ikev1: add metadata to alerts

diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index abc77b67664070e40e015ffc6b045b58090a58bb..52e8312ddcaa545832a8386b79b52da765e02dab 100644 (file)
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -71,6 +71,7 @@
 #include "output-json-sip.h"
 #include "output-json-rfb.h"
 #include "output-json-mqtt.h"
+#include "output-json-ike.h"
 
 #include "util-byte.h"
 #include "util-privs.h"
@@ -530,6 +531,12 @@ static void AlertAddAppLayer(const Packet *p, JsonBuilder *jb,
         case ALPROTO_DNS:
             AlertJsonDns(p->flow, tx_id, jb);
             break;
+        case ALPROTO_IKE:
+            jb_get_mark(jb, &mark);
+            if (!EveIKEAddMetadata(p->flow, tx_id, jb)) {
+                jb_restore_mark(jb, &mark);
+            }
+            break;
         case ALPROTO_MQTT:
             jb_get_mark(jb, &mark);
             if (!JsonMQTTAddMetadata(p->flow, tx_id, jb)) {

diff --git a/src/output-json-ike.c b/src/output-json-ike.c
index 165ffa62a4cbec1740bafe290e717f6463dcb78d..8ed200ecfa0ca56992ea332927d451b1d29601be 100644 (file)
--- a/src/output-json-ike.c
+++ b/src/output-json-ike.c
@@ -64,6 +64,19 @@ typedef struct LogIKELogThread_ {
     MemBuffer *buffer;
 } LogIKELogThread;
 
+bool EveIKEAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js)
+{
+    IKEState *state = FlowGetAppState(f);
+    if (state) {
+        IKETransaction *tx = AppLayerParserGetTx(f->proto, ALPROTO_IKE, state, tx_id);
+        if (tx) {
+            return rs_ike_logger_log(state, tx, LOG_IKE_EXTENDED, js);
+        }
+    }
+
+    return false;
+}
+
 static int JsonIKELogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state,
         void *tx, uint64_t tx_id)
 {

diff --git a/src/output-json-ike.h b/src/output-json-ike.h
index d02c89608eb9b9974cd042f56b7fceed63e60a3c..af5188b19eaec313c71de9eb8a8f7612f97022ce 100644 (file)
--- a/src/output-json-ike.h
+++ b/src/output-json-ike.h
@@ -26,4 +26,6 @@
 
 void JsonIKELogRegister(void);
 
+bool EveIKEAddMetadata(const Flow *f, uint64_t tx_id, JsonBuilder *js);
+
 #endif /* __OUTPUT_JSON_IKE_H__ */