Skip to content

Output alert applayer v7.1 #9005

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
catenacyber wants to merge 7 commits into from
Closed

Output alert applayer v7.1 #9005

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
16342bc
output/alert: rewrite code for app-layer properties
catenacyber May 11, 2023
094438c
output/mqtt: reuse standard code
catenacyber May 12, 2023
7046616
output/rfb: reuse standard code
catenacyber May 12, 2023
a31153a
output/snmp: reuse standard code
catenacyber May 12, 2023
1cc421d
output/ftp-data: reuse standard code
catenacyber May 14, 2023
bbdc702
output/tls: reuse standard code
catenacyber May 14, 2023
98e8d07
output: comments for non-generic app-layers
catenacyber May 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions rust/src/modbus/log.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ pub extern "C" fn rs_modbus_to_json(tx: &mut ModbusTransaction, js: &mut JsonBui

/// populate a json object with transactional information, for logging
fn log(tx: &ModbusTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.open_object("modbus")?;
Copy link
Contributor Author

@catenacyber catenacyber Jun 9, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. What is the right way to do this ?

open the object at the start of the logging function, or should the caller do that ?

Now, half the protocols do one way, and the other half does the other way
This PR makes it that the caller opens the object

Copy link
Member

@jasonish jasonish Jun 12, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wouldn't say there is a right way, but we want to avoid empty objects, or even the overhead of empty objects. So I think the caller should only open the object if it knows it will contain data. If its the logging function that decides whether logging will happen or not, maybe it should open the object, to avoid the case where the caller would have the rewind to a marker.

Copy link
Contributor Author

@catenacyber catenacyber Jun 16, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The way you put it, it looks better to open in the logging function which knows better if the object is empty

js.set_uint("id", tx.id)?;

if let Some(req) = &tx.request {
Expand All @@ -42,7 +41,6 @@ fn log(tx: &ModbusTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.close()?;
}

js.close()?;
Ok(())
}

Expand Down
2 changes: 0 additions & 2 deletions rust/src/mqtt/logger.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,6 @@ fn log_mqtt_header(js: &mut JsonBuilder, hdr: &FixedHeader) -> Result<(), JsonEr
}

fn log_mqtt(tx: &MQTTTransaction, flags: u32, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.open_object("mqtt")?;
for msg in tx.msg.iter() {
match msg.op {
MQTTOperation::CONNECT(ref conn) => {
Expand Down Expand Up @@ -291,7 +290,6 @@ fn log_mqtt(tx: &MQTTTransaction, flags: u32, js: &mut JsonBuilder) -> Result<()
MQTTOperation::UNASSIGNED => {}
}
}
js.close()?; // mqtt

return Ok(());
}
Expand Down
2 changes: 0 additions & 2 deletions rust/src/quic/logger.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,6 @@ fn quic_tls_extension_name(e: u16) -> Option<String> {
}

fn log_template(tx: &QuicTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.open_object("quic")?;
if tx.header.ty != QuicType::Short {
js.set_string("version", String::from(tx.header.version).as_str())?;

Expand Down Expand Up @@ -144,7 +143,6 @@ fn log_template(tx: &QuicTransaction, js: &mut JsonBuilder) -> Result<(), JsonEr
js.close()?;
}

js.close()?;
Ok(())
}

Expand Down
2 changes: 0 additions & 2 deletions rust/src/rdp/log.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ pub extern "C" fn rs_rdp_to_json(tx: &mut RdpTransaction, js: &mut JsonBuilder)

/// populate a json object with transactional information, for logging
fn log(tx: &RdpTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.open_object("rdp")?;
js.set_uint("tx_id", tx.id)?;

match &tx.item {
Expand Down Expand Up @@ -58,7 +57,6 @@ fn log(tx: &RdpTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
}
}

js.close()?;
Ok(())
}

Expand Down
4 changes: 0 additions & 4 deletions rust/src/rfb/logger.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,6 @@ use super::rfb::RFBTransaction;
use crate::jsonbuilder::{JsonBuilder, JsonError};

fn log_rfb(tx: &RFBTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.open_object("rfb")?;

// Protocol version
if let Some(tx_spv) = &tx.tc_server_protocol_version {
js.open_object("server_protocol_version")?;
Expand Down Expand Up @@ -107,8 +105,6 @@ fn log_rfb(tx: &RFBTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.close()?;
}

js.close()?;

return Ok(());
}

Expand Down
6 changes: 1 addition & 5 deletions rust/src/sip/log.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,6 @@ use crate::jsonbuilder::{JsonBuilder, JsonError};
use crate::sip::sip::SIPTransaction;

fn log(tx: &SIPTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.open_object("sip")?;

if let Some(req) = &tx.request {
js.set_string("method", &req.method)?
.set_string("uri", &req.path)?
Expand All @@ -43,12 +41,10 @@ fn log(tx: &SIPTransaction, js: &mut JsonBuilder) -> Result<(), JsonError> {
js.set_string("response_line", resp_line)?;
}

js.close()?;

Ok(())
}

#[no_mangle]
pub extern "C" fn rs_sip_log_json(tx: &mut SIPTransaction, js: &mut JsonBuilder) -> bool {
log(tx, js).is_ok()
}
}
2 changes: 1 addition & 1 deletion rust/src/snmp/log.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ fn snmp_log_response(jsb: &mut JsonBuilder, tx: &mut SNMPTransaction) -> Result<
}

#[no_mangle]
pub extern "C" fn rs_snmp_log_json_response(jsb: &mut JsonBuilder, tx: &mut SNMPTransaction) -> bool
pub extern "C" fn rs_snmp_log_json_response(tx: &mut SNMPTransaction, jsb: &mut JsonBuilder) -> bool
{
snmp_log_response(jsb, tx).is_ok()
}
4 changes: 4 additions & 0 deletions scripts/setup-app-layer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,6 +200,10 @@ def logger_patch_output_c(proto):
output = io.StringIO()
inlines = open(filename).readlines()
for i, line in enumerate(inlines):
if line.find("ALPROTO_TEMPLATE") > -1:
new_line = line.replace("TEMPLATE", proto.upper()).replace(
"template", proto.lower())
output.write(new_line)
if line.find("output-json-template.h") > -1:
output.write(line.replace("template", proto.lower()))
if line.find("/* Template JSON logger.") > -1:
Expand Down
9 changes: 3 additions & 6 deletions src/app-layer-ftp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1407,13 +1407,9 @@ uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
return c == NULL ? len : (uint16_t)(c - buffer + 1);
}

void EveFTPDataAddMetadata(const Flow *f, JsonBuilder *jb)
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
{
const FtpDataState *ftp_state = NULL;
if (f->alstate == NULL)
return;

ftp_state = (FtpDataState *)f->alstate;
const FtpDataState *ftp_state = (FtpDataState *)vtx;

if (ftp_state->file_name) {
jb_set_string_from_bytes(jb, "filename", ftp_state->file_name, ftp_state->file_len);
Expand All @@ -1428,6 +1424,7 @@ void EveFTPDataAddMetadata(const Flow *f, JsonBuilder *jb)
default:
break;
}
return true;
}

/**
Expand Down
2 changes: 1 addition & 1 deletion src/app-layer-ftp.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,7 @@ uint64_t FTPMemuseGlobalCounter(void);
uint64_t FTPMemcapGlobalCounter(void);

uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len);
void EveFTPDataAddMetadata(const Flow *f, JsonBuilder *jb);
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb);

#endif /* __APP_LAYER_FTP_H__ */

Loading