From: Jason Ish <jason.ish@oisf.net>
Date: Tue, 4 Aug 2020 21:35:07 +0000 (-0600)
Subject: alert/eve: add snmp metadata for snmp alerts
X-Git-Tag: suricata-6.0.0-beta1~33
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ef0ebc955030139a97399a77311950836434b951;p=thirdparty%2Fsuricata.git

alert/eve: add snmp metadata for snmp alerts

Redmine issue:
https://redmine.openinfosecfoundation.org/issues/3441
---

diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index f78313151c..ca8e3ba635 100644
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -219,6 +219,20 @@ static void AlertJsonDns(const Flow *f, const uint64_t tx_id, JsonBuilder *js)
     return;
 }
 
+static void AlertJsonSNMP(const Flow *f, const uint64_t tx_id, JsonBuilder *js)
+{
+    void *snmp_state = (void *)FlowGetAppState(f);
+    if (snmp_state != NULL) {
+        void *tx = AppLayerParserGetTx(f->proto, ALPROTO_SNMP, snmp_state,
+                tx_id);
+        if (tx != NULL) {
+            jb_open_object(js, "snmp");
+            rs_snmp_log_json_response(js, snmp_state, tx);
+            jb_close(js);
+        }
+    }
+}
+
 static void AlertJsonSourceTarget(const Packet *p, const PacketAlert *pa,
                                   JsonBuilder *js, JsonAddrInfo *addr)
 {
@@ -483,6 +497,9 @@ static void AlertAddAppLayer(const Packet *p, JsonBuilder *jb,
                 jb_restore_mark(jb, &mark);
             }
             break;
+        case ALPROTO_SNMP:
+            AlertJsonSNMP(p->flow, tx_id, jb);
+            break;
         default:
             break;
     }