suricata
output-json-flow.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Implements Flow JSON logging portion of the engine.
24  */
25 
26 #include "suricata-common.h"
27 #include "detect.h"
28 #include "pkt-var.h"
29 #include "conf.h"
30 
31 #include "threads.h"
32 #include "threadvars.h"
33 #include "tm-threads.h"
34 
35 #include "util-print.h"
36 #include "util-unittest.h"
37 
38 #include "util-debug.h"
39 
40 #include "output.h"
41 #include "util-privs.h"
42 #include "util-buffer.h"
43 #include "util-device.h"
44 #include "util-proto-name.h"
45 #include "util-logopenfile.h"
46 #include "util-time.h"
47 #include "output-json.h"
48 #include "output-json-flow.h"
49 
50 #include "stream-tcp.h"
51 #include "stream-tcp-private.h"
52 #include "flow-storage.h"
53 #include "util-exception-policy.h"
54 
55 static SCJsonBuilder *CreateEveHeaderFromFlow(const Flow *f)
56 {
57  char timebuf[64];
58  char srcip[46] = {0}, dstip[46] = {0};
59  Port sp, dp;
60 
61  SCJsonBuilder *jb = SCJbNewObject();
62  if (unlikely(jb == NULL)) {
63  return NULL;
64  }
65 
66  SCTime_t ts = TimeGet();
67 
68  CreateIsoTimeString(ts, timebuf, sizeof(timebuf));
69 
70  if ((f->flags & FLOW_DIR_REVERSED) == 0) {
71  if (FLOW_IS_IPV4(f)) {
72  PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), srcip, sizeof(srcip));
73  PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), dstip, sizeof(dstip));
74  } else if (FLOW_IS_IPV6(f)) {
75  PrintInet(AF_INET6, (const void *)&(f->src.address), srcip, sizeof(srcip));
76  PrintInet(AF_INET6, (const void *)&(f->dst.address), dstip, sizeof(dstip));
77  }
78  sp = f->sp;
79  dp = f->dp;
80  } else {
81  if (FLOW_IS_IPV4(f)) {
82  PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), srcip, sizeof(srcip));
83  PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), dstip, sizeof(dstip));
84  } else if (FLOW_IS_IPV6(f)) {
85  PrintInet(AF_INET6, (const void *)&(f->dst.address), srcip, sizeof(srcip));
86  PrintInet(AF_INET6, (const void *)&(f->src.address), dstip, sizeof(dstip));
87  }
88  sp = f->dp;
89  dp = f->sp;
90  }
91 
92  /* time */
93  SCJbSetString(jb, "timestamp", timebuf);
94 
95  CreateEveFlowId(jb, (const Flow *)f);
96 
97 #if 0 // TODO
98  /* sensor id */
99  if (sensor_id >= 0)
100  json_object_set_new(js, "sensor_id", json_integer(sensor_id));
101 #endif
102 
103  /* input interface */
104  if (f->livedev) {
105  SCJbSetString(jb, "in_iface", f->livedev->dev);
106  }
107 
108  JB_SET_STRING(jb, "event_type", "flow");
109 
110  /* vlan */
111  if (f->vlan_idx > 0) {
112  SCJbOpenArray(jb, "vlan");
113  SCJbAppendUint(jb, f->vlan_id[0]);
114  if (f->vlan_idx > 1) {
115  SCJbAppendUint(jb, f->vlan_id[1]);
116  }
117  if (f->vlan_idx > 2) {
118  SCJbAppendUint(jb, f->vlan_id[2]);
119  }
120  SCJbClose(jb);
121  }
122 
123  /* tuple */
124  SCJbSetString(jb, "src_ip", srcip);
125  switch(f->proto) {
126  case IPPROTO_ICMP:
127  break;
128  case IPPROTO_UDP:
129  case IPPROTO_TCP:
130  case IPPROTO_SCTP:
131  SCJbSetUint(jb, "src_port", sp);
132  break;
133  }
134  SCJbSetString(jb, "dest_ip", dstip);
135  switch(f->proto) {
136  case IPPROTO_ICMP:
137  break;
138  case IPPROTO_UDP:
139  case IPPROTO_TCP:
140  case IPPROTO_SCTP:
141  SCJbSetUint(jb, "dest_port", dp);
142  break;
143  }
144 
145  if (SCProtoNameValid(f->proto)) {
146  SCJbSetString(jb, "proto", known_proto[f->proto]);
147  } else {
148  char proto[4];
149  snprintf(proto, sizeof(proto), "%"PRIu8"", f->proto);
150  SCJbSetString(jb, "proto", proto);
151  }
152 
153  switch (f->proto) {
154  case IPPROTO_ICMP:
155  case IPPROTO_ICMPV6:
156  SCJbSetUint(jb, "icmp_type", f->icmp_s.type);
157  SCJbSetUint(jb, "icmp_code", f->icmp_s.code);
158  if (f->tosrcpktcnt) {
159  SCJbSetUint(jb, "response_icmp_type", f->icmp_d.type);
160  SCJbSetUint(jb, "response_icmp_code", f->icmp_d.code);
161  }
162  break;
163  case IPPROTO_ESP:
164  SCJbSetUint(jb, "spi", f->esp.spi);
165  break;
166  }
167  return jb;
168 }
169 
170 void EveAddAppProto(Flow *f, SCJsonBuilder *js)
171 {
172  if (f->alproto) {
173  SCJbSetString(js, "app_proto", AppProtoToString(f->alproto));
174  }
175  if (f->alproto_ts && f->alproto_ts != f->alproto) {
176  SCJbSetString(js, "app_proto_ts", AppProtoToString(f->alproto_ts));
177  }
178  if (f->alproto_tc && f->alproto_tc != f->alproto) {
179  SCJbSetString(js, "app_proto_tc", AppProtoToString(f->alproto_tc));
180  }
181  if (f->alproto_orig != f->alproto && f->alproto_orig != ALPROTO_UNKNOWN) {
182  SCJbSetString(js, "app_proto_orig", AppProtoToString(f->alproto_orig));
183  }
184  if (f->alproto_expect != f->alproto && f->alproto_expect != ALPROTO_UNKNOWN) {
185  SCJbSetString(js, "app_proto_expected", AppProtoToString(f->alproto_expect));
186  }
187 
188 }
189 
190 void EveAddFlow(Flow *f, SCJsonBuilder *js)
191 {
193  if (fc) {
194  SCJbSetUint(js, "pkts_toserver", f->todstpktcnt + fc->todstpktcnt);
195  SCJbSetUint(js, "pkts_toclient", f->tosrcpktcnt + fc->tosrcpktcnt);
196  SCJbSetUint(js, "bytes_toserver", f->todstbytecnt + fc->todstbytecnt);
197  SCJbSetUint(js, "bytes_toclient", f->tosrcbytecnt + fc->tosrcbytecnt);
198 
199  SCJbOpenObject(js, "bypassed");
200  SCJbSetUint(js, "pkts_toserver", fc->todstpktcnt);
201  SCJbSetUint(js, "pkts_toclient", fc->tosrcpktcnt);
202  SCJbSetUint(js, "bytes_toserver", fc->todstbytecnt);
203  SCJbSetUint(js, "bytes_toclient", fc->tosrcbytecnt);
204  SCJbClose(js);
205  } else {
206  SCJbSetUint(js, "pkts_toserver", f->todstpktcnt);
207  SCJbSetUint(js, "pkts_toclient", f->tosrcpktcnt);
208  SCJbSetUint(js, "bytes_toserver", f->todstbytecnt);
209  SCJbSetUint(js, "bytes_toclient", f->tosrcbytecnt);
210  }
211 
212  char timebuf1[64];
213  CreateIsoTimeString(f->startts, timebuf1, sizeof(timebuf1));
214  SCJbSetString(js, "start", timebuf1);
215 }
216 
217 static void EveExceptionPolicyLog(SCJsonBuilder *js, uint16_t flag)
218 {
220  SCJbStartObject(js);
221  SCJbSetString(js, "target",
223  SCJbSetString(js, "policy",
226  SCJbClose(js);
227  }
229  SCJbStartObject(js);
230  SCJbSetString(js, "target",
232  SCJbSetString(js, "policy",
235  SCJbClose(js);
236  }
238  SCJbStartObject(js);
239  SCJbSetString(js, "target",
241  SCJbSetString(js, "policy",
244  true));
245  SCJbClose(js);
246  }
248  SCJbStartObject(js);
249  SCJbSetString(
251  SCJbSetString(js, "policy",
254  SCJbClose(js);
255  }
256  if (flag & EXCEPTION_TARGET_FLAG_MIDSTREAM) {
257  SCJbStartObject(js);
258  SCJbSetString(
260  SCJbSetString(js, "policy",
263  SCJbClose(js);
264  }
266  SCJbStartObject(js);
267  SCJbSetString(js, "target",
269  SCJbSetString(js, "policy",
272  SCJbClose(js);
273  }
274 }
275 
276 /* Eve format logging */
277 static void EveFlowLogJSON(OutputJsonThreadCtx *aft, SCJsonBuilder *jb, Flow *f)
278 {
279  EveAddAppProto(f, jb);
280  SCJbOpenObject(jb, "flow");
281  EveAddFlow(f, jb);
282 
283  char timebuf2[64];
284  CreateIsoTimeString(f->lastts, timebuf2, sizeof(timebuf2));
285  SCJbSetString(jb, "end", timebuf2);
286 
287  uint64_t age = (SCTIME_SECS(f->lastts) - SCTIME_SECS(f->startts));
288  SCJbSetUint(jb, "age", age);
289 
291  JB_SET_TRUE(jb, "emergency");
292 
293  const int flow_state = f->flow_state;
294  switch (flow_state) {
295  case FLOW_STATE_NEW:
296  JB_SET_STRING(jb, "state", "new");
297  break;
299  JB_SET_STRING(jb, "state", "established");
300  break;
301  case FLOW_STATE_CLOSED:
302  JB_SET_STRING(jb, "state", "closed");
303  break;
305  JB_SET_STRING(jb, "state", "bypassed");
306  JB_SET_STRING(jb, "bypass", "local");
307  break;
308 #ifdef CAPTURE_OFFLOAD
309  case FLOW_STATE_CAPTURE_BYPASSED:
310  JB_SET_STRING(jb, "state", "bypassed");
311  JB_SET_STRING(jb, "bypass", "capture");
312  break;
313 #endif
314  case FLOW_STATE_SIZE:
316  SCLogDebug("invalid flow state: %d, contact developers", flow_state);
317  }
318 
319  const char *reason = NULL;
321  reason = "tcp_reuse";
322  else if (f->flow_end_flags & FLOW_END_FLAG_FORCED)
323  reason = "forced";
325  reason = "shutdown";
327  reason = "timeout";
328  else
329  reason = "unknown";
330 
331  SCJbSetString(jb, "reason", reason);
332 
333  SCJbSetBool(jb, "alerted", FlowHasAlerts(f));
334  if (f->flags & FLOW_WRONG_THREAD)
335  JB_SET_TRUE(jb, "wrong_thread");
336 
337  if (f->flags & FLOW_IS_ELEPHANT)
338  JB_SET_TRUE(jb, "elephant");
339 
340  if (f->flags & FLOW_ACTION_DROP) {
341  JB_SET_STRING(jb, "action", "drop");
342  } else if (f->flags & FLOW_ACTION_ACCEPT) {
343  JB_SET_STRING(jb, "action", "accept");
344  } else if (f->flags & FLOW_ACTION_PASS) {
345  JB_SET_STRING(jb, "action", "pass");
346  }
347  if (f->applied_exception_policy != 0) {
348  SCJbOpenArray(jb, "exception_policy");
349  EveExceptionPolicyLog(jb, f->applied_exception_policy);
350  SCJbClose(jb); /* close array */
351  }
352 
353  /* Close flow. */
354  SCJbClose(jb);
355 
356  EveAddCommonOptions(&aft->ctx->cfg, NULL, f, jb, LOG_DIR_FLOW);
357 
358  /* TCP */
359  if (f->proto == IPPROTO_TCP) {
360  SCJbOpenObject(jb, "tcp");
361 
362  TcpSession *ssn = f->protoctx;
363 
364  char hexflags[3];
365  snprintf(hexflags, sizeof(hexflags), "%02x",
366  ssn ? ssn->tcp_packet_flags : 0);
367  SCJbSetString(jb, "tcp_flags", hexflags);
368 
369  snprintf(hexflags, sizeof(hexflags), "%02x",
370  ssn ? ssn->client.tcp_flags : 0);
371  SCJbSetString(jb, "tcp_flags_ts", hexflags);
372 
373  snprintf(hexflags, sizeof(hexflags), "%02x",
374  ssn ? ssn->server.tcp_flags : 0);
375  SCJbSetString(jb, "tcp_flags_tc", hexflags);
376 
377  EveTcpFlags(ssn ? ssn->tcp_packet_flags : 0, jb);
378 
379  if (ssn) {
380  const char *tcp_state = StreamTcpStateAsString(ssn->state);
381  if (tcp_state != NULL)
382  SCJbSetString(jb, "state", tcp_state);
384  JB_SET_TRUE(jb, "tc_gap");
385  }
387  JB_SET_TRUE(jb, "ts_gap");
388  }
389 
390  SCJbSetUint(jb, "ts_max_regions", ssn->client.sb.max_regions);
391  SCJbSetUint(jb, "tc_max_regions", ssn->server.sb.max_regions);
392 
393  if (ssn->urg_offset_ts)
394  SCJbSetUint(jb, "ts_urgent_oob_data", ssn->urg_offset_ts);
395  if (ssn->urg_offset_tc)
396  SCJbSetUint(jb, "tc_urgent_oob_data", ssn->urg_offset_tc);
397  }
398 
399  /* Close tcp. */
400  SCJbClose(jb);
401  }
402 }
403 
404 static int JsonFlowLogger(ThreadVars *tv, void *thread_data, Flow *f)
405 {
406  SCEnter();
407  OutputJsonThreadCtx *thread = thread_data;
408 
409  /* reset */
410  MemBufferReset(thread->buffer);
411 
412  SCJsonBuilder *jb = CreateEveHeaderFromFlow(f);
413  if (unlikely(jb == NULL)) {
415  }
416 
417  EveFlowLogJSON(thread, jb, f);
418 
419  OutputJsonBuilderBuffer(tv, NULL, f, jb, thread);
420  SCJbFree(jb);
421 
423 }
424 
426 {
427  /* register as child of eve-log */
428  OutputRegisterFlowSubModule(LOGGER_JSON_FLOW, "eve-log", "JsonFlowLog", "eve-log.flow",
430 }
tm-threads.h
ts
uint64_t ts
Definition: source-erf-file.c:55
FLOW_IS_IPV6
#define FLOW_IS_IPV6(f)
Definition: flow.h:172
Flow_::icmp_s
struct Flow_::@118::@124 icmp_s
FLOW_STATE_ESTABLISHED
@ FLOW_STATE_ESTABLISHED
Definition: flow.h:505
CreateIsoTimeString
void CreateIsoTimeString(const SCTime_t ts, char *str, size_t size)
Definition: util-time.c:209
OutputJsonThreadCtx_::ctx
OutputJsonCtx * ctx
Definition: output-json.h:84
EveAddFlow
void EveAddFlow(Flow *f, SCJsonBuilder *js)
Definition: output-json-flow.c:190
Flow_::startts
SCTime_t startts
Definition: flow.h:493
stream-tcp.h
OutputJsonCtx_::cfg
OutputJsonCommonSettings cfg
Definition: output-json.h:78
GetFlowBypassInfoID
FlowStorageId GetFlowBypassInfoID(void)
Definition: flow-util.c:219
FlowBypassInfo_
Definition: flow.h:529
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
Flow_::proto
uint8_t proto
Definition: flow.h:378
EveAddAppProto
void EveAddAppProto(Flow *f, SCJsonBuilder *js)
Definition: output-json-flow.c:170
JsonLogThreadInit
TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data)
Definition: output-json-common.c:99
threads.h
Flow_
Flow data structure.
Definition: flow.h:356
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:40
EXCEPTION_TARGET_FLAG_APPLAYER_ERROR
#define EXCEPTION_TARGET_FLAG_APPLAYER_ERROR
Definition: util-exception-policy-types.h:49
Flow_::alproto_orig
AppProto alproto_orig
Definition: flow.h:456
SCProtoNameValid
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
Definition: util-proto-name.c:453
StreamingBuffer_::max_regions
uint16_t max_regions
Definition: util-streaming-buffer.h:114
EveTcpFlags
void EveTcpFlags(const uint8_t flags, SCJsonBuilder *js)
jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.
Definition: output-json.c:450
FlowBypassInfo_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:534
TcpSession_::urg_offset_ts
uint16_t urg_offset_ts
Definition: stream-tcp-private.h:291
util-privs.h
known_proto
const char * known_proto[256]
Definition: util-proto-name.c:40
FLOW_ACTION_DROP
#define FLOW_ACTION_DROP
Definition: flow.h:70
TcpStream_::flags
uint16_t flags
Definition: stream-tcp-private.h:107
OutputJsonBuilderBuffer
void OutputJsonBuilderBuffer(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *js, OutputJsonThreadCtx *ctx)
Definition: output-json.c:992
proto
uint8_t proto
Definition: decode-template.h:0
CreateEveFlowId
void CreateEveFlowId(SCJsonBuilder *js, const Flow *f)
Definition: output-json.c:700
Flow_::dp
Port dp
Definition: flow.h:372
Flow_::protoctx
void * protoctx
Definition: flow.h:441
ExceptionPolicyTargetFlagToString
const char * ExceptionPolicyTargetFlagToString(uint8_t target_flag)
Definition: util-exception-policy.c:95
JsonFlowLogRegister
void JsonFlowLogRegister(void)
Definition: output-json-flow.c:425
util-unittest.h
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:412
OutputJsonThreadCtx_
Definition: output-json.h:83
LOGGER_JSON_FLOW
@ LOGGER_JSON_FLOW
Definition: suricata-common.h:495
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:498
OutputJsonLogInitSub
OutputInitResult OutputJsonLogInitSub(SCConfNode *conf, OutputCtx *parent_ctx)
Definition: output-json-common.c:82
FLOW_ACTION_PASS
#define FLOW_ACTION_PASS
Definition: flow.h:117
Flow_::dst
FlowAddress dst
Definition: flow.h:359
OutputRegisterFlowSubModule
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Register a flow output sub-module.
Definition: output.c:472
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:507
EXCEPTION_TARGET_FLAG_DEFRAG_MEMCAP
#define EXCEPTION_TARGET_FLAG_DEFRAG_MEMCAP
Definition: util-exception-policy-types.h:44
ExceptionPolicyTargetPolicy
enum ExceptionPolicy ExceptionPolicyTargetPolicy(uint8_t target_flag)
Definition: util-exception-policy.c:115
util-device.h
util-debug.h
JB_SET_STRING
#define JB_SET_STRING(jb, key, val)
Definition: rust.h:26
output-json-flow.h
FlowBypassInfo_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:536
Flow_::icmp_d
struct Flow_::@120::@126 icmp_d
EveAddCommonOptions
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, SCJsonBuilder *js, enum SCOutputJsonLogDirection dir)
Definition: output-json.c:398
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:495
output-json.h
util-exception-policy.h
FlowAddress_::address
union FlowAddress_::@117 address
TcpSession_::urg_offset_tc
uint16_t urg_offset_tc
Definition: stream-tcp-private.h:292
Flow_::lastts
SCTime_t lastts
Definition: flow.h:410
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:231
Flow_::flow_end_flags
uint8_t flow_end_flags
Definition: flow.h:447
pkt-var.h
TcpSession_::state
uint8_t state
Definition: stream-tcp-private.h:285
FlowBypassInfo_::todstpktcnt
uint64_t todstpktcnt
Definition: flow.h:535
FLOW_WRONG_THREAD
#define FLOW_WRONG_THREAD
Definition: flow.h:110
util-time.h
JB_SET_TRUE
#define JB_SET_TRUE(jb, key)
Definition: rust.h:27
LiveDevice_::dev
char * dev
Definition: util-device.h:42
TcpSession_::tcp_packet_flags
uint8_t tcp_packet_flags
Definition: stream-tcp-private.h:290
Flow_::esp
struct Flow_::@118::@125 esp
LOG_DIR_FLOW
@ LOG_DIR_FLOW
Definition: output-eve-bindgen.h:33
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:497
FLOW_IS_IPV4
#define FLOW_IS_IPV4(f)
Definition: flow.h:170
TimeGet
SCTime_t TimeGet(void)
Definition: util-time.c:152
stream-tcp-private.h
FLOW_END_FLAG_TCPREUSE
#define FLOW_END_FLAG_TCPREUSE
Definition: flow.h:246
conf.h
Port
uint16_t Port
Definition: decode.h:218
FLOW_END_FLAG_EMERGENCY
#define FLOW_END_FLAG_EMERGENCY
Definition: flow.h:242
SCTime_t
Definition: util-time.h:40
STREAMTCP_STREAM_FLAG_HAS_GAP
#define STREAMTCP_STREAM_FLAG_HAS_GAP
Definition: stream-tcp-private.h:217
EXCEPTION_TARGET_FLAG_REASSEMBLY_MEMCAP
#define EXCEPTION_TARGET_FLAG_REASSEMBLY_MEMCAP
Definition: util-exception-policy-types.h:46
Flow_::vlan_idx
uint8_t vlan_idx
Definition: flow.h:382
FLOW_IS_ELEPHANT
#define FLOW_IS_ELEPHANT
Definition: flow.h:59
util-proto-name.h
FlowBypassInfo_::tosrcpktcnt
uint64_t tosrcpktcnt
Definition: flow.h:533
Flow_::alproto_expect
AppProto alproto_expect
Definition: flow.h:459
FLOW_STATE_SIZE
#define FLOW_STATE_SIZE
Definition: flow.h:515
FlowGetStorageById
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
Definition: flow-storage.c:40
Flow_::src
FlowAddress src
Definition: flow.h:359
EXCEPTION_TARGET_FLAG_MIDSTREAM
#define EXCEPTION_TARGET_FLAG_MIDSTREAM
Definition: util-exception-policy-types.h:48
flow-storage.h
OutputJsonThreadCtx_::buffer
MemBuffer * buffer
Definition: output-json.h:86
Flow_::applied_exception_policy
uint8_t applied_exception_policy
Definition: flow.h:473
FLOW_STATE_NEW
@ FLOW_STATE_NEW
Definition: flow.h:504
suricata-common.h
EXCEPTION_TARGET_FLAG_SESSION_MEMCAP
#define EXCEPTION_TARGET_FLAG_SESSION_MEMCAP
Definition: util-exception-policy-types.h:45
TcpStream_::sb
StreamingBuffer sb
Definition: stream-tcp-private.h:135
SCTIME_SECS
#define SCTIME_SECS(t)
Definition: util-time.h:57
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:297
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
Flow_::livedev
struct LiveDevice_ * livedev
Definition: flow.h:398
FLOW_ACTION_ACCEPT
#define FLOW_ACTION_ACCEPT
Definition: flow.h:62
threadvars.h
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:296
FLOW_STATE_CLOSED
@ FLOW_STATE_CLOSED
Definition: flow.h:506
ExceptionPolicyEnumToString
const char * ExceptionPolicyEnumToString(enum ExceptionPolicy policy, bool is_json)
Definition: util-exception-policy.c:39
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:451
util-logopenfile.h
Flow_::flags
uint32_t flags
Definition: flow.h:421
util-buffer.h
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
FLOW_END_FLAG_SHUTDOWN
#define FLOW_END_FLAG_SHUTDOWN
Definition: flow.h:245
EXCEPTION_TARGET_FLAG_FLOW_MEMCAP
#define EXCEPTION_TARGET_FLAG_FLOW_MEMCAP
Definition: util-exception-policy-types.h:47
StreamTcpStateAsString
const char * StreamTcpStateAsString(const enum TcpState state)
Definition: stream-tcp.c:7112
Flow_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: flow.h:380
FlowHasAlerts
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
Definition: flow.c:163
FLOW_END_FLAG_TIMEOUT
#define FLOW_END_FLAG_TIMEOUT
Definition: flow.h:243
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:1207
Flow_::sp
Port sp
Definition: flow.h:361
JsonLogThreadDeinit
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data)
Definition: output-json-common.c:132
TcpSession_
Definition: stream-tcp-private.h:283
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:452
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
FLOW_END_FLAG_FORCED
#define FLOW_END_FLAG_FORCED
Definition: flow.h:244
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:112
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
TcpStream_::tcp_flags
uint8_t tcp_flags
Definition: stream-tcp-private.h:111
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:496
output.h