Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: Sending payloads with cribl/event transport type - inconsistency with channel type #1600

Open
michalbiesek opened this issue Jul 24, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@michalbiesek
Copy link
Contributor

michalbiesek commented Jul 24, 2023

Steps To Reproduce

This is example payload received from event transportation type:

{"type":"payload","id":"michalbiesek-host-host -v -t a cribl.io","pid":181832,"ppid":66772,"fd":9,"src":"nettx","_channel":20401133743160,"len":26,"localip":"0.0.0.0","localp":0,"remoteip":"127.0.0.53","remotep":53,"protocol":"DNS-detection","_time":1690201303.836}
�tcriblio

See that channel type above is int

While in case of other events we use a string type

{"type":"evt","id":"michalbiesek-host-host -v -t a cribl.io","_channel":"20401134899264","body":{"sourcetype":"dns","_time":1690201303.836175,"source":"dns.req","host":"michalbiesek","proc":"host","cmd":"host -v -t a cribl.io","pid":181832,"data":{"domain":"cribl.io"}}}

appscope/src/ctl.c

Lines 509 to 512 in 0be47b2

if (!cJSON_AddStringToObjLN(json_root, CHANNEL, numbuf)) goto err;
} else {
if (!cJSON_AddStringToObjLN(json_root, CHANNEL, "none")) goto err;
}

Environment

- AppScope: 1.4.0
- OS: Linux
- Architecture: both 
- Kernel: - 

The above can results with unexpected behavior on the other side while interpreting the data

@michalbiesek michalbiesek added the bug Something isn't working label Jul 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant