github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-02 07:05:54 +00:00
Code Issues Projects Releases Wiki Activity

fix(userspace/engine): base64 format fix

Browse Source 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
Lorenzo Fontana
2020-02-04 15:03:26 +01:00
committed by poiana
parent 22a95796c1
commit 240f7e2057
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
userspace/engine/formats.cpp
View File

@@ -146,11 +146,13 @@ int falco_formats::format_event (lua_State *ls)
if(strcmp(source, "syscall") == 0) if(strcmp(source, "syscall") == 0)
{ {
try { try {
// This is "output"
s_formatters->tostring((sinsp_evt *) evt, sformat, &line); s_formatters->tostring((sinsp_evt *) evt, sformat, &line);
if(s_json_output) if(s_json_output)
{ {
switch(s_inspector->get_buffer_format()) sinsp_evt::param_fmt cur_fmt = s_inspector->get_buffer_format();
switch(cur_fmt)
{ {
case sinsp_evt::PF_NORMAL: case sinsp_evt::PF_NORMAL:
s_inspector->set_buffer_format(sinsp_evt::PF_JSON); s_inspector->set_buffer_format(sinsp_evt::PF_JSON);
@@ -171,6 +173,7 @@ int falco_formats::format_event (lua_State *ls)
// do nothing // do nothing
break; break;
} }
// This is output fields
s_formatters->tostring((sinsp_evt *) evt, sformat, &json_line); s_formatters->tostring((sinsp_evt *) evt, sformat, &json_line);
// The formatted string might have a leading newline. If it does, remove it. // The formatted string might have a leading newline. If it does, remove it.
@@ -178,8 +181,7 @@ int falco_formats::format_event (lua_State *ls)
{ {
json_line.erase(0, 1); json_line.erase(0, 1);
} }
s_inspector->set_buffer_format(cur_fmt);
s_inspector->set_buffer_format(sinsp_evt::PF_NORMAL);
} }
} }
catch (sinsp_exception& e) catch (sinsp_exception& e)