suricata
output-json.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Tom DeCanio <td@npulsetech.com>
22  */
23 
24 #ifndef SURICATA_OUTPUT_JSON_H
25 #define SURICATA_OUTPUT_JSON_H
26 
27 #include "suricata-common.h"
28 #include "util-buffer.h"
29 #include "util-logopenfile.h"
30 #include "output.h"
31 
32 #include "app-layer-htp-xff.h"
33 
34 void OutputJsonRegister(void);
35 
41 };
42 
43 #define JSON_ADDR_LEN 46
44 #define JSON_PROTO_LEN 16
45 
46 /* A struct to contain address info for rendering to JSON. */
47 typedef struct JsonAddrInfo_ {
54 
56 
57 void JsonAddrInfoInit(const Packet *p, enum OutputJsonLogDirection dir,
58  JsonAddrInfo *addr);
59 
60 /* Suggested output buffer size */
61 #define JSON_OUTPUT_BUFFER_SIZE 65535
62 
63 /* helper struct for OutputJSONMemBufferCallback */
65  MemBuffer **buffer; /**< buffer to use & expand as needed */
66  size_t expand_by; /**< expand by this size */
68 
69 typedef struct OutputJsonCommonSettings_ {
75 
76 /*
77  * Global configuration context data
78  */
79 typedef struct OutputJsonCtx_ {
81  enum LogFileType json_out;
86 
87 typedef struct OutputJsonThreadCtx_ {
92 
93 json_t *SCJsonString(const char *val);
94 
95 void CreateEveFlowId(JsonBuilder *js, const Flow *f);
96 void EveFileInfo(JsonBuilder *js, const File *file, const uint64_t tx_id, const uint16_t flags);
97 void EveTcpFlags(uint8_t flags, JsonBuilder *js);
98 void EvePacket(const Packet *p, JsonBuilder *js, unsigned long max_length);
99 JsonBuilder *CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir,
100  const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx);
101 JsonBuilder *CreateEveHeaderWithTxId(const Packet *p, enum OutputJsonLogDirection dir,
102  const char *event_type, JsonAddrInfo *addr, uint64_t tx_id, OutputJsonCtx *eve_ctx);
103 int OutputJSONBuffer(json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer);
104 int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx);
106 
108 TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data);
109 TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data);
110 
112  const Packet *p, const Flow *f, JsonBuilder *js);
113 void EveAddMetadata(const Packet *p, const Flow *f, JsonBuilder *js);
114 
115 int OutputJSONMemBufferCallback(const char *str, size_t size, void *data);
116 
119 
120 #endif /* SURICATA_OUTPUT_JSON_H */
EveAddCommonOptions
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, JsonBuilder *js)
Definition: output-json.c:416
FreeEveThreadCtx
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx)
Definition: output-json-common.c:58
OutputJsonCtx_::xff_cfg
HttpXFFCfg * xff_cfg
Definition: output-json.h:83
OutputJsonCommonSettings
struct OutputJsonCommonSettings_ OutputJsonCommonSettings
OutputJsonThreadCtx_::ctx
OutputJsonCtx * ctx
Definition: output-json.h:88
SCJsonString
json_t * SCJsonString(const char *val)
Definition: output-json.c:104
CreateEveHeaderWithTxId
JsonBuilder * CreateEveHeaderWithTxId(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, uint64_t tx_id, OutputJsonCtx *eve_ctx)
Definition: output-json.c:873
OutputJsonCtx_::cfg
OutputJsonCommonSettings cfg
Definition: output-json.h:82
OutputJsonCtx
struct OutputJsonCtx_ OutputJsonCtx
OutputJsonLogInitSub
OutputInitResult OutputJsonLogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
Definition: output-json-common.c:73
EvePacket
void EvePacket(const Packet *p, JsonBuilder *js, unsigned long max_length)
Jsonify a packet.
Definition: output-json.c:440
OutputJsonCtx_
Definition: output-json.h:79
Flow_
Flow data structure.
Definition: flow.h:350
OutputJsonCommonSettings_
Definition: output-json.h:69
LogFileCtx_
Definition: util-logopenfile.h:76
OutputJsonCtx_::json_out
enum LogFileType json_out
Definition: output-json.h:81
OutputJsonCommonSettings_::include_community_id
bool include_community_id
Definition: output-json.h:71
OutputJSONMemBufferWrapper_::buffer
MemBuffer ** buffer
Definition: output-json.h:65
EveFileInfo
void EveFileInfo(JsonBuilder *js, const File *file, const uint64_t tx_id, const uint16_t flags)
Definition: output-json.c:132
json_addr_info_zero
const JsonAddrInfo json_addr_info_zero
Definition: output-json.c:89
JsonLogThreadDeinit
TmEcode JsonLogThreadDeinit(ThreadVars *t, void *data)
Definition: output-json-common.c:123
OutputCtx_
Definition: tm-modules.h:85
OutputJsonThreadCtx
struct OutputJsonThreadCtx_ OutputJsonThreadCtx
app-layer-htp-xff.h
OutputJsonThreadCtx_
Definition: output-json.h:87
CreateEveFlowId
void CreateEveFlowId(JsonBuilder *js, const Flow *f)
Definition: output-json.c:705
JsonAddrInfo_::dp
Port dp
Definition: output-json.h:51
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
CreateEveHeader
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Definition: output-json.c:787
JsonAddrInfo_
Definition: output-json.h:47
Packet_
Definition: decode.h:436
OutputJSONMemBufferWrapper_
Definition: output-json.h:64
Port
uint16_t Port
Definition: decode.h:229
TmEcode
TmEcode
Definition: tm-threads-common.h:83
OutputJsonThreadCtx_::file_ctx
LogFileCtx * file_ctx
Definition: output-json.h:89
HttpXFFCfg_
Definition: app-layer-htp-xff.h:41
LOG_DIR_FLOW_TOCLIENT
@ LOG_DIR_FLOW_TOCLIENT
Definition: output-json.h:39
EveAddMetadata
void EveAddMetadata(const Packet *p, const Flow *f, JsonBuilder *js)
Definition: output-json.c:393
OutputJsonCommonSettings_::include_ethernet
bool include_ethernet
Definition: output-json.h:72
MemBuffer_
Definition: util-buffer.h:27
OutputJsonBuilderBuffer
int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx)
Definition: output-json.c:928
OutputJsonCommonSettings_::include_metadata
bool include_metadata
Definition: output-json.h:70
JsonAddrInfo_::proto
char proto[JSON_PROTO_LEN]
Definition: output-json.h:52
File_
Definition: util-file.h:79
OutputInitResult_
Definition: output.h:46
OutputJsonThreadCtx_::buffer
MemBuffer * buffer
Definition: output-json.h:90
LOG_DIR_PACKET
@ LOG_DIR_PACKET
Definition: output-json.h:37
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
JsonAddrInfo_::sp
Port sp
Definition: output-json.h:50
OutputJSONMemBufferWrapper_::expand_by
size_t expand_by
Definition: output-json.h:66
JSON_ADDR_LEN
#define JSON_ADDR_LEN
Definition: output-json.h:43
OutputJsonLogDirection
OutputJsonLogDirection
Definition: output-json.h:36
EveTcpFlags
void EveTcpFlags(uint8_t flags, JsonBuilder *js)
jsonify tcp flags field Only add 'true' fields in an attempt to keep things reasonably compact.
Definition: output-json.c:457
OutputJsonRegister
void OutputJsonRegister(void)
Definition: output-json.c:91
LOG_DIR_FLOW
@ LOG_DIR_FLOW
Definition: output-json.h:38
JsonAddrInfo_::src_ip
char src_ip[JSON_ADDR_LEN]
Definition: output-json.h:48
str
#define str(s)
Definition: suricata-common.h:291
LOG_DIR_FLOW_TOSERVER
@ LOG_DIR_FLOW_TOSERVER
Definition: output-json.h:40
ConfNode_
Definition: conf.h:32
util-logopenfile.h
JsonAddrInfo
struct JsonAddrInfo_ JsonAddrInfo
util-buffer.h
JsonAddrInfo_::dst_ip
char dst_ip[JSON_ADDR_LEN]
Definition: output-json.h:49
OutputJsonCtx_::file_ctx
LogFileCtx * file_ctx
Definition: output-json.h:80
LogFileType
LogFileType
Definition: util-logopenfile.h:38
OutputJSONBuffer
int OutputJSONBuffer(json_t *js, LogFileCtx *file_ctx, MemBuffer **buffer)
Definition: output-json.c:899
OutputJsonCommonSettings_::community_id_seed
uint16_t community_id_seed
Definition: output-json.h:73
OutputJSONMemBufferWrapper
struct OutputJSONMemBufferWrapper_ OutputJSONMemBufferWrapper
JsonAddrInfoInit
void JsonAddrInfoInit(const Packet *p, enum OutputJsonLogDirection dir, JsonAddrInfo *addr)
Definition: output-json.c:477
OutputJsonInitCtx
OutputInitResult OutputJsonInitCtx(ConfNode *)
Create a new LogFileCtx for "fast" output style.
Definition: output-json.c:1037
JSON_PROTO_LEN
#define JSON_PROTO_LEN
Definition: output-json.h:44
OutputJSONMemBufferCallback
int OutputJSONMemBufferCallback(const char *str, size_t size, void *data)
Definition: output-json.c:886
output.h
SCEveFileType_
Structure used to define an EVE output file type plugin.
Definition: output-eve.h:73
JsonLogThreadInit
TmEcode JsonLogThreadInit(ThreadVars *t, const void *initdata, void **data)
Definition: output-json-common.c:90
OutputJsonCtx_::filetype
SCEveFileType * filetype
Definition: output-json.h:84
CreateEveThreadCtx
OutputJsonThreadCtx * CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
Definition: output-json-common.c:29