eve/alert: clean up state logging

src/output-json-alert.c

@@ -324,40 +324,48 @@ static void AlertAddPayload(AlertJsonOutputCtx *json_output_ctx, SCJsonBuilder *
     }
 }
 
-static void AlertAddAppLayer(const Packet *p, SCJsonBuilder *jb, const uint64_t tx_id,
+static void AlertAddAppLayerStates(const Packet *p, const AppProto alproto, const uint8_t sub_state,
-        const uint8_t sub_state, const uint16_t option_flags)
+        void *tx, SCJsonBuilder *jb)
 {
-    const AppProto proto = SCFlowGetAppProtocol(p->flow);
+    const int ts = AppLayerParserGetStateProgress(p->flow->proto, alproto, tx, STREAM_TOSERVER);
-    EveJsonSimpleAppLayerLogger *al = SCEveJsonSimpleGetLogger(proto);
+    const int tc = AppLayerParserGetStateProgress(p->flow->proto, alproto, tx, STREAM_TOCLIENT);
-    SCJsonBuilderMark mark = { 0, 0, 0 };
-    if (al && al->LogTx) {
-        void *state = FlowGetAppState(p->flow);
-        if (state) {
-            void *tx = AppLayerParserGetTx(p->flow->proto, proto, state, tx_id);
-            if (tx) {
-                const int ts =
-                        AppLayerParserGetStateProgress(p->flow->proto, proto, tx, STREAM_TOSERVER);
-                const int tc =
-                        AppLayerParserGetStateProgress(p->flow->proto, proto, tx, STREAM_TOCLIENT);
     SCJbSetString(jb, "ts_progress",
-                        AppLayerParserGetStateNameById(p->flow->proto, proto, ts, STREAM_TOSERVER));
+            AppLayerParserGetStateNameById(p->flow->proto, alproto, ts, STREAM_TOSERVER));
     SCJbSetString(jb, "tc_progress",
-                        AppLayerParserGetStateNameById(p->flow->proto, proto, tc, STREAM_TOCLIENT));
+            AppLayerParserGetStateNameById(p->flow->proto, alproto, tc, STREAM_TOCLIENT));
     if (sub_state) {
-                    const char *sname = AppLayerParserGetSubStateName(proto, sub_state);
+        const char *sname = AppLayerParserGetSubStateName(alproto, sub_state);
         if (sname != NULL) {
             SCJbSetString(jb, "sub_state", sname);
         }
     }
+}
+
+static void AlertAddAppLayer(const Packet *p, SCJsonBuilder *jb, const uint64_t tx_id,
+        const uint8_t sub_state, const uint16_t option_flags)
+{
+    const AppProto proto = SCFlowGetAppProtocol(p->flow);
+    EveJsonSimpleAppLayerLogger *al = SCEveJsonSimpleGetLogger(proto);
+    void *state = FlowGetAppState(p->flow);
+    void *tx = NULL;
+    if (state) {
+        tx = AppLayerParserGetTx(p->flow->proto, proto, state, tx_id);
+    }
+    if (tx == NULL)
+        return;
 
+    AlertAddAppLayerStates(p, proto, sub_state, tx, jb);
+
+    SCJsonBuilderMark mark = { 0, 0, 0 };
+    if (al && al->LogTx) {
         SCJbGetMark(jb, &mark);
         switch (proto) {
             // first check some protocols need special options for alerts logging
             case ALPROTO_WEBSOCKET:
                 if (option_flags &
                         (LOG_JSON_WEBSOCKET_PAYLOAD | LOG_JSON_WEBSOCKET_PAYLOAD_BASE64)) {
-                            bool pp = (option_flags & LOG_JSON_WEBSOCKET_PAYLOAD) != 0;
+                    const bool pp = (option_flags & LOG_JSON_WEBSOCKET_PAYLOAD) != 0;
-                            bool pb64 = (option_flags & LOG_JSON_WEBSOCKET_PAYLOAD_BASE64) != 0;
+                    const bool pb64 = (option_flags & LOG_JSON_WEBSOCKET_PAYLOAD_BASE64) != 0;
                     if (!SCWebSocketLogDetails(tx, jb, pp, pb64)) {
                         SCJbRestoreMark(jb, &mark);
                     }
@@ -368,30 +376,9 @@ static void AlertAddAppLayer(const Packet *p, SCJsonBuilder *jb, const uint64_t
         if (!al->LogTx(tx, jb)) {
             SCJbRestoreMark(jb, &mark);
         }
-            }
-        }
         return;
     }
-    void *state = FlowGetAppState(p->flow);
+
-    if (state) {
-        void *tx = AppLayerParserGetTx(p->flow->proto, proto, state, tx_id);
-        if (tx) {
-            const int ts =
-                    AppLayerParserGetStateProgress(p->flow->proto, proto, tx, STREAM_TOSERVER);
-            const int tc =
-                    AppLayerParserGetStateProgress(p->flow->proto, proto, tx, STREAM_TOCLIENT);
-            SCJbSetString(jb, "ts_progress",
-                    AppLayerParserGetStateNameById(p->flow->proto, proto, ts, STREAM_TOSERVER));
-            SCJbSetString(jb, "tc_progress",
-                    AppLayerParserGetStateNameById(p->flow->proto, proto, tc, STREAM_TOCLIENT));
-            if (sub_state) {
-                const char *sname = AppLayerParserGetSubStateName(proto, sub_state);
-                if (sname != NULL) {
-                    SCJbSetString(jb, "sub_state", sname);
-                }
-            }
-        }
-    }
     switch (proto) {
         case ALPROTO_HTTP1:
             // TODO: Could result in an empty http object being logged.
@@ -455,10 +442,7 @@ static void AlertAddAppLayer(const Packet *p, SCJsonBuilder *jb, const uint64_t
                 SCJbRestoreMark(jb, &mark);
             }
             break;
-        case ALPROTO_DCERPC: {
+        case ALPROTO_DCERPC:
-            if (state) {
-                void *tx = AppLayerParserGetTx(p->flow->proto, proto, state, tx_id);
-                if (tx) {
             SCJbGetMark(jb, &mark);
             SCJbOpenObject(jb, "dcerpc");
             if (p->proto == IPPROTO_TCP) {
@@ -471,10 +455,7 @@ static void AlertAddAppLayer(const Packet *p, SCJsonBuilder *jb, const uint64_t
                 }
             }
             SCJbClose(jb);
-                }
-            }
             break;
-        }
         default:
             break;
     }