Go to the documentation of this file.
67 static JsonBuilder *CreateEveHeaderFromFlow(
const Flow *f)
70 char srcip[46] = {0}, dstip[46] = {0};
73 JsonBuilder *jb = jb_new_object();
79 memset(&
tv, 0x00,
sizeof(
tv));
86 PrintInet(AF_INET, (
const void *)&(f->
src.addr_data32[0]), srcip,
sizeof(srcip));
87 PrintInet(AF_INET, (
const void *)&(f->
dst.addr_data32[0]), dstip,
sizeof(dstip));
96 PrintInet(AF_INET, (
const void *)&(f->
dst.addr_data32[0]), srcip,
sizeof(srcip));
97 PrintInet(AF_INET, (
const void *)&(f->
src.addr_data32[0]), dstip,
sizeof(dstip));
107 jb_set_string(jb,
"timestamp", timebuf);
114 json_object_set_new(js,
"sensor_id", json_integer(sensor_id));
119 jb_set_string(jb,
"in_iface", f->
livedev->
dev);
126 jb_open_array(jb,
"vlan");
127 jb_append_uint(jb, f->
vlan_id[0]);
129 jb_append_uint(jb, f->
vlan_id[1]);
135 jb_set_string(jb,
"src_ip", srcip);
142 jb_set_uint(jb,
"src_port", sp);
145 jb_set_string(jb,
"dest_ip", dstip);
152 jb_set_uint(jb,
"dest_port", dp);
161 jb_set_string(jb,
"proto",
proto);
167 jb_set_uint(jb,
"icmp_type", f->
icmp_s.type);
168 jb_set_uint(jb,
"icmp_code", f->
icmp_s.code);
170 jb_set_uint(jb,
"response_icmp_type", f->
icmp_d.type);
171 jb_set_uint(jb,
"response_icmp_code", f->
icmp_d.code);
175 jb_set_uint(jb,
"spi", f->
esp.spi);
196 jb_set_string(js,
"app_proto_expected",
211 jb_open_object(js,
"bypassed");
226 jb_set_string(js,
"start", timebuf1);
235 jb_open_object(jb,
"flow");
240 jb_set_string(jb,
"end", timebuf2);
243 jb_set_uint(jb,
"age", age);
247 const char *state = NULL;
251 state =
"established";
257 switch (flow_state) {
261 #ifdef CAPTURE_OFFLOAD
262 case FLOW_STATE_CAPTURE_BYPASSED:
268 "Invalid flow state: %d, contact developers",
273 jb_set_string(jb,
"state", state);
275 const char *reason = NULL;
285 jb_set_string(jb,
"reason", reason);
297 if (f->
proto == IPPROTO_TCP) {
298 jb_open_object(jb,
"tcp");
303 snprintf(hexflags,
sizeof(hexflags),
"%02x",
305 jb_set_string(jb,
"tcp_flags", hexflags);
307 snprintf(hexflags,
sizeof(hexflags),
"%02x",
309 jb_set_string(jb,
"tcp_flags_ts", hexflags);
311 snprintf(hexflags,
sizeof(hexflags),
"%02x",
313 jb_set_string(jb,
"tcp_flags_tc", hexflags);
319 if (tcp_state != NULL)
320 jb_set_string(jb,
"state", tcp_state);
336 JsonBuilder *jb = CreateEveHeaderFromFlow(f);
341 EveFlowLogJSON(jhl, jb, f);
349 static void OutputFlowLogDeinitSub(
OutputCtx *output_ctx)
374 output_ctx->
data = flow_ctx;
375 output_ctx->
DeInit = OutputFlowLogDeinitSub;
377 result.
ctx = output_ctx;
382 static TmEcode JsonFlowLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
390 SCLogDebug(
"Error getting context for EveLogFlow. \"initdata\" argument NULL");
398 if (aft->
buffer == NULL) {
411 if (aft->
buffer != NULL) {
437 "eve-log.flow", OutputFlowLogInitSub, JsonFlowLogger,
438 JsonFlowLogThreadInit, JsonFlowLogThreadDeinit, NULL);
void CreateIsoTimeString(const struct timeval *ts, char *str, size_t size)
OutputJsonCommonSettings cfg
#define FLOW_END_FLAG_STATE_NEW
struct LogJsonFileCtx_ LogJsonFileCtx
#define JSON_OUTPUT_BUFFER_SIZE
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
#define FLOW_END_FLAG_STATE_ESTABLISHED
#define FLOW_END_FLAG_STATE_BYPASSED
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
int OutputJsonBuilderBuffer(JsonBuilder *js, LogFileCtx *file_ctx, MemBuffer **buffer)
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, JsonBuilder *js)
void JsonFlowLogRegister(void)
@ FLOW_STATE_LOCAL_BYPASSED
#define JB_SET_STRING(jb, key, val)
union FlowAddress_::@118 address
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
struct JsonFlowLogThread_ JsonFlowLogThread
LogFileCtx * LogFileEnsureExists(LogFileCtx *parent_ctx, int thread_id)
LogFileEnsureExists() Ensure a log file context for the thread exists.
void EveTcpFlags(const uint8_t flags, JsonBuilder *js)
jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.
#define FLOW_WRONG_THREAD
#define JB_SET_TRUE(jb, key)
LogJsonFileCtx * flowlog_ctx
#define FLOW_END_FLAG_EMERGENCY
#define MemBufferReset(mem_buffer)
Reset the mem buffer.
void(* DeInit)(struct OutputCtx_ *)
struct Flow_::@121::@127 icmp_d
void MemBufferFree(MemBuffer *buffer)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
void EveAddAppProto(Flow *f, JsonBuilder *js)
#define FLOW_END_FLAG_STATE_CLOSED
struct LiveDevice_ * livedev
OutputJsonCommonSettings cfg
void CreateEveFlowId(JsonBuilder *js, const Flow *f)
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a flow output sub-module.
void TimeGet(struct timeval *tv)
void * FlowGetStorageById(Flow *f, int id)
#define FLOW_END_FLAG_SHUTDOWN
const char * StreamTcpStateAsString(const enum TcpState state)
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
#define FLOW_END_FLAG_TIMEOUT
struct Flow_::@119::@126 esp
int GetFlowBypassInfoID(void)
AppProto alproto
application level protocol
#define FLOW_END_FLAG_FORCED
#define FLOW_DIR_REVERSED
struct Flow_::@119::@125 icmp_s
MemBuffer * MemBufferCreateNew(uint32_t size)
void EveAddFlow(Flow *f, JsonBuilder *js)