diff --git a/src/output-json-alert.c b/src/output-json-alert.c index abc77b6766..52e8312ddc 100644 --- a/src/output-json-alert.c +++ b/src/output-json-alert.c @@ -71,6 +71,7 @@ #include "output-json-sip.h" #include "output-json-rfb.h" #include "output-json-mqtt.h" +#include "output-json-ike.h" #include "util-byte.h" #include "util-privs.h" @@ -530,6 +531,12 @@ static void AlertAddAppLayer(const Packet *p, JsonBuilder *jb, case ALPROTO_DNS: AlertJsonDns(p->flow, tx_id, jb); break; + case ALPROTO_IKE: + jb_get_mark(jb, &mark); + if (!EveIKEAddMetadata(p->flow, tx_id, jb)) { + jb_restore_mark(jb, &mark); + } + break; case ALPROTO_MQTT: jb_get_mark(jb, &mark); if (!JsonMQTTAddMetadata(p->flow, tx_id, jb)) { diff --git a/src/output-json-ike.c b/src/output-json-ike.c index 165ffa62a4..8ed200ecfa 100644 --- a/src/output-json-ike.c +++ b/src/output-json-ike.c @@ -64,6 +64,19 @@ typedef struct LogIKELogThread_ { MemBuffer *buffer; } LogIKELogThread; +bool EveIKEAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js) +{ + IKEState *state = FlowGetAppState(f); + if (state) { + IKETransaction *tx = AppLayerParserGetTx(f->proto, ALPROTO_IKE, state, tx_id); + if (tx) { + return rs_ike_logger_log(state, tx, LOG_IKE_EXTENDED, js); + } + } + + return false; +} + static int JsonIKELogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state, void *tx, uint64_t tx_id) { diff --git a/src/output-json-ike.h b/src/output-json-ike.h index d02c89608e..af5188b19e 100644 --- a/src/output-json-ike.h +++ b/src/output-json-ike.h @@ -26,4 +26,6 @@ void JsonIKELogRegister(void); +bool EveIKEAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js); + #endif /* __OUTPUT_JSON_IKE_H__ */