From d72bc364de4a9c63f78ce5344319b9de97115745 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 8 Sep 2022 13:57:45 +0200 Subject: [PATCH] output/frame: improve 'complete' logging --- src/output-json-frame.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/output-json-frame.c b/src/output-json-frame.c index 72d68dbcdb..2b594a3f07 100644 --- a/src/output-json-frame.c +++ b/src/output-json-frame.c @@ -158,8 +158,13 @@ static void FrameAddPayloadTCP(JsonBuilder *js, const TcpStream *stream, const F SCLogDebug("frame data_offset %" PRIu64 ", data_len %u frame len %" PRIi64, data_offset, sb_data_len, frame->len); - // TODO update to work with large frames - jb_set_bool(js, "complete", ((int64_t)sb_data_len >= frame->len)); + bool complete = false; + if (frame->len > 0) { + const uint64_t frame_re = frame->offset + (uint64_t)frame->len; + const uint64_t data_re = data_offset + sb_data_len; + complete = frame_re <= data_re; + } + jb_set_bool(js, "complete", complete); uint32_t data_len = MIN(sb_data_len, 256); jb_set_base64(js, "payload", data, data_len); -- 2.47.2