eve/frame: implement payload-buffer-size option

Modeled after the same option in eve/alert. Defaults to 4k.

(cherry picked from commit 829bab295b1bdf58c7df00a62b2d083294744b5c)

diff --git a/src/output-json-frame.c b/src/output-json-frame.c
index d23ba92ac380183bb7199c89ae3ba2e79d6d0ff2..2d7c6c6c6bd13a5acb9cfe3444a102d7a93f5b6c 100644 (file)
--- a/src/output-json-frame.c
+++ b/src/output-json-frame.c
@@ -483,8 +483,22 @@ static OutputInitResult JsonFrameLogInitCtxSub(ConfNode *conf, OutputCtx *parent
     }
     memset(json_output_ctx, 0, sizeof(FrameJsonOutputCtx));
 
+    uint32_t payload_buffer_size = 4096;
+    if (conf != NULL) {
+        const char *payload_buffer_value = ConfNodeLookupChildValue(conf, "payload-buffer-size");
+        if (payload_buffer_value != NULL) {
+            uint32_t value;
+            if (ParseSizeStringU32(payload_buffer_value, &value) < 0) {
+                SCLogError("Error parsing payload-buffer-size \"%s\"", payload_buffer_value);
+                goto error;
+            }
+            payload_buffer_size = value;
+        }
+    }
+
     json_output_ctx->file_ctx = ajt->file_ctx;
     json_output_ctx->eve_ctx = ajt;
+    json_output_ctx->payload_buffer_size = payload_buffer_size;
 
     output_ctx->data = json_output_ctx;
     output_ctx->DeInit = JsonFrameLogDeInitCtxSub;

diff --git a/suricata.yaml.in b/suricata.yaml.in
index 458360b1e64f691fbc9b6e91a34d170d5ebfd7e9..8bfbaac356c75ed620e5d72c811b0284e428c94b 100644 (file)
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -176,6 +176,7 @@ outputs:
         - frame:
             # disabled by default as this is very verbose.
             enabled: no
+            # payload-buffer-size: 4kb # max size of frame payload buffer to output in eve-log
         - anomaly:
             # Anomaly log records describe unexpected conditions such
             # as truncated packets, packets with invalid IP/UDP/TCP