Go to the documentation of this file.
56 static SCJsonBuilder *CreateEveHeaderFromFlow(
const Flow *f)
59 char srcip[46] = {0}, dstip[46] = {0};
62 SCJsonBuilder *jb = SCJbNewObject();
73 PrintInet(AF_INET, (
const void *)&(f->
src.addr_data32[0]), srcip,
sizeof(srcip));
74 PrintInet(AF_INET, (
const void *)&(f->
dst.addr_data32[0]), dstip,
sizeof(dstip));
83 PrintInet(AF_INET, (
const void *)&(f->
dst.addr_data32[0]), srcip,
sizeof(srcip));
84 PrintInet(AF_INET, (
const void *)&(f->
src.addr_data32[0]), dstip,
sizeof(dstip));
94 SCJbSetString(jb,
"timestamp", timebuf);
101 json_object_set_new(js,
"sensor_id", json_integer(sensor_id));
106 SCJbSetString(jb,
"in_iface", f->
livedev->
dev);
113 SCJbOpenArray(jb,
"vlan");
114 SCJbAppendUint(jb, f->
vlan_id[0]);
116 SCJbAppendUint(jb, f->
vlan_id[1]);
119 SCJbAppendUint(jb, f->
vlan_id[2]);
125 SCJbSetString(jb,
"src_ip", srcip);
132 SCJbSetUint(jb,
"src_port", sp);
135 SCJbSetString(jb,
"dest_ip", dstip);
142 SCJbSetUint(jb,
"dest_port", dp);
148 SCJbSetUint(jb,
"ip_v", 4);
150 SCJbSetUint(jb,
"ip_v", 6);
158 SCJbSetString(jb,
"proto",
proto);
164 SCJbSetUint(jb,
"icmp_type", f->
icmp_s.type);
165 SCJbSetUint(jb,
"icmp_code", f->
icmp_s.code);
167 SCJbSetUint(jb,
"response_icmp_type", f->
icmp_d.type);
168 SCJbSetUint(jb,
"response_icmp_code", f->
icmp_d.code);
172 SCJbSetUint(jb,
"spi", f->
esp.spi);
207 SCJbOpenObject(js,
"bypassed");
222 SCJbSetString(js,
"start", timebuf1);
225 static void EveExceptionPolicyLog(SCJsonBuilder *js, uint16_t flag)
229 SCJbSetString(js,
"target",
231 SCJbSetString(js,
"policy",
238 SCJbSetString(js,
"target",
240 SCJbSetString(js,
"policy",
247 SCJbSetString(js,
"target",
249 SCJbSetString(js,
"policy",
259 SCJbSetString(js,
"policy",
268 SCJbSetString(js,
"policy",
275 SCJbSetString(js,
"target",
277 SCJbSetString(js,
"policy",
288 SCJbOpenObject(jb,
"flow");
293 SCJbSetString(jb,
"end", timebuf2);
296 SCJbSetUint(jb,
"age", age);
302 switch (flow_state) {
316 #ifdef CAPTURE_OFFLOAD
317 case FLOW_STATE_CAPTURE_BYPASSED:
324 SCLogDebug(
"invalid flow state: %d, contact developers", flow_state);
327 const char *reason = NULL;
329 reason =
"tcp_reuse";
339 SCJbSetString(jb,
"reason", reason);
356 SCJbOpenArray(jb,
"exception_policy");
364 SCJbSetUint(jb,
"tx_cnt", tx_id);
374 if (f->
proto == IPPROTO_TCP) {
375 SCJbOpenObject(jb,
"tcp");
380 snprintf(hexflags,
sizeof(hexflags),
"%02x",
382 SCJbSetString(jb,
"tcp_flags", hexflags);
384 snprintf(hexflags,
sizeof(hexflags),
"%02x",
386 SCJbSetString(jb,
"tcp_flags_ts", hexflags);
388 snprintf(hexflags,
sizeof(hexflags),
"%02x",
390 SCJbSetString(jb,
"tcp_flags_tc", hexflags);
396 if (tcp_state != NULL)
397 SCJbSetString(jb,
"state", tcp_state);
425 MemBufferReset(thread->
buffer);
427 SCJsonBuilder *jb = CreateEveHeaderFromFlow(f);
432 EveFlowLogJSON(thread, jb, f);
void CreateIsoTimeString(const SCTime_t ts, char *str, size_t size)
void EveAddFlow(Flow *f, SCJsonBuilder *js)
OutputJsonCommonSettings cfg
FlowStorageId GetFlowBypassInfoID(void)
void EveAddAppProto(Flow *f, SCJsonBuilder *js)
TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
#define EXCEPTION_TARGET_FLAG_APPLAYER_ERROR
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
void EveTcpFlags(const uint8_t flags, SCJsonBuilder *js)
jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.
const char * known_proto[256]
void OutputJsonBuilderBuffer(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *js, OutputJsonThreadCtx *ctx)
void CreateEveFlowId(SCJsonBuilder *js, const Flow *f)
const char * ExceptionPolicyTargetFlagToString(uint8_t target_flag)
void JsonFlowLogRegister(void)
OutputInitResult OutputJsonLogInitSub(SCConfNode *conf, OutputCtx *parent_ctx)
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow output sub-module.
@ FLOW_STATE_LOCAL_BYPASSED
#define EXCEPTION_TARGET_FLAG_DEFRAG_MEMCAP
enum ExceptionPolicy ExceptionPolicyTargetPolicy(uint8_t target_flag)
#define JB_SET_STRING(jb, key, val)
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, SCJsonBuilder *js, enum SCOutputJsonLogDirection dir)
union FlowAddress_::@118 address
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
#define FLOW_WRONG_THREAD
#define JB_SET_TRUE(jb, key)
#define FLOW_END_FLAG_TCPREUSE
#define FLOW_END_FLAG_EMERGENCY
#define STREAMTCP_STREAM_FLAG_HAS_GAP
#define EXCEPTION_TARGET_FLAG_REASSEMBLY_MEMCAP
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
#define EXCEPTION_TARGET_FLAG_MIDSTREAM
uint8_t applied_exception_policy
#define EXCEPTION_TARGET_FLAG_SESSION_MEMCAP
struct Flow_::@121::@127 icmp_d
struct LiveDevice_ * livedev
#define FLOW_ACTION_ACCEPT
const char * ExceptionPolicyEnumToString(enum ExceptionPolicy policy, bool is_json)
#define FLOW_END_FLAG_SHUTDOWN
#define EXCEPTION_TARGET_FLAG_FLOW_MEMCAP
const char * StreamTcpStateAsString(const enum TcpState state)
uint16_t vlan_id[VLAN_MAX_LAYERS]
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
#define FLOW_END_FLAG_TIMEOUT
struct Flow_::@119::@126 esp
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data)
AppProto alproto
application level protocol
#define FLOW_END_FLAG_FORCED
#define FLOW_DIR_REVERSED
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
struct Flow_::@119::@125 icmp_s
#define DEBUG_VALIDATE_BUG_ON(exp)