Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 19:48:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-474: add MQTT::max_payload_size option

Browse source 
This caps size of payload strings within mqtt_publish events and
mqtt_publish.log files.  A new "payload_len" field in the log file
shows the real payload size in cases where it may have been truncated.
This commit is contained in:
Jon Siwek 2019-08-02 14:28:55 -07:00
parent c43e809a69
commit 6bc947a48e
12 changed files with 66 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/base/init-bare.zeek
View file

@ -5083,7 +5083,17 @@ export {
## Payload of the published message.
payload : string;
## The actual length of the payload in the case the *payload*
## field's contents were truncated according to
## :zeek:see:`MQTT::max_payload_size`.
payload_len : count;
};
## The maximum payload size to allocate for the purpose of
## payload information in :zeek:see:`mqtt_publish` events (and the
## default MQTT logs generated from that).
const max_payload_size = 100 &redef;
}
module Cluster;

8
scripts/base/protocols/mqtt/main.zeek
View file

@ -85,6 +85,11 @@ export {
## Payload of the message
payload: string &log;
## The actual length of the payload in the case the *payload*
## field's contents were truncated according to
## :zeek:see:`MQTT::max_payload_size`.
payload_len: count &log;
## Track if the message was acked
ack: bool &default=F;
## Indicates if the server sent the RECEIVED qos message
@ -190,7 +195,8 @@ event mqtt_publish(c: connection, is_orig: bool, msg_id: count, msg: MQTT::Publi
$qos=qos_levels[msg$qos],
$qos_level=msg$qos,
$topic=msg$topic,
$payload=msg$payload);
$payload=msg$payload,
$payload_len=msg$payload_len);
if ( pi$qos_level == 0 )
pi$status="ok";