Go to the documentation of this file.
61 #define MODULE_NAME "JsonDropLog"
63 #define LOG_DROP_ALERTS BIT_U8(1)
64 #define LOG_DROP_VERDICT BIT_U8(2)
77 static int g_droplog_flows_start = 1;
99 if (p->
flow != NULL) {
101 jb_set_string(js,
"direction",
"to_server");
103 jb_set_string(js,
"direction",
"to_client");
107 jb_open_object(js,
"drop");
156 jb_set_string(js,
"reason",
str);
196 static TmEcode JsonDropLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
204 SCLogDebug(
"Error getting context for EveLogDrop. \"initdata\" argument NULL");
233 memset(aft, 0,
sizeof(*aft));
241 if (drop_ctx != NULL) {
246 static void JsonDropLogDeInitCtxSub(
OutputCtx *output_ctx)
252 SCLogDebug(
"cleaning up sub output_ctx %p", output_ctx);
268 if (drop_ctx == NULL)
273 JsonDropOutputCtxFree(drop_ctx);
279 if (extended != NULL) {
285 if (extended != NULL) {
286 if (strcasecmp(extended,
"start") == 0) {
287 g_droplog_flows_start = 1;
288 }
else if (strcasecmp(extended,
"all") == 0) {
289 g_droplog_flows_start = 0;
292 "'flow' are 'start' and 'all'");
296 if (extended != NULL) {
305 output_ctx->
data = drop_ctx;
306 output_ctx->
DeInit = JsonDropLogDeInitCtxSub;
308 result.
ctx = output_ctx;
325 int r = DropLogJSON(td, p);
329 if (!g_droplog_flows_start)
355 SCLogDebug(
"engine is not running in inline mode, so returning");
359 SCLogDebug(
"drop log doesn't log pseudo packets");
367 if (g_droplog_flows_start && p->
flow != NULL) {
391 "eve-log.drop", JsonDropLogInitCtxSub, JsonDropLogger,
392 JsonDropLogCondition, JsonDropLogThreadInit, JsonDropLogThreadDeinit,
#define PKT_IS_TOCLIENT(p)
bool PacketCheckAction(const Packet *p, const uint8_t a)
#define TCP_GET_RAW_X2(tcph)
int OutputDropLoggerEnable(void)
const struct Signature_ * s
JsonDropOutputCtx * drop_ctx
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
const char * PacketDropReasonToString(enum PacketDropReason r)
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx)
#define ICMPV6_GET_SEQ(p)
struct JsonDropOutputCtx_ JsonDropOutputCtx
int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx)
OutputJsonThreadCtx * CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
const JsonAddrInfo json_addr_info_zero
#define FLOW_PKT_TOSERVER
#define IPV6_GET_L4PROTO(p)
#define FLOW_TOSERVER_DROP_LOGGED
int ConfValIsTrue(const char *val)
Check if a value is true.
#define TCP_GET_WINDOW(p)
#define TCP_ISSET_FLAG_SYN(p)
#define ICMPV4_GET_SEQ(p)
#define ACTION_REJECT_DST
#define IPV4_GET_IPPROTO(p)
#define PKT_IS_TOSERVER(p)
OutputJsonThreadCtx * ctx
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Per thread variable structure.
#define IPV4_GET_IPLEN(p)
#define TCP_ISSET_FLAG_URG(p)
#define SCLogWarning(...)
Macro used to log WARNING messages.
void AlertJsonHeader(void *ctx, const Packet *p, const PacketAlert *pa, JsonBuilder *js, uint16_t flags, JsonAddrInfo *addr, char *xff_buffer)
#define ACTION_REJECT_BOTH
#define IPV6_GET_CLASS(p)
void(* DeInit)(struct OutputCtx_ *)
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output sub-module.
void EveAddVerdict(JsonBuilder *jb, const Packet *p)
Build verdict object.
#define TCP_ISSET_FLAG_ACK(p)
#define TCP_ISSET_FLAG_RST(p)
#define IPV4_GET_IPTOS(p)
#define SCLogError(...)
Macro used to log ERROR messages.
struct JsonDropLogThread_ JsonDropLogThread
#define TCP_ISSET_FLAG_FIN(p)
void JsonDropLogRegister(void)
#define FLOW_TOCLIENT_DROP_LOGGED
int EngineModeIsIPS(void)
#define TCP_GET_URG_POINTER(p)
void JsonAddrInfoInit(const Packet *p, enum OutputJsonLogDirection dir, JsonAddrInfo *addr)
#define IPV4_GET_IPTTL(p)
void OutputDropLoggerDisable(void)
#define TCP_ISSET_FLAG_PUSH(p)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.