eve/flow: add per flow TCP oob urg data counter

If TCP urgent handling is set to the OOB processing, the number of OOB
bytes is tracked for SEQ offset calculations. If this offset is
non-zero, add the field to the flow record.

Ticket: #7411.
(cherry picked from commit 779f9d8ba35c3f9b5abfa327d3a4209861bd2eb8)

diff --git a/etc/schema.json b/etc/schema.json
index debdd274da86d0c2ef5e20d63a539f381b2ff33a..31e39dbdf9c958c3360c62b121afda5b3e808ec1 100644 (file)
--- a/etc/schema.json
+++ b/etc/schema.json
@@ -5365,6 +5365,10 @@
                 "tc_max_regions": {
                     "type": "integer"
                 },
+                "tc_urgent_oob_data": {
+                    "description": "Number of Out-of-Band bytes sent by server using TCP urgent packets",
+                    "type": "integer"
+                },
                 "tcp_flags": {
                     "type": "string"
                 },
@@ -5380,6 +5384,10 @@
                 "ts_max_regions": {
                     "type": "integer"
                 },
+                "ts_urgent_oob_data": {
+                    "description": "Number of Out-of-Band bytes sent by client using TCP urgent packets",
+                    "type": "integer"
+                },
                 "urg": {
                     "type": "boolean"
                 }

diff --git a/src/output-json-flow.c b/src/output-json-flow.c
index 487185f2ed5b7b5cbfa9f21b5f03dab20c5e3cb7..d31b6575e85caf908e808d61962690a7fa9c55da 100644 (file)
--- a/src/output-json-flow.c
+++ b/src/output-json-flow.c
@@ -317,6 +317,11 @@ static void EveFlowLogJSON(OutputJsonThreadCtx *aft, JsonBuilder *jb, Flow *f)
 
             jb_set_uint(jb, "ts_max_regions", ssn->client.sb.max_regions);
             jb_set_uint(jb, "tc_max_regions", ssn->server.sb.max_regions);
+
+            if (ssn->urg_offset_ts)
+                jb_set_uint(jb, "ts_urgent_oob_data", ssn->urg_offset_ts);
+            if (ssn->urg_offset_tc)
+                jb_set_uint(jb, "tc_urgent_oob_data", ssn->urg_offset_tc);
         }
 
         /* Close tcp. */