From 757f249a7421194ecfd6abb69af5de268cd541b5 Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Sat, 8 Jun 2024 10:37:14 -0400
Subject: [PATCH] output: Add linktype name
Issue: 6954
This commit adds the linktype name to the output stream. The name is
determined from the pcap utility function pcap_datalink_val_to_name
---
etc/schema.json | 4 ++++
src/output-json.c | 7 +++++++
2 files changed, 11 insertions(+)
diff --git a/etc/schema.json b/etc/schema.json
index 08959e3c7a1d..238d220c2da6 100644
--- a/etc/schema.json
+++ b/etc/schema.json
@@ -3475,6 +3475,10 @@
"properties": {
"linktype": {
"type": "integer"
+ },
+ "linktype_name": {
+ "type": "string",
+ "description": "the descriptive name of the linktype"
}
},
"additionalProperties": false
diff --git a/src/output-json.c b/src/output-json.c
index 18376fd428a5..78c5a005402d 100644
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -428,8 +428,15 @@ void EvePacket(const Packet *p, JsonBuilder *js, uint32_t max_length)
return;
}
if (!jb_set_uint(js, "linktype", p->datalink)) {
+ jb_close(js);
return;
}
+
+ const char *dl_name = DatalinkValueToName(p->datalink);
+ // Intentionally ignore the return value from jb_set_string and proceed
+ // so the jb object is closed
+ jb_set_string(js, "linktype_name", dl_name == NULL ? "n/a" : dl_name);
+
jb_close(js);
}