Closed amm3 closed 8 years ago
Okay, I see what's going on and how this fixes the followstream issue. There's a problem, however. It fixes this specific issue, but introduces new ones.
When running that one line to re-init the output module, it only passes the one keyword argument (i.e. (fh=out.fh)
). This blows away any custom arguments a decoder writer might've fed to the output module in the decoder. For example, something like this in a decoder's __init__
function would not work...
self.out = jsonout.JSONOutput(geoip=True)
The 'geoip' argument given to it would be blown away when the output module is re-inited.
The colorout module seems to overcome this by including a series of checks for each of its kwargs to see if it was previously set. Unfortunately, none of the other output modules do this.
We'll need to think of a more complete way to fix this.
I just made a new pull request #83
When you get a chance, can you see if it solves your issue in a way that works for you?
Pull request #83 solves the issue. Closing this one.
I restored a line that had previously been commented out to (re)initialize the decoder's custom output module. Without this call, the initial call to
__init__
done at the decoder load time doesn't have access to the output filehandle, and therefore any writes done within the output initialization are vaporized. Results are most obvious when a decoder uses colorout and the output is directed to an HTML file using-o
.Example command:
decode -d followstream file.pcap -o streams.html
Without this call to
__init__
in decode.py, the HTML headers including stylesheets are not written to the output file.