output-json-email-common.c File Reference

#include "suricata-common.h"
#include "detect.h"
#include "pkt-var.h"
#include "conf.h"
#include "suricata.h"
#include "threads.h"
#include "threadvars.h"
#include "tm-threads.h"
#include "tm-threads-common.h"
#include "util-print.h"
#include "util-unittest.h"
#include "util-debug.h"
#include "app-layer-parser.h"
#include "output.h"
#include "app-layer-smtp.h"
#include "app-layer.h"
#include "util-privs.h"
#include "util-buffer.h"
#include "util-byte.h"
#include "util-logopenfile.h"
#include "output-json.h"
#include "output-json-email-common.h"

Include dependency graph for output-json-email-common.c:

Go to the source code of this file.

Macros
#define	LOG_EMAIL_DEFAULT   0
#define	LOG_EMAIL_EXTENDED   (1<<0)
#define	LOG_EMAIL_ARRAY   (1<<1) /* require array handling */
#define	LOG_EMAIL_COMMA   (1<<2) /* require array handling */
#define	LOG_EMAIL_BODY_MD5   (1<<3)
#define	LOG_EMAIL_SUBJECT_MD5   (1<<4)

Functions
TmEcode	EveEmailLogJson (JsonEmailLogThread *aft, SCJsonBuilder *js, const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id)
bool	EveEmailAddMetadata (const Flow *f, uint64_t tx_id, SCJsonBuilder *js)
void	OutputEmailInitConf (SCConfNode *conf, OutputJsonEmailCtx *email_ctx)

Variables
struct {
const char *   config_field
const char *   email_field
uint32_t   flags
}	email_fields []

Detailed Description

Author

Tom DeCanio td@np.nosp@m.ulse.nosp@m.tech..nosp@m.com

Eric Leblond eric@.nosp@m.regi.nosp@m.t.org

Implements json common email logging portion of the engine.

Definition in file output-json-email-common.c.

Macro Definition Documentation

LOG_EMAIL_ARRAY

#define LOG_EMAIL_ARRAY   (1<<1) /* require array handling */

Definition at line 58 of file output-json-email-common.c.

LOG_EMAIL_BODY_MD5

#define LOG_EMAIL_BODY_MD5   (1<<3)

Definition at line 60 of file output-json-email-common.c.

LOG_EMAIL_COMMA

#define LOG_EMAIL_COMMA   (1<<2) /* require array handling */

Definition at line 59 of file output-json-email-common.c.

LOG_EMAIL_DEFAULT

#define LOG_EMAIL_DEFAULT   0

Definition at line 56 of file output-json-email-common.c.

LOG_EMAIL_EXTENDED

#define LOG_EMAIL_EXTENDED   (1<<0)

Definition at line 57 of file output-json-email-common.c.

LOG_EMAIL_SUBJECT_MD5

#define LOG_EMAIL_SUBJECT_MD5   (1<<4)

Definition at line 61 of file output-json-email-common.c.

Function Documentation

EveEmailAddMetadata()

bool EveEmailAddMetadata	(	const Flow *	f,
		uint64_t	tx_id,
		SCJsonBuilder *	js
	)

Definition at line 195 of file output-json-email-common.c.

EveEmailLogJson()

TmEcode EveEmailLogJson	(	JsonEmailLogThread *	aft,
		SCJsonBuilder *	js,
		const Packet *	p,
		Flow *	f,
		void *	state,
		void *	vtx,
		uint64_t	tx_id
	)

Definition at line 170 of file output-json-email-common.c.

References JsonEmailLogThread_::emaillog_ctx.

OutputEmailInitConf()

void OutputEmailInitConf	(	SCConfNode *	conf,
		OutputJsonEmailCtx *	email_ctx
	)

Definition at line 208 of file output-json-email-common.c.

References config_field, email_field, email_fields, OutputJsonEmailCtx_::fields, OutputJsonEmailCtx_::flags, LOG_EMAIL_BODY_MD5, LOG_EMAIL_EXTENDED, LOG_EMAIL_SUBJECT_MD5, next, SCConfNodeLookupChild(), SCConfNodeLookupChildValue(), SCConfValIsTrue(), SCLogInfo, TAILQ_FOREACH, and SCConfNode_::val.

Here is the call graph for this function:

Variable Documentation

config_field

const char* config_field

Definition at line 63 of file output-json-email-common.c.

Referenced by OutputEmailInitConf().

email_field

const char* email_field

Definition at line 64 of file output-json-email-common.c.

Referenced by OutputEmailInitConf().

email_fields

struct { ... } email_fields[]

Initial value:

=  {
    { "reply_to", "reply-to", LOG_EMAIL_DEFAULT },
    { "bcc", "bcc", LOG_EMAIL_COMMA|LOG_EMAIL_EXTENDED },
    { "message_id", "message-id", LOG_EMAIL_EXTENDED },
    { "subject", "subject", LOG_EMAIL_EXTENDED },
    { "x_mailer", "x-mailer", LOG_EMAIL_EXTENDED },
    { "user_agent", "user-agent", LOG_EMAIL_EXTENDED },
    { "received", "received", LOG_EMAIL_ARRAY },
    { "x_originating_ip", "x-originating-ip", LOG_EMAIL_DEFAULT },
    { "in_reply_to",  "in-reply-to", LOG_EMAIL_DEFAULT },
    { "references",  "references", LOG_EMAIL_DEFAULT },
    { "importance",  "importance", LOG_EMAIL_DEFAULT },
    { "priority",  "priority", LOG_EMAIL_DEFAULT },
    { "sensitivity",  "sensitivity", LOG_EMAIL_DEFAULT },
    { "organization",  "organization", LOG_EMAIL_DEFAULT },
    { "content_md5",  "content-md5", LOG_EMAIL_DEFAULT },
    { "date", "date", LOG_EMAIL_DEFAULT },
    { NULL, NULL, LOG_EMAIL_DEFAULT},
}

Referenced by OutputEmailInitConf().

flags

uint32_t flags

Definition at line 65 of file output-json-email-common.c.