suricata
output-json-netflow.c
Go to the documentation of this file.
1 /* Copyright (C) 2014-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Implements Unidirectiontal NetFlow JSON logging portion of the engine.
24  */
25 
26 #include "suricata-common.h"
27 #include "debug.h"
28 #include "detect.h"
29 #include "pkt-var.h"
30 #include "conf.h"
31 
32 #include "threads.h"
33 #include "threadvars.h"
34 #include "tm-threads.h"
35 
36 #include "util-print.h"
37 #include "util-unittest.h"
38 
39 #include "util-debug.h"
40 
41 #include "output.h"
42 #include "util-privs.h"
43 #include "util-buffer.h"
44 #include "util-proto-name.h"
45 #include "util-logopenfile.h"
46 #include "util-time.h"
47 #include "output-json.h"
48 #include "output-json-netflow.h"
49 
50 #include "stream-tcp-private.h"
51 
52 typedef struct LogJsonFileCtx_ {
56 
57 typedef struct JsonNetFlowLogThread_ {
59  /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
60 
63 
64 static JsonBuilder *CreateEveHeaderFromFlow(const Flow *f, const char *event_type, int dir)
65 {
66  char timebuf[64];
67  char srcip[46] = {0}, dstip[46] = {0};
68  Port sp, dp;
69 
70  JsonBuilder *js = jb_new_object();
71  if (unlikely(js == NULL))
72  return NULL;
73 
74  struct timeval tv;
75  memset(&tv, 0x00, sizeof(tv));
76  TimeGet(&tv);
77 
78  CreateIsoTimeString(&tv, timebuf, sizeof(timebuf));
79 
80  /* reverse header direction if the flow started out wrong */
81  dir ^= ((f->flags & FLOW_DIR_REVERSED) != 0);
82 
83  if (FLOW_IS_IPV4(f)) {
84  if (dir == 0) {
85  PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), srcip, sizeof(srcip));
86  PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), dstip, sizeof(dstip));
87  } else {
88  PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), srcip, sizeof(srcip));
89  PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), dstip, sizeof(dstip));
90  }
91  } else if (FLOW_IS_IPV6(f)) {
92  if (dir == 0) {
93  PrintInet(AF_INET6, (const void *)&(f->src.address), srcip, sizeof(srcip));
94  PrintInet(AF_INET6, (const void *)&(f->dst.address), dstip, sizeof(dstip));
95  } else {
96  PrintInet(AF_INET6, (const void *)&(f->dst.address), srcip, sizeof(srcip));
97  PrintInet(AF_INET6, (const void *)&(f->src.address), dstip, sizeof(dstip));
98  }
99  }
100 
101  if (dir == 0) {
102  sp = f->sp;
103  dp = f->dp;
104  } else {
105  sp = f->dp;
106  dp = f->sp;
107  }
108 
109  /* time */
110  jb_set_string(js, "timestamp", timebuf);
111 
112  CreateEveFlowId(js, (const Flow *)f);
113 
114 #if 0 // TODO
115  /* sensor id */
116  if (sensor_id >= 0)
117  json_object_set_new(js, "sensor_id", json_integer(sensor_id));
118 #endif
119 
120  /* input interface */
121  if (f->livedev) {
122  jb_set_string(js, "in_iface", f->livedev->dev);
123  }
124 
125  if (event_type) {
126  jb_set_string(js, "event_type", event_type);
127  }
128 
129  /* vlan */
130  if (f->vlan_idx > 0) {
131  jb_open_array(js, "vlan");
132  jb_append_uint(js, f->vlan_id[0]);
133  if (f->vlan_idx > 1) {
134  jb_append_uint(js, f->vlan_id[1]);
135  }
136  jb_close(js);
137  }
138 
139  /* tuple */
140  jb_set_string(js, "src_ip", srcip);
141  switch(f->proto) {
142  case IPPROTO_ICMP:
143  break;
144  case IPPROTO_UDP:
145  case IPPROTO_TCP:
146  case IPPROTO_SCTP:
147  jb_set_uint(js, "src_port", sp);
148  break;
149  }
150  jb_set_string(js, "dest_ip", dstip);
151  switch(f->proto) {
152  case IPPROTO_ICMP:
153  break;
154  case IPPROTO_UDP:
155  case IPPROTO_TCP:
156  case IPPROTO_SCTP:
157  jb_set_uint(js, "dest_port", dp);
158  break;
159  }
160 
161  if (SCProtoNameValid(f->proto)) {
162  jb_set_string(js, "proto", known_proto[f->proto]);
163  } else {
164  char proto[4];
165  snprintf(proto, sizeof(proto), "%"PRIu8"", f->proto);
166  jb_set_string(js, "proto", proto);
167  }
168 
169  switch (f->proto) {
170  case IPPROTO_ICMP:
171  case IPPROTO_ICMPV6: {
172  uint8_t type = f->icmp_s.type;
173  uint8_t code = f->icmp_s.code;
174  if (dir == 1) {
175  type = f->icmp_d.type;
176  code = f->icmp_d.code;
177 
178  }
179  jb_set_uint(js, "icmp_type", type);
180  jb_set_uint(js, "icmp_code", code);
181  break;
182  }
183  }
184  return js;
185 }
186 
187 /* JSON format logging */
188 static void NetFlowLogEveToServer(JsonNetFlowLogThread *aft, JsonBuilder *js, Flow *f)
189 {
190  jb_set_string(js, "app_proto",
192 
193  jb_open_object(js, "netflow");
194 
195  jb_set_uint(js, "pkts", f->todstpktcnt);
196  jb_set_uint(js, "bytes", f->todstbytecnt);
197 
198  char timebuf1[64], timebuf2[64];
199 
200  CreateIsoTimeString(&f->startts, timebuf1, sizeof(timebuf1));
201  CreateIsoTimeString(&f->lastts, timebuf2, sizeof(timebuf2));
202 
203  jb_set_string(js, "start", timebuf1);
204  jb_set_string(js, "end", timebuf2);
205 
206  int32_t age = f->lastts.tv_sec - f->startts.tv_sec;
207  jb_set_uint(js, "age", age);
208 
209  jb_set_uint(js, "min_ttl", f->min_ttl_toserver);
210  jb_set_uint(js, "max_ttl", f->max_ttl_toserver);
211 
212  /* Close netflow. */
213  jb_close(js);
214 
215  /* TCP */
216  if (f->proto == IPPROTO_TCP) {
217  jb_open_object(js, "tcp");
218 
219  TcpSession *ssn = f->protoctx;
220 
221  char hexflags[3];
222  snprintf(hexflags, sizeof(hexflags), "%02x",
223  ssn ? ssn->client.tcp_flags : 0);
224  jb_set_string(js, "tcp_flags", hexflags);
225 
226  EveTcpFlags(ssn ? ssn->client.tcp_flags : 0, js);
227 
228  jb_close(js);
229  }
230 }
231 
232 static void NetFlowLogEveToClient(JsonNetFlowLogThread *aft, JsonBuilder *js, Flow *f)
233 {
234  jb_set_string(js, "app_proto",
236 
237  jb_open_object(js, "netflow");
238 
239  jb_set_uint(js, "pkts", f->tosrcpktcnt);
240  jb_set_uint(js, "bytes", f->tosrcbytecnt);
241 
242  char timebuf1[64], timebuf2[64];
243 
244  CreateIsoTimeString(&f->startts, timebuf1, sizeof(timebuf1));
245  CreateIsoTimeString(&f->lastts, timebuf2, sizeof(timebuf2));
246 
247  jb_set_string(js, "start", timebuf1);
248  jb_set_string(js, "end", timebuf2);
249 
250  int32_t age = f->lastts.tv_sec - f->startts.tv_sec;
251  jb_set_uint(js, "age", age);
252 
253  /* To client is zero if we did not see any packet */
254  if (f->tosrcpktcnt) {
255  jb_set_uint(js, "min_ttl", f->min_ttl_toclient);
256  jb_set_uint(js, "max_ttl", f->max_ttl_toclient);
257  }
258 
259  /* Close netflow. */
260  jb_close(js);
261 
262  /* TCP */
263  if (f->proto == IPPROTO_TCP) {
264  jb_open_object(js, "tcp");
265 
266  TcpSession *ssn = f->protoctx;
267 
268  char hexflags[3];
269  snprintf(hexflags, sizeof(hexflags), "%02x",
270  ssn ? ssn->server.tcp_flags : 0);
271  jb_set_string(js, "tcp_flags", hexflags);
272 
273  EveTcpFlags(ssn ? ssn->server.tcp_flags : 0, js);
274 
275  jb_close(js);
276  }
277 }
278 
279 static int JsonNetFlowLogger(ThreadVars *tv, void *thread_data, Flow *f)
280 {
281  SCEnter();
282  JsonNetFlowLogThread *jhl = (JsonNetFlowLogThread *)thread_data;
283  LogJsonFileCtx *netflow_ctx = jhl->flowlog_ctx;
284 
285  /* reset */
286  MemBufferReset(jhl->buffer);
287  JsonBuilder *jb = CreateEveHeaderFromFlow(f, "netflow", 0);
288  if (unlikely(jb == NULL))
289  return TM_ECODE_OK;
290  NetFlowLogEveToServer(jhl, jb, f);
291  EveAddCommonOptions(&netflow_ctx->cfg, NULL, f, jb);
293  jb_free(jb);
294 
295  /* only log a response record if we actually have seen response packets */
296  if (f->tosrcpktcnt) {
297  /* reset */
298  MemBufferReset(jhl->buffer);
299  jb = CreateEveHeaderFromFlow(f, "netflow", 1);
300  if (unlikely(jb == NULL))
301  return TM_ECODE_OK;
302  NetFlowLogEveToClient(jhl, jb, f);
303  EveAddCommonOptions(&netflow_ctx->cfg, NULL, f, jb);
305  jb_free(jb);
306  }
308 }
309 
310 static void OutputNetFlowLogDeinit(OutputCtx *output_ctx)
311 {
312  LogJsonFileCtx *flow_ctx = output_ctx->data;
313  LogFileCtx *logfile_ctx = flow_ctx->file_ctx;
314  LogFileFreeCtx(logfile_ctx);
315  SCFree(flow_ctx);
316  SCFree(output_ctx);
317 }
318 
319 #define DEFAULT_LOG_FILENAME "netflow.json"
320 static OutputInitResult OutputNetFlowLogInit(ConfNode *conf)
321 {
322  OutputInitResult result = { NULL, false };
323  LogFileCtx *file_ctx = LogFileNewCtx();
324  if(file_ctx == NULL) {
325  SCLogError(SC_ERR_NETFLOW_LOG_GENERIC, "couldn't create new file_ctx");
326  return result;
327  }
328 
329  if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME, 1) < 0) {
330  LogFileFreeCtx(file_ctx);
331  return result;
332  }
333 
334  LogJsonFileCtx *flow_ctx = SCMalloc(sizeof(LogJsonFileCtx));
335  if (unlikely(flow_ctx == NULL)) {
336  LogFileFreeCtx(file_ctx);
337  return result;
338  }
339 
340  OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
341  if (unlikely(output_ctx == NULL)) {
342  LogFileFreeCtx(file_ctx);
343  SCFree(flow_ctx);
344  return result;
345  }
346 
347  flow_ctx->file_ctx = file_ctx;
348  output_ctx->data = flow_ctx;
349  output_ctx->DeInit = OutputNetFlowLogDeinit;
350 
351  result.ctx = output_ctx;
352  result.ok = true;
353  return result;
354 }
355 
356 static void OutputNetFlowLogDeinitSub(OutputCtx *output_ctx)
357 {
358  LogJsonFileCtx *flow_ctx = output_ctx->data;
359  SCFree(flow_ctx);
360  SCFree(output_ctx);
361 }
362 
363 static OutputInitResult OutputNetFlowLogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
364 {
365  OutputInitResult result = { NULL, false };
366  OutputJsonCtx *ojc = parent_ctx->data;
367 
368  LogJsonFileCtx *flow_ctx = SCMalloc(sizeof(LogJsonFileCtx));
369  if (unlikely(flow_ctx == NULL))
370  return result;
371 
372  OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
373  if (unlikely(output_ctx == NULL)) {
374  SCFree(flow_ctx);
375  return result;
376  }
377 
378  flow_ctx->file_ctx = ojc->file_ctx;
379  flow_ctx->cfg = ojc->cfg;
380 
381  output_ctx->data = flow_ctx;
382  output_ctx->DeInit = OutputNetFlowLogDeinitSub;
383 
384  result.ctx = output_ctx;
385  result.ok = true;
386  return result;
387 }
388 
389 static TmEcode JsonNetFlowLogThreadInit(ThreadVars *t, const void *initdata, void **data)
390 {
392  if (unlikely(aft == NULL))
393  return TM_ECODE_FAILED;
394  memset(aft, 0, sizeof(JsonNetFlowLogThread));
395 
396  if(initdata == NULL)
397  {
398  SCLogDebug("Error getting context for EveLogNetflow. \"initdata\" argument NULL");
399  SCFree(aft);
400  return TM_ECODE_FAILED;
401  }
402 
403  /* Use the Ouptut Context (file pointer and mutex) */
404  aft->flowlog_ctx = ((OutputCtx *)initdata)->data; //TODO
405 
407  if (aft->buffer == NULL) {
408  SCFree(aft);
409  return TM_ECODE_FAILED;
410  }
411 
412  *data = (void *)aft;
413  return TM_ECODE_OK;
414 }
415 
416 static TmEcode JsonNetFlowLogThreadDeinit(ThreadVars *t, void *data)
417 {
419  if (aft == NULL) {
420  return TM_ECODE_OK;
421  }
422 
423  MemBufferFree(aft->buffer);
424  /* clear memory */
425  memset(aft, 0, sizeof(JsonNetFlowLogThread));
426 
427  SCFree(aft);
428  return TM_ECODE_OK;
429 }
430 
432 {
433  /* register as separate module */
435  "netflow-json-log", OutputNetFlowLogInit, JsonNetFlowLogger,
436  JsonNetFlowLogThreadInit, JsonNetFlowLogThreadDeinit, NULL);
437 
438  /* also register as child of eve-log */
439  OutputRegisterFlowSubModule(LOGGER_JSON_NETFLOW, "eve-log", "JsonNetFlowLog",
440  "eve-log.netflow", OutputNetFlowLogInitSub, JsonNetFlowLogger,
441  JsonNetFlowLogThreadInit, JsonNetFlowLogThreadDeinit, NULL);
442 }
tm-threads.h
JsonNetFlowLogThread
struct JsonNetFlowLogThread_ JsonNetFlowLogThread
FLOW_IS_IPV6
#define FLOW_IS_IPV6(f)
Definition: flow.h:153
CreateIsoTimeString
void CreateIsoTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:213
Flow_::startts
struct timeval startts
Definition: flow.h:474
OutputJsonCtx_::cfg
OutputJsonCommonSettings cfg
Definition: output-json.h:111
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
LogJsonFileCtx
struct LogJsonFileCtx_ LogJsonFileCtx
LogFileNewCtx
LogFileCtx * LogFileNewCtx(void)
LogFileNewCtx() Get a new LogFileCtx.
Definition: util-logopenfile.c:516
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
Flow_::proto
uint8_t proto
Definition: flow.h:361
JSON_OUTPUT_BUFFER_SIZE
#define JSON_OUTPUT_BUFFER_SIZE
Definition: output-json.h:62
threads.h
OutputJsonCtx_
Definition: output-json.h:108
Flow_
Flow data structure.
Definition: flow.h:343
OutputJsonCommonSettings_
Definition: output-json.h:99
Flow_::icmp_s
struct Flow_::@119::@123 icmp_s
Flow_::icmp_d
struct Flow_::@121::@124 icmp_d
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:30
LogFileCtx_
Definition: util-logopenfile.h:52
output-json-netflow.h
Flow_::vlan_id
uint16_t vlan_id[2]
Definition: flow.h:363
SCProtoNameValid
bool SCProtoNameValid(uint16_t proto)
Function to check if the received protocol number is valid and do we have corresponding name entry fo...
Definition: util-proto-name.c:98
OutputJsonBuilderBuffer
int OutputJsonBuilderBuffer(JsonBuilder *js, LogFileCtx *file_ctx, MemBuffer **buffer)
Definition: output-json.c:1429
util-privs.h
EveAddCommonOptions
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, JsonBuilder *js)
Definition: output-json.c:673
JsonNetFlowLogThread_::buffer
MemBuffer * buffer
Definition: output-json-netflow.c:61
Flow_::max_ttl_toserver
uint8_t max_ttl_toserver
Definition: flow.h:446
proto
uint8_t proto
Definition: decode-template.h:0
Flow_::dp
Port dp
Definition: flow.h:355
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:79
Flow_::protoctx
void * protoctx
Definition: flow.h:416
util-unittest.h
OutputCtx_::data
void * data
Definition: tm-modules.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:78
OutputCtx_
Definition: tm-modules.h:78
LogJsonFileCtx_::file_ctx
LogFileCtx * file_ctx
Definition: output-json-flow.c:55
SCConfLogOpenGeneric
int SCConfLogOpenGeneric(ConfNode *conf, LogFileCtx *log_ctx, const char *default_filename, int rotate)
open a generic output "log file", which may be a regular file or a socket
Definition: util-logopenfile.c:305
Flow_::tosrcbytecnt
uint64_t tosrcbytecnt
Definition: flow.h:479
Flow_::dst
FlowAddress dst
Definition: flow.h:346
Flow_::min_ttl_toserver
uint8_t min_ttl_toserver
Definition: flow.h:445
util-debug.h
type
uint8_t type
Definition: decode-icmpv4.h:0
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:44
Flow_::todstpktcnt
uint32_t todstpktcnt
Definition: flow.h:476
output-json.h
FlowAddress_::address
union FlowAddress_::@118 address
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DEFAULT_LOG_FILENAME
#define DEFAULT_LOG_FILENAME
Definition: output-json-netflow.c:319
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:267
pkt-var.h
EveTcpFlags
void EveTcpFlags(const uint8_t flags, JsonBuilder *js)
jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.
Definition: output-json.c:760
LogJsonFileCtx_
Definition: output-json-flow.c:54
util-time.h
OutputInitResult_::ok
bool ok
Definition: output.h:45
LiveDevice_::dev
char * dev
Definition: util-device.h:41
Flow_::todstbytecnt
uint64_t todstbytecnt
Definition: flow.h:478
FLOW_IS_IPV4
#define FLOW_IS_IPV4(f)
Definition: flow.h:151
LOGGER_JSON_NETFLOW
@ LOGGER_JSON_NETFLOW
Definition: suricata-common.h:482
stream-tcp-private.h
conf.h
Port
uint16_t Port
Definition: decode.h:238
TmEcode
TmEcode
Definition: tm-threads-common.h:77
JsonNetFlowLogThread_::flowlog_ctx
LogJsonFileCtx * flowlog_ctx
Definition: output-json-netflow.c:58
Flow_::vlan_idx
uint8_t vlan_idx
Definition: flow.h:364
Flow_::min_ttl_toclient
uint8_t min_ttl_toclient
Definition: flow.h:447
util-proto-name.h
MemBuffer_
Definition: util-buffer.h:27
Flow_::src
FlowAddress src
Definition: flow.h:346
Flow_::lastts
struct timeval lastts
Definition: flow.h:375
MemBufferReset
#define MemBufferReset(mem_buffer)
Reset the mem buffer.
Definition: util-buffer.h:42
OutputInitResult_
Definition: output.h:43
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
MemBufferFree
void MemBufferFree(MemBuffer *buffer)
Definition: util-buffer.c:82
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
LogFileFreeCtx
int LogFileFreeCtx(LogFileCtx *lf_ctx)
LogFileFreeCtx() Destroy a LogFileCtx (Close the file and free memory)
Definition: util-logopenfile.c:538
Flow_::max_ttl_toclient
uint8_t max_ttl_toclient
Definition: flow.h:448
SC_ERR_NETFLOW_LOG_GENERIC
@ SC_ERR_NETFLOW_LOG_GENERIC
Definition: util-error.h:314
TcpSession_::client
TcpStream client
Definition: stream-tcp-private.h:272
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
Flow_::livedev
struct LiveDevice_ * livedev
Definition: flow.h:367
LogJsonFileCtx_::cfg
OutputJsonCommonSettings cfg
Definition: output-json-flow.c:57
threadvars.h
CreateEveFlowId
void CreateEveFlowId(JsonBuilder *js, const Flow *f)
Definition: output-json.c:1190
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
TcpSession_::server
TcpStream server
Definition: stream-tcp-private.h:271
OutputRegisterFlowSubModule
void OutputRegisterFlowSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a flow output sub-module.
Definition: output.c:620
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Flow_::alproto_ts
AppProto alproto_ts
Definition: flow.h:426
ConfNode_
Definition: conf.h:32
util-logopenfile.h
Flow_::flags
uint32_t flags
Definition: flow.h:396
util-buffer.h
TimeGet
void TimeGet(struct timeval *tv)
Definition: util-time.c:153
OutputJsonCtx_::file_ctx
LogFileCtx * file_ctx
Definition: output-json.h:109
known_proto
char * known_proto[256]
Definition: util-proto-name.c:33
JsonNetFlowLogThread_
Definition: output-json-netflow.c:57
Flow_::sp
Port sp
Definition: flow.h:348
TcpSession_
Definition: stream-tcp-private.h:260
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:427
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:425
FLOW_DIR_REVERSED
#define FLOW_DIR_REVERSED
Definition: flow.h:106
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
code
uint8_t code
Definition: decode-icmpv4.h:1
TcpStream_::tcp_flags
uint8_t tcp_flags
Definition: stream-tcp-private.h:99
Flow_::tosrcpktcnt
uint32_t tosrcpktcnt
Definition: flow.h:477
MemBufferCreateNew
MemBuffer * MemBufferCreateNew(uint32_t size)
Definition: util-buffer.c:32
debug.h
output.h
OutputRegisterFlowModule
void OutputRegisterFlowModule(LoggerId id, const char *name, const char *conf_name, OutputInitFunc InitFunc, FlowLogger FlowLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Register a flow output module.
Definition: output.c:582
JsonNetFlowLogRegister
void JsonNetFlowLogRegister(void)
Definition: output-json-netflow.c:431