Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-474: add MQTT::max_payload_size option

Browse source 
This caps size of payload strings within mqtt_publish events and
mqtt_publish.log files.  A new "payload_len" field in the log file
shows the real payload size in cases where it may have been truncated.
This commit is contained in:
Jon Siwek 2019-08-02 14:28:55 -07:00
parent c43e809a69
commit 6bc947a48e
12 changed files with 66 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/base/protocols/mqtt/main.zeek
View file

@ -85,6 +85,11 @@ export {
## Payload of the message
payload: string &log;
## The actual length of the payload in the case the *payload*
## field's contents were truncated according to
## :zeek:see:`MQTT::max_payload_size`.
payload_len: count &log;
## Track if the message was acked
ack: bool &default=F;
## Indicates if the server sent the RECEIVED qos message
@ -190,7 +195,8 @@ event mqtt_publish(c: connection, is_orig: bool, msg_id: count, msg: MQTT::Publi
$qos=qos_levels[msg$qos],
$qos_level=msg$qos,
$topic=msg$topic,
$payload=msg$payload);
$payload=msg$payload,
$payload_len=msg$payload_len);
if ( pi$qos_level == 0 )
pi$status="ok";