From fed9b7a180177bd373641f17801b79ff34f087a8 Mon Sep 17 00:00:00 2001
From: Mark Janssen <mark@praseodym.net>
Date: Thu, 24 Jan 2019 21:48:21 +0100
Subject: [PATCH] eve/flow: add vlan field

---
 src/flow-util.c           |  1 -
 src/flow.h                |  1 -
 src/output-json-flow.c    | 30 ++++++++----------------------
 src/output-json-netflow.c | 30 ++++++++----------------------
 4 files changed, 16 insertions(+), 46 deletions(-)

diff --git a/src/flow-util.c b/src/flow-util.c
index 0e254f32d7..0dc08a6d57 100644
--- a/src/flow-util.c
+++ b/src/flow-util.c
@@ -203,4 +203,3 @@ void FlowInit(Flow *f, const Packet *p)
 
     SCReturn;
 }
-
diff --git a/src/flow.h b/src/flow.h
index 3d774338da..aac932bf79 100644
--- a/src/flow.h
+++ b/src/flow.h
@@ -627,4 +627,3 @@ uint8_t FlowGetDisruptionFlags(const Flow *f, uint8_t flags);
 void FlowHandlePacketUpdate(Flow *f, Packet *p);
 
 #endif /* __FLOW_H__ */
-
diff --git a/src/output-json-flow.c b/src/output-json-flow.c
index 2cb862d087..04e05a1c47 100644
--- a/src/output-json-flow.c
+++ b/src/output-json-flow.c
@@ -121,31 +121,17 @@ static json_t *CreateJSONHeaderFromFlow(const Flow *f, const char *event_type)
     if (event_type) {
         json_object_set_new(js, "event_type", json_string(event_type));
     }
-#if 0
+
     /* vlan */
-    if (f->vlan_id[0] > 0) {
-        json_t *js_vlan;
-        switch (f->vlan_idx) {
-            case 1:
-                json_object_set_new(js, "vlan",
-                                    json_integer(f->vlan_id[0]));
-                break;
-            case 2:
-                js_vlan = json_array();
-                if (unlikely(js != NULL)) {
-                    json_array_append_new(js_vlan,
-                                    json_integer(VLAN_GET_ID1(p)));
-                    json_array_append_new(js_vlan,
-                                    json_integer(VLAN_GET_ID2(p)));
-                    json_object_set_new(js, "vlan", js_vlan);
-                }
-                break;
-            default:
-                /* shouldn't get here */
-                break;
+    if (f->vlan_idx > 0) {
+        json_t *js_vlan = json_array();
+        json_array_append_new(js_vlan, json_integer(f->vlan_id[0]));
+        if (f->vlan_idx > 1) {
+            json_array_append_new(js_vlan, json_integer(f->vlan_id[1]));
         }
+        json_object_set_new(js, "vlan", js_vlan);
     }
-#endif
+
     /* tuple */
     json_object_set_new(js, "src_ip", json_string(srcip));
     switch(f->proto) {
diff --git a/src/output-json-netflow.c b/src/output-json-netflow.c
index ef86c3abe3..e00029943f 100644
--- a/src/output-json-netflow.c
+++ b/src/output-json-netflow.c
@@ -129,31 +129,17 @@ static json_t *CreateJSONHeaderFromFlow(const Flow *f, const char *event_type, i
     if (event_type) {
         json_object_set_new(js, "event_type", json_string(event_type));
     }
-#if 0
+
     /* vlan */
-    if (f->vlan_id[0] > 0) {
-        json_t *js_vlan;
-        switch (f->vlan_idx) {
-            case 1:
-                json_object_set_new(js, "vlan",
-                                    json_integer(f->vlan_id[0]));
-                break;
-            case 2:
-                js_vlan = json_array();
-                if (unlikely(js != NULL)) {
-                    json_array_append_new(js_vlan,
-                                    json_integer(VLAN_GET_ID1(p)));
-                    json_array_append_new(js_vlan,
-                                    json_integer(VLAN_GET_ID2(p)));
-                    json_object_set_new(js, "vlan", js_vlan);
-                }
-                break;
-            default:
-                /* shouldn't get here */
-                break;
+    if (f->vlan_idx > 0) {
+        json_t *js_vlan = json_array();
+        json_array_append_new(js_vlan, json_integer(f->vlan_id[0]));
+        if (f->vlan_idx > 1) {
+            json_array_append_new(js_vlan, json_integer(f->vlan_id[1]));
         }
+        json_object_set_new(js, "vlan", js_vlan);
     }
-#endif
+
     /* tuple */
     json_object_set_new(js, "src_ip", json_string(srcip));
     switch(f->proto) {