ftp/eve: Convert to JsonBuilder #5030
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -60,41 +60,35 @@ typedef struct LogFTPLogThread_ { | |
| MemBuffer *buffer; | ||
| } LogFTPLogThread; | ||
|
|
||
| static void JsonFTPLogCommand(Flow *f, FTPTransaction *tx, JsonBuilder *jb) | ||
| { | ||
| /* Preallocate array objects to simplify failure case */ | ||
| JsonBuilder *js_resplist = NULL; | ||
| JsonBuilder *js_respcode_list = NULL; | ||
| if (!TAILQ_EMPTY(&tx->response_list)) { | ||
| js_resplist = jb_new_array(); | ||
| js_respcode_list = jb_new_array(); | ||
|
|
||
| if (unlikely(js_resplist == NULL || js_respcode_list == NULL)) { | ||
| goto fail; | ||
| } | ||
| } | ||
| jb_set_string(jb, "command", tx->command_descriptor->command_name); | ||
| uint32_t min_length = tx->command_descriptor->command_length + 1; /* command + space */ | ||
| if (tx->request_length > min_length) { | ||
| char *s = BytesToString(tx->request + min_length, | ||
|
There was a problem hiding this comment. @jasonish iirc we talked about a direct There was a problem hiding this comment. I see An interface that accepted a count and worked with a non-null-terminated string would be needed. There was a problem hiding this comment.
There was a problem hiding this comment. |
||
| tx->request_length - min_length - 1); | ||
| if (s) { | ||
| jb_set_string(jb, "command_data", s); | ||
| SCFree(s); | ||
| } | ||
| } else { | ||
| jb_set_string(jb, "command_data", NULL); | ||
| } | ||
|
|
||
| if (!TAILQ_EMPTY(&tx->response_list)) { | ||
| int resp_code_cnt = 0; | ||
| int resp_cnt = 0; | ||
| FTPString *response; | ||
| TAILQ_FOREACH(response, &tx->response_list, next) { | ||
| /* handle multiple lines within the response, \r\n delimited */ | ||
|
|
@@ -107,40 +101,61 @@ static json_t *JsonFTPLogCommand(Flow *f, FTPTransaction *tx) | |
| if (pos >= 3) { | ||
| /* Gather the completion code if present */ | ||
| if (isdigit(where[0]) && isdigit(where[1]) && isdigit(where[2])) { | ||
| char *s = BytesToString(where, 3); | ||
| if (s != NULL) { | ||
| jb_append_string(js_respcode_list, s); | ||
|
There was a problem hiding this comment. the goal of the jsonbuilder transition is to avoid creating temporary objects like this, but instead "stream" the whole object into a single There was a problem hiding this comment. I modeled my implementation after that in Note that I'm building 2 arrays as the response is processed and 2 arrays will be created during that. I'm not sure how the new interfaces support this? There was a problem hiding this comment. There isn't in some cases. In DNS, to avoid looping throught the responses 2x, I had to use intermediate objects as well in |
||
| SCFree(s); | ||
| resp_code_cnt++; | ||
| } | ||
| offset = 4; | ||
| } | ||
| } | ||
| /* move past 3 character completion code */ | ||
| if (pos >= offset) { | ||
| char *s = BytesToString(where + offset, pos - offset); | ||
| if (s != NULL) { | ||
| jb_append_string(js_resplist, s); | ||
| SCFree(s); | ||
| resp_cnt++; | ||
| } | ||
| } | ||
|
|
||
| where += pos; | ||
| length -= pos; | ||
| } | ||
| } | ||
|
|
||
| if (resp_cnt) { | ||
| jb_close(js_resplist); | ||
| jb_set_object(jb, "reply", js_resplist); | ||
| } | ||
| jb_free(js_resplist); | ||
| if (resp_code_cnt) { | ||
| jb_close(js_respcode_list); | ||
| jb_set_object(jb, "completion_code", js_respcode_list); | ||
| } | ||
| jb_free(js_respcode_list); | ||
| } | ||
|
|
||
| if (tx->dyn_port) { | ||
| jb_set_uint(jb, "dynamic_port", tx->dyn_port); | ||
| } | ||
|
|
||
| if (tx->command_descriptor->command == FTP_COMMAND_PORT || | ||
| tx->command_descriptor->command == FTP_COMMAND_EPRT) { | ||
| jb_set_string(jb, "mode", tx->active ? "active" : "passive"); | ||
| } | ||
|
|
||
| jb_set_string(jb, "reply_received", tx->done ? "yes" : "no"); | ||
|
|
||
| return; | ||
|
|
||
| fail: | ||
| if (js_resplist) { | ||
| jb_free(js_resplist); | ||
| } else { | ||
| jb_free(js_respcode_list); | ||
| } | ||
| } | ||
|
|
||
|
|
||
|
|
@@ -159,27 +174,30 @@ static int JsonFTPLogger(ThreadVars *tv, void *thread_data, | |
| LogFTPLogThread *thread = thread_data; | ||
| LogFTPFileCtx *ftp_ctx = thread->ftplog_ctx; | ||
|
|
||
| JsonBuilder *jb = CreateEveHeaderWithTxId(p, LOG_DIR_FLOW, event_type, NULL, tx_id); | ||
| if (likely(jb)) { | ||
| EveAddCommonOptions(&ftp_ctx->cfg, p, f, jb); | ||
| jb_open_object(jb, event_type); | ||
| if (f->alproto == ALPROTO_FTPDATA) { | ||
| JsonFTPDataAddMetadata(f, jb); | ||
| } else { | ||
| JsonFTPLogCommand(f, tx, jb); | ||
| } | ||
|
|
||
| if (!jb_close(jb)) { | ||
| goto fail; | ||
| } | ||
|
|
||
| MemBufferReset(thread->buffer); | ||
| OutputJsonBuilderBuffer(jb, thread->ftplog_ctx->file_ctx, &thread->buffer); | ||
|
|
||
| jb_free(jb); | ||
| } | ||
| return TM_ECODE_OK; | ||
|
|
||
| fail: | ||
| jb_free(jb); | ||
| return TM_ECODE_FAILED; | ||
| } | ||
|
|
||
| static void OutputFTPLogDeInitCtxSub(OutputCtx *output_ctx) | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@jasonish I still think we can optimize these constant cases with some preproc magic to become a single string that we append
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, need to look at this again.