func()

in pcap-cli/internal/transformer/json_translator.go [1255:1307]


func (t *JSONPcapTranslator) addAppLayerData(
	ctx context.Context,
	packet *gopacket.Packet,
	lock *flowLock,
	flowID *uint64,
	tcpFlags *uint8,
	sequence *uint32,
	appLayer *gopacket.ApplicationLayer,
	json *gabs.Container,
	message *string,
	tsp TraceAndSpanProvider,
) (*gabs.Container, error) {
	appLayerData := (*appLayer).LayerContents()

	sizeOfAppLayerData := len(appLayerData)
	if sizeOfAppLayerData == 0 {
		_, lockLatency := lock.UnlockWithTCPFlags(ctx, tcpFlags)
		json.Set(lockLatency.String(), "ll")
		return json, errors.New("AppLayer is empty")
	}

	if L7, handled, isHTTP2 := t.trySetHTTP(ctx, packet, lock, flowID,
		tcpFlags, sequence, appLayerData, json, message, tsp); handled {
		// this `size` is not the same as `length`:
		//   - `size` includes everything, not only the HTTP `payload`
		L7.Set(sizeOfAppLayerData, "size")
		// HTTP/2.0 is binary so not showing it raw
		if !isHTTP2 && sizeOfAppLayerData > 512 {
			L7.Set(string(appLayerData[:512-3])+"...", "raw")
		} else if !isHTTP2 {
			L7.Set(string(appLayerData), "raw")
		}
		return json, nil
	}

	// best-effort to add some information about L7
	json.Set(stringFormatter.Format("{0} | size:{1}",
		*message, sizeOfAppLayerData), "message")

	L7, _ := json.Object("L7")
	L7.Set(sizeOfAppLayerData, "length")

	if sizeOfAppLayerData > 128 {
		L7.Set(string(appLayerData[:128-3])+"...", "sample")
	} else {
		L7.Set(string(appLayerData), "content")
	}

	_, lockLatency := lock.UnlockWithTCPFlags(ctx, tcpFlags)
	json.Set(lockLatency.String(), "ll")

	return json, nil
}