Commit Graph

24 Commits (suricata-3.2.1)

Author SHA1 Message Date
Jason Ish 3fab684f97 logging: don't log that json is disabled in each logger
A warning log is already emitted if eve-log is enabled in the
configuration but json support is not built so the logger
registration functions can be silent.
9 years ago
Jason Ish 44c846f2f8 tls-json: make tls events direction sensitive
Previously the src/dest ips in TLS events would differ between
IDS and IPS modes. Make the header creation direction sensitive
so they are identical in both modes.
9 years ago
Mats Klepsland 5b230bbce5 output-json-tls: add notBefore and notAfter fields to extended output
Add notBefore and notAfter fields from TLS certificate to extended JSON
output.
9 years ago
Jason Ish 1b4ba4496c logging: rename registration functions to not have tmm
As the logging modules are no longer threading modules, rename
them so they don't look like they are being registered as
threading modules.

Also, move the registration to the output.c which will handle
registration of the loggers.
9 years ago
Jason Ish fa27a76462 logging: add profiling back for non-tmm loggers
The loggers moved away from a TMM required a new
profiling support.
9 years ago
Jason Ish aaa65f3d16 logging: convert json tls output to non-thread module 9 years ago
Jason Ish 687602c0ca logging: convert eve dns logging to non-thread module 9 years ago
Jason Ish b23d74ac88 tls-json-log: register module as tls-json-log, not dns-json-log
Fixes issue:
https://redmine.openinfosecfoundation.org/issues/1792
where dns-json-log would not log any data.
9 years ago
Mats Klepsland 47a4daeeb8 output: allow more than one TLS logger 9 years ago
Mats Klepsland e9074bc829 jsontls: use TxLogger 9 years ago
maxtors 06d74b5775 Module specific error code for init ctx error. 9 years ago
maxtors 69863f7b1c Corrected and unified debugmessages for init data errors in *ThreadInit. 9 years ago
Victor Julien c446abeb47 jansson: include in suricata-common.h 10 years ago
Victor Julien 8bb1cf08ef eve: fix mishandling of big messages
When the string representation of a JSON message grew bigger than
64k, the JSON record would just be truncated. This lead to errors
in the parser(s) of the JSON stream.

This patch changes the buffer logic to grow the buffer on demand.
10 years ago
Mats Klepsland 285022fde9 output-json-tls: added SNI field to extended output
Added SNI field to extended JSON output.
10 years ago
Jason Ish b512580bbe logging: integrate rotation into SCConfLogOpenGeneric.
Addresses issue 1492, and will make it harder to omit
rotation on new outputs.
10 years ago
Eric Leblond 39d667ff56 output-json: fix type of data parameter
The cast of data to AlertJsonThread was not correct as the real
type of the void pointer is a OutputJsonCtx. This was working by
luck because they both have a file_ctx as first element.
10 years ago
Eric Leblond 22182e7a84 json-tls: refactor to export logging function
To be able to add TLS data in alert we need to do the same as what
is done with HTTP ie export the logging functions.
11 years ago
Ken Steele 8f1d75039a Enforce function coding standard
Functions should be defined as:

int foo(void)
{
}

Rather than:
int food(void) {
}

All functions where changed by a script to match this standard.
11 years ago
Victor Julien b2d29a85e9 tls-json: add cleanup function
Properly clean up output context when shutting down.
12 years ago
Victor Julien a3b0577a1f output: add TM_FLAG_LOGAPI_TM thread module flag
The TM_FLAG_LOGAPI_TM flag indicates that a module is run by the log
api, not by the 'regular' thread module call functions.

Set flag in all all Log API users' registration code.

Purpose of this flag is in profiling. In profiling output it will be
used to list log api thread modules separately.
12 years ago
Eric Leblond 6fd9b4b255 json: add event_type key
This patch adds an event_type key to the generated events. Current
value is one of "dns", "alert, "file", "tls", "http", "drop". It is
then easy to differentiate in log analysis tools the events based on
source inside Suricata.
12 years ago
Victor Julien 31a024c9b5 Various fixes for scan-build warnings 12 years ago
Victor Julien efd4c42c0a json tls log: rename to output-json-tls 12 years ago