Go to the documentation of this file.
68 #define MODULE_NAME "JsonFrameLog"
70 #define JSON_STREAM_BUFFER_SIZE 4096
85 #if 0 // TODO see if this is useful in some way
86 static inline bool NeedsAsHex(uint8_t c)
106 static void PayloadAsHex(
const uint8_t *data, uint32_t data_len,
char *
str,
size_t str_len)
109 for (uint32_t i = 0; i < data_len; i++) {
110 if (NeedsAsHex(data[i])) {
112 snprintf(hex_str,
sizeof(hex_str),
"%s%02X", !hex ?
"|" :
" ", data[i]);
117 snprintf(p_str,
sizeof(p_str),
"%s%c", hex ?
"|" :
"", data[i]);
134 static int FrameJsonStreamDataCallback(
135 void *cb_data,
const uint8_t *input,
const uint32_t input_len,
const uint64_t input_offset)
140 uint32_t write_size = input_len;
144 const uint64_t data_re = input_offset + input_len;
148 if (input_offset >= frame_re) {
152 if (data_re >= frame_re) {
153 const uint64_t to_write = frame_re - input_offset;
154 if (to_write < (uint64_t)write_size) {
155 write_size = (uint32_t)to_write;
160 if (input_offset > cbd->
last_re) {
162 cbd->
payload,
"[%" PRIu64
" bytes missing]", input_offset - cbd->
last_re);
165 if (write_size > 0) {
167 if (written < write_size)
170 cbd->
last_re = input_offset + write_size;
180 MemBufferReset(buffer);
184 bool complete =
false;
194 ssn, stream, FrameJsonStreamDataCallback, &cbd,
frame->
offset, &unused,
false);
209 jb_set_string(jb,
"payload_printable", (
char *)printable_buf);
210 jb_set_bool(jb,
"complete", complete);
214 static void FrameAddPayloadUDP(JsonBuilder *js,
const Packet *p,
const Frame *
frame)
233 const uint32_t data_len = frame_len;
235 const uint32_t log_data_len =
MIN(data_len, 256);
236 jb_set_base64(js,
"payload", data, log_data_len);
238 uint8_t printable_buf[log_data_len + 1];
241 printable_buf[log_data_len] =
'\0';
242 jb_set_string(js,
"payload_printable", (
char *)printable_buf);
244 char pretty_buf[data_len * 4 + 1];
245 pretty_buf[0] =
'\0';
246 PayloadAsHex(data, data_len, pretty_buf, data_len * 4 + 1);
247 jb_set_string(js,
"payload_hex", pretty_buf);
261 jb_open_object(jb,
"frame");
263 jb_set_string(jb,
"type",
"stream");
267 jb_set_uint(jb,
"id",
frame->
id);
268 jb_set_string(jb,
"direction",
PKT_IS_TOSERVER(p) ?
"toserver" :
"toclient");
270 if (ipproto == IPPROTO_TCP) {
277 jb_set_uint(jb,
"length",
len);
279 jb_set_uint(jb,
"length",
frame->
len);
281 FrameAddPayloadTCP(f, f->
protoctx, stream,
frame, jb, buffer);
283 jb_set_uint(jb,
"length",
frame->
len);
284 FrameAddPayloadUDP(jb, p,
frame);
292 static int FrameJsonUdp(
299 frames = &frames_container->
toserver;
301 frames = &frames_container->
toclient;
304 for (uint32_t idx = 0; idx < frames->
cnt; idx++) {
334 if (frames_container == NULL)
337 if (p->
proto == IPPROTO_UDP) {
338 return FrameJsonUdp(aft, p, p->
flow, frames_container);
353 frames = &frames_container->
toserver;
359 frames = &frames_container->
toclient;
365 for (uint32_t idx = 0; idx < frames->
cnt; idx++) {
374 if (!eof && win < frame->
len && win < 2500) {
375 SCLogDebug(
"frame id %" PRIi64
" len %" PRIi64
", win %" PRIi64
376 ", skipping logging",
395 }
else if (
frame != NULL) {
405 return FrameJson(
tv, aft, p);
415 if (frames_container == NULL)
420 frames = &frames_container->
toserver;
422 frames = &frames_container->
toclient;
424 return (frames->
cnt != 0);
429 static TmEcode JsonFrameLogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
435 if (initdata == NULL) {
436 SCLogDebug(
"Error getting context for EveLogFrame. \"initdata\" argument NULL");
482 static void JsonFrameLogDeInitCtxSub(
OutputCtx *output_ctx)
484 SCLogDebug(
"cleaning up sub output_ctx %p", output_ctx);
488 if (json_output_ctx != NULL) {
510 if (
unlikely(json_output_ctx == NULL)) {
514 uint32_t payload_buffer_size = 4096;
517 if (payload_buffer_value != NULL) {
520 SCLogError(
"Error parsing payload-buffer-size \"%s\"", payload_buffer_value);
523 payload_buffer_size = value;
528 json_output_ctx->
eve_ctx = ajt;
531 output_ctx->
data = json_output_ctx;
532 output_ctx->
DeInit = JsonFrameLogDeInitCtxSub;
536 result.
ctx = output_ctx;
541 if (json_output_ctx != NULL) {
544 if (output_ctx != NULL) {
554 JsonFrameLogInitCtxSub, JsonFrameLogger, JsonFrameLogCondition, JsonFrameLogThreadInit,
555 JsonFrameLogThreadDeinit, NULL);
#define FLOW_PKT_LAST_PSEUDO
OutputJsonThreadCtx * ctx
struct FrameJsonOutputCtx_ FrameJsonOutputCtx
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx)
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx)
OutputJsonThreadCtx * CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
Frame * FrameGetByIndex(Frames *frames, const uint32_t idx)
const JsonAddrInfo json_addr_info_zero
#define APP_LAYER_PARSER_EOF_TS
void PrintStringsToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32_t dst_buf_size, const uint8_t *src_buf, const uint32_t src_buf_len)
uint64_t StreamTcpGetUsable(const TcpStream *stream, const bool eof)
AppLayerParserState * alparser
#define PKT_IS_TOSERVER(p)
const char * AppLayerParserGetFrameNameById(uint8_t ipproto, AppProto alproto, const uint8_t id)
size_t strlcat(char *, const char *src, size_t siz)
#define FRAME_FLAG_TX_ID_SET
#define STREAM_BASE_OFFSET(stream)
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Per thread variable structure.
#define JB_SET_TRUE(jb, key)
FrameJsonOutputCtx * json_output_ctx
uint32_t payload_buffer_size
FramesContainer * AppLayerFramesGetContainer(Flow *f)
#define APP_LAYER_PARSER_EOF_TC
MemBuffer * payload_buffer
void JsonFrameLogRegister(void)
void(* DeInit)(struct OutputCtx_ *)
void OutputRegisterPacketSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, PacketLogger PacketLogFunc, PacketLogCondition PacketConditionFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a packet output sub-module.
void MemBufferFree(MemBuffer *buffer)
void FrameConfigEnableAll(void)
#define JB_SET_FALSE(jb, key)
int ParseSizeStringU32(const char *size, uint32_t *res)
#define FRAME_STREAM_TYPE
#define SCLogError(...)
Macro used to log ERROR messages.
#define FRAME_FLAG_LOGGED
void FrameJsonLogOneFrame(const uint8_t ipproto, const Frame *frame, Flow *f, const TcpStream *stream, const Packet *p, JsonBuilder *jb, MemBuffer *buffer)
log a single frame
struct JsonFrameLogThread_ JsonFrameLogThread
uint64_t StreamDataRightEdge(const TcpStream *stream, const bool eof)
#define STREAMTCP_FLAG_APP_LAYER_DISABLED
uint32_t MemBufferWriteRaw(MemBuffer *dst, const uint8_t *raw, const uint32_t raw_len)
Write a raw buffer to the MemBuffer dst.
void MemBufferWriteString(MemBuffer *dst, const char *fmt,...)
void JsonAddrInfoInit(const Packet *p, enum OutputJsonLogDirection dir, JsonAddrInfo *addr)
#define STREAM_APP_PROGRESS(stream)
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
AppProto alproto
application level protocol
int StreamReassembleLog(const TcpSession *ssn, const TcpStream *stream, StreamReassembleRawFunc Callback, void *cb_data, const uint64_t progress_in, uint64_t *progress_out, const bool eof)
#define DEBUG_VALIDATE_BUG_ON(exp)
MemBuffer * MemBufferCreateNew(uint32_t size)
const char * ConfNodeLookupChildValue(const ConfNode *node, const char *name)
Lookup the value of a child configuration node by name.