aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

eve/frames: pass membuffer to API

Browse Source 
In preparation of stream logging changes.
pull/10654/head
Victor Julien 1 year ago committed by Victor Julien
parent 462a6d7913
commit a205583269
3 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File

9
src/output-json-alert.c
Unescape Escape View File

@ -404,7 +404,8 @@ static void AlertAddFiles(const Packet *p, JsonBuilder *jb, const uint64_t tx_id
} }
} }
static void AlertAddFrame(const Packet *p, JsonBuilder *jb, const int64_t frame_id) static void AlertAddFrame(
const Packet *p, const int64_t frame_id, JsonBuilder *jb, MemBuffer *buffer)
{ {
if (p->flow == NULL || (p->proto == IPPROTO_TCP && p->flow->protoctx == NULL)) if (p->flow == NULL || (p->proto == IPPROTO_TCP && p->flow->protoctx == NULL))
return; return;
@ -426,7 +427,7 @@ static void AlertAddFrame(const Packet *p, JsonBuilder *jb, const int64_t frame_
} }
Frame *frame = FrameGetById(frames, frame_id); Frame *frame = FrameGetById(frames, frame_id);
if (frame != NULL) { if (frame != NULL) {
FrameJsonLogOneFrame(IPPROTO_TCP, frame, p->flow, stream, p, jb); FrameJsonLogOneFrame(IPPROTO_TCP, frame, p->flow, stream, p, jb, buffer);
} }
} else if (p->proto == IPPROTO_UDP) { } else if (p->proto == IPPROTO_UDP) {
if (PKT_IS_TOSERVER(p)) { if (PKT_IS_TOSERVER(p)) {
@ -436,7 +437,7 @@ static void AlertAddFrame(const Packet *p, JsonBuilder *jb, const int64_t frame_
} }
Frame *frame = FrameGetById(frames, frame_id); Frame *frame = FrameGetById(frames, frame_id);
if (frame != NULL) { if (frame != NULL) {
FrameJsonLogOneFrame(IPPROTO_UDP, frame, p->flow, NULL, p, jb); FrameJsonLogOneFrame(IPPROTO_UDP, frame, p->flow, NULL, p, jb, buffer);
} }
} }
} }
@ -672,7 +673,7 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
} }
if (pa->flags & PACKET_ALERT_FLAG_FRAME) { if (pa->flags & PACKET_ALERT_FLAG_FRAME) {
AlertAddFrame(p, jb, pa->frame_id); AlertAddFrame(p, pa->frame_id, jb, aft->payload_buffer);
} }
/* base64-encoded full packet */ /* base64-encoded full packet */

6
src/output-json-frame.c
Unescape Escape View File

@ -224,7 +224,7 @@ static void FrameAddPayloadUDP(JsonBuilder *js, const Packet *p, const Frame *fr
* \note ipproto argument is passed to assist static code analyzers * \note ipproto argument is passed to assist static code analyzers
*/ */
void FrameJsonLogOneFrame(const uint8_t ipproto, const Frame *frame, const Flow *f, void FrameJsonLogOneFrame(const uint8_t ipproto, const Frame *frame, const Flow *f,
const TcpStream *stream, const Packet *p, JsonBuilder *jb) const TcpStream *stream, const Packet *p, JsonBuilder *jb, MemBuffer *buffer)
{ {
DEBUG_VALIDATE_BUG_ON(ipproto != p->proto); DEBUG_VALIDATE_BUG_ON(ipproto != p->proto);
DEBUG_VALIDATE_BUG_ON(ipproto != f->proto); DEBUG_VALIDATE_BUG_ON(ipproto != f->proto);
@ -287,7 +287,7 @@ static int FrameJsonUdp(
return TM_ECODE_OK; return TM_ECODE_OK;
jb_set_string(jb, "app_proto", AppProtoToString(f->alproto)); jb_set_string(jb, "app_proto", AppProtoToString(f->alproto));
FrameJsonLogOneFrame(IPPROTO_UDP, frame, p->flow, NULL, p, jb); FrameJsonLogOneFrame(IPPROTO_UDP, frame, p->flow, NULL, p, jb, aft->payload_buffer);
OutputJsonBuilderBuffer(jb, aft->ctx); OutputJsonBuilderBuffer(jb, aft->ctx);
jb_free(jb); jb_free(jb);
frame->flags |= FRAME_FLAG_LOGGED; frame->flags |= FRAME_FLAG_LOGGED;
@ -359,7 +359,7 @@ static int FrameJson(ThreadVars *tv, JsonFrameLogThread *aft, const Packet *p)
return TM_ECODE_OK; return TM_ECODE_OK;
jb_set_string(jb, "app_proto", AppProtoToString(p->flow->alproto)); jb_set_string(jb, "app_proto", AppProtoToString(p->flow->alproto));
FrameJsonLogOneFrame(IPPROTO_TCP, frame, p->flow, stream, p, jb); FrameJsonLogOneFrame(IPPROTO_TCP, frame, p->flow, stream, p, jb, aft->payload_buffer);
OutputJsonBuilderBuffer(jb, aft->ctx); OutputJsonBuilderBuffer(jb, aft->ctx);
jb_free(jb); jb_free(jb);
frame->flags |= FRAME_FLAG_LOGGED; frame->flags |= FRAME_FLAG_LOGGED;

2
src/output-json-frame.h
Unescape Escape View File

@ -31,7 +31,7 @@
#include "stream-tcp-private.h" #include "stream-tcp-private.h"
void FrameJsonLogOneFrame(const uint8_t ipproto, const Frame *frame, const Flow *f, void FrameJsonLogOneFrame(const uint8_t ipproto, const Frame *frame, const Flow *f,
const TcpStream *stream, const Packet *p, JsonBuilder *jb); const TcpStream *stream, const Packet *p, JsonBuilder *jb, MemBuffer *);
void JsonFrameLogRegister(void); void JsonFrameLogRegister(void);
#endif /* SURICATA_OUTPUT_JSON_FRAME_H */ #endif /* SURICATA_OUTPUT_JSON_FRAME_H */

Write Preview
Loading…
Cancel
Save