8.0.x - ike duplicate attributes - v9

doc/userguide/Makefile.am

@@ -13,6 +13,7 @@ EXTRA_DIST = \
 	firewall \
 	generate-evedoc.sh \
 	index.rst \
+	known-issues.rst \
 	upgrade \
 	upgrade.rst \
 	initscripts.rst \

doc/userguide/index.rst

@@ -37,3 +37,4 @@ This is the documentation for Suricata |version|.
    devguide/index.rst
    verifying-source-files
    appendix/index.rst
+   known-issues

doc/userguide/known-issues.rst

@@ -0,0 +1,9 @@
+Known Issues
+############
+
+The following is a list of known issues in Suricata 8.0.
+
+* When an IKE message contains multiple attributes with the same key,
+  only the first will be logged to avoid producing invalid JSON, or
+  introducing a logging format change. See
+  https://redmine.openinfosecfoundation.org/issues/7923.

rust/src/ike/detect.rs

@@ -145,7 +145,7 @@ pub extern "C" fn SCIkeStateGetSaAttribute(
     let sa_type_s: Result<_, _>;
 
     unsafe { sa_type_s = CStr::from_ptr(sa_type).to_str() }
-    SCLogInfo!("{:#?}", sa_type_s);
+    SCLogDebug!("{:#?}", sa_type_s);
 
     if let Ok(sa) = sa_type_s {
         if tx.ike_version == 1 {

rust/src/ike/logger.rs

@@ -22,14 +22,24 @@ use crate::ike::parser::{ExchangeType, IsakmpPayloadType, SaAttribute};
 use crate::jsonbuilder::{JsonBuilder, JsonError};
 use num_traits::FromPrimitive;
 use std;
+use std::collections::HashSet;
 use std::convert::TryFrom;
 
 const LOG_EXTENDED: u32 = 0x01;
 
 fn add_attributes(transform: &Vec<SaAttribute>, js: &mut JsonBuilder) -> Result<(), JsonError> {
+    let mut logged: HashSet<String> = HashSet::new();
+
     for attribute in transform {
+        let key = attribute.attribute_type.to_string();
+
+        if logged.contains(&key) {
+            continue;
+        }
+        logged.insert(key.clone());
+
         js.set_string(
-            attribute.attribute_type.to_string().as_str(),
+            &key,
             attribute.attribute_value.to_string().as_str(),
         )?;