in pcap-cli/internal/transformer/json_translator.go [1255:1307]
func (t *JSONPcapTranslator) addAppLayerData(
ctx context.Context,
packet *gopacket.Packet,
lock *flowLock,
flowID *uint64,
tcpFlags *uint8,
sequence *uint32,
appLayer *gopacket.ApplicationLayer,
json *gabs.Container,
message *string,
tsp TraceAndSpanProvider,
) (*gabs.Container, error) {
appLayerData := (*appLayer).LayerContents()
sizeOfAppLayerData := len(appLayerData)
if sizeOfAppLayerData == 0 {
_, lockLatency := lock.UnlockWithTCPFlags(ctx, tcpFlags)
json.Set(lockLatency.String(), "ll")
return json, errors.New("AppLayer is empty")
}
if L7, handled, isHTTP2 := t.trySetHTTP(ctx, packet, lock, flowID,
tcpFlags, sequence, appLayerData, json, message, tsp); handled {
// this `size` is not the same as `length`:
// - `size` includes everything, not only the HTTP `payload`
L7.Set(sizeOfAppLayerData, "size")
// HTTP/2.0 is binary so not showing it raw
if !isHTTP2 && sizeOfAppLayerData > 512 {
L7.Set(string(appLayerData[:512-3])+"...", "raw")
} else if !isHTTP2 {
L7.Set(string(appLayerData), "raw")
}
return json, nil
}
// best-effort to add some information about L7
json.Set(stringFormatter.Format("{0} | size:{1}",
*message, sizeOfAppLayerData), "message")
L7, _ := json.Object("L7")
L7.Set(sizeOfAppLayerData, "length")
if sizeOfAppLayerData > 128 {
L7.Set(string(appLayerData[:128-3])+"...", "sample")
} else {
L7.Set(string(appLayerData), "content")
}
_, lockLatency := lock.UnlockWithTCPFlags(ctx, tcpFlags)
json.Set(lockLatency.String(), "ll")
return json, nil
}