BIT_U64(15)
75 #define LOG_MX BIT_U64(16)
76 #define LOG_TXT BIT_U64(17)
77 #define LOG_RP BIT_U64(18)
78 #define LOG_AFSDB BIT_U64(19)
79 #define LOG_X25 BIT_U64(20)
80 #define LOG_ISDN BIT_U64(21)
81 #define LOG_RT BIT_U64(22)
82 #define LOG_NSAP BIT_U64(23)
83 #define LOG_NSAPPTR BIT_U64(24)
84 #define LOG_SIG BIT_U64(25)
85 #define LOG_KEY BIT_U64(26)
86 #define LOG_PX BIT_U64(27)
87 #define LOG_GPOS BIT_U64(28)
88 #define LOG_AAAA BIT_U64(29)
89 #define LOG_LOC BIT_U64(30)
90 #define LOG_NXT BIT_U64(31)
91 #define LOG_SRV BIT_U64(32)
92 #define LOG_ATMA BIT_U64(33)
93 #define LOG_NAPTR BIT_U64(34)
94 #define LOG_KX BIT_U64(35)
95 #define LOG_CERT BIT_U64(36)
96 #define LOG_A6 BIT_U64(37)
97 #define LOG_DNAME BIT_U64(38)
98 #define LOG_OPT BIT_U64(39)
99 #define LOG_APL BIT_U64(40)
100 #define LOG_DS BIT_U64(41)
101 #define LOG_SSHFP BIT_U64(42)
102 #define LOG_IPSECKEY BIT_U64(43)
103 #define LOG_RRSIG BIT_U64(44)
104 #define LOG_NSEC BIT_U64(45)
105 #define LOG_DNSKEY BIT_U64(46)
106 #define LOG_DHCID BIT_U64(47)
107 #define LOG_NSEC3 BIT_U64(48)
108 #define LOG_NSEC3PARAM BIT_U64(49)
109 #define LOG_TLSA BIT_U64(50)
110 #define LOG_HIP BIT_U64(51)
111 #define LOG_CDS BIT_U64(52)
112 #define LOG_CDNSKEY BIT_U64(53)
113 #define LOG_SPF BIT_U64(54)
114 #define LOG_TKEY BIT_U64(55)
115 #define LOG_TSIG BIT_U64(56)
116 #define LOG_MAILA BIT_U64(57)
117 #define LOG_ANY BIT_U64(58)
118 #define LOG_URI BIT_U64(59)
120 #define LOG_FORMAT_GROUPED BIT_U64(60)
121 #define LOG_FORMAT_DETAILED BIT_U64(61)
123 #define LOG_FORMAT_ALL (LOG_FORMAT_GROUPED|LOG_FORMAT_DETAILED)
124 #define LOG_ALL_RRTYPES (~(uint64_t)(LOG_QUERIES|LOG_ANSWERS|LOG_FORMAT_DETAILED|LOG_FORMAT_GROUPED))
191 } dns_rrtype_fields[] = {
264 JsonBuilder *queryjb = jb_new_array();
265 if (queryjb == NULL) {
269 for (uint16_t i = 0; i < UINT16_MAX; i++) {
270 JsonBuilder *js = jb_new_object();
276 jb_append_object(queryjb, js);
289 JsonBuilder *js = jb_new_object();
296 static int JsonDnsLoggerToServer(
ThreadVars *
tv,
void *thread_data,
297 const Packet *p,
Flow *f,
void *alstate,
void *txptr, uint64_t tx_id)
308 for (uint16_t i = 0; i < 0xffff; i++) {
314 jb_open_object(jb,
"dns");
328 static int JsonDnsLoggerToClient(
ThreadVars *
tv,
void *thread_data,
329 const Packet *p,
Flow *f,
void *alstate,
void *txptr, uint64_t tx_id)
346 jb_open_object(jb,
"dns");
357 void *txptr, uint64_t tx_id)
359 if (rs_dns_tx_is_request(txptr)) {
360 return JsonDnsLoggerToServer(
tv, thread_data, p, f, alstate, txptr, tx_id);
361 }
else if (rs_dns_tx_is_response(txptr)) {
362 return JsonDnsLoggerToClient(
tv, thread_data, p, f, alstate, txptr, tx_id);
367 static TmEcode LogDnsLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
375 SCLogDebug(
"Error getting context for EveLogDNS. \"initdata\" argument NULL");
409 static void LogDnsLogDeInitCtxSub(
OutputCtx *output_ctx)
411 SCLogDebug(
"cleaning up sub output_ctx %p", output_ctx);
418 const char *query_key,
const char *answer_key,
419 const char *answer_types_key)
433 if (response != NULL) {
457 dnslog_ctx->
flags |= dns_rrtype_fields[f].flags;
468 static void JsonDnsCheckVersion(
ConfNode *conf)
474 static bool v1_deprecation_warned =
false;
476 if (has_version != NULL) {
477 bool invalid =
false;
478 intmax_t config_version;
480 switch(config_version) {
484 if (!v1_deprecation_warned) {
486 "DNS EVE v1 logging has been removed, will use v2");
487 v1_deprecation_warned =
true;
506 dnslog_ctx->
flags = ~0ULL;
509 JsonDnsLogParseConfig(dnslog_ctx, conf,
"requests",
"responses",
"types");
516 if (strcasecmp(field->
val,
"detailed") == 0) {
518 }
else if (strcasecmp(field->
val,
"grouped") == 0) {
540 JsonDnsCheckVersion(conf);
558 output_ctx->
data = dnslog_ctx;
559 output_ctx->
DeInit = LogDnsLogDeInitCtxSub;
561 JsonDnsLogInitFilters(dnslog_ctx, conf);
568 result.
ctx = output_ctx;
574 #define MODULE_NAME "JsonDnsLog"
578 JsonDnsLogInitCtxSub,
ALPROTO_DNS, JsonDnsLogger, LogDnsLogThreadInit,
579 LogDnsLogThreadDeinit, NULL);