suricata
output-tx.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * AppLayer TX Logger Output registration functions
24  */
25 
26 #include "suricata-common.h"
27 #include "tm-modules.h"
28 #include "output.h"
29 #include "output-tx.h"
30 #include "app-layer.h"
31 #include "app-layer-parser.h"
32 #include "util-profiling.h"
33 #include "util-validate.h"
34 
35 /** per thread data for this module, contains a list of per thread
36  * data for the packet loggers. */
37 typedef struct OutputTxLoggerThreadData_ {
40 
41 /* logger instance, a module + a output ctx,
42  * it's perfectly valid that have multiple instances of the same
43  * log module (e.g. http.log) with different output ctx'. */
44 typedef struct OutputTxLogger_ {
50  const char *name;
52  uint32_t id;
55  TmEcode (*ThreadInit)(ThreadVars *, const void *, void **);
57  void (*ThreadExitPrintStats)(ThreadVars *, void *);
59 
60 static OutputTxLogger *list[ALPROTO_MAX] = { NULL };
61 
68  void (*ThreadExitPrintStats)(ThreadVars *, void *))
69 {
71  SCLogNotice("%s logger not enabled: protocol %s is disabled",
73  return -1;
74  }
75  OutputTxLogger *op = SCMalloc(sizeof(*op));
76  if (op == NULL)
77  return -1;
78  memset(op, 0x00, sizeof(*op));
79 
80  op->alproto = alproto;
81  op->LogFunc = LogFunc;
83  op->output_ctx = output_ctx;
84  op->name = name;
85  op->logger_id = id;
86  op->ThreadInit = ThreadInit;
89 
90  if (alproto == ALPROTO_UNKNOWN) {
91  op->tc_log_progress = 0;
92  } else if (tc_log_progress < 0) {
93  op->tc_log_progress =
95  STREAM_TOCLIENT);
96  } else {
98  }
99 
100  if (alproto == ALPROTO_UNKNOWN) {
101  op->ts_log_progress = 0;
102  } else if (ts_log_progress < 0) {
103  op->ts_log_progress =
105  STREAM_TOSERVER);
106  } else {
108  }
109 
110  if (list[alproto] == NULL) {
111  op->id = 1;
112  list[alproto] = op;
113  } else {
114  OutputTxLogger *t = list[alproto];
115  while (t->next)
116  t = t->next;
117  if (t->id * 2 > UINT32_MAX) {
118  FatalError(SC_ERR_FATAL, "Too many loggers registered.");
119  }
120  op->id = t->id * 2;
121  t->next = op;
122  }
123 
124  SCLogDebug("OutputRegisterTxLogger happy");
125  return 0;
126 }
127 
128 static void OutputTxLogList0(ThreadVars *tv, OutputTxLoggerThreadData *op_thread_data, Packet *p,
129  Flow *f, void *tx, const uint64_t tx_id)
130 {
131  const OutputTxLogger *logger = list[ALPROTO_UNKNOWN];
132  const OutputLoggerThreadStore *store = op_thread_data->store[ALPROTO_UNKNOWN];
133 
134  DEBUG_VALIDATE_BUG_ON(logger == NULL && store != NULL);
135  DEBUG_VALIDATE_BUG_ON(logger != NULL && store == NULL);
136  DEBUG_VALIDATE_BUG_ON(logger == NULL && store == NULL);
137 
138  while (logger && store) {
139  DEBUG_VALIDATE_BUG_ON(logger->LogFunc == NULL);
140 
141  SCLogDebug("logger %p", logger);
142 
143  /* always invoke "wild card" tx loggers */
144  SCLogDebug("Logging tx_id %"PRIu64" to logger %d", tx_id, logger->logger_id);
146  logger->LogFunc(tv, store->thread_data, p, f, f->alstate, tx, tx_id);
148 
149  logger = logger->next;
150  store = store->next;
151 
152  DEBUG_VALIDATE_BUG_ON(logger == NULL && store != NULL);
153  DEBUG_VALIDATE_BUG_ON(logger != NULL && store == NULL);
154  }
155 }
156 
157 static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data)
158 {
159  DEBUG_VALIDATE_BUG_ON(thread_data == NULL);
160  if (p->flow == NULL)
161  return TM_ECODE_OK;
162 
163  OutputTxLoggerThreadData *op_thread_data = (OutputTxLoggerThreadData *)thread_data;
164 
165  Flow * const f = p->flow;
166  const uint8_t ipproto = f->proto;
167  const AppProto alproto = f->alproto;
168 
169  if (list[alproto] == NULL && list[ALPROTO_UNKNOWN] == NULL) {
170  /* No child loggers registered. */
171  return TM_ECODE_OK;
172  }
173 
175  goto end;
176  const LoggerId logger_expectation = AppLayerParserProtocolGetLoggerBits(p->proto, alproto);
177  if (logger_expectation == 0)
178  goto end;
179 
180  void *alstate = f->alstate;
181  if (alstate == NULL) {
182  SCLogDebug("no alstate");
183  goto end;
184  }
185 
186  const bool last_pseudo = (p->flowflags & FLOW_PKT_LAST_PSEUDO) != 0;
187  const bool ts_eof = AppLayerParserStateIssetFlag(f->alparser, APP_LAYER_PARSER_EOF_TS) != 0;
188  const bool tc_eof = AppLayerParserStateIssetFlag(f->alparser, APP_LAYER_PARSER_EOF_TC) != 0;
189  const uint8_t ts_disrupt_flags = FlowGetDisruptionFlags(f, STREAM_TOSERVER);
190  const uint8_t tc_disrupt_flags = FlowGetDisruptionFlags(f, STREAM_TOCLIENT);
191  const uint64_t total_txs = AppLayerParserGetTxCnt(f, alstate);
192  uint64_t tx_id = AppLayerParserGetTransactionLogId(f->alparser);
193  uint64_t max_id = tx_id;
194  int logged = 0;
195  int gap = 0;
196 
199  memset(&state, 0, sizeof(state));
200 
201  while (1) {
202  AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, tx_id, total_txs, &state);
203  if (ires.tx_ptr == NULL)
204  break;
205  void * const tx = ires.tx_ptr;
206  tx_id = ires.tx_id;
207 
208  AppLayerTxData *txd = AppLayerParserGetTxData(ipproto, alproto, tx);
209  if (txd == NULL) {
210  /* make sure this tx, which can't be properly logged is skipped */
211  logged = 1;
212  max_id = tx_id;
213  goto next_tx;
214  }
215 
216  if (list[ALPROTO_UNKNOWN] != 0) {
217  OutputTxLogList0(tv, op_thread_data, p, f, tx, tx_id);
218  if (list[alproto] == NULL)
219  goto next_tx;
220  }
221 
222  SCLogDebug("tx %p/%"PRIu64" txd %p: log_flags %x", tx, tx_id, txd, txd->config.log_flags);
223  if (txd->config.log_flags & BIT_U8(CONFIG_TYPE_TX)) {
224  SCLogDebug("SKIP tx %p/%"PRIu64, tx, tx_id);
225  goto next_tx;
226  }
227 
228  LoggerId tx_logged = txd->logged.flags;
229  const LoggerId tx_logged_old = tx_logged;
230  SCLogDebug("logger: expect %08x, have %08x", logger_expectation, tx_logged);
231  if (tx_logged == logger_expectation) {
232  /* tx already fully logged */
233  goto next_tx;
234  }
235 
236  const int tx_progress_ts =
237  AppLayerParserGetStateProgress(p->proto, alproto, tx, ts_disrupt_flags);
238  const int tx_progress_tc =
239  AppLayerParserGetStateProgress(p->proto, alproto, tx, tc_disrupt_flags);
240  SCLogDebug("tx_progress_ts %d tx_progress_tc %d",
241  tx_progress_ts, tx_progress_tc);
242 
243  const OutputTxLogger *logger = list[alproto];
244  const OutputLoggerThreadStore *store = op_thread_data->store[alproto];
245 
246  DEBUG_VALIDATE_BUG_ON(logger == NULL && store != NULL);
247  DEBUG_VALIDATE_BUG_ON(logger != NULL && store == NULL);
248  DEBUG_VALIDATE_BUG_ON(logger == NULL && store == NULL);
249 
250  while (logger && store) {
251  DEBUG_VALIDATE_BUG_ON(logger->LogFunc == NULL);
253 
254  SCLogDebug("logger %p, Alproto %d LogCondition %p, ts_log_progress %d "
255  "tc_log_progress %d", logger, logger->alproto, logger->LogCondition,
256  logger->ts_log_progress, logger->tc_log_progress);
257  if ((tx_logged_old & BIT_U32(logger->logger_id)) == 0) {
258  SCLogDebug("alproto match %d, logging tx_id %"PRIu64, logger->alproto, tx_id);
259 
260  SCLogDebug("pcap_cnt %"PRIu64", tx_id %"PRIu64" logger %d. "
261  "EOFs TS %s TC %s LAST PSEUDO %s",
262  p->pcap_cnt, tx_id, logger->logger_id,
263  ts_eof ? "true" : "false", tc_eof ? "true" : "false",
264  last_pseudo ? "true" : "false");
265 
266  if ((ts_eof && tc_eof) || last_pseudo) {
267  SCLogDebug("EOF, so log now");
268  } else {
269  if (logger->LogCondition) {
270  int r = logger->LogCondition(tv, p, alstate, tx, tx_id);
271  if (r == FALSE) {
272  SCLogDebug("conditions not met, not logging");
273  goto next_logger;
274  }
275  } else {
276  if (tx_progress_tc < logger->tc_log_progress) {
277  SCLogDebug("progress not far enough, not logging");
278  goto next_logger;
279  }
280 
281  if (tx_progress_ts < logger->ts_log_progress) {
282  SCLogDebug("progress not far enough, not logging");
283  goto next_logger;
284  }
285  }
286  }
287 
288  SCLogDebug("Logging tx_id %"PRIu64" to logger %d", tx_id, logger->logger_id);
290  logger->LogFunc(tv, store->thread_data, p, f, alstate, tx, tx_id);
292 
293  tx_logged |= BIT_U32(logger->logger_id);
294  }
295 
296 next_logger:
297  logger = logger->next;
298  store = store->next;
299 
300  DEBUG_VALIDATE_BUG_ON(logger == NULL && store != NULL);
301  DEBUG_VALIDATE_BUG_ON(logger != NULL && store == NULL);
302  }
303 
304  if (tx_logged != tx_logged_old) {
305  SCLogDebug("logger: storing %08x (was %08x)",
306  tx_logged, tx_logged_old);
307  DEBUG_VALIDATE_BUG_ON(txd == NULL);
308  txd->logged.flags |= tx_logged;
309  }
310 
311  /* If all loggers logged set a flag and update the last tx_id
312  * that was logged.
313  *
314  * If not all loggers were logged we flag that there was a gap
315  * so any subsequent transactions in this loop don't increase
316  * the maximum ID that was logged. */
317  if (!gap && tx_logged == logger_expectation) {
318  logged = 1;
319  max_id = tx_id;
320  } else {
321  gap = 1;
322  }
323 next_tx:
324  if (!ires.has_next)
325  break;
326  tx_id++;
327  }
328 
329  /* Update the the last ID that has been logged with all
330  * transactions before it. */
331  if (logged) {
332  SCLogDebug("updating log tx_id %"PRIu64, max_id);
334  }
335 
336 end:
337  return TM_ECODE_OK;
338 }
339 
340 /** \brief thread init for the tx logger
341  * This will run the thread init functions for the individual registered
342  * loggers */
343 static TmEcode OutputTxLogThreadInit(ThreadVars *tv, const void *initdata, void **data)
344 {
345  OutputTxLoggerThreadData *td = SCMalloc(sizeof(*td));
346  if (td == NULL)
347  return TM_ECODE_FAILED;
348  memset(td, 0x00, sizeof(*td));
349 
350  *data = (void *)td;
351  SCLogDebug("OutputTxLogThreadInit happy (*data %p)", *data);
352 
353  for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
354  OutputTxLogger *logger = list[alproto];
355  while (logger) {
356  if (logger->ThreadInit) {
357  void *retptr = NULL;
358  if (logger->ThreadInit(tv, (void *)logger->output_ctx, &retptr) == TM_ECODE_OK) {
359  OutputLoggerThreadStore *ts = SCMalloc(sizeof(*ts));
360  /* todo */ BUG_ON(ts == NULL);
361  memset(ts, 0x00, sizeof(*ts));
362 
363  /* store thread handle */
364  ts->thread_data = retptr;
365 
366  if (td->store[alproto] == NULL) {
367  td->store[alproto] = ts;
368  } else {
370  while (tmp->next != NULL)
371  tmp = tmp->next;
372  tmp->next = ts;
373  }
374 
375  SCLogDebug("%s is now set up", logger->name);
376  }
377  }
378 
379  logger = logger->next;
380  }
381  }
382  return TM_ECODE_OK;
383 }
384 
385 static TmEcode OutputTxLogThreadDeinit(ThreadVars *tv, void *thread_data)
386 {
387  OutputTxLoggerThreadData *op_thread_data = (OutputTxLoggerThreadData *)thread_data;
388 
389  for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
390  OutputLoggerThreadStore *store = op_thread_data->store[alproto];
391  OutputTxLogger *logger = list[alproto];
392 
393  while (logger && store) {
394  if (logger->ThreadDeinit) {
395  logger->ThreadDeinit(tv, store->thread_data);
396  }
397 
398  OutputLoggerThreadStore *next_store = store->next;
399  SCFree(store);
400  store = next_store;
401  logger = logger->next;
402  }
403  }
404 
405  SCFree(op_thread_data);
406  return TM_ECODE_OK;
407 }
408 
409 static void OutputTxLogExitPrintStats(ThreadVars *tv, void *thread_data)
410 {
411  OutputTxLoggerThreadData *op_thread_data = (OutputTxLoggerThreadData *)thread_data;
412 
413  for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
414  OutputLoggerThreadStore *store = op_thread_data->store[alproto];
415  OutputTxLogger *logger = list[alproto];
416 
417  while (logger && store) {
418  if (logger->ThreadExitPrintStats) {
419  logger->ThreadExitPrintStats(tv, store->thread_data);
420  }
421 
422  logger = logger->next;
423  store = store->next;
424  }
425  }
426 }
427 
428 static uint32_t OutputTxLoggerGetActiveCount(void)
429 {
430  uint32_t cnt = 0;
431  for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
432  for (OutputTxLogger *p = list[alproto]; p != NULL; p = p->next) {
433  cnt++;
434  }
435  }
436  return cnt;
437 }
438 
439 
441 {
442  OutputRegisterRootLogger(OutputTxLogThreadInit, OutputTxLogThreadDeinit,
443  OutputTxLogExitPrintStats, OutputTxLog, OutputTxLoggerGetActiveCount);
444 }
445 
447 {
448  for (AppProto alproto = 0; alproto < ALPROTO_MAX; alproto++) {
449  OutputTxLogger *logger = list[alproto];
450  while (logger) {
451  OutputTxLogger *next_logger = logger->next;
452  SCFree(logger);
453  logger = next_logger;
454  }
455  list[alproto] = NULL;
456  }
457 }
OutputTxLogger_::alproto
AppProto alproto
Definition: output-tx.c:45
Packet_::proto
uint8_t proto
Definition: decode.h:455
OutputTxLoggerThreadData_::store
OutputLoggerThreadStore * store[ALPROTO_MAX]
Definition: output-tx.c:38
output-tx.h
ts
uint64_t ts
Definition: source-erf-file.c:55
OutputLoggerThreadStore_
Definition: output-stats.c:31
OutputLoggerThreadStore_::next
struct OutputLoggerThreadStore_ * next
Definition: output-stats.c:33
AppLayerParserIsEnabled
int AppLayerParserIsEnabled(AppProto alproto)
simple way to globally test if a alproto is registered and fully enabled in the configuration.
Definition: app-layer-parser.c:1474
OutputTxLoggerRegister
void OutputTxLoggerRegister(void)
Definition: output-tx.c:440
AppLayerParserProtocolHasLogger
int AppLayerParserProtocolHasLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1484
AppLayerParserSetTransactionLogId
void AppLayerParserSetTransactionLogId(AppLayerParserState *pstate, uint64_t tx_id)
Definition: app-layer-parser.c:724
CONFIG_TYPE_TX
@ CONFIG_TYPE_TX
Definition: util-config.h:37
FLOW_PKT_LAST_PSEUDO
#define FLOW_PKT_LAST_PSEUDO
Definition: flow.h:232
OutputTxLogger_::tc_log_progress
int tc_log_progress
Definition: output-tx.c:53
OutputTxShutdown
void OutputTxShutdown(void)
Definition: output-tx.c:446
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:594
AppLayerGetTxIterator
AppLayerGetTxIteratorFunc AppLayerGetTxIterator(const uint8_t ipproto, const AppProto alproto)
Definition: app-layer-parser.c:709
Flow_::proto
uint8_t proto
Definition: flow.h:375
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
AppLayerParserGetStateProgress
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
get the progress value for a tx/protocol
Definition: app-layer-parser.c:1103
Flow_
Flow data structure.
Definition: flow.h:353
LoggerId
LoggerId
Definition: suricata-common.h:437
AppLayerParserGetTransactionLogId
uint64_t AppLayerParserGetTransactionLogId(AppLayerParserState *pstate)
Definition: app-layer-parser.c:717
AppProtoToString
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
Definition: app-layer-protos.c:30
logged
int logged
Definition: app-layer-htp.h:1
AppLayerParserGetStateProgressCompletionStatus
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:1131
tm-modules.h
TxLogger
int(* TxLogger)(ThreadVars *, void *thread_data, const Packet *, Flow *f, void *state, void *tx, uint64_t tx_id)
Definition: output-tx.h:32
OutputTxLogger_::ThreadInit
TmEcode(* ThreadInit)(ThreadVars *, const void *, void **)
Definition: output-tx.c:55
OutputTxLogger_::logger_id
LoggerId logger_id
Definition: output-tx.c:51
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:464
APP_LAYER_PARSER_EOF_TS
#define APP_LAYER_PARSER_EOF_TS
Definition: app-layer-parser.h:39
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
ALPROTO_MAX
@ ALPROTO_MAX
Definition: app-layer-protos.h:75
OutputTxLogger_::ThreadDeinit
TmEcode(* ThreadDeinit)(ThreadVars *, void *)
Definition: output-tx.c:56
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:82
OutputLoggerThreadStore_::thread_data
void * thread_data
Definition: output-stats.c:32
OutputCtx_
Definition: tm-modules.h:78
OutputTxLoggerThreadData
struct OutputTxLoggerThreadData_ OutputTxLoggerThreadData
Flow_::alparser
AppLayerParserState * alparser
Definition: flow.h:485
OutputRegisterTxLogger
int OutputRegisterTxLogger(LoggerId id, const char *name, AppProto alproto, TxLogger LogFunc, OutputCtx *output_ctx, int tc_log_progress, int ts_log_progress, TxLoggerCondition LogCondition, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, void(*ThreadExitPrintStats)(ThreadVars *, void *))
Definition: output-tx.c:62
AppLayerParserStateIssetFlag
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag)
Definition: app-layer-parser.c:1727
BIT_U32
#define BIT_U32(n)
Definition: suricata-common.h:381
OutputTxLogger_::next
struct OutputTxLogger_ * next
Definition: output-tx.c:49
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:56
ThreadInitFunc
TmEcode(* ThreadInitFunc)(ThreadVars *, const void *, void **)
Definition: tm-modules.h:39
app-layer-parser.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:281
util-profiling.h
FALSE
#define FALSE
Definition: suricata-common.h:34
OutputTxLogger_::ts_log_progress
int ts_log_progress
Definition: output-tx.c:54
AppLayerGetTxIterState
Definition: app-layer-parser.h:140
Packet_
Definition: decode.h:433
APP_LAYER_PARSER_EOF_TC
#define APP_LAYER_PARSER_EOF_TC
Definition: app-layer-parser.h:40
TmEcode
TmEcode
Definition: tm-threads-common.h:81
OutputTxLogger_::output_ctx
OutputCtx * output_ctx
Definition: output-tx.c:48
OutputTxLogger_::LogCondition
TxLoggerCondition LogCondition
Definition: output-tx.c:47
OutputTxLogger_::ThreadExitPrintStats
void(* ThreadExitPrintStats)(ThreadVars *, void *)
Definition: output-tx.c:57
PACKET_PROFILING_LOGGER_END
#define PACKET_PROFILING_LOGGER_END(p, id)
Definition: util-profiling.h:258
Packet_::flow
struct Flow_ * flow
Definition: decode.h:470
BIT_U8
#define BIT_U8(n)
Definition: suricata-common.h:379
suricata-common.h
OutputTxLogger
struct OutputTxLogger_ OutputTxLogger
AppLayerParserGetTxData
AppLayerTxData * AppLayerParserGetTxData(uint8_t ipproto, AppProto alproto, void *tx)
Definition: app-layer-parser.c:1196
FatalError
#define FatalError(x,...)
Definition: util-debug.h:530
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:31
util-validate.h
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
Packet_::next
struct Packet_ * next
Definition: decode.h:603
TxLoggerCondition
int(* TxLoggerCondition)(ThreadVars *, const Packet *, void *state, void *tx, uint64_t tx_id)
Definition: output-tx.h:37
OutputTxLogger_::LogFunc
TxLogger LogFunc
Definition: output-tx.c:46
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Flow_::alstate
void * alstate
Definition: flow.h:486
SC_ERR_FATAL
@ SC_ERR_FATAL
Definition: util-error.h:203
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
OutputTxLogger_
Definition: output-tx.c:44
PACKET_PROFILING_LOGGER_START
#define PACKET_PROFILING_LOGGER_START(p, id)
Definition: util-profiling.h:251
OutputRegisterRootLogger
void OutputRegisterRootLogger(ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats, OutputLogFunc LogFunc, OutputGetActiveCountFunc ActiveCntFunc)
Definition: output.c:965
OutputTxLogger_::name
const char * name
Definition: output-tx.c:50
AppLayerParserProtocolGetLoggerBits
LoggerId AppLayerParserProtocolGetLoggerBits(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:1492
AppLayerGetTxIteratorFunc
AppLayerGetTxIterTuple(* AppLayerGetTxIteratorFunc)(const uint8_t ipproto, const AppProto alproto, void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
tx iterator prototype
Definition: app-layer-parser.h:149
FlowGetDisruptionFlags
uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags)
get 'disruption' flags: GAP/DEPTH/PASS
Definition: flow.c:1141
SCLogNotice
#define SCLogNotice(...)
Macro used to log NOTICE messages.
Definition: util-debug.h:230
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:460
OutputTxLogger_::id
uint32_t id
Definition: output-tx.c:52
AppLayerParserGetTxCnt
uint64_t AppLayerParserGetTxCnt(const Flow *f, void *alstate)
Definition: app-layer-parser.c:1117
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
output.h
ThreadDeinitFunc
TmEcode(* ThreadDeinitFunc)(ThreadVars *, void *)
Definition: tm-modules.h:40
OutputTxLoggerThreadData_
Definition: output-tx.c:37
app-layer.h