|
|
|
@ -199,24 +199,18 @@ static void EveAddPacketVars(const Packet *p, JsonBuilder *js_vars)
|
|
|
|
|
if (pv->key != NULL) {
|
|
|
|
|
uint32_t offset = 0;
|
|
|
|
|
uint8_t keybuf[pv->key_len + 1];
|
|
|
|
|
PrintStringsToBuffer(keybuf, &offset,
|
|
|
|
|
sizeof(keybuf),
|
|
|
|
|
pv->key, pv->key_len);
|
|
|
|
|
PrintStringsToBuffer(keybuf, &offset, pv->key_len + 1, pv->key, pv->key_len);
|
|
|
|
|
uint32_t len = pv->value_len;
|
|
|
|
|
uint8_t printable_buf[len + 1];
|
|
|
|
|
offset = 0;
|
|
|
|
|
PrintStringsToBuffer(printable_buf, &offset,
|
|
|
|
|
sizeof(printable_buf),
|
|
|
|
|
pv->value, pv->value_len);
|
|
|
|
|
PrintStringsToBuffer(printable_buf, &offset, len + 1, pv->value, pv->value_len);
|
|
|
|
|
jb_set_string(js_vars, (char *)keybuf, (char *)printable_buf);
|
|
|
|
|
} else {
|
|
|
|
|
const char *varname = VarNameStoreLookupById(pv->id, VAR_TYPE_PKT_VAR);
|
|
|
|
|
uint32_t len = pv->value_len;
|
|
|
|
|
uint8_t printable_buf[len + 1];
|
|
|
|
|
uint32_t offset = 0;
|
|
|
|
|
PrintStringsToBuffer(printable_buf, &offset,
|
|
|
|
|
sizeof(printable_buf),
|
|
|
|
|
pv->value, pv->value_len);
|
|
|
|
|
PrintStringsToBuffer(printable_buf, &offset, len + 1, pv->value, pv->value_len);
|
|
|
|
|
jb_set_string(js_vars, varname, (char *)printable_buf);
|
|
|
|
|
}
|
|
|
|
|
jb_close(js_vars);
|
|
|
|
@ -271,9 +265,8 @@ static void EveAddFlowVars(const Flow *f, JsonBuilder *js_root, JsonBuilder **js
|
|
|
|
|
uint32_t len = fv->data.fv_str.value_len;
|
|
|
|
|
uint8_t printable_buf[len + 1];
|
|
|
|
|
uint32_t offset = 0;
|
|
|
|
|
PrintStringsToBuffer(printable_buf, &offset,
|
|
|
|
|
sizeof(printable_buf),
|
|
|
|
|
fv->data.fv_str.value, fv->data.fv_str.value_len);
|
|
|
|
|
PrintStringsToBuffer(printable_buf, &offset, len + 1, fv->data.fv_str.value,
|
|
|
|
|
fv->data.fv_str.value_len);
|
|
|
|
|
|
|
|
|
|
jb_start_object(js_flowvars);
|
|
|
|
|
jb_set_string(js_flowvars, varname, (char *)printable_buf);
|
|
|
|
@ -288,16 +281,13 @@ static void EveAddFlowVars(const Flow *f, JsonBuilder *js_root, JsonBuilder **js
|
|
|
|
|
|
|
|
|
|
uint8_t keybuf[fv->keylen + 1];
|
|
|
|
|
uint32_t offset = 0;
|
|
|
|
|
PrintStringsToBuffer(keybuf, &offset,
|
|
|
|
|
sizeof(keybuf),
|
|
|
|
|
fv->key, fv->keylen);
|
|
|
|
|
PrintStringsToBuffer(keybuf, &offset, fv->keylen + 1, fv->key, fv->keylen);
|
|
|
|
|
|
|
|
|
|
uint32_t len = fv->data.fv_str.value_len;
|
|
|
|
|
uint8_t printable_buf[len + 1];
|
|
|
|
|
offset = 0;
|
|
|
|
|
PrintStringsToBuffer(printable_buf, &offset,
|
|
|
|
|
sizeof(printable_buf),
|
|
|
|
|
fv->data.fv_str.value, fv->data.fv_str.value_len);
|
|
|
|
|
PrintStringsToBuffer(printable_buf, &offset, len + 1, fv->data.fv_str.value,
|
|
|
|
|
fv->data.fv_str.value_len);
|
|
|
|
|
|
|
|
|
|
jb_start_object(js_flowvars);
|
|
|
|
|
jb_set_string(js_flowvars, (const char *)keybuf, (char *)printable_buf);
|
|
|
|
@ -429,9 +419,9 @@ void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, c
|
|
|
|
|
* \param js JSON object
|
|
|
|
|
* \param max_length If non-zero, restricts the number of packet data bytes handled.
|
|
|
|
|
*/
|
|
|
|
|
void EvePacket(const Packet *p, JsonBuilder *js, unsigned long max_length)
|
|
|
|
|
void EvePacket(const Packet *p, JsonBuilder *js, uint32_t max_length)
|
|
|
|
|
{
|
|
|
|
|
unsigned long max_len = max_length == 0 ? GET_PKT_LEN(p) : max_length;
|
|
|
|
|
uint32_t max_len = max_length == 0 ? GET_PKT_LEN(p) : max_length;
|
|
|
|
|
jb_set_base64(js, "packet", GET_PKT_DATA(p), max_len);
|
|
|
|
|
|
|
|
|
|
if (!jb_open_object(js, "packet_info")) {
|
|
|
|
@ -931,7 +921,8 @@ int OutputJSONMemBufferCallback(const char *str, size_t size, void *data)
|
|
|
|
|
MemBufferExpand(memb, wrapper->expand_by);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
MemBufferWriteRaw((*memb), (const uint8_t *)str, size);
|
|
|
|
|
DEBUG_VALIDATE_BUG_ON(size > UINT32_MAX);
|
|
|
|
|
MemBufferWriteRaw((*memb), (const uint8_t *)str, (uint32_t)size);
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
@ -985,11 +976,12 @@ int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
size_t jslen = jb_len(js);
|
|
|
|
|
DEBUG_VALIDATE_BUG_ON(jb_len(js) > UINT32_MAX);
|
|
|
|
|
if (MEMBUFFER_OFFSET(*buffer) + jslen >= MEMBUFFER_SIZE(*buffer)) {
|
|
|
|
|
MemBufferExpand(buffer, jslen);
|
|
|
|
|
MemBufferExpand(buffer, (uint32_t)jslen);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
MemBufferWriteRaw((*buffer), jb_ptr(js), jslen);
|
|
|
|
|
MemBufferWriteRaw((*buffer), jb_ptr(js), (uint32_t)jslen);
|
|
|
|
|
LogFileWrite(file_ctx, *buffer);
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
@ -1144,7 +1136,7 @@ OutputInitResult OutputJsonInitCtx(ConfNode *conf)
|
|
|
|
|
{
|
|
|
|
|
FatalError("Failed to allocate memory for eve-log.prefix setting.");
|
|
|
|
|
}
|
|
|
|
|
json_ctx->file_ctx->prefix_len = strlen(prefix);
|
|
|
|
|
json_ctx->file_ctx->prefix_len = (uint32_t)strlen(prefix);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Threaded file output */
|
|
|
|
|