From 29d5eea18b54f197eaa89890614fc09be790d835 Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Sat, 8 Jun 2024 10:37:14 -0400
Subject: [PATCH] output: Add linktype name

Issue: 6954

This commit adds the linktype name to the output stream. The name is
determined from the pcap utility function pcap_datalink_val_to_name
---
 etc/schema.json   | 4 ++++
 src/output-json.c | 7 +++++++
 2 files changed, 11 insertions(+)

diff --git a/etc/schema.json b/etc/schema.json
index 03db8c7c3d06..c48feafbdaa3 100644
--- a/etc/schema.json
+++ b/etc/schema.json
@@ -3472,6 +3472,10 @@
             "properties": {
                 "linktype": {
                     "type": "integer"
+                },
+                "linktype_name": {
+                    "type": "string",
+                    "description": "the descriptive name of the linktype"
                 }
             },
             "additionalProperties": false
diff --git a/src/output-json.c b/src/output-json.c
index c55875a6758f..34314ba6e72d 100644
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -428,8 +428,15 @@ void EvePacket(const Packet *p, JsonBuilder *js, uint32_t max_length)
         return;
     }
     if (!jb_set_uint(js, "linktype", p->datalink)) {
+        jb_close(js);
         return;
     }
+
+    const char *dl_name = DatalinkValueToName(p->datalink);
+    // Intentionally ignore the return value from jb_set_string and proceed
+    // so the jb object is closed
+    jb_set_string(js, "linktype_name", dl_name == NULL ? "n/a" : dl_name);
+
     jb_close(js);
 }