output/json: Include fileinfo in alerts

This commit adds fileinfo to alerts when `metadata` is configured.

src/output-json-alert.c

@@ -565,6 +565,31 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
             }
         }
 
+        /* including fileinfo data is configured by the metadata setting */
+        if (json_output_ctx->flags & LOG_JSON_RULE_METADATA) {
+            FileContainer *ffc = AppLayerParserGetFiles(p->flow,
+                    p->flowflags & FLOW_PKT_TOSERVER ? STREAM_TOSERVER:STREAM_TOCLIENT);
+            if (ffc != NULL) {
+                File *file = ffc->head;
+                bool isopen = false;
+                while (file) {
+                    if (pa->tx_id == file->txid) {
+                        if (!isopen) {
+                            isopen = true;
+                            jb_open_array(jb, "fileinfo");
+                        }
+                        jb_start_object(jb);
+                        EveFileInfo(jb, file, file->flags & FILE_STORED);
+                        jb_close(jb);
+                    }
+                    file = file->next;
+                }
+                if (isopen) {
+                    jb_close(jb);
+                }
+            }
+        }
+
         if (p->flow) {
             EveAddAppProto(p->flow, jb);
             if (json_output_ctx->flags & LOG_JSON_FLOW) {

src/output-json-file.c

@@ -174,7 +174,9 @@ JsonBuilder *JsonBuildFileInfoRecord(const Packet *p, const File *ff,
 
     jb_set_string(js, "app_proto", AppProtoToString(p->flow->alproto));
 
-    JsonFileInfo(js, ff, stored);
+    jb_open_object(js, "fileinfo");
+    EveFileInfo(js, ff, stored);
+    jb_close(js);
 
     /* xff header */
     if (have_xff_ip && xff_cfg->flags & XFF_EXTRADATA) {

src/output-json.c

@@ -152,30 +152,27 @@ json_t *JsonAddStringN(const char *string, size_t size)
     return SCJsonString(tmpbuf);
 }
 
-void JsonFileInfo(JsonBuilder *js, const File *ff, const bool stored)
+void EveFileInfo(JsonBuilder *jb, const File *ff, const bool stored)
 {
-    /* Open the fileinfo object. */
-    jb_open_object(js, "fileinfo");
-
     size_t filename_size = ff->name_len * 2 + 1;
     char filename_string[filename_size];
     BytesToStringBuffer(ff->name, ff->name_len, filename_string, filename_size);
-    jb_set_string(js, "filename", filename_string);
+    jb_set_string(jb, "filename", filename_string);
 
-    jb_open_array(js, "sid");
+    jb_open_array(jb, "sid");
     for (uint32_t i = 0; ff->sid != NULL && i < ff->sid_cnt; i++) {
-        jb_append_uint(js, ff->sid[i]);
+        jb_append_uint(jb, ff->sid[i]);
     }
-    jb_close(js);
+    jb_close(jb);
 
 #ifdef HAVE_MAGIC
     if (ff->magic)
-        jb_set_string(js, "magic", (char *)ff->magic);
+        jb_set_string(jb, "magic", (char *)ff->magic);
 #endif
-    jb_set_bool(js, "gaps", ff->flags & FILE_HAS_GAPS);
+    jb_set_bool(jb, "gaps", ff->flags & FILE_HAS_GAPS);
     switch (ff->state) {
         case FILE_STATE_CLOSED:
-            jb_set_string(js, "state", "CLOSED");
+            JB_SET_STRING(jb, "state", "CLOSED");
 #ifdef HAVE_NSS
             if (ff->flags & FILE_MD5) {
                 size_t x;
@@ -184,7 +181,7 @@ void JsonFileInfo(JsonBuilder *js, const File *ff, const bool stored)
                 for (i = 0, x = 0; x < sizeof(ff->md5); x++) {
                     i += snprintf(&str[i], 255-i, "%02x", ff->md5[x]);
                 }
-                jb_set_string(js, "md5", str);
+                jb_set_string(jb, "md5", str);
             }
             if (ff->flags & FILE_SHA1) {
                 size_t x;
@@ -193,18 +190,18 @@ void JsonFileInfo(JsonBuilder *js, const File *ff, const bool stored)
                 for (i = 0, x = 0; x < sizeof(ff->sha1); x++) {
                     i += snprintf(&str[i], 255-i, "%02x", ff->sha1[x]);
                 }
-                jb_set_string(js, "sha1", str);
+                jb_set_string(jb, "sha1", str);
             }
 #endif
             break;
         case FILE_STATE_TRUNCATED:
-            JB_SET_STRING(js, "state", "TRUNCATED");
+            JB_SET_STRING(jb, "state", "TRUNCATED");
             break;
         case FILE_STATE_ERROR:
-            JB_SET_STRING(js, "state", "ERROR");
+            JB_SET_STRING(jb, "state", "ERROR");
             break;
         default:
-            JB_SET_STRING(js, "state", "UNKNOWN");
+            JB_SET_STRING(jb, "state", "UNKNOWN");
             break;
     }
 
@@ -216,26 +213,23 @@ void JsonFileInfo(JsonBuilder *js, const File *ff, const bool stored)
         for (i = 0, x = 0; x < sizeof(ff->sha256); x++) {
             i += snprintf(&str[i], 255-i, "%02x", ff->sha256[x]);
         }
-        jb_set_string(js, "sha256", str);
+        jb_set_string(jb, "sha256", str);
     }
 #endif
 
     if (stored) {
-        jb_set_bool(js, "stored", true);
+        JB_SET_TRUE(jb, "stored");
-        jb_set_uint(js, "file_id", ff->file_store_id);
+        jb_set_uint(jb, "file_id", ff->file_store_id);
     } else {
-        jb_set_bool(js, "stored", false);
+        JB_SET_FALSE(jb, "stored");
     }
 
-    jb_set_uint(js, "size", FileTrackedSize(ff));
+    jb_set_uint(jb, "size", FileTrackedSize(ff));
     if (ff->end > 0) {
-        jb_set_uint(js, "start", ff->start);
+        jb_set_uint(jb, "start", ff->start);
-        jb_set_uint(js, "end", ff->end);
+        jb_set_uint(jb, "end", ff->end);
     }
-    jb_set_uint(js, "tx_id", ff->txid);
+    jb_set_uint(jb, "tx_id", ff->txid);
-
-    /* Close fileinfo object */
-    jb_close(js);
 }
 
 static void JsonAddPacketvars(const Packet *p, json_t *js_vars)

src/output-json.h

@@ -72,7 +72,7 @@ int OutputJSONMemBufferCallback(const char *str, size_t size, void *data);
 void CreateJSONFlowId(json_t *js, const Flow *f);
 void CreateEveFlowId(JsonBuilder *js, const Flow *f);
 void JsonTcpFlags(uint8_t flags, json_t *js);
-void JsonFileInfo(JsonBuilder *js, const File *file, const bool stored);
+void EveFileInfo(JsonBuilder *js, const File *file, const bool stored);
 void EveTcpFlags(uint8_t flags, JsonBuilder *js);
 void JsonPacket(const Packet *p, json_t *js, unsigned long max_length);
 void EvePacket(const Packet *p, JsonBuilder *js, unsigned long max_length);