output/http: log invalid status as a string

Ticket: 7311

If response_status_number is not a valid poisitive integer,
we should not try to parse it again, and fail again,
but just log the raw string.

diff --git a/etc/schema.json b/etc/schema.json
index 08959e3c7a1dac9a77004723b7e8ecf1dff0d5f2..e27ffb559b8d40d081f072892b13e6c154c05654 100644 (file)
--- a/etc/schema.json
+++ b/etc/schema.json
@@ -2014,6 +2014,10 @@
                 "status": {
                     "type": "integer"
                 },
+                "status_string": {
+                    "description": "status string when it is not a valid integer (like 2XX)",
+                    "type": "string"
+                },
                 "true_client_ip": {
                     "type": "string"
                 },

diff --git a/src/output-json-http.c b/src/output-json-http.c
index b45be9a45b6ba7a5959bfaf91902ca9d265fcd83..87c8b6ddb85a8613d3e3a2bffbbc4f4b5936e440 100644 (file)
--- a/src/output-json-http.c
+++ b/src/output-json-http.c
@@ -296,12 +296,8 @@ static void EveHttpLogJSONExtended(JsonBuilder *js, htp_tx_t *tx)
     if (resp > 0) {
         jb_set_uint(js, "status", (uint32_t)resp);
     } else if (tx->response_status != NULL) {
-        const size_t status_size = bstr_len(tx->response_status) * 2 + 1;
-        char status_string[status_size];
-        BytesToStringBuffer(bstr_ptr(tx->response_status), bstr_len(tx->response_status),
-                status_string, status_size);
-        unsigned int val = strtoul(status_string, NULL, 10);
-        jb_set_uint(js, "status", val);
+        jb_set_string_from_bytes(js, "status_string", bstr_ptr(tx->response_status),
+                (uint32_t)bstr_len(tx->response_status));
     }
 
     htp_header_t *h_location = htp_table_get_c(tx->response_headers, "location");