From: Mark Janssen <mark@praseodym.net>
Date: Sun, 10 Feb 2019 14:29:42 +0000 (+0100)
Subject: eve/json: always output vlan field as array
X-Git-Tag: suricata-5.0.0-beta1~30
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=600f2ab39159b475f72a19837a91dd4432905df1;p=thirdparty%2Fsuricata.git

eve/json: always output vlan field as array
---

diff --git a/src/output-json.c b/src/output-json.c
index a91d6eb982..cf0fafd5cb 100644
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -716,27 +716,13 @@ json_t *CreateJSONHeader(const Packet *p, enum OutputJsonLogDirection dir,
     }
 
     /* vlan */
-    if (p->vlan_idx > 0) {
-        json_t *js_vlan;
-        switch (p->vlan_idx) {
-            case 1:
-                json_object_set_new(js, "vlan",
-                                    json_integer(VLAN_GET_ID1(p)));
-                break;
-            case 2:
-                js_vlan = json_array();
-                if (unlikely(js != NULL)) {
-                    json_array_append_new(js_vlan,
-                                    json_integer(VLAN_GET_ID1(p)));
-                    json_array_append_new(js_vlan,
-                                    json_integer(VLAN_GET_ID2(p)));
-                    json_object_set_new(js, "vlan", js_vlan);
-                }
-                break;
-            default:
-                /* shouldn't get here */
-                break;
+    if (f->vlan_idx > 0) {
+        json_t *js_vlan = json_array();
+        json_array_append_new(js_vlan, json_integer(f->vlan_id[0]));
+        if (f->vlan_idx > 1) {
+            json_array_append_new(js_vlan, json_integer(f->vlan_id[1]));
         }
+        json_object_set_new(js, "vlan", js_vlan);
     }
 
     /* 5-tuple */