suricata
output-json.h File Reference
#include "suricata-common.h"
#include "util-buffer.h"
#include "util-logopenfile.h"
#include "output.h"
#include "app-layer-htp-xff.h"
Include dependency graph for output-json.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  OutputJSONMemBufferWrapper_
 
struct  OutputJsonCommonSettings_
 
struct  OutputJsonCtx_
 
struct  OutputJsonThreadCtx_
 

Macros

#define JSON_OUTPUT_BUFFER_SIZE   65535
 

Typedefs

typedef struct OutputJSONMemBufferWrapper_ OutputJSONMemBufferWrapper
 
typedef struct OutputJsonCommonSettings_ OutputJsonCommonSettings
 
typedef struct OutputJsonCtx_ OutputJsonCtx
 
typedef struct OutputJsonThreadCtx_ OutputJsonThreadCtx
 

Enumerations

enum  OutputJsonLogDirection { LOG_DIR_PACKET = 0, LOG_DIR_FLOW, LOG_DIR_FLOW_TOCLIENT, LOG_DIR_FLOW_TOSERVER }
 

Functions

void OutputJsonRegister (void)
 
int OutputJSONMemBufferCallback (const char *str, size_t size, void *data)
 
void CreateJSONFlowId (json_t *js, const Flow *f)
 
void JsonTcpFlags (uint8_t flags, json_t *js)
 jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact. More...
 
void JsonPacket (const Packet *p, json_t *js, unsigned long max_length)
 Jsonify a packet. More...
 
void JsonFiveTuple (const Packet *, enum OutputJsonLogDirection, json_t *)
 Add five tuple from packet to JSON object. More...
 
json_t * CreateJSONHeader (const Packet *p, enum OutputJsonLogDirection dir, const char *event_type)
 
json_t * CreateJSONHeaderWithTxId (const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, uint64_t tx_id)
 
int OutputJSONBuffer (json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer)
 
OutputInitResult OutputJsonInitCtx (ConfNode *)
 Create a new LogFileCtx for "fast" output style. More...
 
OutputInitResult OutputJsonLogInitSub (ConfNode *conf, OutputCtx *parent_ctx)
 
TmEcode JsonLogThreadInit (ThreadVars *t, const void *initdata, void **data)
 
TmEcode JsonLogThreadDeinit (ThreadVars *t, void *data)
 
json_t * SCJsonBool (int val)
 
json_t * SCJsonString (const char *val)
 
json_t * JsonAddStringN (const char *string, size_t size)
 Create a JSON string from a character sequence. More...
 
void SCJsonDecref (json_t *js)
 
void JsonAddCommonOptions (const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, json_t *js)
 

Detailed Description

Author
Tom DeCanio td@np.nosp@m.ulse.nosp@m.tech..nosp@m.com

Definition in file output-json.h.

Macro Definition Documentation

Typedef Documentation

typedef struct OutputJsonCtx_ OutputJsonCtx

Enumeration Type Documentation

Enumerator
LOG_DIR_PACKET 
LOG_DIR_FLOW 
LOG_DIR_FLOW_TOCLIENT 
LOG_DIR_FLOW_TOSERVER 

Definition at line 36 of file output-json.h.

Function Documentation

void CreateJSONFlowId ( json_t *  js,
const Flow f 
)

Definition at line 699 of file output-json.c.

References Flow_::parent_id.

Referenced by CreateJSONHeader().

Here is the caller graph for this function:

json_t* CreateJSONHeaderWithTxId ( const Packet p,
enum OutputJsonLogDirection  dir,
const char *  event_type,
uint64_t  tx_id 
)

Definition at line 783 of file output-json.c.

References CreateJSONHeader(), and unlikely.

Referenced by JsonHttpLogJSONBodyBase64().

Here is the call graph for this function:

Here is the caller graph for this function:

json_t* JsonAddStringN ( const char *  string,
size_t  size 
)
void JsonFiveTuple ( const Packet p,
enum OutputJsonLogDirection  dir,
json_t *  js 
)
TmEcode JsonLogThreadDeinit ( ThreadVars t,
void *  data 
)

Definition at line 97 of file output-json-common.c.

References OutputJsonThreadCtx_::buffer, MemBufferFree(), SCFree, and TM_ECODE_OK.

Referenced by JsonNFSLogRegister(), and JsonSMBLogRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

TmEcode JsonLogThreadInit ( ThreadVars t,
const void *  initdata,
void **  data 
)

Definition at line 75 of file output-json-common.c.

References OutputJsonThreadCtx_::buffer, OutputJsonThreadCtx_::ctx, JSON_OUTPUT_BUFFER_SIZE, MemBufferCreateNew(), SCCalloc, SCFree, TM_ECODE_FAILED, TM_ECODE_OK, and unlikely.

Referenced by JsonNFSLogRegister(), and JsonSMBLogRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

void JsonPacket ( const Packet p,
json_t *  js,
unsigned long  max_length 
)

Jsonify a packet.

Parameters
pPacket
jsJSON object
max_lengthIf non-zero, restricts the number of packet data bytes handled.

Definition at line 408 of file output-json.c.

References Base64Encode(), Packet_::datalink, GET_PKT_DATA, GET_PKT_LEN, len, SC_BASE64_OK, and unlikely.

Referenced by AlertJsonHeader().

Here is the call graph for this function:

Here is the caller graph for this function:

void JsonTcpFlags ( uint8_t  flags,
json_t *  js 
)

jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.

Definition at line 428 of file output-json.c.

References TH_ACK, TH_CWR, TH_ECN, TH_FIN, TH_PUSH, TH_RST, TH_SYN, and TH_URG.

Referenced by JsonAddFlow().

Here is the caller graph for this function:

OutputInitResult OutputJsonInitCtx ( ConfNode conf)

Create a new LogFileCtx for "fast" output style.

Parameters
confThe configuration node for this output.
Returns
A LogFileCtx pointer on success, NULL on failure.

Definition at line 843 of file output-json.c.

References SyslogSetup_::alert_syslog_level, ByteExtractStringUint16(), ByteExtractStringUint64(), OutputJsonCtx_::cfg, OutputJsonCommonSettings_::community_id_seed, ConfGet(), ConfNodeLookupChild(), ConfNodeLookupChildValue(), ConfValIsFalse(), ConfValIsTrue(), OutputInitResult_::ctx, OutputCtx_::data, DEFAULT_ALERT_SYSLOG_FACILITY, DEFAULT_ALERT_SYSLOG_FACILITY_STR, DEFAULT_LOG_FILENAME, OutputCtx_::DeInit, OutputJsonCtx_::file_ctx, HttpXFFGetCfg(), OutputJsonCommonSettings_::include_community_id, OutputJsonCommonSettings_::include_metadata, LogFileCtx_::is_pcap_offline, OutputJsonCtx_::json_out, likely, LOGFILE_TYPE_FILE, LOGFILE_TYPE_REDIS, LOGFILE_TYPE_SYSLOG, LOGFILE_TYPE_UNIX_DGRAM, LOGFILE_TYPE_UNIX_STREAM, LogFileFreeCtx(), LogFileNewCtx(), OutputInitResult_::ok, openlog, OutputRegisterFileRotationFlag(), LogFileCtx_::prefix, LogFileCtx_::prefix_len, LogFileCtx_::rotation_flag, RUNMODE_PCAP_FILE, RunmodeGetCurrent(), SC_ERR_DEPRECATED_CONF, SC_ERR_INVALID_ARGUMENT, SC_ERR_MEM_ALLOC, SC_WARN_EVENT_DROPPED, SCCalloc, SCConfLogOpenGeneric(), SCFree, SCLogDebug, SCLogError, SCLogInfo, SCLogWarning, SCMapEnumNameToValue(), SCStrdup, SCSyslogGetFacilityMap(), SCSyslogGetLogLevelMap(), LogFileCtx_::sensor_name, LogFileCtx_::syslog_setup, LogFileCtx_::type, unlikely, ConfNode_::val, and OutputJsonCtx_::xff_cfg.

Referenced by OutputJsonRegister().

Here is the call graph for this function:

Here is the caller graph for this function:

OutputInitResult OutputJsonLogInitSub ( ConfNode conf,
OutputCtx parent_ctx 
)

Definition at line 50 of file output-json-common.c.

References OutputInitResult_::ctx, OutputCtx_::data, OutputCtx_::DeInit, OutputInitResult_::ok, SCCalloc, SCFree, and unlikely.

Referenced by JsonNFSAddMetadata(), and JsonSMBAddMetadata().

Here is the caller graph for this function:

int OutputJSONMemBufferCallback ( const char *  str,
size_t  size,
void *  data 
)

Definition at line 796 of file output-json.c.

References OutputJSONMemBufferWrapper_::buffer, OutputJSONMemBufferWrapper_::expand_by, MEMBUFFER_OFFSET, MEMBUFFER_SIZE, MemBufferExpand(), and MemBufferWriteRaw.

Referenced by EngineAnalysisRules2(), OutputJSONBuffer(), and RulesDumpMatchArray().

Here is the call graph for this function:

Here is the caller graph for this function:

void OutputJsonRegister ( void  )

Definition at line 85 of file output-json.c.

References MODULE_NAME, OutputJsonInitCtx(), and OutputRegisterModule().

Referenced by OutputRegisterLoggers().

Here is the call graph for this function:

Here is the caller graph for this function:

json_t* SCJsonBool ( int  val)

Definition at line 93 of file output-json.c.

void SCJsonDecref ( json_t *  json)

Wrap json_decref. This is mainly to expose this function to Rust as its defined in the Jansson header file as an inline function.

Definition at line 102 of file output-json.c.

json_t* SCJsonString ( const char *  val)