22550237931

Committed 01 Mar 2026 06:56PM UTC coverage: 64.812% (-8.9%) from 73.687%

Build # 22550237931

Build Type

Pull #14920

github

Committed by

web-flow

Commit Message

Merge e05854a6d into 90823fa90

Pull Request Pull Request #14920: draft: rust based configuration file parser and loader - v4

Run Details

561 of 789 new or added lines in 4 files covered. (71.1%)

23225 existing lines in 498 files now uncovered.

131605 of 203055 relevant lines covered (64.81%)

2328818.84 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

60.4

/src/output-json-pgsql.c

/* Copyright (C) 2022-2024 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \file
 *
 * \author Juliana Fajardini <jufajardini@oisf.net>
 *
 * Implement JSON/eve logging for app-layer Pgsql.
 */

#include "suricata-common.h"
#include "detect.h"
#include "pkt-var.h"
#include "conf.h"

#include "threads.h"
#include "threadvars.h"
#include "tm-threads.h"

#include "util-unittest.h"
#include "util-buffer.h"
#include "util-debug.h"
#include "util-byte.h"

#include "output.h"
#include "output-json.h"

#include "app-layer.h"
#include "app-layer-parser.h"

#include "output-json-pgsql.h"
#include "rust.h"

#define PGSQL_LOG_PASSWORDS BIT_U32(0)
#define PGSQL_DEFAULTS      (PGSQL_LOG_PASSWORDS)

typedef struct OutputPgsqlCtx_ {
    uint32_t flags;
    OutputJsonCtx *eve_ctx;
} OutputPgsqlCtx;

typedef struct LogPgsqlLogThread_ {
    OutputPgsqlCtx *pgsqllog_ctx;
    OutputJsonThreadCtx *ctx;
} LogPgsqlLogThread;

bool JsonPgsqlAddMetadata(void *vtx, SCJsonBuilder *jb)
{
    return SCPgsqlLogger(vtx, PGSQL_DEFAULTS, jb);
}

static int JsonPgsqlLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state,
        void *txptr, uint64_t tx_id)
{
    LogPgsqlLogThread *thread = thread_data;
    SCLogDebug("Logging pgsql transaction %" PRIu64 ".", tx_id);

    SCJsonBuilder *jb =
            CreateEveHeader(p, LOG_DIR_FLOW, "pgsql", NULL, thread->pgsqllog_ctx->eve_ctx);
    if (unlikely(jb == NULL)) {
        return TM_ECODE_FAILED;
    }

    if (!SCPgsqlLogger(txptr, thread->pgsqllog_ctx->flags, jb)) {
        goto error;
    }

    OutputJsonBuilderBuffer(tv, p, p->flow, jb, thread->ctx);
    SCJbFree(jb);

    return TM_ECODE_OK;

error:
    SCJbFree(jb);
    return TM_ECODE_FAILED;
}

static void OutputPgsqlLogDeInitCtxSub(OutputCtx *output_ctx)
{
    OutputPgsqlCtx *pgsqllog_ctx = (OutputPgsqlCtx *)output_ctx->data;
    SCFree(pgsqllog_ctx);
    SCFree(output_ctx);
}

static void JsonPgsqlLogParseConfig(SCConfNode *conf, OutputPgsqlCtx *pgsqllog_ctx)
{
    pgsqllog_ctx->flags = ~0U;

    const char *query = SCConfNodeLookupChildValue(conf, "passwords");
    if (query != NULL) {
        if (SCConfValIsTrue(query)) {
            pgsqllog_ctx->flags |= PGSQL_LOG_PASSWORDS;
        } else {
            pgsqllog_ctx->flags &= ~PGSQL_LOG_PASSWORDS;
        }
    } else {
        pgsqllog_ctx->flags &= ~PGSQL_LOG_PASSWORDS;
    }
}

static OutputInitResult OutputPgsqlLogInitSub(SCConfNode *conf, OutputCtx *parent_ctx)
{
    OutputInitResult result = { NULL, false };
    OutputJsonCtx *ojc = parent_ctx->data;

    OutputPgsqlCtx *pgsql_ctx = SCCalloc(1, sizeof(OutputPgsqlCtx));
    if (unlikely(pgsql_ctx == NULL))
        return result;

    OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));
    if (unlikely(output_ctx == NULL)) {
        SCFree(pgsql_ctx);
        return result;
    }

    pgsql_ctx->eve_ctx = ojc;

    output_ctx->data = pgsql_ctx;
    output_ctx->DeInit = OutputPgsqlLogDeInitCtxSub;

    JsonPgsqlLogParseConfig(conf, pgsql_ctx);

    SCAppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_PGSQL);

    SCLogDebug("PostgreSQL log sub-module initialized.");

    result.ctx = output_ctx;
    result.ok = true;
    return result;
}

static TmEcode JsonPgsqlLogThreadInit(ThreadVars *t, const void *initdata, void **data)
{
    LogPgsqlLogThread *thread = SCCalloc(1, sizeof(LogPgsqlLogThread));
    if (unlikely(thread == NULL)) {
        return TM_ECODE_FAILED;
    }

    if (initdata == NULL) {
        SCLogDebug("Error getting context for EveLogPgsql.  \"initdata\" is NULL.");
        goto error_exit;
    }

    thread->pgsqllog_ctx = ((OutputCtx *)initdata)->data;
    thread->ctx = CreateEveThreadCtx(t, thread->pgsqllog_ctx->eve_ctx);
    if (!thread->ctx) {
        goto error_exit;
    }
    *data = (void *)thread;

    return TM_ECODE_OK;

error_exit:
    SCFree(thread);
    return TM_ECODE_FAILED;
}

static TmEcode JsonPgsqlLogThreadDeinit(ThreadVars *t, void *data)
{
    LogPgsqlLogThread *thread = (LogPgsqlLogThread *)data;
    if (thread == NULL) {
        return TM_ECODE_OK;
    }
    FreeEveThreadCtx(thread->ctx);
    SCFree(thread);
    return TM_ECODE_OK;
}

void JsonPgsqlLogRegister(void)
{
    /* PGSQL_START_REMOVE */
    if (SCConfGetNode("app-layer.protocols.pgsql") == NULL) {
        SCLogDebug("Disabling Pgsql eve-logger");
        return;
    }
    /* PGSQL_END_REMOVE */
    /* Register as an eve sub-module. */
    OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonPgsqlLog", "eve-log.pgsql",
            OutputPgsqlLogInitSub, ALPROTO_PGSQL, JsonPgsqlLogger, JsonPgsqlLogThreadInit,
            JsonPgsqlLogThreadDeinit);

    SCLogDebug("PostgreSQL JSON logger registered.");
}

1	/* Copyright (C) 2022-2024 Open Information Security Foundation
2	*
3	* You can copy, redistribute or modify this Program under the terms of
4	* the GNU General Public License version 2 as published by the Free
5	* Software Foundation.
6	*
7	* This program is distributed in the hope that it will be useful,
8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10	* GNU General Public License for more details.
11	*
12	* You should have received a copy of the GNU General Public License
13	* version 2 along with this program; if not, write to the Free Software
14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15	* 02110-1301, USA.
16	*/
17
18	/**
19	* \file
20	*
21	* \author Juliana Fajardini <jufajardini@oisf.net>
22	*
23	* Implement JSON/eve logging for app-layer Pgsql.
24	*/
25
26	#include "suricata-common.h"
27	#include "detect.h"
28	#include "pkt-var.h"
29	#include "conf.h"
30
31	#include "threads.h"
32	#include "threadvars.h"
33	#include "tm-threads.h"
34
35	#include "util-unittest.h"
36	#include "util-buffer.h"
37	#include "util-debug.h"
38	#include "util-byte.h"
39
40	#include "output.h"
41	#include "output-json.h"
42
43	#include "app-layer.h"
44	#include "app-layer-parser.h"
45
46	#include "output-json-pgsql.h"
47	#include "rust.h"
48
49	#define PGSQL_LOG_PASSWORDS BIT_U32(0)	3✔
50	#define PGSQL_DEFAULTS (PGSQL_LOG_PASSWORDS)	2✔
51
52	typedef struct OutputPgsqlCtx_ {
53	uint32_t flags;
54	OutputJsonCtx *eve_ctx;
55	} OutputPgsqlCtx;
56
57	typedef struct LogPgsqlLogThread_ {
58	OutputPgsqlCtx *pgsqllog_ctx;
59	OutputJsonThreadCtx *ctx;
60	} LogPgsqlLogThread;
61
62	bool JsonPgsqlAddMetadata(void vtx, SCJsonBuilder jb)
63	{	2✔
64	return SCPgsqlLogger(vtx, PGSQL_DEFAULTS, jb);	2✔
65	}	2✔
66
67	static int JsonPgsqlLogger(ThreadVars tv, void thread_data, const Packet p, Flow f, void *state,
68	void *txptr, uint64_t tx_id)
69	{	73✔
70	LogPgsqlLogThread *thread = thread_data;	73✔
71	SCLogDebug("Logging pgsql transaction %" PRIu64 ".", tx_id);	73✔
72
73	SCJsonBuilder *jb =	73✔
74	CreateEveHeader(p, LOG_DIR_FLOW, "pgsql", NULL, thread->pgsqllog_ctx->eve_ctx);	73✔
75	if (unlikely(jb == NULL)) {	73✔
76	return TM_ECODE_FAILED;	×
77	}	×
78
79	if (!SCPgsqlLogger(txptr, thread->pgsqllog_ctx->flags, jb)) {	73✔
80	goto error;	×
81	}	×
82
83	OutputJsonBuilderBuffer(tv, p, p->flow, jb, thread->ctx);	73✔
84	SCJbFree(jb);	73✔
85
86	return TM_ECODE_OK;	73✔
87
88	error:	×
89	SCJbFree(jb);	×
90	return TM_ECODE_FAILED;	×
91	}	73✔
92
93	static void OutputPgsqlLogDeInitCtxSub(OutputCtx *output_ctx)
UNCOV 94	{	×
UNCOV 95	OutputPgsqlCtx pgsqllog_ctx = (OutputPgsqlCtx )output_ctx->data;	×
UNCOV 96	SCFree(pgsqllog_ctx);	×
UNCOV 97	SCFree(output_ctx);	×
UNCOV 98	}	×
99
100	static void JsonPgsqlLogParseConfig(SCConfNode conf, OutputPgsqlCtx pgsqllog_ctx)
101	{	1✔
102	pgsqllog_ctx->flags = ~0U;	1✔
103
104	const char *query = SCConfNodeLookupChildValue(conf, "passwords");	1✔
105	if (query != NULL) {	1✔
UNCOV 106	if (SCConfValIsTrue(query)) {	×
UNCOV 107	pgsqllog_ctx->flags \|= PGSQL_LOG_PASSWORDS;	×
UNCOV 108	} else {	×
UNCOV 109	pgsqllog_ctx->flags &= ~PGSQL_LOG_PASSWORDS;	×
UNCOV 110	}	×
111	} else {	1✔
112	pgsqllog_ctx->flags &= ~PGSQL_LOG_PASSWORDS;	1✔
113	}	1✔
114	}	1✔
115
116	static OutputInitResult OutputPgsqlLogInitSub(SCConfNode conf, OutputCtx parent_ctx)
117	{	1✔
118	OutputInitResult result = { NULL, false };	1✔
119	OutputJsonCtx *ojc = parent_ctx->data;	1✔
120
121	OutputPgsqlCtx *pgsql_ctx = SCCalloc(1, sizeof(OutputPgsqlCtx));	1✔
122	if (unlikely(pgsql_ctx == NULL))	1✔
123	return result;	×
124
125	OutputCtx *output_ctx = SCCalloc(1, sizeof(OutputCtx));	1✔
126	if (unlikely(output_ctx == NULL)) {	1✔
127	SCFree(pgsql_ctx);	×
128	return result;	×
129	}	×
130
131	pgsql_ctx->eve_ctx = ojc;	1✔
132
133	output_ctx->data = pgsql_ctx;	1✔
134	output_ctx->DeInit = OutputPgsqlLogDeInitCtxSub;	1✔
135
136	JsonPgsqlLogParseConfig(conf, pgsql_ctx);	1✔
137
138	SCAppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_PGSQL);	1✔
139
140	SCLogDebug("PostgreSQL log sub-module initialized.");	1✔
141
142	result.ctx = output_ctx;	1✔
143	result.ok = true;	1✔
144	return result;	1✔
145	}	1✔
146
147	static TmEcode JsonPgsqlLogThreadInit(ThreadVars t, const void initdata, void **data)
148	{	1✔
149	LogPgsqlLogThread *thread = SCCalloc(1, sizeof(LogPgsqlLogThread));	1✔
150	if (unlikely(thread == NULL)) {	1✔
151	return TM_ECODE_FAILED;	×
152	}	×
153
154	if (initdata == NULL) {	1✔
155	SCLogDebug("Error getting context for EveLogPgsql. \"initdata\" is NULL.");	×
156	goto error_exit;	×
157	}	×
158
159	thread->pgsqllog_ctx = ((OutputCtx *)initdata)->data;	1✔
160	thread->ctx = CreateEveThreadCtx(t, thread->pgsqllog_ctx->eve_ctx);	1✔
161	if (!thread->ctx) {	1✔
162	goto error_exit;	×
163	}	×
164	data = (void )thread;	1✔
165
166	return TM_ECODE_OK;	1✔
167
168	error_exit:	×
169	SCFree(thread);	×
170	return TM_ECODE_FAILED;	×
171	}	1✔
172
173	static TmEcode JsonPgsqlLogThreadDeinit(ThreadVars t, void data)
UNCOV 174	{	×
UNCOV 175	LogPgsqlLogThread thread = (LogPgsqlLogThread )data;	×
UNCOV 176	if (thread == NULL) {	×
177	return TM_ECODE_OK;	×
178	}	×
UNCOV 179	FreeEveThreadCtx(thread->ctx);	×
UNCOV 180	SCFree(thread);	×
UNCOV 181	return TM_ECODE_OK;	×
UNCOV 182	}	×
183
184	void JsonPgsqlLogRegister(void)
185	{	29✔
186	/* PGSQL_START_REMOVE */
187	if (SCConfGetNode("app-layer.protocols.pgsql") == NULL) {	29✔
188	SCLogDebug("Disabling Pgsql eve-logger");	21✔
189	return;	21✔
190	}	21✔
191	/* PGSQL_END_REMOVE */
192	/* Register as an eve sub-module. */
193	OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonPgsqlLog", "eve-log.pgsql",	8✔
194	OutputPgsqlLogInitSub, ALPROTO_PGSQL, JsonPgsqlLogger, JsonPgsqlLogThreadInit,	8✔
195	JsonPgsqlLogThreadDeinit);	8✔
196
197	SCLogDebug("PostgreSQL JSON logger registered.");	8✔
198	}	8✔

OISF / suricata / 22550237931

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous