From 225cdf996e6de52e79b7b306a4e99e9b9604fa47 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 23 Apr 2019 13:06:16 +0200 Subject: [PATCH] eve/alert: take vlan from packet, not flow Flow is not guaranteed to exist. --- src/output-json.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/output-json.c b/src/output-json.c index cf0fafd5cb..64d5b44220 100644 --- a/src/output-json.c +++ b/src/output-json.c @@ -716,13 +716,15 @@ json_t *CreateJSONHeader(const Packet *p, enum OutputJsonLogDirection dir, } /* vlan */ - if (f->vlan_idx > 0) { + if (p->vlan_idx > 0) { json_t *js_vlan = json_array(); - json_array_append_new(js_vlan, json_integer(f->vlan_id[0])); - if (f->vlan_idx > 1) { - json_array_append_new(js_vlan, json_integer(f->vlan_id[1])); + if (js_vlan) { + json_array_append_new(js_vlan, json_integer(p->vlan_id[0])); + if (p->vlan_idx > 1) { + json_array_append_new(js_vlan, json_integer(p->vlan_id[1])); + } + json_object_set_new(js, "vlan", js_vlan); } - json_object_set_new(js, "vlan", js_vlan); } /* 5-tuple */