static inline int
ln_addTags_Syslog(struct json_object *taglist, es_str_t **str)
{
int r = 0;
struct json_object *tagObj;
int needComma = 0;
const char *tagCstr;
int i;
assert(json_object_is_type(taglist, json_type_array));
CHKR(es_addBuf(str, " event.tags=\"", 13));
for (i = json_object_array_length(taglist) - 1; i >= 0; i--) {
if(needComma)
es_addChar(str, ',');
else
needComma = 1;
CHKN(tagObj = json_object_array_get_idx(taglist, i));
CHKN(tagCstr = json_object_get_string(tagObj));
CHKR(es_addBuf(str, (char*)tagCstr, strlen(tagCstr)));
}
es_addChar(str, '"');
done:
return r;
}
int
ln_fmtEventToRFC5424(struct json_object *json, es_str_t **str)
{
int r = -1;
struct json_object *tags;
assert(json != NULL);
assert(json_object_is_type(json, json_type_object));
if((*str = es_newStr(256)) == NULL)
goto done;
es_addBuf(str, "[cee@115", 8);
if(json_object_object_get_ex(json, "event.tags", &tags)) {
CHKR(ln_addTags_Syslog(tags, str));
}
struct json_object_iterator it = json_object_iter_begin(json);
struct json_object_iterator itEnd = json_object_iter_end(json);
while (!json_object_iter_equal(&it, &itEnd)) {
char *const name = (char*)json_object_iter_peek_name(&it);
if (strcmp(name, "event.tags")) {
es_addChar(str, ' ');
ln_addField_Syslog(name, json_object_iter_peek_value(&it), str);
}
json_object_iter_next(&it);
}
es_addChar(str, ']');
done:
return r;
}
/**
* Special parser for iptables-like name/value pairs.
* The pull multiple fields. Note that once this parser has been selected,
* it is very unlikely to be left, as it is *very* generic. This parser is
* required because practice shows that already-structured data like iptables
* can otherwise not be processed by liblognorm in a meaningful way.
*
* @param[in] tree current tree to process
* @param[in] str string to be matched against (the to-be-normalized data)
* @param[in] strLen length of str
* @param[in/out] offs start position in input data, on exit first unparsed position
* @param[in/out] event handle to event that is being created during normalization
*
* @return 0 if parser was successfully, something else on error
*/
static int
ln_iptablesParser(struct ln_ptree *tree, const char *str, size_t strLen, size_t *offs,
struct json_object *json)
{
int r;
size_t o = *offs;
es_str_t *fname;
es_str_t *fval;
const char *pstr;
const char *end;
struct json_object *value;
ln_dbgprintf(tree->ctx, "%zu enter iptables parser, len %zu", *offs, strLen);
if(o == strLen) {
r = -1; /* can not be, we have no n/v pairs! */
goto done;
}
end = str + strLen;
pstr = str + o;
while(pstr < end) {
while(pstr < end && isspace(*pstr))
++pstr;
CHKN(fname = es_newStr(16));
while(pstr < end && !isspace(*pstr) && *pstr != '=') {
es_addChar(&fname, *pstr);
++pstr;
}
if(pstr < end && *pstr == '=') {
CHKN(fval = es_newStr(16));
++pstr;
/* error on space */
while(pstr < end && !isspace(*pstr)) {
es_addChar(&fval, *pstr);
++pstr;
}
} else {
CHKN(fval = es_newStrFromCStr("[*PRESENT*]",
sizeof("[*PRESENT*]")-1));
}
char *cn, *cv;
CHKN(cn = ln_es_str2cstr(&fname));
CHKN(cv = ln_es_str2cstr(&fval));
if (tree->ctx->debug) {
ln_dbgprintf(tree->ctx, "iptables parser extracts %s=%s", cn, cv);
}
CHKN(value = json_object_new_string(cv));
json_object_object_add(json, cn, value);
es_deleteStr(fval);
es_deleteStr(fname);
}
r = 0;
*offs = strLen;
done:
ln_dbgprintf(tree->ctx, "%zu iptables parser returns %d", *offs, r);
return r;
}
static int
ln_addField_Syslog(char *name, struct json_object *field, es_str_t **str)
{
int r;
const char *value;
int needComma = 0;
struct json_object *obj;
int i;
assert(field != NULL);
assert(str != NULL);
assert(*str != NULL);
CHKR(es_addBuf(str, name, strlen(name)));
CHKR(es_addBuf(str, "=\"", 2));
switch(json_object_get_type(field)) {
case json_type_array:
for (i = json_object_array_length(field) - 1; i >= 0; i--) {
if(needComma)
es_addChar(str, ',');
else
needComma = 1;
CHKN(obj = json_object_array_get_idx(field, i));
CHKN(value = json_object_get_string(obj));
CHKR(ln_addValue_Syslog(value, str));
}
break;
case json_type_string:
case json_type_int:
CHKN(value = json_object_get_string(field));
CHKR(ln_addValue_Syslog(value, str));
break;
case json_type_null:
case json_type_boolean:
case json_type_double:
case json_type_object:
CHKR(es_addBuf(str, "***unsupported type***", sizeof("***unsupported type***")-1));
break;
default:
CHKR(es_addBuf(str, "***OBJECT***", sizeof("***OBJECT***")-1));
}
CHKR(es_addChar(str, '\"'));
r = 0;
done:
return r;
}
int
ee_addField_JSON(struct ee_field *field, es_str_t **str)
{
int r;
struct ee_valnode *valnode;
assert(field != NULL);assert(field->objID== ObjID_FIELD);
assert(str != NULL); assert(*str != NULL);
#ifdef NO_EMPTY_FIELDS
if(field->nVals == 0) {
r = 1;
goto done;
} else if(field->nVals == 1 && es_strlen(field->val->val.str) == 0) {
r = 1;
goto done;
}
#endif
CHKR(es_addChar(str, '\"'));
CHKR(es_addStr(str, field->name));
if(ee_ctxIsEncUltraCompact(field->ctx)) {
CHKR(es_addBuf(str, "\":", 2));
} else {
CHKR(es_addBuf(str, "\": ", 3));
}
if(field->nVals == 0) {
if(ee_ctxIsEncUltraCompact(field->ctx)) {
CHKR(es_addChar(str, '\"'));
} else {
CHKR(es_addBuf(str, "\"\"", 2));
}
} else if(field->nVals == 1) {
CHKR(ee_addValue_JSON(field->val, str));
} else { /* we have multiple values --> array */
CHKR(es_addChar(str, '['));
CHKR(ee_addValue_JSON(field->val, str));
for(valnode = field->valroot ; valnode != NULL ; valnode = valnode->next) {
CHKR(es_addChar(str, ','));
CHKR(ee_addValue_JSON(valnode->val, str));
}
CHKR(es_addChar(str, ']'));
}
r = 0;
done:
return r;
}
/**
* recursive handler for DOT graph generator.
*/
static void
ln_genDotPTreeGraphRec(struct ln_ptree *tree, es_str_t **str)
{
int i;
ln_fieldList_t *node;
dotAddPtr(str, tree);
es_addBufConstcstr(str, " [label=\"");
if(tree->lenPrefix > 0) {
es_addChar(str, '\'');
es_addBuf(str, (char*) prefixBase(tree), tree->lenPrefix);
es_addChar(str, '\'');
}
es_addBufConstcstr(str, "\"");
if(isLeaf(tree)) {
es_addBufConstcstr(str, " style=\"bold\"");
}
es_addBufConstcstr(str, "]\n");
/* display char subtrees */
for(i = 0 ; i < 256 ; ++i) {
if(tree->subtree[i] != NULL) {
dotAddPtr(str, tree);
es_addBufConstcstr(str, " -> ");
dotAddPtr(str, tree->subtree[i]);
es_addBufConstcstr(str, " [label=\"");
es_addChar(str, (char) i);
es_addBufConstcstr(str, "\"]\n");
ln_genDotPTreeGraphRec(tree->subtree[i], str);
}
}
/* display field subtrees */
for(node = tree->froot ; node != NULL ; node = node->next ) {
dotAddPtr(str, tree);
es_addBufConstcstr(str, " -> ");
dotAddPtr(str, node->subtree);
es_addBufConstcstr(str, " [label=\"");
es_addStr(str, node->name);
es_addBufConstcstr(str, "\" style=\"dotted\"]\n");
ln_genDotPTreeGraphRec(node->subtree, str);
}
}
static inline int
ee_addTags_JSON(struct ee_tagbucket *tags, es_str_t **str)
{
int r = 0;
struct ee_tagbucket_listnode *tag;
int needComma = 0;
CHKR(es_addBuf(str, "\"event.tags\":[", 14));
for(tag = tags->root ; tag != NULL ; tag = tag->next) {
if(needComma)
es_addChar(str, ',');
else
needComma = 1;
es_addChar(str, '"');
CHKR(es_addStr(str, tag->name));
es_addChar(str, '"');
}
es_addChar(str, ']');
done: return r;
}
int
ee_fmtEventToJSON(struct ee_event *event, es_str_t **str)
{
int r = -1;
struct ee_fieldbucket_listnode *node;
int bNeedComma = 0;
assert(event != NULL);assert(event->objID == ObjID_EVENT);
if((*str = es_newStr(256)) == NULL) goto done;
es_addChar(str, '{');
if( event->ctx->flags & EE_CTX_FLAG_INCLUDE_FLAT_TAGS
&& event->tags != NULL) {
CHKR(ee_addTags_JSON(event->tags, str));
bNeedComma = 1;
}
if(event->fields != NULL) {
for(node = event->fields->root ; node != NULL ; node = node->next) {
assert(node->field->objID == ObjID_FIELD);
if(bNeedComma) {
CHKR(es_addBuf(str, ", ", 2));
} else {
bNeedComma = 1;
}
#ifdef NO_EMPTY_FIELDS
if(ee_addField_JSON(node->field, str) == 1)
continue;
#else
ee_addField_JSON(node->field, str);
#endif
}
}
es_addChar(str, '}');
done:
return r;
}
static int
ln_addValue_Syslog(const char *value, es_str_t **str)
{
int r;
es_size_t i;
assert(str != NULL);
assert(*str != NULL);
assert(value != NULL);
for(i = 0; i < strlen(value); i++) {
switch(value[i]) {
case '\0':
es_addChar(str, '\\');
es_addChar(str, '0');
break;
case '\n':
es_addChar(str, '\\');
es_addChar(str, 'n');
break;
/* TODO : add rest of control characters here... */
case ',': /* comma is CEE-reserved for lists */
es_addChar(str, '\\');
es_addChar(str, ',');
break;
#if 0 /* alternative encoding for discussion */
case '^': /* CEE-reserved for lists */
es_addChar(str, '\\');
es_addChar(str, '^');
break;
#endif
/* at this layer ... do we need to think about transport
* encoding at all? Or simply leave it to the transport agent?
*/
case '\\': /* RFC5424 reserved */
es_addChar(str, '\\');
es_addChar(str, '\\');
break;
case ']': /* RFC5424 reserved */
es_addChar(str, '\\');
es_addChar(str, ']');
break;
case '\"': /* RFC5424 reserved */
es_addChar(str, '\\');
es_addChar(str, '\"');
break;
default:
es_addChar(str, value[i]);
break;
}
}
r = 0;
return r;
}
/* TODO: JSON encoding for Unicode characters is as of RFC4627 not fully
* supported. The algorithm is that we must build the wide character from
* UTF-8 (if char > 127) and build the full 4-octet Unicode character out
* of it. Then, this needs to be encoded. Currently, we work on a
* byte-by-byte basis, which simply is incorrect.
* rgerhards, 2010-11-09
*/
int
ee_addValue_JSON(struct ee_value *value, es_str_t **str)
{
int r;
es_str_t *valstr;
unsigned char *buf;
unsigned char c;
es_size_t i;
char numbuf[4];
int j;
assert(str != NULL); assert(*str != NULL);
assert(value != NULL); assert(value->objID == ObjID_VALUE);
// TODO: support other types!
assert(value->valtype == ee_valtype_str);
valstr = value->val.str;
es_addChar(str, '\"');
buf = es_getBufAddr(valstr);
for(i = 0 ; i < es_strlen(valstr) ; ++i) {
c = buf[i];
if( (c >= 0x23 && c <= 0x5b)
|| (c >= 0x5d /* && c <= 0x10FFFF*/)
|| c == 0x20 || c == 0x21) {
/* no need to escape */
es_addChar(str, c);
} else {
/* we must escape, try RFC4627-defined special sequences first */
switch(c) {
case '\0':
es_addBuf(str, "\\u0000", 6);
break;
case '\"':
es_addBuf(str, "\\\"", 2);
break;
case '/':
es_addBuf(str, "\\/", 2);
break;
case '\\':
es_addBuf(str, "\\\\", 2);
break;
case '\010':
es_addBuf(str, "\\b", 2);
break;
case '\014':
es_addBuf(str, "\\f", 2);
break;
case '\n':
es_addBuf(str, "\\n", 2);
break;
case '\r':
es_addBuf(str, "\\r", 2);
break;
case '\t':
es_addBuf(str, "\\t", 2);
break;
default:
/* TODO : proper Unicode encoding (see header comment) */
for(j = 0 ; j < 4 ; ++j) {
numbuf[3-j] = hexdigit[c % 16];
c = c / 16;
}
es_addBuf(str, "\\u", 2);
es_addBuf(str, numbuf, 4);
break;
}
}
}
es_addChar(str, '\"');
r = 0;
return r;
}
