--- /dev/null
+/* Copyright (C) 2007-2013 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Victor Julien <victor@inliniac.net>
+ *
+ * Implements Flow JSON logging portion of the engine.
+ */
+
+#include "suricata-common.h"
+#include "debug.h"
+#include "detect.h"
+#include "pkt-var.h"
+#include "conf.h"
+
+#include "threads.h"
+#include "threadvars.h"
+#include "tm-threads.h"
+
+#include "util-print.h"
+#include "util-unittest.h"
+
+#include "util-debug.h"
+
+#include "output.h"
+#include "util-privs.h"
+#include "util-buffer.h"
+#include "util-proto-name.h"
+#include "util-logopenfile.h"
+#include "util-time.h"
+#include "output-json.h"
+
+#ifdef HAVE_LIBJANSSON
+#include <jansson.h>
+
+typedef struct LogJsonFileCtx_ {
+ LogFileCtx *file_ctx;
+ uint32_t flags; /** Store mode */
+} LogJsonFileCtx;
+
+typedef struct JsonFlowLogThread_ {
+ LogJsonFileCtx *flowlog_ctx;
+ /** LogFileCtx has the pointer to the file and a mutex to allow multithreading */
+ uint32_t uri_cnt;
+
+ MemBuffer *buffer;
+} JsonFlowLogThread;
+
+
+#define LOG_HTTP_DEFAULT 0
+#define LOG_HTTP_EXTENDED 1
+#define LOG_HTTP_CUSTOM 2
+
+static json_t *CreateJSONHeaderFromFlow(Flow *f, char *event_type)
+{
+ char timebuf[64];
+ char srcip[46], dstip[46];
+ Port sp, dp;
+
+ json_t *js = json_object();
+ if (unlikely(js == NULL))
+ return NULL;
+
+ CreateIsoTimeString(&f->startts, timebuf, sizeof(timebuf));
+
+ srcip[0] = '\0';
+ dstip[0] = '\0';
+ if (FLOW_IS_IPV4(f)) {
+ PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), srcip, sizeof(srcip));
+ PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), dstip, sizeof(dstip));
+ } else if (FLOW_IS_IPV6(f)) {
+ PrintInet(AF_INET6, (const void *)&(f->src.address), srcip, sizeof(srcip));
+ PrintInet(AF_INET6, (const void *)&(f->dst.address), dstip, sizeof(dstip));
+ }
+
+ sp = f->sp;
+ dp = f->dp;
+
+ char proto[16];
+ if (SCProtoNameValid(f->proto) == TRUE) {
+ strlcpy(proto, known_proto[f->proto], sizeof(proto));
+ } else {
+ snprintf(proto, sizeof(proto), "%03" PRIu32, f->proto);
+ }
+
+ /* time & tx */
+ json_object_set_new(js, "timestamp", json_string(timebuf));
+#if 0 // TODO
+ /* sensor id */
+ if (sensor_id >= 0)
+ json_object_set_new(js, "sensor_id", json_integer(sensor_id));
+#endif
+ if (event_type) {
+ json_object_set_new(js, "event_type", json_string(event_type));
+ }
+#if 0
+ /* vlan */
+ if (f->vlan_id[0] > 0) {
+ json_t *js_vlan;
+ switch (f->vlan_idx) {
+ case 1:
+ json_object_set_new(js, "vlan",
+ json_integer(f->vlan_id[0]));
+ break;
+ case 2:
+ js_vlan = json_array();
+ if (unlikely(js != NULL)) {
+ json_array_append_new(js_vlan,
+ json_integer(VLAN_GET_ID1(p)));
+ json_array_append_new(js_vlan,
+ json_integer(VLAN_GET_ID2(p)));
+ json_object_set_new(js, "vlan", js_vlan);
+ }
+ break;
+ default:
+ /* shouldn't get here */
+ break;
+ }
+ }
+#endif
+ /* tuple */
+ json_object_set_new(js, "src_ip", json_string(srcip));
+ switch(f->proto) {
+ case IPPROTO_ICMP:
+ break;
+ case IPPROTO_UDP:
+ case IPPROTO_TCP:
+ case IPPROTO_SCTP:
+ json_object_set_new(js, "src_port", json_integer(sp));
+ break;
+ }
+ json_object_set_new(js, "dest_ip", json_string(dstip));
+ switch(f->proto) {
+ case IPPROTO_ICMP:
+ break;
+ case IPPROTO_UDP:
+ case IPPROTO_TCP:
+ case IPPROTO_SCTP:
+ json_object_set_new(js, "dest_port", json_integer(dp));
+ break;
+ }
+ json_object_set_new(js, "proto", json_string(proto));
+ switch (f->proto) {
+ case IPPROTO_ICMP:
+ case IPPROTO_ICMPV6:
+ json_object_set_new(js, "icmp_type",
+ json_integer(f->type));
+ json_object_set_new(js, "icmp_code",
+ json_integer(f->code));
+ break;
+ }
+ return js;
+}
+
+/* JSON format logging */
+static void JsonFlowLogJSON(JsonFlowLogThread *aft, json_t *js, Flow *f)
+{
+#if 0
+ LogJsonFileCtx *flow_ctx = aft->flowlog_ctx;
+#endif
+ json_t *hjs = json_object();
+ if (hjs == NULL) {
+ return;
+ }
+
+ json_object_set_new(hjs, "app_proto", json_string(AppProtoToString(f->alproto)));
+
+ json_object_set_new(js, "flow", hjs);
+}
+
+static int JsonFlowLogger(ThreadVars *tv, void *thread_data, Flow *f)
+{
+ SCEnter();
+ JsonFlowLogThread *jhl = (JsonFlowLogThread *)thread_data;
+ MemBuffer *buffer = (MemBuffer *)jhl->buffer;
+
+ /* reset */
+ MemBufferReset(buffer);
+
+ json_t *js = CreateJSONHeaderFromFlow(f, "flow"); //TODO const
+ if (unlikely(js == NULL))
+ return TM_ECODE_OK;
+
+ JsonFlowLogJSON(jhl, js, f);
+
+ OutputJSONBuffer(js, jhl->flowlog_ctx->file_ctx, buffer);
+ json_object_del(js, "http");
+
+ json_object_clear(js);
+ json_decref(js);
+
+ SCReturnInt(TM_ECODE_OK);
+}
+
+static void OutputFlowLogDeinit(OutputCtx *output_ctx)
+{
+ LogJsonFileCtx *flow_ctx = output_ctx->data;
+ LogFileCtx *logfile_ctx = flow_ctx->file_ctx;
+ LogFileFreeCtx(logfile_ctx);
+ SCFree(flow_ctx);
+ SCFree(output_ctx);
+}
+
+#define DEFAULT_LOG_FILENAME "flow.json"
+OutputCtx *OutputFlowLogInit(ConfNode *conf)
+{
+ SCLogInfo("hi");
+ LogFileCtx *file_ctx = LogFileNewCtx();
+ if(file_ctx == NULL) {
+ SCLogError(SC_ERR_HTTP_LOG_GENERIC, "couldn't create new file_ctx");
+ return NULL;
+ }
+
+ if (SCConfLogOpenGeneric(conf, file_ctx, DEFAULT_LOG_FILENAME) < 0) {
+ LogFileFreeCtx(file_ctx);
+ return NULL;
+ }
+
+ LogJsonFileCtx *flow_ctx = SCMalloc(sizeof(LogJsonFileCtx));
+ if (unlikely(flow_ctx == NULL)) {
+ LogFileFreeCtx(file_ctx);
+ return NULL;
+ }
+
+ OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
+ if (unlikely(output_ctx == NULL)) {
+ LogFileFreeCtx(file_ctx);
+ SCFree(flow_ctx);
+ return NULL;
+ }
+
+ flow_ctx->file_ctx = file_ctx;
+ output_ctx->data = flow_ctx;
+ output_ctx->DeInit = OutputFlowLogDeinit;
+
+ return output_ctx;
+}
+
+static void OutputFlowLogDeinitSub(OutputCtx *output_ctx)
+{
+ LogJsonFileCtx *flow_ctx = output_ctx->data;
+ SCFree(flow_ctx);
+ SCFree(output_ctx);
+}
+
+OutputCtx *OutputFlowLogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
+{
+ AlertJsonThread *ajt = parent_ctx->data;
+
+ LogJsonFileCtx *flow_ctx = SCMalloc(sizeof(LogJsonFileCtx));
+ if (unlikely(flow_ctx == NULL))
+ return NULL;
+
+ OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
+ if (unlikely(output_ctx == NULL)) {
+ SCFree(flow_ctx);
+ return NULL;
+ }
+
+ flow_ctx->file_ctx = ajt->file_ctx;
+ flow_ctx->flags = LOG_HTTP_DEFAULT;
+
+ output_ctx->data = flow_ctx;
+ output_ctx->DeInit = OutputFlowLogDeinitSub;
+
+ return output_ctx;
+}
+
+#define OUTPUT_BUFFER_SIZE 65535
+static TmEcode JsonFlowLogThreadInit(ThreadVars *t, void *initdata, void **data)
+{
+ JsonFlowLogThread *aft = SCMalloc(sizeof(JsonFlowLogThread));
+ if (unlikely(aft == NULL))
+ return TM_ECODE_FAILED;
+ memset(aft, 0, sizeof(JsonFlowLogThread));
+
+ if(initdata == NULL)
+ {
+ SCLogDebug("Error getting context for HTTPLog. \"initdata\" argument NULL");
+ SCFree(aft);
+ return TM_ECODE_FAILED;
+ }
+
+ /* Use the Ouptut Context (file pointer and mutex) */
+ aft->flowlog_ctx = ((OutputCtx *)initdata)->data; //TODO
+
+ aft->buffer = MemBufferCreateNew(OUTPUT_BUFFER_SIZE);
+ if (aft->buffer == NULL) {
+ SCFree(aft);
+ return TM_ECODE_FAILED;
+ }
+
+ *data = (void *)aft;
+ return TM_ECODE_OK;
+}
+
+static TmEcode JsonFlowLogThreadDeinit(ThreadVars *t, void *data)
+{
+ JsonFlowLogThread *aft = (JsonFlowLogThread *)data;
+ if (aft == NULL) {
+ return TM_ECODE_OK;
+ }
+
+ MemBufferFree(aft->buffer);
+ /* clear memory */
+ memset(aft, 0, sizeof(JsonFlowLogThread));
+
+ SCFree(aft);
+ return TM_ECODE_OK;
+}
+
+void TmModuleJsonFlowLogRegister (void) {
+ tmm_modules[TMM_JSONFLOWLOG].name = "JsonFlowLog";
+ tmm_modules[TMM_JSONFLOWLOG].ThreadInit = JsonFlowLogThreadInit;
+ tmm_modules[TMM_JSONFLOWLOG].ThreadDeinit = JsonFlowLogThreadDeinit;
+ tmm_modules[TMM_JSONFLOWLOG].RegisterTests = NULL;
+ tmm_modules[TMM_JSONFLOWLOG].cap_flags = 0;
+ tmm_modules[TMM_JSONFLOWLOG].flags = TM_FLAG_LOGAPI_TM;
+
+ /* register as separate module */
+ OutputRegisterFlowModule("JsonFlowLog", "flow-json-log",
+ OutputFlowLogInit, JsonFlowLogger);
+
+ /* also register as child of eve-log */
+ OutputRegisterFlowSubModule("eve-log", "JsonFlowLog", "eve-log.flow",
+ OutputFlowLogInitSub, JsonFlowLogger);
+}
+
+#else
+
+static TmEcode OutputJsonThreadInit(ThreadVars *t, void *initdata, void **data)
+{
+ SCLogInfo("Can't init JSON output - JSON support was disabled during build.");
+ return TM_ECODE_FAILED;
+}
+
+void TmModuleJsonFlowLogRegister (void)
+{
+ tmm_modules[TMM_JSONFLOWLOG].name = "JsonFlowLog";
+ tmm_modules[TMM_JSONFLOWLOG].ThreadInit = OutputJsonThreadInit;
+}
+
+#endif
projects / thirdparty / suricata.git / commitdiff
