68 #define MODULE_NAME "JsonFrameLog"
70 #define JSON_STREAM_BUFFER_SIZE 4096
85 #if 0 // TODO see if this is useful in some way
86 static inline bool NeedsAsHex(uint8_t c)
106 static void PayloadAsHex(
const uint8_t *data, uint32_t data_len,
char *
str,
size_t str_len)
109 for (uint32_t i = 0; i < data_len; i++) {
110 if (NeedsAsHex(data[i])) {
112 snprintf(hex_str,
sizeof(hex_str),
"%s%02X", !hex ?
"|" :
" ", data[i]);
117 snprintf(p_str,
sizeof(p_str),
"%s%c", hex ?
"|" :
"", data[i]);
128 static void FrameAddPayloadTCP(JsonBuilder *js,
const TcpStream *stream,
const Frame *frame)
130 uint32_t sb_data_len = 0;
131 const uint8_t *data = NULL;
132 uint64_t data_offset = 0;
142 data_offset = (uint64_t)frame->
offset;
143 SCLogDebug(
"data_offset %" PRIu64, data_offset);
145 &stream->
sb, &data, &sb_data_len, (uint64_t)data_offset) == 0) {
150 if (data == NULL || sb_data_len == 0) {
155 if (frame->
len >= 0) {
156 sb_data_len =
MIN(frame->
len, (int32_t)sb_data_len);
158 SCLogDebug(
"frame data_offset %" PRIu64
", data_len %u frame len %" PRIi64, data_offset,
159 sb_data_len, frame->
len);
161 bool complete =
false;
162 if (frame->
len > 0) {
163 const uint64_t frame_re = frame->
offset + (uint64_t)frame->
len;
164 const uint64_t data_re = data_offset + sb_data_len;
165 complete = frame_re <= data_re;
167 jb_set_bool(js,
"complete", complete);
169 uint32_t data_len =
MIN(sb_data_len, 256);
170 jb_set_base64(js,
"payload", data, data_len);
172 uint8_t printable_buf[data_len + 1];
175 printable_buf[data_len] =
'\0';
176 jb_set_string(js,
"payload_printable", (
char *)printable_buf);
178 char pretty_buf[data_len * 4 + 1];
179 pretty_buf[0] =
'\0';
180 PayloadAsHex(data, data_len, pretty_buf, data_len * 4 + 1);
181 jb_set_string(js,
"payload_hex", pretty_buf);
185 static void FrameAddPayloadUDP(JsonBuilder *js,
const Packet *p,
const Frame *frame)
192 if (frame->
len == -1) {
195 frame_len = (uint32_t)frame->
len;
204 const uint32_t data_len = frame_len;
206 const uint32_t log_data_len =
MIN(data_len, 256);
207 jb_set_base64(js,
"payload", data, log_data_len);
209 uint8_t printable_buf[log_data_len + 1];
212 printable_buf[log_data_len] =
'\0';
213 jb_set_string(js,
"payload_printable", (
char *)printable_buf);
215 char pretty_buf[data_len * 4 + 1];
216 pretty_buf[0] =
'\0';
217 PayloadAsHex(data, data_len, pretty_buf, data_len * 4 + 1);
218 jb_set_string(js,
"payload_hex", pretty_buf);
232 jb_open_object(jb,
"frame");
234 jb_set_string(jb,
"type",
"stream");
238 jb_set_uint(jb,
"id", frame->
id);
239 jb_set_string(jb,
"direction",
PKT_IS_TOSERVER(p) ?
"toserver" :
"toclient");
241 if (ipproto == IPPROTO_TCP) {
243 jb_set_uint(jb,
"stream_offset", frame->
offset);
245 if (frame->
len < 0) {
248 jb_set_uint(jb,
"length",
len);
250 jb_set_uint(jb,
"length", frame->
len);
252 FrameAddPayloadTCP(jb, stream, frame);
254 jb_set_uint(jb,
"length", frame->
len);
255 FrameAddPayloadUDP(jb, p, frame);
258 jb_set_uint(jb,
"tx_id", frame->
tx_id);
263 static int FrameJsonUdp(
270 frames = &frames_container->
toserver;
272 frames = &frames_container->
toclient;
275 for (uint32_t idx = 0; idx < frames->
cnt; idx++) {
305 if (frames_container == NULL)
308 if (p->
proto == IPPROTO_UDP) {
309 return FrameJsonUdp(aft, p, p->
flow, frames_container);
324 frames = &frames_container->
toserver;
330 frames = &frames_container->
toclient;
336 for (uint32_t idx = 0; idx < frames->
cnt; idx++) {
345 if (!eof && win < frame->
len && win < 2500) {
346 SCLogDebug(
"frame id %" PRIi64
" len %" PRIi64
", win %" PRIi64
347 ", skipping logging",
348 frame->
id, frame->
len, win);
366 }
else if (frame != NULL) {
376 return FrameJson(
tv, aft, p);
386 if (frames_container == NULL)
391 frames = &frames_container->
toserver;
393 frames = &frames_container->
toclient;
395 return (frames->
cnt != 0);
400 static TmEcode JsonFrameLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
406 if (initdata == NULL) {
407 SCLogDebug(
"Error getting context for EveLogFrame. \"initdata\" argument NULL");
453 static void JsonFrameLogDeInitCtxSub(
OutputCtx *output_ctx)
455 SCLogDebug(
"cleaning up sub output_ctx %p", output_ctx);
459 if (json_output_ctx != NULL) {
481 if (
unlikely(json_output_ctx == NULL)) {
487 json_output_ctx->
eve_ctx = ajt;
489 output_ctx->
data = json_output_ctx;
490 output_ctx->
DeInit = JsonFrameLogDeInitCtxSub;
494 result.
ctx = output_ctx;
499 if (json_output_ctx != NULL) {
502 if (output_ctx != NULL) {
512 JsonFrameLogInitCtxSub, JsonFrameLogger, JsonFrameLogCondition, JsonFrameLogThreadInit,
513 JsonFrameLogThreadDeinit, NULL);