]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
file-json: log 'email' information
authorEric Leblond <eric@regit.org>
Thu, 30 Apr 2015 13:24:52 +0000 (15:24 +0200)
committerEric Leblond <eric@regit.org>
Fri, 2 Oct 2015 20:57:58 +0000 (22:57 +0200)
Log information coming from email/MIME decoding in the message.

src/output-json-file.c

index 8e1ea7796a784f5db91172bff928970eb3bdca84..615ae596e86c55dc37aab6936733295c44d1701c 100644 (file)
 #include "util-buffer.h"
 #include "util-byte.h"
 
+#include "log-file.h"
+#include "util-logopenfile.h"
+
 #include "output.h"
 #include "output-json.h"
 #include "output-json-http.h"
 #include "output-json-smtp.h"
-
-#include "log-file.h"
-#include "util-logopenfile.h"
+#include "output-json-email-common.h"
 
 #include "app-layer-htp.h"
 #include "util-memcmp.h"
@@ -101,6 +102,9 @@ static void FileWriteJsonRecord(JsonFileLogThread *aft, const Packet *p, const F
             hjs = JsonSMTPAddMetadata(p->flow);
             if (hjs)
                 json_object_set_new(js, "smtp", hjs);
+            hjs = JsonEmailAddMetadata(p->flow);
+            if (hjs)
+                json_object_set_new(js, "email", hjs);
             break;
     }
 
@@ -164,6 +168,7 @@ static void FileWriteJsonRecord(JsonFileLogThread *aft, const Packet *p, const F
             break;
         case ALPROTO_SMTP:
             json_object_del(js, "smtp");
+            json_object_del(js, "email");
             break;
     }