]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
output-json-alert: log correct dns and dnp3 tx
authorEric Leblond <eric@regit.org>
Thu, 21 Jun 2018 19:05:16 +0000 (21:05 +0200)
committerVictor Julien <victor@inliniac.net>
Wed, 27 Jun 2018 11:46:57 +0000 (13:46 +0200)
Using transaction log entry is not correct to log the transaction
that did cause the alert. The tx_id in the PacketAlert is correct
so let's use that.

src/output-json-alert.c

index c0f1e7515d8730c0c6fefe93a39de84e204ddd82..008a5441ebef3d4088bb0f00c1593eec5753ef65 100644 (file)
@@ -158,11 +158,10 @@ static void AlertJsonSsh(const Flow *f, json_t *js)
     return;
 }
 
-static void AlertJsonDnp3(const Flow *f, json_t *js)
+static void AlertJsonDnp3(const Flow *f, const uint64_t tx_id, json_t *js)
 {
     DNP3State *dnp3_state = (DNP3State *)FlowGetAppState(f);
     if (dnp3_state) {
-        uint64_t tx_id = AppLayerParserGetTransactionLogId(f->alparser);
         DNP3Transaction *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_DNP3,
             dnp3_state, tx_id);
         if (tx) {
@@ -188,12 +187,11 @@ static void AlertJsonDnp3(const Flow *f, json_t *js)
     return;
 }
 
-static void AlertJsonDns(const Flow *f, json_t *js)
+static void AlertJsonDns(const Flow *f, const uint64_t tx_id, json_t *js)
 {
 #ifndef HAVE_RUST
     DNSState *dns_state = (DNSState *)FlowGetAppState(f);
     if (dns_state) {
-        uint64_t tx_id = AppLayerParserGetTransactionLogId(f->alparser);
         DNSTransaction *tx = AppLayerParserGetTx(f->proto, ALPROTO_DNS,
                                                  dns_state, tx_id);
         if (tx) {
@@ -507,11 +505,11 @@ static int AlertJson(ThreadVars *tv, JsonAlertLogThread *aft, const Packet *p)
 
             /* dnp3 alert */
             if (proto == ALPROTO_DNP3) {
-                AlertJsonDnp3(p->flow, js);
+                AlertJsonDnp3(p->flow, pa->tx_id, js);
             }
 
             if (proto == ALPROTO_DNS) {
-                AlertJsonDns(p->flow, js);
+                AlertJsonDns(p->flow, pa->tx_id, js);
             }
         }