aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

alert-json: clean up flags

Browse Source 
Make payload/packet logging code also use the flags field in
AlertJsonOutputCtx, instead of in the LogFileCtx.
pull/1098/head
Victor Julien 11 years ago
parent b188d93630
commit f453fb810f
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File

18
src/output-json-alert.c
Unescape Escape View File

@ -186,7 +186,7 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
} }
/* payload */ /* payload */
if (aft->file_ctx->flags & (LOG_JSON_PAYLOAD | LOG_JSON_PAYLOAD_BASE64)) { if (json_output_ctx->flags & (LOG_JSON_PAYLOAD | LOG_JSON_PAYLOAD_BASE64)) {
int stream = (p->proto == IPPROTO_TCP) ? int stream = (p->proto == IPPROTO_TCP) ?
(pa->flags & (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_STREAM_MATCH) ? (pa->flags & (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_STREAM_MATCH) ?
1 : 0) : 0; 1 : 0) : 0;
@ -207,14 +207,14 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
AlertJsonPrintStreamSegmentCallback, AlertJsonPrintStreamSegmentCallback,
(void *)payload); (void *)payload);
if (aft->file_ctx->flags & LOG_JSON_PAYLOAD_BASE64) { if (json_output_ctx->flags & LOG_JSON_PAYLOAD_BASE64) {
unsigned long len = JSON_STREAM_BUFFER_SIZE * 2; unsigned long len = JSON_STREAM_BUFFER_SIZE * 2;
unsigned char encoded[len]; unsigned char encoded[len];
Base64Encode((unsigned char *)payload, payload->offset, encoded, &len); Base64Encode((unsigned char *)payload, payload->offset, encoded, &len);
json_object_set_new(js, "payload", json_string((char *)encoded)); json_object_set_new(js, "payload", json_string((char *)encoded));
} }
if (aft->file_ctx->flags & LOG_JSON_PAYLOAD) { if (json_output_ctx->flags & LOG_JSON_PAYLOAD) {
json_object_set_new(js, "payload_printable", json_object_set_new(js, "payload_printable",
json_string((char *)payload->buffer)); json_string((char *)payload->buffer));
} }
@ -227,14 +227,14 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
p->payload_len + 1, p->payload_len + 1,
p->payload, p->payload_len); p->payload, p->payload_len);
if (aft->file_ctx->flags & LOG_JSON_PAYLOAD_BASE64) { if (json_output_ctx->flags & LOG_JSON_PAYLOAD_BASE64) {
unsigned long len = sizeof(packet_buf) * 2; unsigned long len = sizeof(packet_buf) * 2;
unsigned char encoded[len]; unsigned char encoded[len];
Base64Encode(packet_buf, offset, encoded, &len); Base64Encode(packet_buf, offset, encoded, &len);
json_object_set_new(js, "payload", json_string((char *)encoded)); json_object_set_new(js, "payload", json_string((char *)encoded));
} }
if (aft->file_ctx->flags & LOG_JSON_PAYLOAD) { if (json_output_ctx->flags & LOG_JSON_PAYLOAD) {
json_object_set_new(js, "payload_printable", json_string((char *)packet_buf)); json_object_set_new(js, "payload_printable", json_string((char *)packet_buf));
} }
} }
@ -243,7 +243,7 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
} }
/* base64-encoded full packet */ /* base64-encoded full packet */
if (aft->file_ctx->flags & LOG_JSON_PACKET) { if (json_output_ctx->flags & LOG_JSON_PACKET) {
unsigned long len = GET_PKT_LEN(p) * 2; unsigned long len = GET_PKT_LEN(p) * 2;
unsigned char encoded_packet[len]; unsigned char encoded_packet[len];
Base64Encode((unsigned char*) GET_PKT_DATA(p), GET_PKT_LEN(p), encoded_packet, &len); Base64Encode((unsigned char*) GET_PKT_DATA(p), GET_PKT_LEN(p), encoded_packet, &len);
@ -482,17 +482,17 @@ static OutputCtx *JsonAlertLogInitCtxSub(ConfNode *conf, OutputCtx *parent_ctx)
} }
if (payload_printable != NULL) { if (payload_printable != NULL) {
if (ConfValIsTrue(payload_printable)) { if (ConfValIsTrue(payload_printable)) {
json_output_ctx->file_ctx->flags |= LOG_JSON_PAYLOAD; json_output_ctx->flags |= LOG_JSON_PAYLOAD;
} }
} }
if (payload != NULL) { if (payload != NULL) {
if (ConfValIsTrue(payload)) { if (ConfValIsTrue(payload)) {
json_output_ctx->file_ctx->flags |= LOG_JSON_PAYLOAD_BASE64; json_output_ctx->flags |= LOG_JSON_PAYLOAD_BASE64;
} }
} }
if (packet != NULL) { if (packet != NULL) {
if (ConfValIsTrue(packet)) { if (ConfValIsTrue(packet)) {
json_output_ctx->file_ctx->flags |= LOG_JSON_PACKET; json_output_ctx->flags |= LOG_JSON_PACKET;
} }
} }
} }

Write Preview
Loading…
Cancel
Save