/src/suricata/rust/src/pop3/logger.rs
Line | Count | Source |
1 | | /* Copyright (C) 2025 Open Information Security Foundation |
2 | | * |
3 | | * You can copy, redistribute or modify this Program under the terms of |
4 | | * the GNU General Public License version 2 as published by the Free |
5 | | * Software Foundation. |
6 | | * |
7 | | * This program is distributed in the hope that it will be useful, |
8 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
9 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
10 | | * GNU General Public License for more details. |
11 | | * |
12 | | * You should have received a copy of the GNU General Public License |
13 | | * version 2 along with this program; if not, write to the Free Software |
14 | | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
15 | | * 02110-1301, USA. |
16 | | */ |
17 | | |
18 | | // Author: Alex Savage <exlavasage@gmail.com> |
19 | | |
20 | | //! POP3 parser json logger |
21 | | |
22 | | use super::pop3::POP3Transaction; |
23 | | use crate::jsonbuilder::{JsonBuilder, JsonError}; |
24 | | use std; |
25 | | |
26 | 0 | fn log_pop3(tx: &POP3Transaction, js: &mut JsonBuilder) -> Result<(), JsonError> { |
27 | 0 | js.open_object("pop3")?; |
28 | 0 | if let Some(ref request) = tx.request { |
29 | 0 | let js_request = js.open_object("request")?; |
30 | 0 | js_request.set_string("command", &request.keyword.to_string())?; |
31 | | |
32 | 0 | let js_args = js_request.open_array("args")?; |
33 | 0 | for arg in &request.args { |
34 | 0 | js_args.append_string_from_bytes(arg)?; |
35 | | } |
36 | 0 | js_args.close()?; |
37 | 0 | js_request.close()?; |
38 | 0 | } |
39 | 0 | if let Some(ref response) = tx.response { |
40 | 0 | let js_response = js.open_object("response")?; |
41 | 0 | js_response.set_bool("success", response.status == sawp_pop3::Status::OK)?; |
42 | 0 | js_response.set_string("status", response.status.to_str())?; |
43 | 0 | js_response.set_string_from_bytes("header", &response.header)?; |
44 | | |
45 | 0 | let js_data = js_response.open_array("data")?; |
46 | 0 | for data in &response.data { |
47 | 0 | js_data.append_string_from_bytes(data)?; |
48 | | } |
49 | 0 | js_data.close()?; |
50 | 0 | js_response.close()?; |
51 | 0 | } |
52 | | |
53 | 0 | js.close()?; |
54 | 0 | Ok(()) |
55 | 0 | } |
56 | | |
57 | | #[no_mangle] |
58 | 0 | pub unsafe extern "C" fn SCPop3LoggerLog( |
59 | 0 | tx: *mut std::os::raw::c_void, js: &mut JsonBuilder, |
60 | 0 | ) -> bool { |
61 | 0 | let tx = cast_pointer!(tx, POP3Transaction); |
62 | 0 | log_pop3(tx, js).is_ok() |
63 | 0 | } |