eve: mac logging code cleanup

pull/8042/head
Victor Julien 3 years ago
parent 2d79a5206b
commit 99fd69ee8c

@ -79,6 +79,7 @@
static void OutputJsonDeInitCtx(OutputCtx *);
static void CreateEveCommunityFlowId(JsonBuilder *js, const Flow *f, const uint16_t seed);
static int CreateJSONEther(JsonBuilder *parent, const Packet *p, const Flow *f);
static const char *TRAFFIC_ID_PREFIX = "traffic/id/";
static const char *TRAFFIC_LABEL_PREFIX = "traffic/label/";
@ -408,8 +409,6 @@ void EveAddMetadata(const Packet *p, const Flow *f, JsonBuilder *js)
}
}
int CreateJSONEther(JsonBuilder *parent, const Packet *p, const Flow *f);
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg,
const Packet *p, const Flow *f, JsonBuilder *js)
{
@ -753,23 +752,24 @@ static int MacSetIterateToJSON(uint8_t *val, MacSetSide side, void *data)
return 0;
}
int CreateJSONEther(JsonBuilder *js, const Packet *p, const Flow *f)
static int CreateJSONEther(JsonBuilder *js, const Packet *p, const Flow *f)
{
if (unlikely(js == NULL))
return 0;
/* start new EVE sub-object */
jb_open_object(js, "ether");
if (p == NULL) {
MacSet *ms = NULL;
/* ensure we have a flow */
if (unlikely(f == NULL)) {
if (p != NULL) {
/* this is a packet context, so we need to add scalar fields */
if (p->ethh != NULL) {
jb_open_object(js, "ether");
uint8_t *src = p->ethh->eth_src;
uint8_t *dst = p->ethh->eth_dst;
JSONFormatAndAddMACAddr(js, "src_mac", src, false);
JSONFormatAndAddMACAddr(js, "dest_mac", dst, false);
jb_close(js);
return 0;
}
} else if (f != NULL) {
/* we are creating an ether object in a flow context, so we need to
append to arrays */
ms = FlowGetStorageById((Flow *)f, MacSetGetFlowStorageID());
MacSet *ms = FlowGetStorageById((Flow *)f, MacSetGetFlowStorageID());
if (ms != NULL && MacSetSize(ms) > 0) {
jb_open_object(js, "ether");
JSONMACAddrInfo info;
info.dst = jb_new_array();
info.src = jb_new_array();
@ -787,17 +787,9 @@ int CreateJSONEther(JsonBuilder *js, const Packet *p, const Flow *f)
jb_set_object(js, "src_macs", info.src);
jb_free(info.dst);
jb_free(info.src);
}
} else {
/* this is a packet context, so we need to add scalar fields */
if (p->ethh != NULL) {
uint8_t *src = p->ethh->eth_src;
uint8_t *dst = p->ethh->eth_dst;
JSONFormatAndAddMACAddr(js, "src_mac", src, false);
JSONFormatAndAddMACAddr(js, "dest_mac", dst, false);
jb_close(js);
}
}
jb_close(js);
return 0;
}

Loading…
Cancel
Save