summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ChangeLog12
-rw-r--r--configure.ac2
-rw-r--r--doc/manual.html2
-rw-r--r--grammar/rainerscript.c3
-rw-r--r--plugins/imuxsock/imuxsock.c95
-rw-r--r--plugins/mmaudit/mmaudit.c75
-rw-r--r--plugins/mmjsonparse/mmjsonparse.c89
-rw-r--r--plugins/mmnormalize/mmnormalize.c36
-rw-r--r--runtime/msg.c254
-rw-r--r--runtime/msg.h7
-rw-r--r--runtime/rsyslog.h5
-rw-r--r--template.c55
12 files changed, 403 insertions, 232 deletions
diff --git a/ChangeLog b/ChangeLog
index 6bd82a0f..abbe8449 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,8 +1,18 @@
---------------------------------------------------------------------------
-Version 6.5.1 [devel] 2012-08-??
+Version 7.1.1 [devel] 2012-09-??
+- imuxsock now stores trusted properties by default in the CEE root
+ This was done in order to keep compatible with other implementations of
+ the lumberjack schema
+ Thanks to Miloslav Trmač for pointing to this.
+- bugfix: string-generating templates caused abort if CEE field could not
+ be found
+---------------------------------------------------------------------------
+Version 7.1.0 [devel] 2012-09-06
+- added support for hierarchical properties (CEE/lumberjack)
- added pure JSON output plugin parameter passing mode
- ommongodb now supports templates
- bugfix: imtcp could abort on exit due to invalid free()
+- imported bugfixes from 6.4.1
---------------------------------------------------------------------------
Version 6.5.0 [devel] 2012-08-28
- imrelp now supports non-cancel thread termination
diff --git a/configure.ac b/configure.ac
index 1d7aec58..25f6ab46 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@
# Process this file with autoconf to produce a configure script.
AC_PREREQ(2.61)
-AC_INIT([rsyslog],[6.5.0],[rsyslog@lists.adiscon.com])
+AC_INIT([rsyslog],[7.1.0],[rsyslog@lists.adiscon.com])
AM_INIT_AUTOMAKE
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
diff --git a/doc/manual.html b/doc/manual.html
index 9a8644c9..58b270f9 100644
--- a/doc/manual.html
+++ b/doc/manual.html
@@ -19,7 +19,7 @@ rsyslog support</a> available directly from the source!</p>
<p><b>Please visit the <a href="http://www.rsyslog.com/sponsors">rsyslog sponsor's page</a>
to honor the project sponsors or become one yourself!</b> We are very grateful for any help towards the
project goals.</p>
-<p><b>This documentation is for version 6.5.0 (devel branch) of rsyslog.</b>
+<p><b>This documentation is for version 7.1.0 (devel branch) of rsyslog.</b>
Visit the <i><a href="http://www.rsyslog.com/status">rsyslog status page</a></i></b>
to obtain current version information and project status.
</p><p><b>If you like rsyslog, you might
diff --git a/grammar/rainerscript.c b/grammar/rainerscript.c
index 33630a76..56a6376d 100644
--- a/grammar/rainerscript.c
+++ b/grammar/rainerscript.c
@@ -139,7 +139,7 @@ objlstDestruct(struct objlst *lst)
while(lst != NULL) {
toDel = lst;
lst = lst->next;
- // TODO: delete object
+ cnfobjDestruct(toDel->obj);
free(toDel);
}
}
@@ -648,6 +648,7 @@ cnfobjDestruct(struct cnfobj *o)
{
if(o != NULL) {
nvlstDestruct(o->nvlst);
+ objlstDestruct(o->subobjs);
free(o);
}
}
diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c
index 57b2a70a..bb0e998f 100644
--- a/plugins/imuxsock/imuxsock.c
+++ b/plugins/imuxsock/imuxsock.c
@@ -164,8 +164,6 @@ static int startIndexUxLocalSockets; /* process fd from that index on (used to
static int nfd = 1; /* number of Unix sockets open / read-only after startup */
static int sd_fds = 0; /* number of systemd activated sockets */
-static ee_ctx ctxee = NULL; /* library context */
-
/* config vars for legacy config system */
#define DFLT_bCreatePath 0
#define DFLT_ratelimitInterval 0
@@ -643,14 +641,12 @@ getTrustedProp(struct ucred *cred, char *propName, uchar *buf, size_t lenBuf, in
if((fd = open(namebuf, O_RDONLY)) == -1) {
DBGPRINTF("error reading '%s'\n", namebuf);
- *lenProp = 0;
- FINALIZE;
+ ABORT_FINALIZE(RS_RET_ERR);
}
if((lenRead = read(fd, buf, lenBuf - 1)) == -1) {
DBGPRINTF("error reading file data for '%s'\n", namebuf);
- *lenProp = 0;
close(fd);
- FINALIZE;
+ ABORT_FINALIZE(RS_RET_ERR);
}
/* we strip after the first \n */
@@ -686,8 +682,7 @@ getTrustedExe(struct ucred *cred, uchar *buf, size_t lenBuf, int* lenProp)
if((lenRead = readlink(namebuf, (char*)buf, lenBuf - 1)) == -1) {
DBGPRINTF("error reading link '%s'\n", namebuf);
- *lenProp = 0;
- FINALIZE;
+ ABORT_FINALIZE(RS_RET_ERR);
}
buf[lenRead] = '\0';
@@ -720,6 +715,7 @@ copyescaped(uchar *dstbuf, uchar *inbuf, int inlen)
}
+#if 0
/* Creates new field to be added to event
* used for SystemLogParseTrusted parsing
*/
@@ -738,6 +734,7 @@ createNewField(char *fieldname, char *value, int lenValue) {
return newField;
}
+#endif
/* submit received message to the queue engine
@@ -765,7 +762,7 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim
uchar *pmsgbuf;
int toffs; /* offset for trusted properties */
struct syslogTime dummyTS;
- struct ee_event *event = NULL;
+ struct json_object *json = NULL, *jval;
DEFiRet;
/* TODO: handle format errors?? */
@@ -812,45 +809,27 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim
}
if (pLstn->bParseTrusted) {
- struct ee_field *newField;
-
- if(ctxee == NULL) {
- if((ctxee = ee_initCtx()) == NULL) {
- errmsg.LogError(0, RS_RET_NO_RULESET, "error: could not initialize libee ctx, cannot "
- "activate action");
- ABORT_FINALIZE(RS_RET_ERR_LIBEE_INIT);
- }
+ json = json_object_new_object();
+ /* create value string, create field, and add it */
+ jval = json_object_new_int(cred->pid);
+ json_object_object_add(json, "pid", jval);
+ jval = json_object_new_int(cred->uid);
+ json_object_object_add(json, "uid", jval);
+ jval = json_object_new_int(cred->gid);
+ json_object_object_add(json, "gid", jval);
+ if(getTrustedProp(cred, "comm", propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
+ jval = json_object_new_string((char*)propBuf);
+ json_object_object_add(json, "appname", jval);
+ }
+ if(getTrustedExe(cred, propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
+ jval = json_object_new_string((char*)propBuf);
+ json_object_object_add(json, "exe", jval);
+ }
+ if(getTrustedProp(cred, "cmdline", propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
+ jval = json_object_new_string((char*)propBuf);
+ json_object_object_add(json, "cmd", jval);
}
-
- event = ee_newEvent(ctxee);
-
- /* create value string, create field, and add it to event */
- lenProp = snprintf((char *)propBuf, sizeof(propBuf), "%lu", (long unsigned) cred->pid);
- newField = createNewField("pid", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
- lenProp = snprintf((char *)propBuf, sizeof(propBuf), "%lu", (long unsigned) cred->uid);
- newField = createNewField("uid", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
- lenProp = snprintf((char *)propBuf, sizeof(propBuf), "%lu", (long unsigned) cred->gid);
- newField = createNewField("gid", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
- getTrustedProp(cred, "comm", propBuf, sizeof(propBuf), &lenProp);
- newField = createNewField("appname", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
- getTrustedExe(cred, propBuf, sizeof(propBuf), &lenProp);
- newField = createNewField("exe", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
- getTrustedProp(cred, "cmdline", propBuf, sizeof(propBuf), &lenProp);
- newField = createNewField("cmd", (char *)propBuf, lenProp);
- ee_addFieldToEvent(event, newField);
-
} else {
-
memcpy(pmsgbuf, pRcv, lenRcv);
memcpy(pmsgbuf+lenRcv, " @[", 3);
toffs = lenRcv + 3; /* next free location */
@@ -860,20 +839,17 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim
memcpy(pmsgbuf+toffs, propBuf, lenProp);
toffs = toffs + lenProp;
- getTrustedProp(cred, "comm", propBuf, sizeof(propBuf), &lenProp);
- if(lenProp) {
+ if(getTrustedProp(cred, "comm", propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
memcpy(pmsgbuf+toffs, " _COMM=", 7);
memcpy(pmsgbuf+toffs+7, propBuf, lenProp);
toffs = toffs + 7 + lenProp;
}
- getTrustedExe(cred, propBuf, sizeof(propBuf), &lenProp);
- if(lenProp) {
+ if(getTrustedExe(cred, propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
memcpy(pmsgbuf+toffs, " _EXE=", 6);
memcpy(pmsgbuf+toffs+6, propBuf, lenProp);
toffs = toffs + 6 + lenProp;
}
- getTrustedProp(cred, "cmdline", propBuf, sizeof(propBuf), &lenProp);
- if(lenProp) {
+ if(getTrustedProp(cred, "cmdline", propBuf, sizeof(propBuf), &lenProp) == RS_RET_OK) {
memcpy(pmsgbuf+toffs, " _CMDLINE=", 9);
toffs = toffs + 9 +
copyescaped(pmsgbuf+toffs+9, propBuf, lenProp);
@@ -902,12 +878,11 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred, struct tim
parse++; lenMsg--; /* '>' */
- /* event is saved to pMsg */
- if(pMsg->event != NULL) {
- ee_deleteEvent(pMsg->event);
- }
- if (event != NULL) {
- pMsg->event = event;
+ if(json != NULL) {
+ /* as per lumberjack spec, these properties need to go into
+ * the CEE root.
+ */
+ msgAddJSON(pMsg, (uchar*)"!", json);
}
if(ts == NULL) {
@@ -1361,10 +1336,6 @@ CODESTARTafterRun
discardLogSockets();
nfd = 1;
- if(ctxee != NULL) {
- ee_exitCtx(ctxee);
- ctxee = NULL;
- }
ENDafterRun
diff --git a/plugins/mmaudit/mmaudit.c b/plugins/mmaudit/mmaudit.c
index fcefd013..4934312b 100644
--- a/plugins/mmaudit/mmaudit.c
+++ b/plugins/mmaudit/mmaudit.c
@@ -67,7 +67,6 @@ DEFobjCurrIf(errmsg);
DEF_OMOD_STATIC_DATA
typedef struct _instanceData {
- ee_ctx ctxee; /**< context to be used for libee */
} instanceData;
typedef struct configSettings_s {
@@ -93,7 +92,6 @@ ENDisCompatibleWithFeature
BEGINfreeInstance
CODESTARTfreeInstance
- ee_exitCtx(pData->ctxee);
ENDfreeInstance
@@ -169,17 +167,20 @@ finalize_it:
/* parse the audit record and create libee structure
*/
static rsRetVal
-audit_parse(instanceData *pData, uchar *buf, struct ee_event **event)
+audit_parse(uchar *buf, struct json_object **jsonRoot)
{
- es_str_t *estr;
+ struct json_object *json;
+ struct json_object *jval;
char name[1024];
char val[1024];
DEFiRet;
- *event = ee_newEvent(pData->ctxee);
- if(event == NULL) {
+ *jsonRoot = json_object_new_object();
+ if(*jsonRoot == NULL) {
ABORT_FINALIZE(RS_RET_ERR);
}
+ json = json_object_new_object();
+ json_object_object_add(*jsonRoot, "data", json);
while(*buf) {
//dbgprintf("audit_parse, buf: '%s'\n", buf);
@@ -189,10 +190,8 @@ audit_parse(instanceData *pData, uchar *buf, struct ee_event **event)
}
++buf;
CHKiRet(parseValue(&buf, val, sizeof(val)));
-
- estr = es_newStrFromCStr(val, strlen(val));
- ee_addStrFieldToEvent(*event, name, estr);
- es_deleteStr(estr);
+ jval = json_object_new_string(val);
+ json_object_object_add(json, name, jval);
dbgprintf("mmaudit: parsed %s=%s\n", name, val);
}
@@ -206,9 +205,10 @@ BEGINdoAction
msg_t *pMsg;
uchar *buf;
int typeID;
- struct ee_event *event;
+ struct json_object *jsonRoot;
+ struct json_object *json;
+ struct json_object *jval;
int i;
- es_str_t *estr;
char auditID[1024];
int bSuccess = 0;
CODESTARTdoAction
@@ -252,48 +252,24 @@ dbgprintf("mmaudit: msg is '%s'\n", buf);
}
buf += 2;
-dbgprintf("mmaudit: cookie found, type %d, auditID '%s', rest of message: '%s'\n", typeID, auditID, buf);
- audit_parse(pData, buf, &event);
- if(event == NULL) {
+ audit_parse(buf, &jsonRoot);
+ if(jsonRoot == NULL) {
DBGPRINTF("mmaudit: audit parse error, assuming no "
"audit message: '%s'\n", buf);
FINALIZE;
}
/* we now need to shuffle the "outer" properties into that stream */
- estr = es_newStrFromCStr(auditID, strlen(auditID));
- ee_addStrFieldToEvent(event, "audithdr.auditid", estr);
- es_deleteStr(estr);
-
- /* we abuse auditID a bit to save space... (TODO: change!) */
- snprintf(auditID, sizeof(auditID), "%d", typeID);
- estr = es_newStrFromCStr(auditID, strlen(auditID));
- ee_addStrFieldToEvent(event, "audithdr.type", estr);
- es_deleteStr(estr);
-
- /* TODO: in the long term, we need to think about merging & different
- name spaces (probably best to add the newly-obtained event as a child to
- the existing event...)
- */
- if(pMsg->event != NULL) {
- ee_deleteEvent(pMsg->event);
- }
- pMsg->event = event;
+ json = json_object_new_object();
+ json_object_object_add(jsonRoot, "hdr", json);
+ jval = json_object_new_string(auditID);
+ json_object_object_add(json, "auditid", jval);
+ jval = json_object_new_int(typeID);
+ json_object_object_add(json, "type", jval);
+
+ msgAddJSON(pMsg, (uchar*)"!audit", jsonRoot);
bSuccess = 1;
-#if 1
- /***DEBUG***/ // TODO: remove after initial testing - 2010-12-01
- {
- char *cstr;
- es_str_t *str;
- ee_fmtEventToJSON(pMsg->event, &str);
- cstr = es_str2cstr(str, NULL);
- dbgprintf("mmaudit generated: %s\n", cstr);
- free(cstr);
- es_deleteStr(str);
- }
- /***END DEBUG***/
-#endif
finalize_it:
MsgSetParseSuccess(pMsg, bSuccess);
ENDdoAction
@@ -318,13 +294,6 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1)
* the format specified (if any) is always ignored.
*/
CHKiRet(cflineParseTemplateName(&p, *ppOMSR, 0, OMSR_TPL_AS_MSG, (uchar*) "RSYSLOG_FileFormat"));
-
- /* finally build the instance */
- if((pData->ctxee = ee_initCtx()) == NULL) {
- errmsg.LogError(0, RS_RET_NO_RULESET, "error: could not initialize libee ctx, cannot "
- "activate action");
- ABORT_FINALIZE(RS_RET_ERR_LIBEE_INIT);
- }
CODE_STD_FINALIZERparseSelectorAct
ENDparseSelectorAct
diff --git a/plugins/mmjsonparse/mmjsonparse.c b/plugins/mmjsonparse/mmjsonparse.c
index 03147b59..d419f246 100644
--- a/plugins/mmjsonparse/mmjsonparse.c
+++ b/plugins/mmjsonparse/mmjsonparse.c
@@ -36,7 +36,7 @@
#include <unistd.h>
#include <ctype.h>
#include <libestr.h>
-#include <libee/libee.h>
+#include <json/json.h>
#include "conf.h"
#include "syslogd-types.h"
#include "template.h"
@@ -59,7 +59,7 @@ DEFobjCurrIf(errmsg);
DEF_OMOD_STATIC_DATA
typedef struct _instanceData {
- ee_ctx ctxee; /**< context to be used for libee */
+ struct json_tokener *tokener;
} instanceData;
typedef struct configSettings_s {
@@ -85,7 +85,8 @@ ENDisCompatibleWithFeature
BEGINfreeInstance
CODESTARTfreeInstance
- ee_exitCtx(pData->ctxee);
+ if(pData->tokener != NULL)
+ json_tokener_free(pData->tokener);
ENDfreeInstance
@@ -99,12 +100,54 @@ BEGINtryResume
CODESTARTtryResume
ENDtryResume
+
+static rsRetVal
+processJSON(instanceData *pData, msg_t *pMsg, char *buf, size_t lenBuf)
+{
+ struct json_object *json;
+ const char *errMsg;
+ DEFiRet;
+
+ dbgprintf("mmjsonparse: toParse: '%s'\n", buf);
+ json_tokener_reset(pData->tokener);
+
+ json = json_tokener_parse_ex(pData->tokener, buf, lenBuf);
+ if(Debug) {
+ errMsg = NULL;
+ if(json == NULL) {
+ enum json_tokener_error err;
+
+ err = pData->tokener->err;
+ if(err != json_tokener_continue)
+ errMsg = json_tokener_errors[err];
+ else
+ errMsg = "Unterminated input";
+ } else if((size_t)pData->tokener->char_offset < lenBuf)
+ errMsg = "Extra characters after JSON object";
+ else if(!json_object_is_type(json, json_type_object))
+ errMsg = "JSON value is not an object";
+ if(errMsg != NULL) {
+ dbgprintf("mmjsonparse: Error parsing JSON '%s': %s\n",
+ buf, errMsg);
+ }
+ }
+ if(json == NULL
+ || ((size_t)pData->tokener->char_offset < lenBuf)
+ || (!json_object_is_type(json, json_type_object))) {
+ FINALIZE; /* just don't set property */
+ }
+
+ msgAddJSON(pMsg, (uchar*)"!", json);
+dbgprintf("AAAA: The msg json object: %s\n",json_object_to_json_string(pMsg->json));
+finalize_it:
+ RETiRet;
+}
+
#define COOKIE "@cee: "
#define LEN_COOKIE (sizeof(COOKIE)-1)
BEGINdoAction
msg_t *pMsg;
uchar *buf;
- struct ee_event *event;
int bSuccess = 0;
CODESTARTdoAction
pMsg = (msg_t*) ppString[0];
@@ -125,35 +168,8 @@ dbgprintf("mmjsonparse: msg is '%s'\n", buf);
}
buf += LEN_COOKIE;
dbgprintf("mmjsonparse: cookie found, rest of message: '%s'\n", buf);
- event = ee_newEventFromJSON(pData->ctxee, (char*)buf);
- if(event == NULL) {
- DBGPRINTF("mmjsonparse: JSON parse error, assuming no "
- "JSON-enhanced message: '%s'\n", buf);
- FINALIZE;
- }
- /* TODO: in the long term, we need to think about merging & different
- name spaces (probably best to add the newly-obtained event as a child to
- the existing event...)
- */
- if(pMsg->event != NULL) {
- ee_deleteEvent(pMsg->event);
- }
- pMsg->event = event;
+ CHKiRet(processJSON(pData, pMsg, (char*) buf, strlen((char*)buf)));
bSuccess = 1;
-
-#if 1
- /***DEBUG***/ // TODO: remove after initial testing - 2010-12-01
- {
- char *cstr;
- es_str_t *str;
- ee_fmtEventToJSON(pMsg->event, &str);
- cstr = es_str2cstr(str, NULL);
- dbgprintf("mmjsonparse generated: %s\n", cstr);
- free(cstr);
- es_deleteStr(str);
- }
- /***END DEBUG***/
-#endif
finalize_it:
MsgSetParseSuccess(pMsg, bSuccess);
ENDdoAction
@@ -180,10 +196,11 @@ CODE_STD_STRING_REQUESTparseSelectorAct(1)
CHKiRet(cflineParseTemplateName(&p, *ppOMSR, 0, OMSR_TPL_AS_MSG, (uchar*) "RSYSLOG_FileFormat"));
/* finally build the instance */
- if((pData->ctxee = ee_initCtx()) == NULL) {
- errmsg.LogError(0, RS_RET_NO_RULESET, "error: could not initialize libee ctx, cannot "
- "activate action");
- ABORT_FINALIZE(RS_RET_ERR_LIBEE_INIT);
+ pData->tokener = json_tokener_new();
+ if(pData->tokener == NULL) {
+ errmsg.LogError(0, RS_RET_ERR, "error: could not create json "
+ "tokener, cannot activate action");
+ ABORT_FINALIZE(RS_RET_ERR);
}
CODE_STD_FINALIZERparseSelectorAct
ENDparseSelectorAct
diff --git a/plugins/mmnormalize/mmnormalize.c b/plugins/mmnormalize/mmnormalize.c
index c5b290f4..bf0b9ce6 100644
--- a/plugins/mmnormalize/mmnormalize.c
+++ b/plugins/mmnormalize/mmnormalize.c
@@ -4,9 +4,12 @@
*
* NOTE: read comments in module-template.h for details on the calling interface!
*
+ * TODO: check if we can replace libee via JSON system - currently that part
+ * is pretty inefficient... rgerhards, 2012-08-27
+ *
* File begun on 2010-01-01 by RGerhards
*
- * Copyright 2010 Rainer Gerhards and Adiscon GmbH.
+ * Copyright 2010-2012 Rainer Gerhards and Adiscon GmbH.
*
* This file is part of rsyslog.
*
@@ -37,6 +40,7 @@
#include <unistd.h>
#include <libestr.h>
#include <libee/libee.h>
+#include <json/json.h>
#include <liblognorm.h>
#include "conf.h"
#include "syslogd-types.h"
@@ -108,8 +112,12 @@ BEGINdoAction
msg_t *pMsg;
es_str_t *str;
uchar *buf;
+ char *cstrJSON;
int len;
int r;
+ struct ee_event *event = NULL;
+ struct json_tokener *tokener;
+ struct json_object *json;
CODESTARTdoAction
pMsg = (msg_t*) ppString[0];
/* note that we can performance-optimize the interface, but this also
@@ -123,7 +131,7 @@ CODESTARTdoAction
len = getMSGLen(pMsg);
}
str = es_newStrFromCStr((char*)buf, len);
- r = ln_normalize(pData->ctxln, str, &pMsg->event);
+ r = ln_normalize(pData->ctxln, str, &event);
if(r != 0) {
DBGPRINTF("error %d during ln_normalize\n", r);
MsgSetParseSuccess(pMsg, 0);
@@ -131,16 +139,20 @@ CODESTARTdoAction
MsgSetParseSuccess(pMsg, 1);
}
es_deleteStr(str);
- /***DEBUG***/ // TODO: remove after initial testing - 2010-12-01
- {
- char *cstr;
- ee_fmtEventToJSON(pMsg->event, &str);
- cstr = es_str2cstr(str, NULL);
- dbgprintf("mmnormalize generated: %s\n", cstr);
- free(cstr);
- es_deleteStr(str);
- }
- /***END DEBUG***/
+
+ /* reformat to our json data struct */
+ // TODO: this is all extremly ineffcient!
+ ee_fmtEventToJSON(event, &str);
+ cstrJSON = es_str2cstr(str, NULL);
+ dbgprintf("mmnormalize generated: %s\n", cstrJSON);
+
+ tokener = json_tokener_new();
+ json = json_tokener_parse_ex(tokener, cstrJSON, strlen((char*)cstrJSON));
+ json_tokener_free(tokener);
+ msgAddJSON(pMsg, (uchar*)"!", json);
+
+ free(cstrJSON);
+ es_deleteStr(str);
ENDdoAction
diff --git a/runtime/msg.c b/runtime/msg.c
index 187f0c22..f1f7997c 100644
--- a/runtime/msg.c
+++ b/runtime/msg.c
@@ -39,7 +39,9 @@
#include <sys/sysinfo.h>
#include <netdb.h>
#include <libestr.h>
-#include <libee/libee.h>
+#include <json/json.h>
+/* For struct json_object_iter, should not be necessary in future versions */
+#include <json/json_object_private.h>
#if HAVE_MALLOC_H
# include <malloc.h>
#endif
@@ -291,6 +293,8 @@ static pthread_mutex_t mutTrimCtr; /* mutex to handle malloc trim */
/* some forward declarations */
static int getAPPNAMELen(msg_t *pM, sbool bLockMutex);
+static rsRetVal jsonPathFindParent(msg_t *pM, uchar *name, uchar *leaf, struct json_object **parent, int bCreate);
+static uchar * jsonPathGetLeaf(uchar *name, int lenName);
/* The following functions will support advanced output module
@@ -740,7 +744,7 @@ static inline rsRetVal msgBaseConstruct(msg_t **ppThis)
pM->pRcvFromIP = NULL;
pM->rcvFrom.pRcvFrom = NULL;
pM->pRuleset = NULL;
- pM->event = NULL;
+ pM->json = NULL;
memset(&pM->tRcvdAt, 0, sizeof(pM->tRcvdAt));
memset(&pM->tTIMESTAMP, 0, sizeof(pM->tTIMESTAMP));
pM->TAG.pszTAG = NULL;
@@ -879,8 +883,8 @@ CODESTARTobjDestruct(msg)
rsCStrDestruct(&pThis->pCSPROCID);
if(pThis->pCSMSGID != NULL)
rsCStrDestruct(&pThis->pCSMSGID);
- if(pThis->event != NULL)
- ee_deleteEvent(pThis->event);
+ if(pThis->json != NULL)
+ json_object_put(pThis->json);
if(pThis->pszUUID != NULL)
free(pThis->pszUUID);
# ifndef HAVE_ATOMIC_BUILTINS
@@ -2403,39 +2407,87 @@ static uchar *getNOW(eNOWType eNow)
#undef tmpBUFSIZE /* clean up */
-/* Get a CEE-Property from libee. This function probably should be
- * placed somewhere else, but this smells like a big restructuring
- * useful in any case. So for the time being, I'll simply leave the
- * function here, as the context seems good enough. -- rgerhards, 2010-12-01
- */
-static inline void
-getCEEPropVal(msg_t *pMsg, es_str_t *propName, uchar **pRes, int *buflen, unsigned short *pbMustBeFreed)
+/* Get a CEE-Property as string value*/
+static inline rsRetVal
+getCEEPropVal(msg_t *pM, es_str_t *propName, uchar **pRes, int *buflen, unsigned short *pbMustBeFreed)
{
- es_str_t *str = NULL;
- int r;
+ uchar *name = NULL;
+ uchar *leaf;
+ struct json_object *parent;
+ struct json_object *field;
+ DEFiRet;
if(*pbMustBeFreed)
free(*pRes);
*pRes = NULL;
+dbgprintf("AAAA: enter getCEEPropVal\n");
+ // TODO: mutex?
+ if(pM->json == NULL) goto finalize_it;
- if(pMsg->event == NULL) goto finalize_it;
- r = ee_getEventFieldAsString(pMsg->event, propName, &str);
-
- if(r != EE_OK) {
- DBGPRINTF("msgGtCEEVar: libee error %d during ee_getEventFieldAsString\n", r);
- FINALIZE;
+ if(!es_strbufcmp(propName, (uchar*)"!", 1)) {
+ field = pM->json;
+ } else {
+ name = (uchar*)es_str2cstr(propName, NULL);
+dbgprintf("AAAA: name to search '%s'\n", name);
+ leaf = jsonPathGetLeaf(name, ustrlen(name));
+dbgprintf("AAAA: leaf '%s'\n", leaf);
+ CHKiRet(jsonPathFindParent(pM, name, leaf, &parent, 1));
+ field = json_object_object_get(parent, (char*)leaf);
+ }
+ if(field == 0) {
+ *pRes = (uchar*) "";
+ *pbMustBeFreed = 0;
+ } else {
+ *pRes = (uchar*) strdup(json_object_get_string(field));
+dbgprintf("AAAA: json_object_get_string() returns '%s'\n", *pRes);
+ *buflen = (int) ustrlen(*pRes);
+ *pbMustBeFreed = 1;
}
- *pRes = (unsigned char*) es_str2cstr(str, "#000");
- es_deleteStr(str);
- *buflen = (int) ustrlen(*pRes);
- *pbMustBeFreed = 1;
finalize_it:
+ free(name);
if(*pRes == NULL) {
/* could not find any value, so set it to empty */
*pRes = (unsigned char*)"";
*pbMustBeFreed = 0;
}
+ RETiRet;
+}
+
+
+/* Get a CEE-Property as native json object
+ */
+rsRetVal
+msgGetCEEPropJSON(msg_t *pM, es_str_t *propName, struct json_object **pjson)
+{
+ uchar *name = NULL;
+ uchar *leaf;
+ struct json_object *parent;
+ DEFiRet;
+
+dbgprintf("AAAA: enter getCEEPropJSON\n");
+ // TODO: mutex?
+ if(pM->json == NULL) {
+ ABORT_FINALIZE(RS_RET_NOT_FOUND);
+ }
+
+ if(!es_strbufcmp(propName, (uchar*)"!", 1)) {
+ *pjson = pM->json;
+ FINALIZE;
+ }
+ name = (uchar*)es_str2cstr(propName, NULL);
+dbgprintf("AAAA: name to search '%s'\n", name);
+ leaf = jsonPathGetLeaf(name, ustrlen(name));
+dbgprintf("AAAA: leaf '%s'\n", leaf);
+ CHKiRet(jsonPathFindParent(pM, name, leaf, &parent, 1));
+ *pjson = json_object_object_get(parent, (char*)leaf);
+ if(*pjson == NULL) {
+ ABORT_FINALIZE(RS_RET_NOT_FOUND);
+ }
+
+finalize_it:
+ free(name);
+ RETiRet;
}
@@ -2648,7 +2700,6 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
uchar *pBuf;
int iLen;
short iOffs;
- es_str_t *str; /* for CEE handling, temp. string */
BEGINfunc
assert(pMsg != NULL);
@@ -2796,16 +2847,15 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
pRes = glbl.GetLocalHostName();
break;
case PROP_CEE_ALL_JSON:
- if(pMsg->event == NULL) {
- if(*pbMustBeFreed == 1)
- free(pRes);
- pRes = (uchar*) "{}";
- *pbMustBeFreed = 0;
+ if(pMsg->json == NULL) {
+ if(*pbMustBeFreed == 1)
+ free(pRes);
+ pRes = (uchar*) "{}";
+ bufLen = 2;
+ *pbMustBeFreed = 0;
} else {
- ee_fmtEventToJSON(pMsg->event, &str);
- pRes = (uchar*) es_str2cstr(str, "#000");
- es_deleteStr(str);
- *pbMustBeFreed = 1; /* all of these functions allocate dyn. memory */
+ pRes = (uchar*)strdup(json_object_get_string(pMsg->json));
+ *pbMustBeFreed = 1;
}
break;
case PROP_CEE:
@@ -3456,29 +3506,25 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
es_str_t*
msgGetCEEVarNew(msg_t *pMsg, char *name)
{
+ uchar *leaf;
+ char *val;
es_str_t *estr = NULL;
- es_str_t *epropName = NULL;
- struct ee_field *field;
+ struct json_object *json, *parent;
ISOBJ_TYPE_assert(pMsg, msg);
- if(pMsg->event == NULL) {
+ if(pMsg->json == NULL) {
estr = es_newStr(1);
goto done;
}
-
- epropName = es_newStrFromCStr(name, strlen(name)); // TODO: optimize (in grammar!)
- field = ee_getEventField(pMsg->event, epropName);
- if(field != NULL) {
- ee_getFieldAsString(field, &estr);
- }
- if(estr == NULL) {
- DBGPRINTF("msgGetCEEVar: error obtaining var (field=%p, var='%s')\n",
- field, name);
- estr = es_newStrFromCStr("*ERROR*", sizeof("*ERROR*") - 1);
+ leaf = jsonPathGetLeaf((uchar*)name, strlen(name));
+ if(jsonPathFindParent(pMsg, (uchar*)name, leaf, &parent, 1) != RS_RET_OK) {
+ estr = es_newStr(1);
+ goto done;
}
- es_deleteStr(epropName);
-
+ json = json_object_object_get(parent, (char*)leaf);
+ val = (char*)json_object_get_string(json);
+ estr = es_newStrFromCStr(val, strlen(val));
done:
return estr;
}
@@ -3613,6 +3659,118 @@ MsgGetSeverity(obj_t_ptr pThis, int *piSeverity)
}
+static uchar *
+jsonPathGetLeaf(uchar *name, int lenName)
+{
+ int i;
+ for(i = lenName ; name[i] != '!' && i >= 0 ; --i)
+ /* just skip */;
+ if(name[i] == '!')
+ ++i;
+ return name + i;
+}
+
+
+static rsRetVal
+jsonPathFindNext(struct json_object *root, uchar **name, uchar *leaf,
+ struct json_object **found, int bCreate)
+{
+ uchar namebuf[1024];
+ struct json_object *json;
+ size_t i;
+ uchar *p = *name;
+ DEFiRet;
+
+ if(*p == '!')
+ ++p;
+ for(i = 0 ; *p && *p != '!' && p != leaf && i < sizeof(namebuf)-1 ; ++i, ++p)
+ namebuf[i] = *p;
+ if(i == 0) {
+ namebuf[i] = '\0';
+ dbgprintf("AAAA: next JSONP elt: '%s'\n", namebuf);
+ json = json_object_object_get(root, (char*)namebuf);
+ } else
+ json = root;
+ if(json == NULL) {
+ if(!bCreate) {
+ ABORT_FINALIZE(RS_RET_JNAME_INVALID);
+ } else {
+ json = json_object_new_object();
+ json_object_object_add(root, (char*)namebuf, json);
+ }
+ }
+
+ *name = p;
+ *found = json;
+finalize_it:
+ RETiRet;
+}
+
+static rsRetVal
+jsonPathFindParent(msg_t *pM, uchar *name, uchar *leaf, struct json_object **parent, int bCreate)
+{
+ DEFiRet;
+ *parent = pM->json;
+ while(name < leaf-1) {
+ jsonPathFindNext(*parent, &name, leaf, parent, bCreate);
+dbgprintf("AAAA: name %p, leaf %p\n", name, leaf);
+ }
+ RETiRet;
+}
+
+static rsRetVal
+jsonMerge(struct json_object *existing, struct json_object *json)
+{
+ /* TODO: check & handle duplicate names */
+ DEFiRet;
+ struct json_object_iter it;
+
+ json_object_object_foreachC(json, it) {
+dbgprintf("AAAA jsonMerge adds '%s'\n", it.key);
+ json_object_object_add(existing, it.key,
+ json_object_get(it.val));
+ }
+ /* note: json-c does ref counting. We added all descandants refcounts
+ * in the loop above. So when we now free(_put) the root object, only
+ * root gets freed().
+ */
+ json_object_put(json);
+ RETiRet;
+}
+
+rsRetVal
+msgAddJSON(msg_t *pM, uchar *name, struct json_object *json)
+{
+ /* TODO: error checks! This is a quick&dirty PoC! */
+ struct json_object *parent, *leafnode;
+ uchar *leaf;
+ DEFiRet;
+
+ MsgLock(pM);
+ if(name[0] == '!' && name[1] == '\0') {
+ if(pM->json == NULL)
+ pM->json = json;
+ else
+ CHKiRet(jsonMerge(pM->json, json));
+ } else {
+ if(pM->json == NULL) {
+ /* now we need a root obj */
+ pM->json = json_object_new_object();
+ }
+ leaf = jsonPathGetLeaf(name, ustrlen(name));
+ CHKiRet(jsonPathFindParent(pM, name, leaf, &parent, 1));
+ leafnode = json_object_object_get(parent, (char*)leaf);
+ if(leafnode == NULL)
+ json_object_object_add(parent, (char*)leaf, json);
+ else
+ CHKiRet(jsonMerge(pM->json, json));
+ }
+
+finalize_it:
+ MsgUnlock(pM);
+ RETiRet;
+}
+
/* dummy */
rsRetVal msgQueryInterface(void) { return RS_RET_NOT_IMPLEMENTED; }
diff --git a/runtime/msg.h b/runtime/msg.h
index f6b54a77..857eb673 100644
--- a/runtime/msg.h
+++ b/runtime/msg.h
@@ -3,7 +3,7 @@
*
* File begun on 2007-07-13 by RGerhards (extracted from syslogd.c)
*
- * Copyright 2007-2009 Rainer Gerhards and Adiscon GmbH.
+ * Copyright 2007-2012 Rainer Gerhards and Adiscon GmbH.
*
* This file is part of the rsyslog runtime library.
*
@@ -30,6 +30,7 @@
#include <pthread.h>
#include <libestr.h>
+#include <json/json.h>
#include "obj.h"
#include "syslogd-types.h"
#include "template.h"
@@ -109,7 +110,7 @@ struct msg {
it obviously is solved in way or another...). */
struct syslogTime tRcvdAt;/* time the message entered this program */
struct syslogTime tTIMESTAMP;/* (parsed) value of the timestamp */
- struct ee_event *event; /**< libee event */
+ struct json_object *json;
/* some fixed-size buffers to save malloc()/free() for frequently used fields (from the default templates) */
uchar szRawMsg[CONF_RAWMSG_BUFSIZE]; /* most messages are small, and these are stored here (without malloc/free!) */
uchar szHOSTNAME[CONF_HOSTNAME_BUFSIZE];
@@ -184,6 +185,7 @@ char *getPRI(msg_t *pMsg);
void getRawMsg(msg_t *pM, uchar **pBuf, int *piLen);
rsRetVal msgGetCEEVar(msg_t *pThis, cstr_t *propName, var_t **ppVar);
es_str_t* msgGetCEEVarNew(msg_t *pMsg, char *name);
+rsRetVal msgAddJSON(msg_t *pM, uchar *name, struct json_object *json);
/* TODO: remove these five (so far used in action.c) */
uchar *getMSG(msg_t *pM);
@@ -199,6 +201,7 @@ int getProgramNameLen(msg_t *pM, sbool bLockMutex);
uchar *getRcvFrom(msg_t *pM);
rsRetVal propNameToID(cstr_t *pCSPropName, propid_t *pPropID);
uchar *propIDToName(propid_t propID);
+rsRetVal msgGetCEEPropJSON(msg_t *pM, es_str_t *propName, struct json_object **pjson);
/* The MsgPrepareEnqueue() function is a macro for performance reasons.
diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h
index 928c3ab9..b15b558e 100644
--- a/runtime/rsyslog.h
+++ b/runtime/rsyslog.h
@@ -382,6 +382,11 @@ enum rsRetVal_ /** return value. All methods return this if not specified oth
RS_RET_PARAM_NOT_PERMITTED = -2222, /**< legacy parameter no longer permitted (usally already set by v2) */
RS_RET_NO_JSON_PASSING = -2223, /**< rsyslog core does not support JSON-passing plugin API */
+ /**** up to 2300 is reserved for v6 use ****/
+ RS_RET_JNAME_NO_ROOT = -2301, /**< root element is missing in JSON path */
+ RS_RET_JNAME_INVALID = -2302, /**< JSON path is invalid */
+ RS_RET_JSON_PARSE_ERR = -2303, /**< we had a problem parsing JSON (or extra data) */
+
/* RainerScript error messages (range 1000.. 1999) */
RS_RET_SYSVAR_NOT_FOUND = 1001, /**< system variable could not be found (maybe misspelled) */
diff --git a/template.c b/template.c
index 27b508c6..3cef586c 100644
--- a/template.c
+++ b/template.c
@@ -44,6 +44,7 @@
#include "errmsg.h"
#include "strgen.h"
#include "rsconf.h"
+#include "msg.h"
#include "unicode-helper.h"
/* static data */
@@ -284,6 +285,7 @@ rsRetVal tplToJSON(struct template *pTpl, msg_t *pMsg, struct json_object **pjso
unsigned short bMustBeFreed;
uchar *pVal;
struct json_object *json, *jsonf;
+ rsRetVal localRet;
DEFiRet;
assert(pTpl != NULL);
@@ -298,14 +300,28 @@ rsRetVal tplToJSON(struct template *pTpl, msg_t *pMsg, struct json_object **pjso
jsonf = json_object_new_string((char*) pTpe->data.constant.pConstant);
json_object_object_add(json, (char*)pTpe->fieldName, jsonf);
} else if(pTpe->eEntryType == FIELD) {
- pVal = (uchar*) MsgGetProp(pMsg, pTpe, pTpe->data.field.propid,
- pTpe->data.field.propName, &propLen, &bMustBeFreed);
- if(pTpe->data.field.options.bMandatory || propLen > 0) {
- jsonf = json_object_new_string_len((char*)pVal, propLen);
- json_object_object_add(json, (char*)pTpe->fieldName, jsonf);
- }
- if(bMustBeFreed) { /* json-c makes its own private copy! */
- free(pVal);
+ if(pTpe->data.field.propid == PROP_CEE) {
+ localRet = msgGetCEEPropJSON(pMsg, pTpe->data.field.propName, &jsonf);
+ if(localRet == RS_RET_OK) {
+ json_object_object_add(json, (char*)pTpe->fieldName, json_object_get(jsonf));
+ } else {
+ DBGPRINTF("tplToJSON: error %d looking up property\n",
+ localRet);
+ if(pTpe->data.field.options.bMandatory) {
+ json_object_object_add(json, (char*)pTpe->fieldName, NULL);
+ }
+ }
+ } else {
+ pVal = (uchar*) MsgGetProp(pMsg, pTpe, pTpe->data.field.propid,
+ pTpe->data.field.propName, &propLen,
+ &bMustBeFreed);
+ if(pTpe->data.field.options.bMandatory || propLen > 0) {
+ jsonf = json_object_new_string_len((char*)pVal, propLen);
+ json_object_object_add(json, (char*)pTpe->fieldName, jsonf);
+ }
+ if(bMustBeFreed) { /* json-c makes its own private copy! */
+ free(pVal);
+ }
}
}
}
@@ -727,7 +743,7 @@ static int do_Parameter(unsigned char **pp, struct template *pTpl)
}
if(pTpe->data.field.propid == PROP_CEE) {
/* in CEE case, we need to preserve the actual property name */
- if((pTpe->data.field.propName = es_newStrFromCStr((char*)cstrGetSzStrNoNULL(pStrProp)+2, cstrLen(pStrProp)-2)) == NULL) {
+ if((pTpe->data.field.propName = es_newStrFromCStr((char*)cstrGetSzStrNoNULL(pStrProp)+1, cstrLen(pStrProp)-1)) == NULL) {
cstrDestruct(&pStrProp);
return 1;
}
@@ -1281,7 +1297,7 @@ static rsRetVal
createPropertyTpe(struct template *pTpl, struct cnfobj *o)
{
struct templateEntry *pTpe;
- cstr_t *name;
+ cstr_t *name = NULL;
uchar *outname = NULL;
int i;
int droplastlf = 0;
@@ -1312,9 +1328,12 @@ createPropertyTpe(struct template *pTpl, struct cnfobj *o)
if(!pvals[i].bUsed)
continue;
if(!strcmp(pblkProperty.descr[i].name, "name")) {
- rsCStrConstructFromszStr(&name,
- (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL));
+ char *tmp;
+
+ tmp = es_str2cstr(pvals[i].val.d.estr, NULL);
+ rsCStrConstructFromszStr(&name, (uchar*)tmp);
cstrFinalize(name);
+ free(tmp);
} else if(!strcmp(pblkProperty.descr[i].name, "droplastlf")) {
droplastlf = pvals[i].val.d.n;
} else if(!strcmp(pblkProperty.descr[i].name, "mandatory")) {
@@ -1475,8 +1494,8 @@ createPropertyTpe(struct template *pTpl, struct cnfobj *o)
CHKiRet(propNameToID(name, &pTpe->data.field.propid));
if(pTpe->data.field.propid == PROP_CEE) {
/* in CEE case, we need to preserve the actual property name */
- pTpe->data.field.propName = es_newStrFromCStr((char*)cstrGetSzStrNoNULL(name)+2,
- cstrLen(name)-2);
+ pTpe->data.field.propName = es_newStrFromCStr((char*)cstrGetSzStrNoNULL(name)+1,
+ cstrLen(name)-1);
}
pTpe->data.field.options.bDropLastLF = droplastlf;
pTpe->data.field.options.bSPIffNo1stSP = spifno1stsp;
@@ -1521,7 +1540,7 @@ createPropertyTpe(struct template *pTpl, struct cnfobj *o)
pTpe->data.field.options.bSecPathReplace = 1;
break;
}
- pTpe->fieldName = ustrdup(outname);
+ pTpe->fieldName = outname;
if(outname != NULL)
pTpe->lenFieldName = ustrlen(outname);
pTpe->data.field.eDateFormat = datefmt;
@@ -1563,6 +1582,10 @@ createPropertyTpe(struct template *pTpl, struct cnfobj *o)
}
finalize_it:
+ if(pvals != NULL)
+ cnfparamvalsDestruct(pvals, &pblkProperty);
+ if(name != NULL)
+ rsCStrDestruct(&name);
RETiRet;
}
@@ -1746,6 +1769,8 @@ tplProcessCnf(struct cnfobj *o)
pTpl->optFormatEscape = JSON_ESCAPE;
finalize_it:
+ if(pvals != NULL)
+ cnfparamvalsDestruct(pvals, &pblk);
if(iRet != RS_RET_OK) {
if(pTpl != NULL) {
/* we simply make the template defunct in this case by setting
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-28 20:24:04 +0000