Fixed stream handling Fixed some coding style issues

pull/1020/merge
Alexander Gozman 12 years ago committed by Victor Julien
parent ab58ee2676
commit ffac6b71e2

@ -133,11 +133,12 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
json_object_set_new(js, "alert", ajs);
/* payload */
if (aft->file_ctx->flags & LOG_JSON_PAYLOAD)
{
if (aft->file_ctx->flags & LOG_JSON_PAYLOAD) {
int stream = (p->proto == IPPROTO_TCP) ?
(pa->flags & (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_STREAM_MATCH) ?
1 : 0) : 0;
/* Is this a stream? If so, pack part of it into the payload field */
if (pa->flags & PACKET_ALERT_FLAG_STREAM_MATCH && PKT_IS_TCP(p) && p->flow != NULL && p->flow->protoctx != NULL)
{
if (stream) {
uint8_t flag;
#define JSON_STREAM_BUFFER_SIZE 4096
@ -153,15 +154,15 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
StreamSegmentForEach((const Packet *)p, flag,
AlertJsonPrintStreamSegmentCallback,
(void *)payload);
json_object_set_new(js, "payload", json_string((char *)payload->buffer));
json_object_set_new(js, "payload",
json_string((char *)payload->buffer));
json_object_set_new(js, "stream", json_integer(1));
}
} else {
/* This is a single packet and not a stream */
else
{
char payload[p->payload_len + 1];
uint32_t offset = 0;
PrintStringsToBuffer((uint8_t *)payload, &offset, p->payload_len + 1,
PrintStringsToBuffer((uint8_t *)payload, &offset,
p->payload_len + 1,
p->payload, p->payload_len);
json_object_set_new(js, "payload", json_string(payload));
json_object_set_new(js, "stream", json_integer(0));
@ -169,15 +170,13 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
}
/* base64-encoded full packet */
if (aft->file_ctx->flags & LOG_JSON_PACKET)
{
if (aft->file_ctx->flags & LOG_JSON_PACKET) {
unsigned long len = GET_PKT_LEN(p) * 2;
unsigned char encoded_packet[len];
Base64Encode((unsigned char*) GET_PKT_DATA(p), GET_PKT_LEN(p), encoded_packet, &len);
json_object_set_new(js, "packet", json_string((char *)encoded_packet));
}
OutputJSONBuffer(js, aft->file_ctx, aft->buffer);
json_object_del(js, "alert");
}

@ -222,7 +222,9 @@ void PrintStringsToBuffer(uint8_t *dst_buf, uint32_t *dst_buf_offset_ptr, uint32
for (ch = 0; ch < src_buf_len; ch++) {
PrintBufferData((char *)dst_buf, dst_buf_offset_ptr, dst_buf_size,
"%c",
isprint((uint8_t)src_buf[ch]) || src_buf[ch] == '\n' || src_buf[ch] == '\r' ? (uint8_t)src_buf[ch] : '.');
(isprint((uint8_t)src_buf[ch]) ||
src_buf[ch] == '\n' ||
src_buf[ch] == '\r') ? (uint8_t)src_buf[ch] : '.');
}
return;

Loading…
Cancel
Save