72 SCLogError(
"Failed to allocate OutputTx list");
122 if (t->
id * 2ULL > UINT32_MAX) {
141 const uint64_t tx_id,
AppLayerTxData *txd,
const bool tx_complete,
const bool ts_ready,
142 const bool tc_ready,
const bool ts_eof,
const bool tc_eof,
const bool eof)
145 uint8_t opposing_dir;
146 bool packet_dir_ready;
147 const bool opposing_dir_ready = eof;
148 bool opposing_tx_ready;
150 packet_dir = STREAM_TOSERVER;
151 opposing_dir = STREAM_TOCLIENT;
152 packet_dir_ready = eof | ts_ready | ts_eof;
153 opposing_tx_ready = tc_ready;
155 packet_dir = STREAM_TOCLIENT;
156 opposing_dir = STREAM_TOSERVER;
157 packet_dir_ready = eof | tc_ready | tc_eof;
158 opposing_tx_ready = ts_ready;
163 SCLogDebug(
"eof %d ts_ready %d ts_eof %d", eof, ts_ready, ts_eof);
164 SCLogDebug(
"eof %d tc_ready %d tc_eof %d", eof, tc_ready, tc_eof);
166 SCLogDebug(
"packet dir %s opposing %s packet_dir_ready %d opposing_dir_ready %d",
167 packet_dir == STREAM_TOSERVER ?
"TOSERVER" :
"TOCLIENT",
168 opposing_dir == STREAM_TOSERVER ?
"TOSERVER" :
"TOCLIENT", packet_dir_ready,
178 bool opposing_finished =
179 ffc_opposing == NULL || (ffc_opposing->
head == NULL && opposing_tx_ready);
180 SCLogDebug(
"opposing_finished %d ffc_opposing %p ffc_opposing->head %p opposing_tx_ready %d",
181 opposing_finished, ffc_opposing, ffc_opposing ? ffc_opposing->
head : NULL,
184 if (ffc || ffc_opposing)
185 SCLogDebug(
"pcap_cnt %" PRIu64
" flow %p tx %p tx_id %" PRIu64
186 " ffc %p ffc_opposing %p tx_complete %d",
187 p->
pcap_cnt, f, tx, tx_id, ffc, ffc_opposing, tx_complete);
192 SCLogDebug(
"tx: calling files: ffc %p head %p file_close %d file_trunc %d", ffc, ffc->
head,
193 file_close, file_trunc);
194 if (filedata_td && txd->files_opened > txd->files_stored)
196 file_close, file_trunc, packet_dir);
197 if (file_td && txd->files_opened > txd->files_logged)
199 tv, file_td, p, ffc, tx, tx_id, txd, file_close, file_trunc, packet_dir);
202 if (opposing_dir_ready && ffc_opposing != NULL) {
205 opposing_finished =
true;
206 SCLogDebug(
"tx: calling for opposing direction files: file_close:%s file_trunc:%s",
207 file_close ?
"true" :
"false", file_trunc ?
"true" :
"false");
208 if (filedata_td && txd->files_opened > txd->files_stored)
210 opposing_dir, file_close, file_trunc, opposing_dir);
211 if (file_td && txd->files_opened > txd->files_logged)
212 OutputFileLogFfc(
tv, file_td, p, ffc_opposing, tx, tx_id, txd, file_close, file_trunc,
216 const bool tx_done = packet_dir_ready && opposing_finished;
217 SCLogDebug(
"tx_done %d packet_dir_ready %d opposing_finished %d", tx_done, packet_dir_ready,
221 const bool is_file_tx = (ffc != NULL || ffc_opposing != NULL);
222 if (!is_file_tx || tx_done) {
223 SCLogDebug(
"is_file_tx %d tx_done %d", is_file_tx, tx_done);
226 SCLogDebug(
"setting LOGGER_FILE => %08x", txd->logged.flags);
230 SCLogDebug(
"setting LOGGER_FILEDATA => %08x", txd->logged.flags);
233 SCLogDebug(
"pcap_cnt %" PRIu64
" flow %p tx %p tx_id %" PRIu64
234 " NOT SETTING FILE FLAGS ffc %p ffc_opposing %p tx_complete %d",
235 p->
pcap_cnt, f, tx, tx_id, ffc, ffc_opposing, tx_complete);
240 Flow *f,
void *tx,
const uint64_t tx_id)
249 while (logger && store) {
260 logger = logger->
next;
275 void *alstate,
void *tx,
const uint64_t tx_id,
const AppProto alproto,
const bool eof,
276 const int tx_progress_ts,
const int tx_progress_tc,
struct Ctx *
ctx)
282 while (logger && store) {
286 SCLogDebug(
"logger %p, Alproto %d LogCondition %p, ts_log_progress %d "
287 "tc_log_progress %d",
294 tx_id, logger->
logger_id, eof ?
"true" :
"false");
301 SCLogDebug(
"conditions not met, not logging");
305 if (tx_progress_tc < logger->tc_log_progress) {
306 SCLogDebug(
"progress not far enough, not logging");
310 if (tx_progress_ts < logger->ts_log_progress) {
311 SCLogDebug(
"progress not far enough, not logging");
326 logger = logger->
next;
342 SCLogDebug(
"not pseudo, no app update: skip");
348 SCLogDebug(
"pseudo, or app update: run output");
353 const uint8_t ipproto = f->
proto;
358 const bool file_logging_active = (op_thread_data->
file || op_thread_data->
filedata);
359 if (!file_logging_active) {
369 if (alstate == NULL) {
374 if (logger_expectation == 0) {
375 SCLogDebug(
"bail: logger_expectation %u. LOGGER_FILE %u LOGGER_FILEDATA %u",
385 const bool eof = last_pseudo || (ts_eof && tc_eof);
386 SCLogDebug(
"eof %d last_pseudo %d ts_eof %d tc_eof %d", eof, last_pseudo, ts_eof, tc_eof);
390 SCLogDebug(
"ts_disrupt_flags %02x tc_disrupt_flags %02x", ts_disrupt_flags, tc_disrupt_flags);
393 uint64_t max_id = tx_id;
399 SCLogDebug(
"pcap_cnt %" PRIu64
": tx_id %" PRIu64
" total_txs %" PRIu64, p->
pcap_cnt, tx_id,
404 memset(&state, 0,
sizeof(state));
406 const int complete_ts =
408 const int complete_tc =
411 AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, tx_id, total_txs, &state);
412 if (ires.tx_ptr == NULL)
414 void *
const tx = ires.tx_ptr;
416 SCLogDebug(
"STARTING tx_id %" PRIu64
", tx %p", tx_id, tx);
427 const int tx_progress_ts =
429 const int tx_progress_tc =
431 const bool tx_complete = (tx_progress_ts == complete_ts && tx_progress_tc == complete_tc);
433 SCLogDebug(
"file_thread_data %p filedata_thread_data %p", op_thread_data->
file,
436 if (file_logging_active) {
437 if (AppLayerParserIsFileTx(txd)) {
439 const bool ts_ready = (tx_progress_ts == complete_ts);
440 const bool tc_ready = (tx_progress_tc == complete_tc);
441 SCLogDebug(
"ts_ready %d tc_ready %d", ts_ready, tc_ready);
443 const bool eval_files = ts_ready | tc_ready | tx_complete | ts_eof | tc_eof | eof;
445 SCLogDebug(
"eval_files: %u, ts_ready %u, tc_ready %u, tx_complete %u, ts_eof %u, "
447 eval_files, ts_ready, tc_ready, tx_complete, ts_eof, tc_eof, eof);
448 SCLogDebug(
"txd->file_tx & pkt_dir: %02x & %02x -> %02x", txd->file_tx, pkt_dir,
449 (txd->file_tx & pkt_dir));
454 if (eval_files || AppLayerParserIsFileTxInDir(txd, pkt_dir)) {
455 OutputTxLogFiles(
tv, op_thread_data->
file, op_thread_data->
filedata, p, f, tx,
456 tx_id, txd, tx_complete, ts_ready, tc_ready, ts_eof, tc_eof, eof);
458 }
else if (support_files) {
459 if (op_thread_data->
file) {
461 SCLogDebug(
"not a file_tx: setting LOGGER_FILE => %08x", txd->logged.flags);
465 SCLogDebug(
"not a file_tx: setting LOGGER_FILEDATA => %08x", txd->logged.flags);
469 SCLogDebug(
"logger: expect %08x, have %08x", logger_expectation, txd->logged.flags);
470 if (!txd->updated_tc && !txd->updated_ts && !(tx_progress_ts == complete_ts) &&
471 !(tx_progress_tc == complete_tc) && !ts_eof && !tc_eof) {
477 OutputTxLogList0(
tv, op_thread_data, p, f, tx, tx_id);
478 if (list[alproto] == NULL)
482 SCLogDebug(
"tx %p/%" PRIu64
" txd %p: log_flags %x logger_expectation %x", tx, tx_id, txd,
483 txd->config.log_flags, logger_expectation);
487 txd->logged.flags |= logger_expectation;
491 if (txd->logged.flags == logger_expectation) {
497 SCLogDebug(
"logger: expect %08x, have %08x", logger_expectation, txd->logged.flags);
500 struct Ctx ctx = { .tx_logged = txd->logged.flags, .tx_logged_old = txd->logged.flags };
501 SCLogDebug(
"logger: expect %08x, have %08x", logger_expectation,
ctx.tx_logged);
503 OutputTxLogCallLoggers(
tv, op_thread_data, logger, store, p, f, alstate, tx, tx_id, alproto,
504 eof, tx_progress_ts, tx_progress_tc, &
ctx);
506 SCLogDebug(
"logger: expect %08x, have %08x", logger_expectation,
ctx.tx_logged);
507 if (
ctx.tx_logged !=
ctx.tx_logged_old) {
508 SCLogDebug(
"logger: storing %08x (was %08x)",
ctx.tx_logged,
ctx.tx_logged_old);
510 txd->logged.flags |=
ctx.tx_logged;
519 if (!gap &&
ctx.tx_logged == logger_expectation) {
520 SCLogDebug(
"no gap %d, %08x == %08x", gap,
ctx.tx_logged, logger_expectation);
536 SCLogDebug(
"updating log tx_id %"PRIu64, max_id);
555 SCLogDebug(
"OutputTxLogThreadInit happy (*data %p)", *data);
567 ts->thread_data = retptr;
569 if (td->
store[alproto] == NULL) {
573 while (tmp->
next != NULL)
582 logger = logger->
next;
588 FatalError(
"failed to set up file thread data");
593 FatalError(
"failed to set up filedata thread data");
610 while (logger && store) {
618 logger = logger->
next;
622 if (op_thread_data->
file) {
633 static uint32_t OutputTxLoggerGetActiveCount(
void)
660 FatalError(
"Failed to allocate OutputTx list");
663 OutputTxLoggerGetActiveCount);
677 logger = next_logger;
679 list[alproto] = NULL;