eve: use eve-level xff configuration

If an "xff" configuration section exists on the eve object,
parse and save it for child loggers to use.

diff --git a/src/output-json.c b/src/output-json.c
index a4b31594b929af035b9ab840be738d519d7e1dc3..485ea58517c4544498d6954e1166e8573a90426c 100644 (file)
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -854,6 +854,15 @@ OutputInitResult OutputJsonInitCtx(ConfNode *conf)
             json_ctx->include_metadata = true;
         }
 
+        /* Do we have a global eve xff configuration? */
+        const ConfNode *xff = ConfNodeLookupChild(conf, "xff");
+        if (xff != NULL) {
+            json_ctx->xff_cfg = SCCalloc(1, sizeof(HttpXFFCfg));
+            if (likely(json_ctx->xff_cfg != NULL)) {
+                HttpXFFGetCfg(conf, json_ctx->xff_cfg);
+            }
+        }
+
         const char *pcapfile_s = ConfNodeLookupChildValue(conf, "pcap-file");
         if (pcapfile_s != NULL && ConfValIsTrue(pcapfile_s)) {
             json_ctx->file_ctx->is_pcap_offline =
@@ -880,6 +889,9 @@ static void OutputJsonDeInitCtx(OutputCtx *output_ctx)
                 "%"PRIu64" events were dropped due to slow or "
                 "disconnected socket", logfile_ctx->dropped);
     }
+    if (json_ctx->xff_cfg != NULL) {
+        SCFree(json_ctx->xff_cfg);
+    }
     LogFileFreeCtx(logfile_ctx);
     SCFree(json_ctx);
     SCFree(output_ctx);

diff --git a/src/output-json.h b/src/output-json.h
index ff3870f39d8279a3721805108f27fe5216fb042f..06d94df38dac9c5ddf40c3f0c841a7ec2530a067 100644 (file)
--- a/src/output-json.h
+++ b/src/output-json.h
@@ -29,6 +29,8 @@
 #include "util-logopenfile.h"
 #include "output.h"
 
+#include "app-layer-htp-xff.h"
+
 void OutputJsonRegister(void);
 
 #ifdef HAVE_LIBJANSSON
@@ -66,6 +68,7 @@ typedef struct OutputJsonCtx_ {
     LogFileCtx *file_ctx;
     enum LogFileType json_out;
     bool include_metadata;
+    HttpXFFCfg *xff_cfg;
 } OutputJsonCtx;
 
 json_t *SCJsonBool(int val);

diff --git a/suricata.yaml.in b/suricata.yaml.in
index d09c8aeac3c1957ed5a96d69b1a9a1aee644b906..2041c7b063ca81480f47978be0507015c8a0d616 100644 (file)
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -173,6 +173,24 @@ outputs:
 
       pcap-file: false
 
+      # HTTP X-Forwarded-For support by adding an extra field or overwriting
+      # the source or destination IP address (depending on flow direction)
+      # with the one reported in the X-Forwarded-For HTTP header. This is
+      # helpful when reviewing alerts for traffic that is being reverse
+      # or forward proxied.
+      xff:
+        enabled: no
+        # Two operation modes are available, "extra-data" and "overwrite".
+        mode: extra-data
+        # Two proxy deployments are supported, "reverse" and "forward". In
+        # a "reverse" deployment the IP address used is the last one, in a
+        # "forward" deployment the first IP address is used.
+        deployment: reverse
+        # Header name where the actual IP address will be reported, if more
+        # than one IP address is present, the last IP address will be the
+        # one taken into consideration.
+        header: X-Forwarded-For
+
       types:
         - alert:
             # payload: yes             # enable dumping payload in Base64