smtp-json: update SMTP EVE messages

This patch updates SMTP message to have them feature a 'smtp'
section which will contain all fields coming from the smtp
protocol.
pull/1667/head
Eric Leblond 12 years ago
parent 7bca8268bc
commit 2abae3f0a1

@ -54,12 +54,32 @@
#ifdef HAVE_LIBJANSSON #ifdef HAVE_LIBJANSSON
#include <jansson.h> #include <jansson.h>
static json_t *JsonSmtpDataLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id)
{
json_t *sjs = json_object();
SMTPTransaction *tx = vtx;
if (sjs == NULL) {
return NULL;
}
if (((SMTPState *)state)->helo) {
json_object_set_new(sjs, "helo",
json_string((const char *)((SMTPState *)state)->helo));
}
if (tx->mail_from) {
json_object_set_new(sjs, "mail_from",
json_string((const char *)tx->mail_from));
}
return sjs;
}
static int JsonSmtpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) static int JsonSmtpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id)
{ {
SCEnter(); SCEnter();
JsonEmailLogThread *jhl = (JsonEmailLogThread *)thread_data; JsonEmailLogThread *jhl = (JsonEmailLogThread *)thread_data;
MemBuffer *buffer = (MemBuffer *)jhl->buffer; MemBuffer *buffer = (MemBuffer *)jhl->buffer;
json_t *sjs;
json_t *js = CreateJSONHeader((Packet *)p, 1, "smtp"); json_t *js = CreateJSONHeader((Packet *)p, 1, "smtp");
if (unlikely(js == NULL)) if (unlikely(js == NULL))
return TM_ECODE_OK; return TM_ECODE_OK;
@ -67,10 +87,18 @@ static int JsonSmtpLogger(ThreadVars *tv, void *thread_data, const Packet *p, Fl
/* reset */ /* reset */
MemBufferReset(buffer); MemBufferReset(buffer);
sjs = JsonSmtpDataLogger(tv, thread_data, p, f, state, tx, tx_id);
if (sjs) {
json_object_set_new(js, "smtp", sjs);
}
if (JsonEmailLogJson(jhl, js, p, f, state, tx, tx_id) == TM_ECODE_OK) { if (JsonEmailLogJson(jhl, js, p, f, state, tx, tx_id) == TM_ECODE_OK) {
OutputJSONBuffer(js, jhl->emaillog_ctx->file_ctx, buffer); OutputJSONBuffer(js, jhl->emaillog_ctx->file_ctx, buffer);
} }
json_object_del(js, "smtp"); json_object_del(js, "email");
if (sjs) {
json_object_del(js, "smtp");
}
json_object_clear(js); json_object_clear(js);
json_decref(js); json_decref(js);

Loading…
Cancel
Save