Adding upstream version 1:7.0.3.upstream/1%7.0.3

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 108 insertions, 0 deletions

diff --git a/src/output-json-metadata.c b/src/output-json-metadata.c
new file mode 100644
index 0000000..231ff1d
--- /dev/null
+++ b/src/output-json-metadata.c
@@ -0,0 +1,108 @@
+/* Copyright (C) 2013-2021 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Victor Julien <victor@inliniac.net>
+ *
+ * Logs vars in JSON format.
+ *
+ */
+
+#include "suricata-common.h"
+#include "detect.h"
+#include "flow.h"
+#include "conf.h"
+
+#include "threads.h"
+#include "tm-threads.h"
+#include "threadvars.h"
+#include "util-debug.h"
+
+#include "util-misc.h"
+#include "util-unittest.h"
+#include "util-unittest-helper.h"
+
+#include "detect-parse.h"
+#include "detect-engine.h"
+#include "detect-engine-mpm.h"
+#include "detect-reference.h"
+#include "app-layer-parser.h"
+#include "app-layer-dnp3.h"
+#include "app-layer-htp.h"
+#include "app-layer-htp-xff.h"
+#include "util-classification-config.h"
+#include "util-syslog.h"
+#include "util-logopenfile.h"
+
+#include "output.h"
+#include "output-json.h"
+#include "output-json-metadata.h"
+
+#include "util-byte.h"
+#include "util-privs.h"
+#include "util-print.h"
+#include "util-proto-name.h"
+#include "util-optimize.h"
+#include "util-buffer.h"
+
+#define MODULE_NAME "JsonMetadataLog"
+
+static int MetadataJson(ThreadVars *tv, OutputJsonThreadCtx *aft, const Packet *p)
+{
+    JsonBuilder *js = CreateEveHeader(p, LOG_DIR_PACKET, "metadata", NULL, aft->ctx);
+    if (unlikely(js == NULL))
+        return TM_ECODE_OK;
+
+    /* If metadata is not enabled for eve, explicitly log it here as this is
+     * what logging metadata is about. */
+    if (!aft->ctx->cfg.include_metadata) {
+        EveAddMetadata(p, p->flow, js);
+    }
+    OutputJsonBuilderBuffer(js, aft);
+
+    jb_free(js);
+    return TM_ECODE_OK;
+}
+
+static int JsonMetadataLogger(ThreadVars *tv, void *thread_data, const Packet *p)
+{
+    OutputJsonThreadCtx *aft = thread_data;
+
+    return MetadataJson(tv, aft, p);
+}
+
+static int JsonMetadataLogCondition(ThreadVars *tv, void *data, const Packet *p)
+{
+    if (p->pktvar) {
+        return TRUE;
+    }
+    return FALSE;
+}
+
+void JsonMetadataLogRegister (void)
+{
+    OutputRegisterPacketSubModule(LOGGER_JSON_METADATA, "eve-log", MODULE_NAME, "eve-log.metadata",
+            OutputJsonLogInitSub, JsonMetadataLogger, JsonMetadataLogCondition, JsonLogThreadInit,
+            JsonLogThreadDeinit, NULL);
+
+    /* Kept for compatibility. */
+    OutputRegisterPacketSubModule(LOGGER_JSON_METADATA, "eve-log", MODULE_NAME, "eve-log.vars",
+            OutputJsonLogInitSub, JsonMetadataLogger, JsonMetadataLogCondition, JsonLogThreadInit,
+            JsonLogThreadDeinit, NULL);
+}