/src/suricata7/src/output-json-dhcp.c
Line | Count | Source |
1 | | /* Copyright (C) 2015-2021 Open Information Security Foundation |
2 | | * |
3 | | * You can copy, redistribute or modify this Program under the terms of |
4 | | * the GNU General Public License version 2 as published by the Free |
5 | | * Software Foundation. |
6 | | * |
7 | | * This program is distributed in the hope that it will be useful, |
8 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
9 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
10 | | * GNU General Public License for more details. |
11 | | * |
12 | | * You should have received a copy of the GNU General Public License |
13 | | * version 2 along with this program; if not, write to the Free Software |
14 | | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
15 | | * 02110-1301, USA. |
16 | | */ |
17 | | |
18 | | /** |
19 | | * \file |
20 | | * |
21 | | * \author Jason Ish <jason.ish@oisf.net> |
22 | | */ |
23 | | |
24 | | #include "suricata-common.h" |
25 | | #include "detect.h" |
26 | | #include "pkt-var.h" |
27 | | #include "conf.h" |
28 | | |
29 | | #include "threads.h" |
30 | | #include "threadvars.h" |
31 | | #include "tm-threads.h" |
32 | | |
33 | | #include "util-unittest.h" |
34 | | #include "util-buffer.h" |
35 | | #include "util-debug.h" |
36 | | #include "util-byte.h" |
37 | | |
38 | | #include "output.h" |
39 | | #include "output-json.h" |
40 | | |
41 | | #include "app-layer.h" |
42 | | #include "app-layer-parser.h" |
43 | | |
44 | | #include "output-json-dhcp.h" |
45 | | #include "rust.h" |
46 | | |
47 | | |
48 | | typedef struct LogDHCPFileCtx_ { |
49 | | void *rs_logger; |
50 | | OutputJsonCtx *eve_ctx; |
51 | | } LogDHCPFileCtx; |
52 | | |
53 | | typedef struct LogDHCPLogThread_ { |
54 | | LogDHCPFileCtx *dhcplog_ctx; |
55 | | OutputJsonThreadCtx *thread; |
56 | | } LogDHCPLogThread; |
57 | | |
58 | | static int JsonDHCPLogger(ThreadVars *tv, void *thread_data, |
59 | | const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) |
60 | 26.5k | { |
61 | 26.5k | LogDHCPLogThread *thread = thread_data; |
62 | 26.5k | LogDHCPFileCtx *ctx = thread->dhcplog_ctx; |
63 | | |
64 | 26.5k | if (!rs_dhcp_logger_do_log(ctx->rs_logger, tx)) { |
65 | 0 | return TM_ECODE_OK; |
66 | 0 | } |
67 | | |
68 | 26.5k | JsonBuilder *js = CreateEveHeader((Packet *)p, 0, "dhcp", NULL, ctx->eve_ctx); |
69 | 26.5k | if (unlikely(js == NULL)) { |
70 | 0 | return TM_ECODE_FAILED; |
71 | 0 | } |
72 | | |
73 | 26.5k | rs_dhcp_logger_log(ctx->rs_logger, tx, js); |
74 | | |
75 | 26.5k | OutputJsonBuilderBuffer(js, thread->thread); |
76 | 26.5k | jb_free(js); |
77 | | |
78 | 26.5k | return TM_ECODE_OK; |
79 | 26.5k | } |
80 | | |
81 | | static void OutputDHCPLogDeInitCtxSub(OutputCtx *output_ctx) |
82 | 0 | { |
83 | 0 | LogDHCPFileCtx *dhcplog_ctx = (LogDHCPFileCtx *)output_ctx->data; |
84 | 0 | rs_dhcp_logger_free(dhcplog_ctx->rs_logger); |
85 | 0 | SCFree(dhcplog_ctx); |
86 | 0 | SCFree(output_ctx); |
87 | 0 | } |
88 | | |
89 | | static OutputInitResult OutputDHCPLogInitSub(ConfNode *conf, |
90 | | OutputCtx *parent_ctx) |
91 | 4 | { |
92 | 4 | OutputInitResult result = { NULL, false }; |
93 | | |
94 | 4 | LogDHCPFileCtx *dhcplog_ctx = SCCalloc(1, sizeof(*dhcplog_ctx)); |
95 | 4 | if (unlikely(dhcplog_ctx == NULL)) { |
96 | 0 | return result; |
97 | 0 | } |
98 | 4 | dhcplog_ctx->eve_ctx = parent_ctx->data; |
99 | | |
100 | 4 | OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx)); |
101 | 4 | if (unlikely(output_ctx == NULL)) { |
102 | 0 | SCFree(dhcplog_ctx); |
103 | 0 | return result; |
104 | 0 | } |
105 | 4 | output_ctx->data = dhcplog_ctx; |
106 | 4 | output_ctx->DeInit = OutputDHCPLogDeInitCtxSub; |
107 | | |
108 | 4 | dhcplog_ctx->rs_logger = rs_dhcp_logger_new(conf); |
109 | | |
110 | 4 | AppLayerParserRegisterLogger(IPPROTO_UDP, ALPROTO_DHCP); |
111 | | |
112 | 4 | result.ctx = output_ctx; |
113 | 4 | result.ok = true; |
114 | 4 | return result; |
115 | 4 | } |
116 | | |
117 | | static TmEcode JsonDHCPLogThreadInit(ThreadVars *t, const void *initdata, void **data) |
118 | 4 | { |
119 | 4 | LogDHCPLogThread *thread = SCCalloc(1, sizeof(*thread)); |
120 | 4 | if (unlikely(thread == NULL)) { |
121 | 0 | return TM_ECODE_FAILED; |
122 | 0 | } |
123 | 4 | LogDHCPFileCtx *ctx = ((OutputCtx *)initdata)->data; |
124 | 4 | thread->dhcplog_ctx = ctx; |
125 | 4 | thread->thread = CreateEveThreadCtx(t, ctx->eve_ctx); |
126 | 4 | if (thread->thread == NULL) { |
127 | 0 | SCFree(thread); |
128 | 0 | return TM_ECODE_FAILED; |
129 | 0 | } |
130 | | |
131 | 4 | *data = (void *)thread; |
132 | 4 | return TM_ECODE_OK; |
133 | 4 | } |
134 | | |
135 | | static TmEcode JsonDHCPLogThreadDeinit(ThreadVars *t, void *data) |
136 | 0 | { |
137 | 0 | LogDHCPLogThread *thread = (LogDHCPLogThread *)data; |
138 | 0 | if (thread == NULL) { |
139 | 0 | return TM_ECODE_OK; |
140 | 0 | } |
141 | 0 | FreeEveThreadCtx(thread->thread); |
142 | 0 | SCFree(thread); |
143 | 0 | return TM_ECODE_OK; |
144 | 0 | } |
145 | | |
146 | | void JsonDHCPLogRegister(void) |
147 | 74 | { |
148 | | /* Register as an eve sub-module. */ |
149 | 74 | OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonDHCPLog", "eve-log.dhcp", |
150 | 74 | OutputDHCPLogInitSub, ALPROTO_DHCP, JsonDHCPLogger, JsonDHCPLogThreadInit, |
151 | | JsonDHCPLogThreadDeinit, NULL); |
152 | 74 | } |