summaryrefslogtreecommitdiffstats
path: root/runtime/msg.c
diff options
context:
space:
mode:
Diffstat (limited to 'runtime/msg.c')
-rw-r--r--runtime/msg.c337
1 files changed, 214 insertions, 123 deletions
diff --git a/runtime/msg.c b/runtime/msg.c
index a52d0cce..8f92565a 100644
--- a/runtime/msg.c
+++ b/runtime/msg.c
@@ -37,6 +37,7 @@
#include <ctype.h>
#include <sys/socket.h>
#include <netdb.h>
+#include <libestr.h>
#include <libee/libee.h>
#if HAVE_MALLOC_H
# include <malloc.h>
@@ -46,7 +47,6 @@
#include "stringbuf.h"
#include "template.h"
#include "msg.h"
-#include "var.h"
#include "datetime.h"
#include "glbl.h"
#include "regexp.h"
@@ -58,7 +58,6 @@
/* static data */
DEFobjStaticHelpers
-DEFobjCurrIf(var)
DEFobjCurrIf(datetime)
DEFobjCurrIf(glbl)
DEFobjCurrIf(regexp)
@@ -422,6 +421,7 @@ resolveDNS(msg_t *pMsg) {
uchar fromHostFQDN[NI_MAXHOST];
DEFiRet;
+dbgprintf("XXXX: in msg/resolveDNS (dnscache)\n");
MsgLock(pMsg);
CHKiRet(objUse(net, CORE_COMPONENT));
if(pMsg->msgFlags & NEEDS_DNSRESOL) {
@@ -432,12 +432,12 @@ resolveDNS(msg_t *pMsg) {
}
}
finalize_it:
- MsgUnlock(pMsg);
if(iRet != RS_RET_OK) {
/* best we can do: remove property */
MsgSetRcvFromStr(pMsg, UCHAR_CONSTANT(""), 0, &propFromHost);
prop.Destruct(&propFromHost);
}
+ MsgUnlock(pMsg);
if(propFromHost != NULL)
prop.Destruct(&propFromHost);
if(propFromHostIP != NULL)
@@ -480,16 +480,13 @@ getRcvFromIP(msg_t *pM)
}
-
-/* map a property name (string) to a property ID */
-rsRetVal propNameToID(cstr_t *pCSPropName, propid_t *pPropID)
+/* map a property name (C string) to a property ID */
+rsRetVal
+propNameStrToID(uchar *pName, propid_t *pPropID)
{
- uchar *pName;
DEFiRet;
- assert(pCSPropName != NULL);
- assert(pPropID != NULL);
- pName = rsCStrGetSzStrNoNULL(pCSPropName);
+ assert(pName != NULL);
/* sometimes there are aliases to the original MonitoWare
* property names. These come after || in the ifs below. */
@@ -504,11 +501,6 @@ rsRetVal propNameToID(cstr_t *pCSPropName, propid_t *pPropID)
*pPropID = PROP_SYSLOGTAG;
} else if(!strcmp((char*) pName, "rawmsg")) {
*pPropID = PROP_RAWMSG;
- /* enable this, if someone actually uses UxTradMsg, delete after some time has
- * passed and nobody complained -- rgerhards, 2009-06-16
- } else if(!strcmp((char*) pName, "uxtradmsg")) {
- pRes = getUxTradMsg(pMsg);
- */
} else if(!strcmp((char*) pName, "inputname")) {
*pPropID = PROP_INPUTNAME;
} else if(!strcmp((char*) pName, "fromhost")) {
@@ -543,6 +535,8 @@ rsRetVal propNameToID(cstr_t *pCSPropName, propid_t *pPropID)
*pPropID = PROP_PROCID;
} else if(!strcmp((char*) pName, "msgid")) {
*pPropID = PROP_MSGID;
+ } else if(!strcmp((char*) pName, "parsesuccess")) {
+ *pPropID = PROP_PARSESUCCESS;
/* here start system properties (those, that do not relate to the message itself */
} else if(!strcmp((char*) pName, "$now")) {
*pPropID = PROP_SYS_NOW;
@@ -577,6 +571,21 @@ rsRetVal propNameToID(cstr_t *pCSPropName, propid_t *pPropID)
}
+/* map a property name (string) to a property ID */
+rsRetVal
+propNameToID(cstr_t *pCSPropName, propid_t *pPropID)
+{
+ uchar *pName;
+ DEFiRet;
+
+ assert(pCSPropName != NULL);
+ assert(pPropID != NULL);
+ pName = rsCStrGetSzStrNoNULL(pCSPropName);
+ iRet = propNameStrToID(pName, pPropID);
+ RETiRet;
+}
+
+
/* map a property ID to a name string (useful for displaying) */
uchar *propIDToName(propid_t propID)
{
@@ -591,12 +600,6 @@ uchar *propIDToName(propid_t propID)
return UCHAR_CONSTANT("syslogtag");
case PROP_RAWMSG:
return UCHAR_CONSTANT("rawmsg");
- /* enable this, if someone actually uses UxTradMsg, delete after some time has
- * passed and nobody complained -- rgerhards, 2009-06-16
- case PROP_UXTRADMSG:
- pRes = getUxTradMsg(pMsg);
- break;
- */
case PROP_INPUTNAME:
return UCHAR_CONSTANT("inputname");
case PROP_FROMHOST:
@@ -631,6 +634,8 @@ uchar *propIDToName(propid_t propID)
return UCHAR_CONSTANT("procid");
case PROP_MSGID:
return UCHAR_CONSTANT("msgid");
+ case PROP_PARSESUCCESS:
+ return UCHAR_CONSTANT("parsesuccess");
case PROP_SYS_NOW:
return UCHAR_CONSTANT("$NOW");
case PROP_SYS_YEAR:
@@ -693,6 +698,7 @@ static inline rsRetVal msgBaseConstruct(msg_t **ppThis)
pM->flowCtlType = 0;
pM->bDoLock = 0;
pM->bAlreadyFreed = 0;
+ pM->bParseSuccess = 0;
pM->iRefCount = 1;
pM->iSeverity = -1;
pM->iFacility = -1;
@@ -731,6 +737,8 @@ static inline rsRetVal msgBaseConstruct(msg_t **ppThis)
pM->pszTimestamp3339[0] = '\0';
pM->pszTIMESTAMP_SecFrac[0] = '\0';
pM->pszRcvdAt_SecFrac[0] = '\0';
+ pM->pszTIMESTAMP_Unix[0] = '\0';
+ pM->pszRcvdAt_Unix[0] = '\0';
/* DEV debugging only! dbgprintf("msgConstruct\t0x%x, ref 1\n", (int)pM);*/
@@ -973,10 +981,6 @@ msg_t* MsgDup(msg_t* pOld)
pNew->pInputName = pOld->pInputName;
prop.AddRef(pNew->pInputName);
}
- /* enable this, if someone actually uses UxTradMsg, delete after some time has
- * passed and nobody complained -- rgerhards, 2009-06-16
- pNew->offAfterPRI = pOld->offAfterPRI;
- */
if(pOld->iLenTAG > 0) {
if(pOld->iLenTAG < CONF_TAG_BUFSIZE) {
memcpy(pNew->TAG.szBuf, pOld->TAG.szBuf, pOld->iLenTAG + 1);
@@ -1048,10 +1052,6 @@ static rsRetVal MsgSerialize(msg_t *pThis, strm_t *pStrm)
objSerializeSCALAR(pStrm, ttGenTime, INT);
objSerializeSCALAR(pStrm, tRcvdAt, SYSLOGTIME);
objSerializeSCALAR(pStrm, tTIMESTAMP, SYSLOGTIME);
- /* enable this, if someone actually uses UxTradMsg, delete after some time has
- * passed and nobody complained -- rgerhards, 2009-06-16
- objSerializeSCALAR(pStrm, offsAfterPRI, SHORT);
- */
CHKiRet(obj.SerializeProp(pStrm, UCHAR_CONSTANT("pszTAG"), PROPTYPE_PSZ, (void*)
((pThis->iLenTAG < CONF_TAG_BUFSIZE) ? pThis->TAG.szBuf : pThis->TAG.pszTAG)));
@@ -1245,18 +1245,6 @@ getRawMsg(msg_t *pM, uchar **pBuf, int *piLen)
}
-/* enable this, if someone actually uses UxTradMsg, delete after some time has
- * passed and nobody complained -- rgerhards, 2009-06-16
-char *getUxTradMsg(msg_t *pM)
-{
- if(pM == NULL)
- return "";
- else
- return (char*)pM->pszRawMsg + pM->offAfterPRI;
-}
-*/
-
-
int getMSGLen(msg_t *pM)
{
return((pM == NULL) ? 0 : pM->iLenMSG);
@@ -1351,6 +1339,13 @@ getTimeReported(msg_t *pM, enum tplFormatTypes eFmt)
}
MsgUnlock(pM);
return(pM->pszTIMESTAMP3339);
+ case tplFmtUnixDate:
+ MsgLock(pM);
+ if(pM->pszTIMESTAMP_Unix[0] == '\0') {
+ datetime.formatTimestampUnix(&pM->tTIMESTAMP, pM->pszTIMESTAMP_Unix);
+ }
+ MsgUnlock(pM);
+ return(pM->pszTIMESTAMP_Unix);
case tplFmtSecFrac:
if(pM->pszTIMESTAMP_SecFrac[0] == '\0') {
MsgLock(pM);
@@ -1430,6 +1425,13 @@ static inline char *getTimeGenerated(msg_t *pM, enum tplFormatTypes eFmt)
}
MsgUnlock(pM);
return(pM->pszRcvdAt3339);
+ case tplFmtUnixDate:
+ MsgLock(pM);
+ if(pM->pszRcvdAt_Unix[0] == '\0') {
+ datetime.formatTimestampUnix(&pM->tRcvdAt, pM->pszRcvdAt_Unix);
+ }
+ MsgUnlock(pM);
+ return(pM->pszRcvdAt_Unix);
case tplFmtSecFrac:
if(pM->pszRcvdAt_SecFrac[0] == '\0') {
MsgLock(pM);
@@ -1651,6 +1653,15 @@ finalize_it:
}
+/* Return state of last parser. If it had success, "OK" is returned, else
+ * "FAIL". All from the constant pool.
+ */
+static inline char *getParseSuccess(msg_t *pM)
+{
+ return (pM->bParseSuccess) ? "OK" : "FAIL";
+}
+
+
/* al, 2011-07-26: LockMsg to avoid race conditions
*/
static inline char *getMSGID(msg_t *pM)
@@ -1666,6 +1677,14 @@ static inline char *getMSGID(msg_t *pM)
}
}
+/* rgerhards 2012-03-15: set parser success (an integer, acutally bool)
+ */
+void MsgSetParseSuccess(msg_t *pMsg, int bSuccess)
+{
+ assert(pMsg != NULL);
+ pMsg->bParseSuccess = bSuccess;
+}
+
/* rgerhards 2009-06-12: set associated ruleset
*/
void MsgSetRuleset(msg_t *pMsg, ruleset_t *pRuleset)
@@ -1683,8 +1702,6 @@ void MsgSetTAG(msg_t *pMsg, uchar* pszBuf, size_t lenBuf)
uchar *pBuf;
assert(pMsg != NULL);
-dbgprintf("MsgSetTAG in: len %d, pszBuf: %s\n", lenBuf, pszBuf);
-
freeTAG(pMsg);
pMsg->iLenTAG = lenBuf;
@@ -1703,8 +1720,6 @@ dbgprintf("MsgSetTAG in: len %d, pszBuf: %s\n", lenBuf, pszBuf);
memcpy(pBuf, pszBuf, pMsg->iLenTAG);
pBuf[pMsg->iLenTAG] = '\0'; /* this also works with truncation! */
-
-dbgprintf("MsgSetTAG exit: pMsg->iLenTAG %d, pMsg->TAG.szBuf: %s\n", pMsg->iLenTAG, pMsg->TAG.szBuf);
}
@@ -2335,6 +2350,112 @@ finalize_it:
}
}
+
+/* encode a property in JSON escaped format. This is a helper
+ * to MsgGetProp. It needs to update all provided parameters.
+ * Note: Code is borrowed from libee (my own code, so ASL 2.0
+ * is fine with it); this function may later be replaced by
+ * some "better" and more complete implementation (maybe from
+ * libee or its helpers).
+ * For performance reasons, we begin to copy the string only
+ * when we recognice that we actually need to do some escaping.
+ * rgerhards, 2012-03-16
+ */
+static rsRetVal
+jsonEncode(uchar **ppRes, unsigned short *pbMustBeFreed, int *pBufLen)
+{
+ static char hexdigit[16] =
+ {'0', '1', '2', '3', '4', '5', '6', '7', '8',
+ '9', 'A', 'B', 'C', 'D', 'E', 'F' };
+ unsigned char c;
+ es_size_t i;
+ char numbuf[4];
+ int j;
+ unsigned buflen;
+ uchar *pSrc;
+ es_str_t *dst = NULL;
+ DEFiRet;
+
+ pSrc = *ppRes;
+ buflen = (*pBufLen == -1) ? ustrlen(pSrc) : *pBufLen;
+ for(i = 0 ; i < buflen ; ++i) {
+ c = pSrc[i];
+ if( (c >= 0x23 && c <= 0x5b)
+ || (c >= 0x5d /* && c <= 0x10FFFF*/)
+ || c == 0x20 || c == 0x21) {
+ /* no need to escape */
+ if(dst != NULL)
+ es_addChar(&dst, c);
+ } else {
+ if(dst == NULL) {
+ if(i == 0) {
+ /* we hope we have only few escapes... */
+ dst = es_newStr(buflen+10);
+ } else {
+ dst = es_newStrFromBuf((char*)pSrc, i-1);
+ }
+ if(dst == NULL) {
+ ABORT_FINALIZE(RS_RET_OUT_OF_MEMORY);
+ }
+ }
+ /* we must escape, try RFC4627-defined special sequences first */
+ switch(c) {
+ case '\0':
+ es_addBuf(&dst, "\\u0000", 6);
+ break;
+ case '\"':
+ es_addBuf(&dst, "\\\"", 2);
+ break;
+ case '/':
+ es_addBuf(&dst, "\\/", 2);
+ break;
+ case '\\':
+ es_addBuf(&dst, "\\\\", 2);
+ break;
+ case '\010':
+ es_addBuf(&dst, "\\b", 2);
+ break;
+ case '\014':
+ es_addBuf(&dst, "\\f", 2);
+ break;
+ case '\n':
+ es_addBuf(&dst, "\\n", 2);
+ break;
+ case '\r':
+ es_addBuf(&dst, "\\r", 2);
+ break;
+ case '\t':
+ es_addBuf(&dst, "\\t", 2);
+ break;
+ default:
+ /* TODO : proper Unicode encoding (see header comment) */
+ for(j = 0 ; j < 4 ; ++j) {
+ numbuf[3-j] = hexdigit[c % 16];
+ c = c / 16;
+ }
+ es_addBuf(&dst, "\\u", 2);
+ es_addBuf(&dst, numbuf, 4);
+ break;
+ }
+ }
+ }
+
+ if(dst != NULL) {
+ /* we updated the string and need to replace the
+ * previous data.
+ */
+ if(*pbMustBeFreed)
+ free(*ppRes);
+ *ppRes = (uchar*)es_str2cstr(dst, NULL);
+ *pbMustBeFreed = 1;
+ es_deleteStr(dst);
+ }
+
+finalize_it:
+ RETiRet;
+}
+
+
/* This function returns a string-representation of the
* requested message property. This is a generic function used
* to abstract properties so that these can be easier
@@ -2418,12 +2539,6 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
case PROP_RAWMSG:
getRawMsg(pMsg, &pRes, &bufLen);
break;
- /* enable this, if someone actually uses UxTradMsg, delete after some time has
- * passed and nobody complained -- rgerhards, 2009-06-16
- case PROP_UXTRADMSG:
- pRes = getUxTradMsg(pMsg);
- break;
- */
case PROP_INPUTNAME:
getInputName(pMsg, &pRes, &bufLen);
break;
@@ -2482,6 +2597,9 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
case PROP_MSGID:
pRes = (uchar*)getMSGID(pMsg);
break;
+ case PROP_PARSESUCCESS:
+ pRes = (uchar*)getParseSuccess(pMsg);
+ break;
case PROP_SYS_NOW:
if((pRes = getNOW(NOW_NOW)) == NULL) {
RET_OUT_OF_MEMORY;
@@ -2534,10 +2652,17 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
pRes = glbl.GetLocalHostName();
break;
case PROP_CEE_ALL_JSON:
- ee_fmtEventToJSON(pMsg->event, &str);
- pRes = (uchar*) es_str2cstr(str, "#000");
- es_deleteStr(str);
- *pbMustBeFreed = 1; /* all of these functions allocate dyn. memory */
+ if(pMsg->event == NULL) {
+ if(*pbMustBeFreed == 1)
+ free(pRes);
+ pRes = (uchar*) "";
+ *pbMustBeFreed = 0;
+ } else {
+ ee_fmtEventToJSON(pMsg->event, &str);
+ pRes = (uchar*) es_str2cstr(str, "#000");
+ es_deleteStr(str);
+ *pbMustBeFreed = 1; /* all of these functions allocate dyn. memory */
+ }
break;
case PROP_CEE:
getCEEPropVal(pMsg, propName, &pRes, &bufLen, pbMustBeFreed);
@@ -3102,8 +3227,8 @@ dbgprintf("prop repl 4, pRes='%s', len %d\n", pRes, bufLen);
}
}
- /* finally, we need to check if the property should be formatted in CSV
- * format (we use RFC 4180, and always use double quotes). As of this writing,
+ /* finally, we need to check if the property should be formatted in CSV or JSON.
+ * For CSV we use RFC 4180, and always use double quotes. As of this writing,
* this should be the last action carried out on the property, but in the
* future there may be reasons to change that. -- rgerhards, 2009-04-02
*/
@@ -3137,6 +3262,8 @@ dbgprintf("prop repl 4, pRes='%s', len %d\n", pRes, bufLen);
pRes = pBStart;
bufLen = -1;
*pbMustBeFreed = 1;
+ } else if(pTpe->data.field.options.bJSON) {
+ jsonEncode(&pRes, pbMustBeFreed, &bufLen);
}
if(bufLen == -1)
@@ -3149,98 +3276,68 @@ dbgprintf("end prop repl, pRes='%s', len %d\n", pRes, bufLen);
}
-/* The function returns a cee variable suitable for use with RainerScript. Most importantly, this means
- * that the value is returned in a var_t object. The var_t is constructed inside this function and
- * MUST be freed by the caller.
+/* The function returns a cee variable suitable for use with RainerScript.
+ * Note: caller must free the returned string.
* Note that we need to do a lot of conversions between es_str_t and cstr -- this will go away once
* we have moved larger parts of rsyslog to es_str_t. Acceptable for the moment, especially as we intend
* to rewrite the script engine as well!
* rgerhards, 2010-12-03
*/
-rsRetVal
-msgGetCEEVar(msg_t *pMsg, cstr_t *propName, var_t **ppVar)
+es_str_t*
+msgGetCEEVarNew(msg_t *pMsg, char *name)
{
- DEFiRet;
- var_t *pVar;
- cstr_t *pstrProp;
- es_str_t *str = NULL;
+ es_str_t *estr = NULL;
es_str_t *epropName = NULL;
- int r;
+ struct ee_field *field;
ISOBJ_TYPE_assert(pMsg, msg);
- ASSERT(propName != NULL);
- ASSERT(ppVar != NULL);
- /* make sure we have a var_t instance */
- CHKiRet(var.Construct(&pVar));
- CHKiRet(var.ConstructFinalize(pVar));
-
- epropName = es_newStrFromBuf((char*)propName->pBuf, propName->iStrLen);
- r = ee_getEventFieldAsString(pMsg->event, epropName, &str);
-
- if(r != EE_OK) {
- DBGPRINTF("msgGtCEEVar: libee error %d during ee_getEventFieldAsString\n", r);
- CHKiRet(cstrConstruct(&pstrProp));
- CHKiRet(cstrFinalize(pstrProp));
- } else {
- CHKiRet(cstrConstructFromESStr(&pstrProp, str));
+ if(pMsg->event == NULL) {
+ estr = es_newStr(1);
+ goto done;
}
- /* now create a string object out of it and hand that over to the var */
- CHKiRet(var.SetString(pVar, pstrProp));
- es_deleteStr(str);
-
- /* finally store var */
- *ppVar = pVar;
+ epropName = es_newStrFromCStr(name, strlen(name)); // TODO: optimize (in grammar!)
+ field = ee_getEventField(pMsg->event, epropName);
+ if(field != NULL) {
+ ee_getFieldAsString(field, &estr);
+ }
+ if(estr == NULL) {
+ DBGPRINTF("msgGetCEEVar: error obtaining var (field=%p, var='%s')\n",
+ field, name);
+ estr = es_newStrFromCStr("*ERROR*", sizeof("*ERROR*") - 1);
+ }
+ es_deleteStr(epropName);
-finalize_it:
- if(epropName != NULL)
- es_deleteStr(epropName);
- RETiRet;
+done:
+ return estr;
}
-/* The returns a message variable suitable for use with RainerScript. Most importantly, this means
- * that the value is returned in a var_t object. The var_t is constructed inside this function and
- * MUST be freed by the caller.
- * rgerhards, 2008-02-25
+/* Return an es_str_t for given message property.
*/
-rsRetVal
-msgGetMsgVar(msg_t *pThis, cstr_t *pstrPropName, var_t **ppVar)
+es_str_t*
+msgGetMsgVarNew(msg_t *pThis, uchar *name)
{
- DEFiRet;
- var_t *pVar;
size_t propLen;
uchar *pszProp = NULL;
- cstr_t *pstrProp;
propid_t propid;
unsigned short bMustBeFreed = 0;
+ es_str_t *estr;
ISOBJ_TYPE_assert(pThis, msg);
- ASSERT(pstrPropName != NULL);
- ASSERT(ppVar != NULL);
-
- /* make sure we have a var_t instance */
- CHKiRet(var.Construct(&pVar));
- CHKiRet(var.ConstructFinalize(pVar));
/* always call MsgGetProp() without a template specifier */
/* TODO: optimize propNameToID() call -- rgerhards, 2009-06-26 */
- propNameToID(pstrPropName, &propid);
+ propNameStrToID(name, &propid);
pszProp = (uchar*) MsgGetProp(pThis, NULL, propid, NULL, &propLen, &bMustBeFreed);
- /* now create a string object out of it and hand that over to the var */
- CHKiRet(rsCStrConstructFromszStr(&pstrProp, pszProp));
- CHKiRet(var.SetString(pVar, pstrProp));
-
- /* finally store var */
- *ppVar = pVar;
-
-finalize_it:
+dbgprintf("ZZZZ: var %s returns '%s'\n", name, pszProp);
+ estr = es_newStrFromCStr((char*)pszProp, propLen);
if(bMustBeFreed)
free(pszProp);
- RETiRet;
+ return estr;
}
@@ -3273,11 +3370,6 @@ rsRetVal MsgSetProperty(msg_t *pThis, var_t *pProp)
MsgSetMSGoffs(pThis, pProp->val.num);
} else if(isProp("pszRawMsg")) {
MsgSetRawMsg(pThis, (char*) rsCStrGetSzStrNoNULL(pProp->val.pStr), cstrLen(pProp->val.pStr));
- /* enable this, if someone actually uses UxTradMsg, delete after some time has
- * passed and nobody complained -- rgerhards, 2009-06-16
- } else if(isProp("offAfterPRI")) {
- pThis->offAfterPRI = pProp->val.num;
- */
} else if(isProp("pszUxTradMsg")) {
/*IGNORE*/; /* this *was* a property, but does no longer exist */
} else if(isProp("pszTAG")) {
@@ -3356,7 +3448,6 @@ rsRetVal msgQueryInterface(void) { return RS_RET_NOT_IMPLEMENTED; }
*/
BEGINObjClassInit(msg, 1, OBJ_IS_CORE_MODULE)
/* request objects we use */
- CHKiRet(objUse(var, CORE_COMPONENT));
CHKiRet(objUse(datetime, CORE_COMPONENT));
CHKiRet(objUse(glbl, CORE_COMPONENT));
CHKiRet(objUse(prop, CORE_COMPONENT));
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-10 10:31:22 +0000