/src/suricata7/src/output-eve-stream.c

Source (jump to first uncovered line)
/* Copyright (C) 2023 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \file
 */

#include "suricata-common.h"
#include "packet.h"
#include "detect.h"
#include "flow.h"
#include "conf.h"

#include "threads.h"
#include "tm-threads.h"
#include "threadvars.h"
#include "util-debug.h"

#include "decode-ipv4.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-mpm.h"
#include "detect-reference.h"

#include "output.h"
#include "output-json.h"
#include "output-json-flow.h"
#include "output-eve-stream.h"

#include "stream-tcp.h"

#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-classification-config.h"
#include "util-privs.h"
#include "util-print.h"
#include "util-proto-name.h"
#include "util-logopenfile.h"
#include "util-time.h"
#include "util-buffer.h"

#include "action-globals.h"

#define MODULE_NAME "EveStreamLog"

#define LOG_DROP_ALERTS 1

typedef struct EveStreamOutputCtx_ {
    uint16_t trigger_flags; /**< presence of flags in packet trigger logging. 0xffff for all. */
    OutputJsonCtx *eve_ctx;
} EveStreamOutputCtx;

typedef struct EveStreamLogThread_ {
    EveStreamOutputCtx *stream_ctx;
    OutputJsonThreadCtx *ctx;
} EveStreamLogThread;

static TmEcode EveStreamLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
    EveStreamLogThread *aft = SCCalloc(1, sizeof(EveStreamLogThread));
    if (unlikely(aft == NULL))
        return TM_ECODE_FAILED;

    if (initdata == NULL) {
        SCLogDebug("Error getting context for EveLogDrop.  \"initdata\" argument NULL");
        goto error_exit;
    }

    /** Use the Output Context (file pointer and mutex) */
    aft->stream_ctx = ((OutputCtx *)initdata)->data;
    aft->ctx = CreateEveThreadCtx(t, aft->stream_ctx->eve_ctx);
    if (!aft->ctx) {
        goto error_exit;
    }

    *data = (void *)aft;
    return TM_ECODE_OK;

error_exit:
    SCFree(aft);
    return TM_ECODE_FAILED;
}

static TmEcode EveStreamLogThreadDeinit(ThreadVars *t, void *data)
{
    EveStreamLogThread *aft = (EveStreamLogThread *)data;
    if (aft == NULL) {
        return TM_ECODE_OK;
    }

    FreeEveThreadCtx(aft->ctx);

    /* clear memory */
    memset(aft, 0, sizeof(*aft));

    SCFree(aft);
    return TM_ECODE_OK;
}

static void EveStreamOutputCtxFree(EveStreamOutputCtx *ctx)
{
    if (ctx != NULL) {
        SCFree(ctx);
    }
}

static void EveStreamLogDeInitCtxSub(OutputCtx *output_ctx)
{
    OutputDropLoggerDisable();

    EveStreamOutputCtx *ctx = output_ctx->data;
    SCFree(ctx);
    SCLogDebug("cleaning up sub output_ctx %p", output_ctx);
    SCFree(output_ctx);
}

static uint16_t SetFlag(ConfNode *conf, const char *opt, const uint16_t inflag)
{
    const char *v = ConfNodeLookupChildValue(conf, opt);
    if (v != NULL && ConfValIsTrue(v)) {
        return inflag;
    }
    return 0;
}

static OutputInitResult EveStreamLogInitCtxSub(ConfNode *conf, OutputCtx *parent_ctx)
{
    OutputInitResult result = { NULL, false };
    OutputJsonCtx *ajt = parent_ctx->data;

    EveStreamOutputCtx *ctx = SCCalloc(1, sizeof(*ctx));
    if (ctx == NULL)
        return result;

    OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
    if (unlikely(output_ctx == NULL)) {
        EveStreamOutputCtxFree(ctx);
        return result;
    }

    if (conf) {
        // TODO add all flags

        ctx->trigger_flags |= SetFlag(conf, "event-set", STREAM_PKT_FLAG_EVENTSET);
        ctx->trigger_flags |= SetFlag(conf, "state-update", STREAM_PKT_FLAG_STATE_UPDATE);
        ctx->trigger_flags |=
                SetFlag(conf, "spurious-retransmission", STREAM_PKT_FLAG_SPURIOUS_RETRANSMISSION);

        ctx->trigger_flags |= SetFlag(conf, "all", 0xFFFF);
        SCLogDebug("trigger_flags %04x", ctx->trigger_flags);
    }
    ctx->eve_ctx = ajt;

    output_ctx->data = ctx;
    output_ctx->DeInit = EveStreamLogDeInitCtxSub;

    result.ctx = output_ctx;
    result.ok = true;

    SCLogWarning("eve.stream facility is EXPERIMENTAL and can change w/o notice");
    return result;
}

void EveAddFlowTcpStreamFlags(const TcpStream *stream, const char *name, JsonBuilder *jb)
{
    jb_open_array(jb, name);
    if (stream->flags & STREAMTCP_STREAM_FLAG_HAS_GAP)
        jb_append_string(jb, "has_gap");
    if (stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)
        jb_append_string(jb, "noreassembly");
    if (stream->flags & STREAMTCP_STREAM_FLAG_KEEPALIVE)
        jb_append_string(jb, "keepalive");
    if (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED)
        jb_append_string(jb, "depth_reached");
    if (stream->flags & STREAMTCP_STREAM_FLAG_TRIGGER_RAW)
        jb_append_string(jb, "trigger_raw");
    if (stream->flags & STREAMTCP_STREAM_FLAG_TIMESTAMP)
        jb_append_string(jb, "timestamp");
    if (stream->flags & STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP)
        jb_append_string(jb, "zero_timestamp");
    if (stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)
        jb_append_string(jb, "appproto_detection_completed");
    if (stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED)
        jb_append_string(jb, "appproto_detection_skipped");
    if (stream->flags & STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED)
        jb_append_string(jb, "new_raw_disabled");
    if (stream->flags & STREAMTCP_STREAM_FLAG_DISABLE_RAW)
        jb_append_string(jb, "disable_raw");
    if (stream->flags & STREAMTCP_STREAM_FLAG_RST_RECV)
        jb_append_string(jb, "rst_recv");
    jb_close(jb);
}

void EveAddFlowTcpFlags(const TcpSession *ssn, const char *name, JsonBuilder *jb)
{
    jb_open_object(jb, "flags");

    jb_open_array(jb, name);
    if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) {
        jb_append_string(jb, "midstream");
    }
    if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED) {
        jb_append_string(jb, "midstream_established");
    }
    if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM_SYNACK) {
        jb_append_string(jb, "midstream_synack");
    }
    if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) {
        jb_append_string(jb, "timestamp");
    }
    if (ssn->flags & STREAMTCP_FLAG_SERVER_WSCALE) {
        jb_append_string(jb, "server_wscale");
    }
    if (ssn->flags & STREAMTCP_FLAG_CLOSED_BY_RST) {
        jb_append_string(jb, "closed_by_rst");
    }
    if (ssn->flags & STREAMTCP_FLAG_4WHS) {
        jb_append_string(jb, "4whs");
    }
    if (ssn->flags & STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT) {
        jb_append_string(jb, "detect_evasion_attempt");
    }
    if (ssn->flags & STREAMTCP_FLAG_CLIENT_SACKOK) {
        jb_append_string(jb, "client_sackok");
    }
    if (ssn->flags & STREAMTCP_FLAG_CLIENT_SACKOK) {
        jb_append_string(jb, "sackok");
    }
    if (ssn->flags & STREAMTCP_FLAG_3WHS_CONFIRMED) {
        jb_append_string(jb, "3whs_confirmed");
    }
    if (ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) {
        jb_append_string(jb, "app_layer_disabled");
    }
    if (ssn->flags & STREAMTCP_FLAG_BYPASS) {
        jb_append_string(jb, "bypass");
    }
    if (ssn->flags & STREAMTCP_FLAG_TCP_FAST_OPEN) {
        jb_append_string(jb, "tcp_fast_open");
    }
    if (ssn->flags & STREAMTCP_FLAG_TFO_DATA_IGNORED) {
        jb_append_string(jb, "tfo_data_ignored");
    }
    jb_close(jb);
    jb_close(jb);
}

static void LogStream(const TcpStream *stream, JsonBuilder *js)
{
    jb_set_uint(js, "isn", stream->isn);
    jb_set_uint(js, "next_seq", stream->next_seq);
    jb_set_uint(js, "last_ack", stream->last_ack);
    jb_set_uint(js, "next_win", stream->next_win);
    if (!(stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) {
        jb_set_uint(js, "base_seq", stream->base_seq);
        jb_set_uint(js, "segs_right_edge", stream->segs_right_edge);
    }
    jb_set_uint(js, "window", stream->window);
    jb_set_uint(js, "wscale", stream->wscale);

    EveAddFlowTcpStreamFlags(stream, "flags", js);
}

/**
 * \brief   Log the stream packets
 *
 * \param tv    Pointer the current thread variables
 * \param data  Pointer to the EveStreamLogThread struct
 * \param p     Pointer the packet which is being logged
 *
 * \retval 0 on succes
 */
static int EveStreamLogger(ThreadVars *tv, void *thread_data, const Packet *p)
{
    EveStreamLogThread *td = thread_data;
    EveStreamOutputCtx *ctx = td->stream_ctx;

    JsonAddrInfo addr = json_addr_info_zero;
    JsonAddrInfoInit(p, LOG_DIR_PACKET, &addr);

    JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "stream_tcp", &addr, ctx->eve_ctx);
    if (unlikely(js == NULL))
        return TM_ECODE_OK;

    if (p->flow != NULL) {
        if (p->flowflags & FLOW_PKT_TOSERVER) {
            jb_set_string(js, "direction", "to_server");
        } else {
            jb_set_string(js, "direction", "to_client");
        }
    }

    jb_open_object(js, "stream_tcp");
    jb_open_object(js, "packet");

    if (PKT_IS_IPV4(p)) {
        jb_set_uint(js, "len", IPV4_GET_IPLEN(p));
        jb_set_uint(js, "tos", IPV4_GET_IPTOS(p));
        jb_set_uint(js, "ttl", IPV4_GET_IPTTL(p));
        jb_set_uint(js, "ipid", IPV4_GET_IPID(p));
    } else if (PKT_IS_IPV6(p)) {
        jb_set_uint(js, "len", IPV6_GET_PLEN(p));
        jb_set_uint(js, "tc", IPV6_GET_CLASS(p));
        jb_set_uint(js, "hoplimit", IPV6_GET_HLIM(p));
        jb_set_uint(js, "flowlbl", IPV6_GET_FLOW(p));
    }
    if (PKT_IS_TCP(p)) {
        jb_set_uint(js, "tcpseq", TCP_GET_SEQ(p));
        jb_set_uint(js, "tcpack", TCP_GET_ACK(p));
        jb_set_uint(js, "tcpwin", TCP_GET_WINDOW(p));
        jb_set_bool(js, "syn", TCP_ISSET_FLAG_SYN(p) ? true : false);
        jb_set_bool(js, "ack", TCP_ISSET_FLAG_ACK(p) ? true : false);
        jb_set_bool(js, "psh", TCP_ISSET_FLAG_PUSH(p) ? true : false);
        jb_set_bool(js, "rst", TCP_ISSET_FLAG_RST(p) ? true : false);
        jb_set_bool(js, "urg", TCP_ISSET_FLAG_URG(p) ? true : false);
        jb_set_bool(js, "fin", TCP_ISSET_FLAG_FIN(p) ? true : false);
        jb_set_uint(js, "tcpres", TCP_GET_RAW_X2(p->tcph));
        jb_set_uint(js, "tcpurgp", TCP_GET_URG_POINTER(p));

        jb_open_array(js, "flags");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_RETRANSMISSION)
            jb_append_string(js, "retransmission");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_SPURIOUS_RETRANSMISSION)
            jb_append_string(js, "spurious_retransmission");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_KEEPALIVE)
            jb_append_string(js, "keepalive");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_KEEPALIVEACK)
            jb_append_string(js, "keepalive_ack");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_WINDOWUPDATE)
            jb_append_string(js, "window_update");

        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_EVENTSET)
            jb_append_string(js, "event_set");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_STATE_UPDATE)
            jb_append_string(js, "state_update");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_DUP_ACK)
            jb_append_string(js, "dup_ack");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_DSACK)
            jb_append_string(js, "dsack");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_ACK_UNSEEN_DATA)
            jb_append_string(js, "ack_unseen_data");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_TCP_PORT_REUSE)
            jb_append_string(js, "tcp_port_reuse");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_TCP_ZERO_WIN_PROBE)
            jb_append_string(js, "zero_window_probe");
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_TCP_ZERO_WIN_PROBE_ACK)
            jb_append_string(js, "zero_window_probe_ack");
        jb_close(js);
    }
    jb_close(js);

    jb_open_object(js, "session");
    if (p->flow != NULL && p->flow->protoctx != NULL) {
        const TcpSession *ssn = p->flow->protoctx;
        const char *tcp_state = StreamTcpStateAsString(ssn->state);
        if (tcp_state != NULL)
            jb_set_string(js, "state", tcp_state);
        if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_STATE_UPDATE) {
            const char *tcp_pstate = StreamTcpStateAsString(ssn->pstate);
            if (tcp_pstate != NULL)
                jb_set_string(js, "pstate", tcp_pstate);
        }
        EveAddFlowTcpFlags(ssn, "flags", js);

        jb_open_object(js, "client");
        LogStream(&ssn->client, js);
        jb_close(js);
        jb_open_object(js, "server");
        LogStream(&ssn->server, js);
        jb_close(js);
    }
    jb_close(js);

    if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_EVENTSET) {
        jb_open_array(js, "events");
        for (int i = 0; i < p->events.cnt; i++) {
            uint8_t event_code = p->events.events[i];
            bool is_decode = EVENT_IS_DECODER_PACKET_ERROR(event_code);
            if (is_decode)
                continue;
            if (event_code >= DECODE_EVENT_MAX)
                continue;
            const char *event = DEvents[event_code].event_name;
            if (event == NULL)
                continue;
            jb_append_string(js, event);
        }
        jb_close(js);
    }

    if (p->drop_reason != 0) {
        const char *str = PacketDropReasonToString(p->drop_reason);
        jb_set_string(js, "reason", str);
    }

    /* Close stream. */
    jb_close(js);

    OutputJsonBuilderBuffer(js, td->ctx);
    jb_free(js);

    return TM_ECODE_OK;
}

/**
 * \brief Check if we need to log this packet
 *
 * \param tv    Pointer the current thread variables
 * \param p     Pointer the packet which is tested
 *
 * \retval bool TRUE or FALSE
 */
static int EveStreamLogCondition(ThreadVars *tv, void *data, const Packet *p)
{
    EveStreamLogThread *td = data;
    EveStreamOutputCtx *ctx = td->stream_ctx;

    return (p->proto == IPPROTO_TCP &&
            (ctx->trigger_flags == 0xffff ||
                    (p->tcpvars.stream_pkt_flags & ctx->trigger_flags) != 0));
}

void EveStreamLogRegister(void)
{
    OutputRegisterPacketSubModule(LOGGER_JSON_STREAM, "eve-log", MODULE_NAME, "eve-log.stream",
            EveStreamLogInitCtxSub, EveStreamLogger, EveStreamLogCondition, EveStreamLogThreadInit,
            EveStreamLogThreadDeinit, NULL);
}

Coverage Report

Created: 2025-07-23 07:29

Line	Count	Source (jump to first uncovered line)
1		/* Copyright (C) 2023 Open Information Security Foundation
2		*
3		* You can copy, redistribute or modify this Program under the terms of
4		* the GNU General Public License version 2 as published by the Free
5		* Software Foundation.
6		*
7		* This program is distributed in the hope that it will be useful,
8		* but WITHOUT ANY WARRANTY; without even the implied warranty of
9		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10		* GNU General Public License for more details.
11		*
12		* You should have received a copy of the GNU General Public License
13		* version 2 along with this program; if not, write to the Free Software
14		* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15		* 02110-1301, USA.
16		*/
17
18		/**
19		* \file
20		*/
21
22		#include "suricata-common.h"
23		#include "packet.h"
24		#include "detect.h"
25		#include "flow.h"
26		#include "conf.h"
27
28		#include "threads.h"
29		#include "tm-threads.h"
30		#include "threadvars.h"
31		#include "util-debug.h"
32
33		#include "decode-ipv4.h"
34		#include "detect-parse.h"
35		#include "detect-engine.h"
36		#include "detect-engine-mpm.h"
37		#include "detect-reference.h"
38
39		#include "output.h"
40		#include "output-json.h"
41		#include "output-json-flow.h"
42		#include "output-eve-stream.h"
43
44		#include "stream-tcp.h"
45
46		#include "util-unittest.h"
47		#include "util-unittest-helper.h"
48		#include "util-classification-config.h"
49		#include "util-privs.h"
50		#include "util-print.h"
51		#include "util-proto-name.h"
52		#include "util-logopenfile.h"
53		#include "util-time.h"
54		#include "util-buffer.h"
55
56		#include "action-globals.h"
57
58	71	#define MODULE_NAME "EveStreamLog"
59
60		#define LOG_DROP_ALERTS 1
61
62		typedef struct EveStreamOutputCtx_ {
63		uint16_t trigger_flags; /*< presence of flags in packet trigger logging. 0xffff for all. /
64		OutputJsonCtx *eve_ctx;
65		} EveStreamOutputCtx;
66
67		typedef struct EveStreamLogThread_ {
68		EveStreamOutputCtx *stream_ctx;
69		OutputJsonThreadCtx *ctx;
70		} EveStreamLogThread;
71
72		static TmEcode EveStreamLogThreadInit(ThreadVars t, const void initdata, void **data)
73	0	{
74	0	EveStreamLogThread *aft = SCCalloc(1, sizeof(EveStreamLogThread));
75	0	if (unlikely(aft == NULL))
76	0	return TM_ECODE_FAILED;
77
78	0	if (initdata == NULL) {
79	0	SCLogDebug("Error getting context for EveLogDrop. \"initdata\" argument NULL");
80	0	goto error_exit;
81	0	}
82
83		/** Use the Output Context (file pointer and mutex) */
84	0	aft->stream_ctx = ((OutputCtx *)initdata)->data;
85	0	aft->ctx = CreateEveThreadCtx(t, aft->stream_ctx->eve_ctx);
86	0	if (!aft->ctx) {
87	0	goto error_exit;
88	0	}
89
90	0	data = (void )aft;
91	0	return TM_ECODE_OK;
92
93	0	error_exit:
94	0	SCFree(aft);
95	0	return TM_ECODE_FAILED;
96	0	}
97
98		static TmEcode EveStreamLogThreadDeinit(ThreadVars t, void data)
99	0	{
100	0	EveStreamLogThread aft = (EveStreamLogThread )data;
101	0	if (aft == NULL) {
102	0	return TM_ECODE_OK;
103	0	}
104
105	0	FreeEveThreadCtx(aft->ctx);
106
107		/* clear memory */
108	0	memset(aft, 0, sizeof(*aft));
109
110	0	SCFree(aft);
111	0	return TM_ECODE_OK;
112	0	}
113
114		static void EveStreamOutputCtxFree(EveStreamOutputCtx *ctx)
115	0	{
116	0	if (ctx != NULL) {
117	0	SCFree(ctx);
118	0	}
119	0	}
120
121		static void EveStreamLogDeInitCtxSub(OutputCtx *output_ctx)
122	0	{
123	0	OutputDropLoggerDisable();
124
125	0	EveStreamOutputCtx *ctx = output_ctx->data;
126	0	SCFree(ctx);
127	0	SCLogDebug("cleaning up sub output_ctx %p", output_ctx);
128	0	SCFree(output_ctx);
129	0	}
130
131		static uint16_t SetFlag(ConfNode conf, const char opt, const uint16_t inflag)
132	0	{
133	0	const char *v = ConfNodeLookupChildValue(conf, opt);
134	0	if (v != NULL && ConfValIsTrue(v)) {
135	0	return inflag;
136	0	}
137	0	return 0;
138	0	}
139
140		static OutputInitResult EveStreamLogInitCtxSub(ConfNode conf, OutputCtx parent_ctx)
141	0	{
142	0	OutputInitResult result = { NULL, false };
143	0	OutputJsonCtx *ajt = parent_ctx->data;
144
145	0	EveStreamOutputCtx ctx = SCCalloc(1, sizeof(ctx));
146	0	if (ctx == NULL)
147	0	return result;
148
149	0	OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
150	0	if (unlikely(output_ctx == NULL)) {
151	0	EveStreamOutputCtxFree(ctx);
152	0	return result;
153	0	}
154
155	0	if (conf) {
156		// TODO add all flags
157
158	0	ctx->trigger_flags \|= SetFlag(conf, "event-set", STREAM_PKT_FLAG_EVENTSET);
159	0	ctx->trigger_flags \|= SetFlag(conf, "state-update", STREAM_PKT_FLAG_STATE_UPDATE);
160	0	ctx->trigger_flags \|=
161	0	SetFlag(conf, "spurious-retransmission", STREAM_PKT_FLAG_SPURIOUS_RETRANSMISSION);
162
163	0	ctx->trigger_flags \|= SetFlag(conf, "all", 0xFFFF);
164	0	SCLogDebug("trigger_flags %04x", ctx->trigger_flags);
165	0	}
166	0	ctx->eve_ctx = ajt;
167
168	0	output_ctx->data = ctx;
169	0	output_ctx->DeInit = EveStreamLogDeInitCtxSub;
170
171	0	result.ctx = output_ctx;
172	0	result.ok = true;
173
174	0	SCLogWarning("eve.stream facility is EXPERIMENTAL and can change w/o notice");
175	0	return result;
176	0	}
177
178		void EveAddFlowTcpStreamFlags(const TcpStream stream, const char name, JsonBuilder *jb)
179	0	{
180	0	jb_open_array(jb, name);
181	0	if (stream->flags & STREAMTCP_STREAM_FLAG_HAS_GAP)
182	0	jb_append_string(jb, "has_gap");
183	0	if (stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)
184	0	jb_append_string(jb, "noreassembly");
185	0	if (stream->flags & STREAMTCP_STREAM_FLAG_KEEPALIVE)
186	0	jb_append_string(jb, "keepalive");
187	0	if (stream->flags & STREAMTCP_STREAM_FLAG_DEPTH_REACHED)
188	0	jb_append_string(jb, "depth_reached");
189	0	if (stream->flags & STREAMTCP_STREAM_FLAG_TRIGGER_RAW)
190	0	jb_append_string(jb, "trigger_raw");
191	0	if (stream->flags & STREAMTCP_STREAM_FLAG_TIMESTAMP)
192	0	jb_append_string(jb, "timestamp");
193	0	if (stream->flags & STREAMTCP_STREAM_FLAG_ZERO_TIMESTAMP)
194	0	jb_append_string(jb, "zero_timestamp");
195	0	if (stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_COMPLETED)
196	0	jb_append_string(jb, "appproto_detection_completed");
197	0	if (stream->flags & STREAMTCP_STREAM_FLAG_APPPROTO_DETECTION_SKIPPED)
198	0	jb_append_string(jb, "appproto_detection_skipped");
199	0	if (stream->flags & STREAMTCP_STREAM_FLAG_NEW_RAW_DISABLED)
200	0	jb_append_string(jb, "new_raw_disabled");
201	0	if (stream->flags & STREAMTCP_STREAM_FLAG_DISABLE_RAW)
202	0	jb_append_string(jb, "disable_raw");
203	0	if (stream->flags & STREAMTCP_STREAM_FLAG_RST_RECV)
204	0	jb_append_string(jb, "rst_recv");
205	0	jb_close(jb);
206	0	}
207
208		void EveAddFlowTcpFlags(const TcpSession ssn, const char name, JsonBuilder *jb)
209	0	{
210	0	jb_open_object(jb, "flags");
211
212	0	jb_open_array(jb, name);
213	0	if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM) {
214	0	jb_append_string(jb, "midstream");
215	0	}
216	0	if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM_ESTABLISHED) {
217	0	jb_append_string(jb, "midstream_established");
218	0	}
219	0	if (ssn->flags & STREAMTCP_FLAG_MIDSTREAM_SYNACK) {
220	0	jb_append_string(jb, "midstream_synack");
221	0	}
222	0	if (ssn->flags & STREAMTCP_FLAG_TIMESTAMP) {
223	0	jb_append_string(jb, "timestamp");
224	0	}
225	0	if (ssn->flags & STREAMTCP_FLAG_SERVER_WSCALE) {
226	0	jb_append_string(jb, "server_wscale");
227	0	}
228	0	if (ssn->flags & STREAMTCP_FLAG_CLOSED_BY_RST) {
229	0	jb_append_string(jb, "closed_by_rst");
230	0	}
231	0	if (ssn->flags & STREAMTCP_FLAG_4WHS) {
232	0	jb_append_string(jb, "4whs");
233	0	}
234	0	if (ssn->flags & STREAMTCP_FLAG_DETECTION_EVASION_ATTEMPT) {
235	0	jb_append_string(jb, "detect_evasion_attempt");
236	0	}
237	0	if (ssn->flags & STREAMTCP_FLAG_CLIENT_SACKOK) {
238	0	jb_append_string(jb, "client_sackok");
239	0	}
240	0	if (ssn->flags & STREAMTCP_FLAG_CLIENT_SACKOK) {
241	0	jb_append_string(jb, "sackok");
242	0	}
243	0	if (ssn->flags & STREAMTCP_FLAG_3WHS_CONFIRMED) {
244	0	jb_append_string(jb, "3whs_confirmed");
245	0	}
246	0	if (ssn->flags & STREAMTCP_FLAG_APP_LAYER_DISABLED) {
247	0	jb_append_string(jb, "app_layer_disabled");
248	0	}
249	0	if (ssn->flags & STREAMTCP_FLAG_BYPASS) {
250	0	jb_append_string(jb, "bypass");
251	0	}
252	0	if (ssn->flags & STREAMTCP_FLAG_TCP_FAST_OPEN) {
253	0	jb_append_string(jb, "tcp_fast_open");
254	0	}
255	0	if (ssn->flags & STREAMTCP_FLAG_TFO_DATA_IGNORED) {
256	0	jb_append_string(jb, "tfo_data_ignored");
257	0	}
258	0	jb_close(jb);
259	0	jb_close(jb);
260	0	}
261
262		static void LogStream(const TcpStream stream, JsonBuilder js)
263	0	{
264	0	jb_set_uint(js, "isn", stream->isn);
265	0	jb_set_uint(js, "next_seq", stream->next_seq);
266	0	jb_set_uint(js, "last_ack", stream->last_ack);
267	0	jb_set_uint(js, "next_win", stream->next_win);
268	0	if (!(stream->flags & STREAMTCP_STREAM_FLAG_NOREASSEMBLY)) {
269	0	jb_set_uint(js, "base_seq", stream->base_seq);
270	0	jb_set_uint(js, "segs_right_edge", stream->segs_right_edge);
271	0	}
272	0	jb_set_uint(js, "window", stream->window);
273	0	jb_set_uint(js, "wscale", stream->wscale);
274
275	0	EveAddFlowTcpStreamFlags(stream, "flags", js);
276	0	}
277
278		/**
279		* \brief Log the stream packets
280		*
281		* \param tv Pointer the current thread variables
282		* \param data Pointer to the EveStreamLogThread struct
283		* \param p Pointer the packet which is being logged
284		*
285		* \retval 0 on succes
286		*/
287		static int EveStreamLogger(ThreadVars tv, void thread_data, const Packet *p)
288	0	{
289	0	EveStreamLogThread *td = thread_data;
290	0	EveStreamOutputCtx *ctx = td->stream_ctx;
291
292	0	JsonAddrInfo addr = json_addr_info_zero;
293	0	JsonAddrInfoInit(p, LOG_DIR_PACKET, &addr);
294
295	0	JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "stream_tcp", &addr, ctx->eve_ctx);
296	0	if (unlikely(js == NULL))
297	0	return TM_ECODE_OK;
298
299	0	if (p->flow != NULL) {
300	0	if (p->flowflags & FLOW_PKT_TOSERVER) {
301	0	jb_set_string(js, "direction", "to_server");
302	0	} else {
303	0	jb_set_string(js, "direction", "to_client");
304	0	}
305	0	}
306
307	0	jb_open_object(js, "stream_tcp");
308	0	jb_open_object(js, "packet");
309
310	0	if (PKT_IS_IPV4(p)) {
311	0	jb_set_uint(js, "len", IPV4_GET_IPLEN(p));
312	0	jb_set_uint(js, "tos", IPV4_GET_IPTOS(p));
313	0	jb_set_uint(js, "ttl", IPV4_GET_IPTTL(p));
314	0	jb_set_uint(js, "ipid", IPV4_GET_IPID(p));
315	0	} else if (PKT_IS_IPV6(p)) {
316	0	jb_set_uint(js, "len", IPV6_GET_PLEN(p));
317	0	jb_set_uint(js, "tc", IPV6_GET_CLASS(p));
318	0	jb_set_uint(js, "hoplimit", IPV6_GET_HLIM(p));
319	0	jb_set_uint(js, "flowlbl", IPV6_GET_FLOW(p));
320	0	}
321	0	if (PKT_IS_TCP(p)) {
322	0	jb_set_uint(js, "tcpseq", TCP_GET_SEQ(p));
323	0	jb_set_uint(js, "tcpack", TCP_GET_ACK(p));
324	0	jb_set_uint(js, "tcpwin", TCP_GET_WINDOW(p));
325	0	jb_set_bool(js, "syn", TCP_ISSET_FLAG_SYN(p) ? true : false);
326	0	jb_set_bool(js, "ack", TCP_ISSET_FLAG_ACK(p) ? true : false);
327	0	jb_set_bool(js, "psh", TCP_ISSET_FLAG_PUSH(p) ? true : false);
328	0	jb_set_bool(js, "rst", TCP_ISSET_FLAG_RST(p) ? true : false);
329	0	jb_set_bool(js, "urg", TCP_ISSET_FLAG_URG(p) ? true : false);
330	0	jb_set_bool(js, "fin", TCP_ISSET_FLAG_FIN(p) ? true : false);
331	0	jb_set_uint(js, "tcpres", TCP_GET_RAW_X2(p->tcph));
332	0	jb_set_uint(js, "tcpurgp", TCP_GET_URG_POINTER(p));
333
334	0	jb_open_array(js, "flags");
335	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_RETRANSMISSION)
336	0	jb_append_string(js, "retransmission");
337	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_SPURIOUS_RETRANSMISSION)
338	0	jb_append_string(js, "spurious_retransmission");
339	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_KEEPALIVE)
340	0	jb_append_string(js, "keepalive");
341	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_KEEPALIVEACK)
342	0	jb_append_string(js, "keepalive_ack");
343	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_WINDOWUPDATE)
344	0	jb_append_string(js, "window_update");
345
346	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_EVENTSET)
347	0	jb_append_string(js, "event_set");
348	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_STATE_UPDATE)
349	0	jb_append_string(js, "state_update");
350	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_DUP_ACK)
351	0	jb_append_string(js, "dup_ack");
352	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_DSACK)
353	0	jb_append_string(js, "dsack");
354	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_ACK_UNSEEN_DATA)
355	0	jb_append_string(js, "ack_unseen_data");
356	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_TCP_PORT_REUSE)
357	0	jb_append_string(js, "tcp_port_reuse");
358	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_TCP_ZERO_WIN_PROBE)
359	0	jb_append_string(js, "zero_window_probe");
360	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_TCP_ZERO_WIN_PROBE_ACK)
361	0	jb_append_string(js, "zero_window_probe_ack");
362	0	jb_close(js);
363	0	}
364	0	jb_close(js);
365
366	0	jb_open_object(js, "session");
367	0	if (p->flow != NULL && p->flow->protoctx != NULL) {
368	0	const TcpSession *ssn = p->flow->protoctx;
369	0	const char *tcp_state = StreamTcpStateAsString(ssn->state);
370	0	if (tcp_state != NULL)
371	0	jb_set_string(js, "state", tcp_state);
372	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_STATE_UPDATE) {
373	0	const char *tcp_pstate = StreamTcpStateAsString(ssn->pstate);
374	0	if (tcp_pstate != NULL)
375	0	jb_set_string(js, "pstate", tcp_pstate);
376	0	}
377	0	EveAddFlowTcpFlags(ssn, "flags", js);
378
379	0	jb_open_object(js, "client");
380	0	LogStream(&ssn->client, js);
381	0	jb_close(js);
382	0	jb_open_object(js, "server");
383	0	LogStream(&ssn->server, js);
384	0	jb_close(js);
385	0	}
386	0	jb_close(js);
387
388	0	if (p->tcpvars.stream_pkt_flags & STREAM_PKT_FLAG_EVENTSET) {
389	0	jb_open_array(js, "events");
390	0	for (int i = 0; i < p->events.cnt; i++) {
391	0	uint8_t event_code = p->events.events[i];
392	0	bool is_decode = EVENT_IS_DECODER_PACKET_ERROR(event_code);
393	0	if (is_decode)
394	0	continue;
395	0	if (event_code >= DECODE_EVENT_MAX)
396	0	continue;
397	0	const char *event = DEvents[event_code].event_name;
398	0	if (event == NULL)
399	0	continue;
400	0	jb_append_string(js, event);
401	0	}
402	0	jb_close(js);
403	0	}
404
405	0	if (p->drop_reason != 0) {
406	0	const char *str = PacketDropReasonToString(p->drop_reason);
407	0	jb_set_string(js, "reason", str);
408	0	}
409
410		/* Close stream. */
411	0	jb_close(js);
412
413	0	OutputJsonBuilderBuffer(js, td->ctx);
414	0	jb_free(js);
415
416	0	return TM_ECODE_OK;
417	0	}
418
419		/**
420		* \brief Check if we need to log this packet
421		*
422		* \param tv Pointer the current thread variables
423		* \param p Pointer the packet which is tested
424		*
425		* \retval bool TRUE or FALSE
426		*/
427		static int EveStreamLogCondition(ThreadVars tv, void data, const Packet *p)
428	0	{
429	0	EveStreamLogThread *td = data;
430	0	EveStreamOutputCtx *ctx = td->stream_ctx;
431
432	0	return (p->proto == IPPROTO_TCP &&
433	0	(ctx->trigger_flags == 0xffff \|\|
434	0	(p->tcpvars.stream_pkt_flags & ctx->trigger_flags) != 0));
435	0	}
436
437		void EveStreamLogRegister(void)
438	71	{
439	71	OutputRegisterPacketSubModule(LOGGER_JSON_STREAM, "eve-log", MODULE_NAME, "eve-log.stream",
440	71	EveStreamLogInitCtxSub, EveStreamLogger, EveStreamLogCondition, EveStreamLogThreadInit,
441	71	EveStreamLogThreadDeinit, NULL);
442	71	}