|
|
|
|
@ -133,11 +133,12 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
|
|
|
|
|
json_object_set_new(js, "alert", ajs);
|
|
|
|
|
|
|
|
|
|
/* payload */
|
|
|
|
|
if (aft->file_ctx->flags & LOG_JSON_PAYLOAD)
|
|
|
|
|
{
|
|
|
|
|
if (aft->file_ctx->flags & LOG_JSON_PAYLOAD) {
|
|
|
|
|
int stream = (p->proto == IPPROTO_TCP) ?
|
|
|
|
|
(pa->flags & (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_STREAM_MATCH) ?
|
|
|
|
|
1 : 0) : 0;
|
|
|
|
|
/* Is this a stream? If so, pack part of it into the payload field */
|
|
|
|
|
if (pa->flags & PACKET_ALERT_FLAG_STREAM_MATCH && PKT_IS_TCP(p) && p->flow != NULL && p->flow->protoctx != NULL)
|
|
|
|
|
{
|
|
|
|
|
if (stream) {
|
|
|
|
|
uint8_t flag;
|
|
|
|
|
|
|
|
|
|
#define JSON_STREAM_BUFFER_SIZE 4096
|
|
|
|
|
@ -153,15 +154,15 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
|
|
|
|
|
StreamSegmentForEach((const Packet *)p, flag,
|
|
|
|
|
AlertJsonPrintStreamSegmentCallback,
|
|
|
|
|
(void *)payload);
|
|
|
|
|
json_object_set_new(js, "payload", json_string((char *)payload->buffer));
|
|
|
|
|
json_object_set_new(js, "payload",
|
|
|
|
|
json_string((char *)payload->buffer));
|
|
|
|
|
json_object_set_new(js, "stream", json_integer(1));
|
|
|
|
|
}
|
|
|
|
|
} else {
|
|
|
|
|
/* This is a single packet and not a stream */
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
char payload[p->payload_len + 1];
|
|
|
|
|
uint32_t offset = 0;
|
|
|
|
|
PrintStringsToBuffer((uint8_t *)payload, &offset, p->payload_len + 1,
|
|
|
|
|
PrintStringsToBuffer((uint8_t *)payload, &offset,
|
|
|
|
|
p->payload_len + 1,
|
|
|
|
|
p->payload, p->payload_len);
|
|
|
|
|
json_object_set_new(js, "payload", json_string(payload));
|
|
|
|
|
json_object_set_new(js, "stream", json_integer(0));
|
|
|
|
|
@ -169,15 +170,13 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* base64-encoded full packet */
|
|
|
|
|
if (aft->file_ctx->flags & LOG_JSON_PACKET)
|
|
|
|
|
{
|
|
|
|
|
if (aft->file_ctx->flags & LOG_JSON_PACKET) {
|
|
|
|
|
unsigned long len = GET_PKT_LEN(p) * 2;
|
|
|
|
|
unsigned char encoded_packet[len];
|
|
|
|
|
Base64Encode((unsigned char*) GET_PKT_DATA(p), GET_PKT_LEN(p), encoded_packet, &len);
|
|
|
|
|
json_object_set_new(js, "packet", json_string((char *)encoded_packet));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
OutputJSONBuffer(js, aft->file_ctx, aft->buffer);
|
|
|
|
|
json_object_del(js, "alert");
|
|
|
|
|
}
|
|
|
|
|
|