suricata
output-json-flow.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Implements Flow JSON logging portion of the engine.
24  */
25 
26 #include "suricata-common.h"
27 #include "debug.h"
28 #include "detect.h"
29 #include "pkt-var.h"
30 #include "conf.h"
31 
32 #include "threads.h"
33 #include "threadvars.h"
34 #include "tm-threads.h"
35 
36 #include "util-print.h"
37 #include "util-unittest.h"
38 
39 #include "util-debug.h"
40 
41 #include "output.h"
42 #include "util-privs.h"
43 #include "util-buffer.h"
44 #include "util-proto-name.h"
45 #include "util-logopenfile.h"
46 #include "util-time.h"
47 #include "output-json.h"
48 #include "output-json-flow.h"
49 
50 #include "stream-tcp.h"
51 #include "stream-tcp-private.h"
52 #include "flow-storage.h"
53 
54 typedef struct LogJsonFileCtx_ {
56  uint32_t flags; /** Store mode */
59 
60 typedef struct JsonFlowLogThread_ {
62  /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
65 
66 static JsonBuilder *CreateEveHeaderFromFlow(const Flow *f, const char *event_type)
67 {
68  char timebuf[64];
69  char srcip[46] = {0}, dstip[46] = {0};
70  Port sp, dp;
71 
72  JsonBuilder *jb = jb_new_object();
73  if (unlikely(jb == NULL)) {
74  return NULL;
75  }
76 
77  struct timeval tv;
78  memset(&tv, 0x00, sizeof(tv));
79  TimeGet(&tv);
80 
81  CreateIsoTimeString(&tv, timebuf, sizeof(timebuf));
82 
83  if ((f->flags & FLOW_DIR_REVERSED) == 0) {
84  if (FLOW_IS_IPV4(f)) {
85  PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), srcip, sizeof(srcip));
86  PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), dstip, sizeof(dstip));
87  } else if (FLOW_IS_IPV6(f)) {
88  PrintInet(AF_INET6, (const void *)&(f->src.address), srcip, sizeof(srcip));
89  PrintInet(AF_INET6, (const void *)&(f->dst.address), dstip, sizeof(dstip));
90  }
91  sp = f->sp;
92  dp = f->dp;
93  } else {
94  if (FLOW_IS_IPV4(f)) {
95  PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), srcip, sizeof(srcip));
96  PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), dstip, sizeof(dstip));
97  } else if (FLOW_IS_IPV6(f)) {
98  PrintInet(AF_INET6, (const void *)&(f->dst.address), srcip, sizeof(srcip));
99  PrintInet(AF_INET6, (const void *)&(f->src.address), dstip, sizeof(dstip));
100  }
101  sp = f->dp;
102  dp = f->sp;
103  }
104 
105  /* time */
106  jb_set_string(jb, "timestamp", timebuf);
107 
108  CreateEveFlowId(jb, (const Flow *)f);
109 
110 #if 0 // TODO
111  /* sensor id */
112  if (sensor_id >= 0)
113  json_object_set_new(js, "sensor_id", json_integer(sensor_id));
114 #endif
115 
116  /* input interface */
117  if (f->livedev) {
118  jb_set_string(jb, "in_iface", f->livedev->dev);
119  }
120 
121  if (event_type) {
122  jb_set_string(jb, "event_type", event_type);
123  }
124 
125  /* vlan */
126  if (f->vlan_idx > 0) {
127  jb_open_array(jb, "vlan");
128  jb_append_uint(jb, f->vlan_id[0]);
129  if (f->vlan_idx > 1) {
130  jb_append_uint(jb, f->vlan_id[1]);
131  }
132  jb_close(jb);
133  }
134 
135  /* tuple */
136  jb_set_string(jb, "src_ip", srcip);
137  switch(f->proto) {
138  case IPPROTO_ICMP:
139  break;
140  case IPPROTO_UDP:
141  case IPPROTO_TCP:
142  case IPPROTO_SCTP:
143  jb_set_uint(jb, "src_port", sp);
144  break;
145  }
146  jb_set_string(jb, "dest_ip", dstip);
147  switch(f->proto) {
148  case IPPROTO_ICMP:
149  break;
150  case IPPROTO_UDP:
151  case IPPROTO_TCP:
152  case IPPROTO_SCTP:
153  jb_set_uint(jb, "dest_port", dp);
154  break;
155  }
156 
157  if (SCProtoNameValid(f->proto)) {
158  jb_set_string(jb, "proto", known_proto[f->proto]);
159  } else {
160  char proto[4];
161  snprintf(proto, sizeof(proto), "%"PRIu8"", f->proto);
162  jb_set_string(jb, "proto", proto);
163  }
164 
165  switch (f->proto) {
166  case IPPROTO_ICMP:
167  case IPPROTO_ICMPV6:
168  jb_set_uint(jb, "icmp_type", f->icmp_s.type);
169  jb_set_uint(jb, "icmp_code", f->icmp_s.code);
170  if (f->tosrcpktcnt) {
171  jb_set_uint(jb, "response_icmp_type", f->icmp_d.type);
172  jb_set_uint(jb, "response_icmp_code", f->icmp_d.code);
173  }
174  break;
175  }
176  return jb;
177 }
178 
179 void EveAddAppProto(Flow *f, JsonBuilder *js)
180 {
181  if (f->alproto) {
182  jb_set_string(js, "app_proto", AppProtoToString(f->alproto));
183  }
184  if (f->alproto_ts && f->alproto_ts != f->alproto) {
185  jb_set_string(js, "app_proto_ts", AppProtoToString(f->alproto_ts));
186  }
187  if (f->alproto_tc && f->alproto_tc != f->alproto) {
188  jb_set_string(js, "app_proto_tc", AppProtoToString(f->alproto_tc));
189  }
190  if (f->alproto_orig != f->alproto && f->alproto_orig != ALPROTO_UNKNOWN) {
191  jb_set_string(js, "app_proto_orig", AppProtoToString(f->alproto_orig));
192  }
193  if (f->alproto_expect != f->alproto && f->alproto_expect != ALPROTO_UNKNOWN) {
194  jb_set_string(js, "app_proto_expected",
196  }
197 
198 }
199 
200 void EveAddFlow(Flow *f, JsonBuilder *js)
201 {
203  if (fc) {
204  jb_set_uint(js, "pkts_toserver", f->todstpktcnt + fc->todstpktcnt);
205  jb_set_uint(js, "pkts_toclient", f->tosrcpktcnt + fc->tosrcpktcnt);
206  jb_set_uint(js, "bytes_toserver", f->todstbytecnt + fc->todstbytecnt);
207  jb_set_uint(js, "bytes_toclient", f->tosrcbytecnt + fc->tosrcbytecnt);
208 
209  jb_open_object(js, "bypassed");
210  jb_set_uint(js, "pkts_toserver", fc->todstpktcnt);
211  jb_set_uint(js, "pkts_toclient", fc->tosrcpktcnt);
212  jb_set_uint(js, "bytes_toserver", fc->todstbytecnt);
213  jb_set_uint(js, "bytes_toclient", fc->tosrcbytecnt);
214  jb_close(js);
215  } else {
216  jb_set_uint(js, "pkts_toserver", f->todstpktcnt);
217  jb_set_uint(js, "pkts_toclient", f->tosrcpktcnt);
218  jb_set_uint(js, "bytes_toserver", f->todstbytecnt);
219  jb_set_uint(js, "bytes_toclient", f->tosrcbytecnt);
220  }
221 
222  char timebuf1[64];
223  CreateIsoTimeString(&f->startts, timebuf1, sizeof(timebuf1));
224  jb_set_string(js, "start", timebuf1);
225 }
226 
227 /* Eve format logging */
228 static void EveFlowLogJSON(JsonFlowLogThread *aft, JsonBuilder *jb, Flow *f)
229 {
230  LogJsonFileCtx *flow_ctx = aft->flowlog_ctx;
231 
232  EveAddAppProto(f, jb);
233  jb_open_object(jb, "flow");
234  EveAddFlow(f, jb);
235 
236  char timebuf2[64];
237  CreateIsoTimeString(&f->lastts, timebuf2, sizeof(timebuf2));
238  jb_set_string(jb, "end", timebuf2);
239 
240  int32_t age = f->lastts.tv_sec - f->startts.tv_sec;
241  jb_set_uint(jb, "age", age);
242 
244  JB_SET_TRUE(jb, "emergency");
245  const char *state = NULL;
247  state = "new";
249  state = "established";
251  state = "closed";
253  state = "bypassed";
254  int flow_state = SC_ATOMIC_GET(f->flow_state);
255  switch (flow_state) {
257  JB_SET_STRING(jb, "bypass", "local");
258  break;
259 #ifdef CAPTURE_OFFLOAD
260  case FLOW_STATE_CAPTURE_BYPASSED:
261  JB_SET_STRING(jb, "bypass", "capture");
262  break;
263 #endif
264  default:
266  "Invalid flow state: %d, contact developers",
267  flow_state);
268  }
269  }
270 
271  jb_set_string(jb, "state", state);
272 
273  const char *reason = NULL;
275  reason = "timeout";
276  else if (f->flow_end_flags & FLOW_END_FLAG_FORCED)
277  reason = "forced";
279  reason = "shutdown";
280 
281  jb_set_string(jb, "reason", reason);
282 
283  jb_set_bool(jb, "alerted", FlowHasAlerts(f));
284  if (f->flags & FLOW_WRONG_THREAD)
285  JB_SET_TRUE(jb, "wrong_thread");
286 
287  /* Close flow. */
288  jb_close(jb);
289 
290  EveAddCommonOptions(&flow_ctx->cfg, NULL, f, jb);
291 
292  /* TCP */
293  if (f->proto == IPPROTO_TCP) {
294  jb_open_object(jb, "tcp");
295 
296  TcpSession *ssn = f->protoctx;
297 
298  char hexflags[3];
299  snprintf(hexflags, sizeof(hexflags), "%02x",
300  ssn ? ssn->tcp_packet_flags : 0);
301  jb_set_string(jb, "tcp_flags", hexflags);
302 
303  snprintf(hexflags, sizeof(hexflags), "%02x",
304  ssn ? ssn->client.tcp_flags : 0);
305  jb_set_string(jb, "tcp_flags_ts", hexflags);
306 
307  snprintf(hexflags, sizeof(hexflags), "%02x",
308  ssn ? ssn->server.tcp_flags : 0);
309  jb_set_string(jb, "tcp_flags_tc", hexflags);
310 
311  EveTcpFlags(ssn ? ssn->tcp_packet_flags : 0, jb);
312 
313  if (ssn) {
314  const char *tcp_state = StreamTcpStateAsString(ssn->state);
315  if (tcp_state != NULL)
316  jb_set_string(jb, "state", tcp_state);
318  JB_SET_TRUE(jb, "gap_ts");
320  JB_SET_TRUE(jb, "gap_tc");
321  }
322 
323  /* Close tcp. */
324  jb_close(jb);
325  }
326 }
327 
328 static int JsonFlowLogger(ThreadVars *tv, void *thread_data, Flow *f)
329 {
330  SCEnter();
331  JsonFlowLogThread *jhl = (JsonFlowLogThread *)thread_data;
332 
333  /* reset */
334  MemBufferReset(jhl->buffer);
335 
336  JsonBuilder *jb = CreateEveHeaderFromFlow(f, "flow");
337  if (unlikely(jb == NULL)) {
338  return TM_ECODE_OK;
339  }
340 
341  EveFlowLogJSON(jhl, jb, f);
342 
344  jb_free(jb);
345 
347 }
348 
349 static void OutputFlowLogDeinit(OutputCtx *output_ctx)
350 {
351  LogJsonFileCtx *flow_ctx = output_ctx->data;
352  LogFileCtx *logfile_ctx = flow_ctx->file_ctx;
353  LogFileFreeCtx(logfile_ctx);
354  SCFree(flow_ctx);
355  SCFree(output_ctx);
356 }
357 
358 #define DEFAULT_LOG_FILENAME "flow.json"
359 static OutputInitResult OutputFlowLogInit(ConfNode *conf)
360 {
361  OutputInitResult result = { NULL, false };
362  LogFileCtx *file_ctx = LogFileNewCtx();
363  if(file_ctx == NULL) {
364  SCLogError(SC_ERR_FLOW_LOG_GENERIC, "couldn't create new file_ctx");
365  return result;
366  }
367 
368  if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) {
369  LogFileFreeCtx(file_ctx);
370  return result;
371  }
372 
373  LogJsonFileCtx *flow_ctx = SCMalloc(sizeof(LogJsonFileCtx));
374  if (unlikely(flow_ctx == NULL)) {
375  LogFileFreeCtx(file_ctx);
376  return result;
377  }
378 
379  OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
380  if (unlikely(output_ctx == NULL)) {
381  LogFileFreeCtx(file_ctx);
382  SCFree(flow_ctx);
383  return result;
384  }
385 
386  flow_ctx->file_ctx = file_ctx;
387  output_ctx->data = flow_ctx;
388  output_ctx->DeInit = OutputFlowLogDeinit;
389 
390  result.ctx = output_ctx;
391  result.ok = true;
392  return result;
393 }
394 
395 static void OutputFlowLogDeinitSub(OutputCtx *output_ctx)
396 {
397  LogJsonFileCtx *flow_ctx = output_ctx->data;
398  SCFree(flow_ctx);
399  SCFree(output_ctx);
400 }
401 
402 static OutputInitResult OutputFlowLogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
403 {
404  OutputInitResult result = { NULL, false };
405  OutputJsonCtx *ojc = parent_ctx->data;
406 
407  LogJsonFileCtx *flow_ctx = SCMalloc(sizeof(LogJsonFileCtx));
408  if (unlikely(flow_ctx == NULL))
409  return result;
410 
411  OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
412  if (unlikely(output_ctx == NULL)) {
413  SCFree(flow_ctx);
414  return result;
415  }
416 
417  flow_ctx->file_ctx = ojc->file_ctx;
418  flow_ctx->cfg = ojc->cfg;
419 
420  output_ctx->data = flow_ctx;
421  output_ctx->DeInit = OutputFlowLogDeinitSub;
422 
423  result.ctx = output_ctx;
424  result.ok = true;
425  return result;
426 }
427 
428 static TmEcode JsonFlowLogThreadInit(ThreadVars *t, const void *initdata, void **data)
429 {
431  if (unlikely(aft == NULL))
432  return TM_ECODE_FAILED;
433  memset(aft, 0, sizeof(JsonFlowLogThread));
434 
435  if(initdata == NULL)
436  {
437  SCLogDebug("Error getting context for EveLogFlow. \"initdata\" argument NULL");
438  SCFree(aft);
439  return TM_ECODE_FAILED;
440  }
441 
442  /* Use the Ouptut Context (file pointer and mutex) */
443  aft->flowlog_ctx = ((OutputCtx *)initdata)->data; //TODO
444 
446  if (aft->buffer == NULL) {
447  SCFree(aft);
448  return TM_ECODE_FAILED;
449  }
450 
451  *data = (void *)aft;
452  return TM_ECODE_OK;
453 }
454 
455 static TmEcode JsonFlowLogThreadDeinit(ThreadVars *t, void *data)
456 {
457  JsonFlowLogThread *aft = (JsonFlowLogThread *)data;
458  if (aft == NULL) {
459  return TM_ECODE_OK;
460  }
461 
462  MemBufferFree(aft->buffer);
463  /* clear memory */
464  memset(aft, 0, sizeof(JsonFlowLogThread));
465 
466  SCFree(aft);
467  return TM_ECODE_OK;
468 }
469 
471 {
472  /* register as separate module */
473  OutputRegisterFlowModule(LOGGER_JSON_FLOW, "JsonFlowLog", "flow-json-log",
474  OutputFlowLogInit, JsonFlowLogger, JsonFlowLogThreadInit,
475  JsonFlowLogThreadDeinit, NULL);
476 
477  /* also register as child of eve-log */
478  OutputRegisterFlowSubModule(LOGGER_JSON_FLOW, "eve-log", "JsonFlowLog",
479  "eve-log.flow", OutputFlowLogInitSub, JsonFlowLogger,
480  JsonFlowLogThreadInit, JsonFlowLogThreadDeinit, NULL);
481 }
tm-threads.h
LogJsonFileCtx_::flags
uint32_t flags
Definition: output-json-flow.c:56
FLOW_IS_IPV6
#define FLOW_IS_IPV6(f)
Definition: flow.h:153
JsonFlowLogThread_
Definition: output-json-flow.c:60
SC_ERR_INVALID_VALUE
@ SC_ERR_INVALID_VALUE
Definition: util-error.h:160
CreateIsoTimeString
void CreateIsoTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:213
Flow_::startts
struct timeval startts
Definition: flow.h:474
stream-tcp.h
OutputJsonCtx_::cfg
OutputJsonCommonSettings cfg
Definition: output-json.h:111
FLOW_END_FLAG_STATE_NEW
#define FLOW_END_FLAG_STATE_NEW
Definition: flow.h:226
FlowBypassInfo_
Definition: flow.h:503
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
LogJsonFileCtx
struct LogJsonFileCtx_ LogJsonFileCtx
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:517
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
Flow_::proto
uint8_t proto
Definition: flow.h:361
JSON_OUTPUT_BUFFER_SIZE
#define JSON_OUTPUT_BUFFER_SIZE
Definition: output-json.h:62
threads.h
OutputJsonCtx_
Definition: output-json.h:108
Flow_
Flow data structure.
Definition: flow.h:343
OutputJsonCommonSettings_
Definition: output-json.h:99
Flow_::icmp_s
struct Flow_::@119::@123 icmp_s
Flow_::icmp_d
struct Flow_::@121::@124 icmp_d
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:30
LogFileCtx_
Definition: util-logopenfile.h:52
FLOW_END_FLAG_STATE_ESTABLISHED
#define FLOW_END_FLAG_STATE_ESTABLISHED
Definition: flow.h:227
Flow_::alproto_orig
AppProto alproto_orig
Definition: flow.h:431
Flow_::vlan_id
uint16_t vlan_id[2]
Definition: flow.h:363
FLOW_END_FLAG_STATE_BYPASSED
#define FLOW_END_FLAG_STATE_BYPASSED
Definition: flow.h:233
SCProtoNameValid
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
Definition: util-proto-name.c:98
FlowBypassInfo_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:508
OutputJsonBuilderBuffer
int OutputJsonBuilderBuffer(JsonBuilder *js, LogFileCtx *file_ctx, MemBuffer **buffer)
Definition: output-json.c:1429
util-privs.h
EveAddCommonOptions
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, JsonBuilder *js)
Definition: output-json.c:673
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:95
proto
uint8_t proto
Definition: decode-template.h:0
Flow_::dp
Port dp
Definition: flow.h:355
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:79
Flow_::protoctx
void * protoctx
Definition: flow.h:416
JsonFlowLogRegister
void JsonFlowLogRegister(void)
Definition: output-json-flow.c:470
util-unittest.h
OutputCtx_::data
void * data
Definition: tm-modules.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:78
OutputCtx_
Definition: tm-modules.h:78
LogJsonFileCtx_::file_ctx
LogFileCtx * file_ctx
Definition: output-json-flow.c:55
SCConfLogOpenGeneric
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
Definition: util-logopenfile.c:305
LOGGER_JSON_FLOW
@ LOGGER_JSON_FLOW
Definition: suricata-common.h:481
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:479
Flow_::dst
FlowAddress dst
Definition: flow.h:346
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:486
util-debug.h
JB_SET_STRING
#define JB_SET_STRING(jb, key, val)
Definition: rust.h:24
output-json-flow.h
FlowBypassInfo_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:510
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:42
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:476
output-json.h
FlowAddress_::address
union FlowAddress_::@118 address
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:267
Flow_::flow_end_flags
uint8_t flow_end_flags
Definition: flow.h:422
pkt-var.h
JsonFlowLogThread
struct JsonFlowLogThread_ JsonFlowLogThread
EveTcpFlags
void EveTcpFlags(const uint8_t flags, JsonBuilder *js)
jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.
Definition: output-json.c:760
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:262
FlowBypassInfo_::todstpktcnt
uint64_t todstpktcnt
Definition: flow.h:509
FLOW_WRONG_THREAD
#define FLOW_WRONG_THREAD
Definition: flow.h:104
LogJsonFileCtx_
Definition: output-json-flow.c:54
util-time.h
JB_SET_TRUE
#define JB_SET_TRUE(jb, key)
Definition: rust.h:25
OutputInitResult_::ok
bool ok
Definition: output.h:43
LiveDevice_::dev
char * dev
Definition: util-device.h:41
TcpSession_::tcp_packet_flags
uint8_t tcp_packet_flags
Definition: stream-tcp-private.h:267
DEFAULT_LOG_FILENAME
#define DEFAULT_LOG_FILENAME
Definition: output-json-flow.c:358
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:478
FLOW_IS_IPV4
#define FLOW_IS_IPV4(f)
Definition: flow.h:151
JsonFlowLogThread_::buffer
MemBuffer * buffer
Definition: output-json-flow.c:63
stream-tcp-private.h
conf.h
JsonFlowLogThread_::flowlog_ctx
LogJsonFileCtx * flowlog_ctx
Definition: output-json-flow.c:61
Port
uint16_t Port
Definition: decode.h:238
FLOW_END_FLAG_EMERGENCY
#define FLOW_END_FLAG_EMERGENCY
Definition: flow.h:229
TmEcode
TmEcode
Definition: tm-threads-common.h:77
Flow_::vlan_idx
uint8_t vlan_idx
Definition: flow.h:364
SC_ERR_FLOW_LOG_GENERIC
@ SC_ERR_FLOW_LOG_GENERIC
Definition: util-error.h:313
util-proto-name.h
FlowBypassInfo_::tosrcpktcnt
uint64_t tosrcpktcnt
Definition: flow.h:507
MemBuffer_
Definition: util-buffer.h:27
Flow_::alproto_expect
AppProto alproto_expect
Definition: flow.h:434
Flow_::src
FlowAddress src
Definition: flow.h:346
Flow_::lastts
struct timeval lastts
Definition: flow.h:375
MemBufferReset
#define MemBufferReset(mem_buffer)
Reset the mem buffer.
Definition: util-buffer.h:42
flow-storage.h
OutputInitResult_
Definition: output.h:41
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
MemBufferFree
void MemBufferFree(MemBuffer *buffer)
Definition: util-buffer.c:82
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
EveAddAppProto
void EveAddAppProto(Flow *f, JsonBuilder *js)
Definition: output-json-flow.c:179
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:539
FLOW_END_FLAG_STATE_CLOSED
#define FLOW_END_FLAG_STATE_CLOSED
Definition: flow.h:228
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:272
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
Flow_::livedev
struct LiveDevice_ * livedev
Definition: flow.h:367
LogJsonFileCtx_::cfg
OutputJsonCommonSettings cfg
Definition: output-json-flow.c:57
threadvars.h
CreateEveFlowId
void CreateEveFlowId(JsonBuilder *js, const Flow *f)
Definition: output-json.c:1190
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:271
OutputRegisterFlowSubModule
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a flow output sub-module.
Definition: output.c:629
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:426
ConfNode_
Definition: conf.h:32
util-logopenfile.h
Flow_::flags
uint32_t flags
Definition: flow.h:396
util-buffer.h
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
TimeGet
void TimeGet(struct timeval *tv)
Definition: util-time.c:153
OutputJsonCtx_::file_ctx
LogFileCtx * file_ctx
Definition: output-json.h:109
FlowGetStorageById
void * FlowGetStorageById(Flow *f, int id)
Definition: flow-storage.c:39
FLOW_END_FLAG_SHUTDOWN
#define FLOW_END_FLAG_SHUTDOWN
Definition: flow.h:232
StreamTcpStateAsString
const char * StreamTcpStateAsString(const enum TcpState state)
Definition: stream-tcp.c:6274
known_proto
char * known_proto[256]
Definition: util-proto-name.c:33
FlowHasAlerts
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
Definition: flow.c:224
FLOW_END_FLAG_TIMEOUT
#define FLOW_END_FLAG_TIMEOUT
Definition: flow.h:230
STREAMTCP_STREAM_FLAG_GAP
#define STREAMTCP_STREAM_FLAG_GAP
Definition: stream-tcp-private.h:198
Flow_::sp
Port sp
Definition: flow.h:348
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:347
TcpSession_
Definition: stream-tcp-private.h:260
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:427
GetFlowBypassInfoID
int GetFlowBypassInfoID(void)
Definition: flow-util.c:205
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:425
FLOW_END_FLAG_FORCED
#define FLOW_END_FLAG_FORCED
Definition: flow.h:231
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:106
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
TcpStream_::tcp_flags
uint8_t tcp_flags
Definition: stream-tcp-private.h:99
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:477
MemBufferCreateNew
MemBuffer * MemBufferCreateNew(uint32_t size)
Definition: util-buffer.c:32
debug.h
output.h
OutputRegisterFlowModule
void OutputRegisterFlowModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a flow output module.
Definition: output.c:590
EveAddFlow
void EveAddFlow(Flow *f, JsonBuilder *js)
Definition: output-json-flow.c:200