From 4b3b13a9d88fe0a47e5a443419b470fef925a971 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Wed, 24 Apr 2024 22:13:35 -0300 Subject: [PATCH 1/2] pgsql/logger: open json object from logger function Before, the JsonBuilder object for the pgsql event was being created from the C-side function that actually called the Rust logger. This resulted that if another module - such as the Json Alert called the PGSQL logger, we wouldn't have the `pgsql` key present in the log output - only its inner fields. Bug #6983 --- rust/src/pgsql/logger.rs | 3 +++ src/output-json-pgsql.c | 2 -- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/rust/src/pgsql/logger.rs b/rust/src/pgsql/logger.rs index 934b549a1671..bcfcb5a8e933 100644 --- a/rust/src/pgsql/logger.rs +++ b/rust/src/pgsql/logger.rs @@ -27,6 +27,7 @@ use std; pub const PGSQL_LOG_PASSWORDS: u32 = BIT_U32!(0); fn log_pgsql(tx: &PgsqlTransaction, flags: u32, js: &mut JsonBuilder) -> Result<(), JsonError> { + js.open_object("pgsql")?; js.set_uint("tx_id", tx.tx_id)?; if let Some(request) = &tx.request { js.set_object("request", &log_request(request, flags)?)?; @@ -35,12 +36,14 @@ fn log_pgsql(tx: &PgsqlTransaction, flags: u32, js: &mut JsonBuilder) -> Result< // TODO Log anomaly event instead? js.set_bool("request", false)?; js.set_bool("response", false)?; + js.close()?; return Ok(()); } if !tx.responses.is_empty() { js.set_object("response", &log_response_object(tx)?)?; } + js.close()?; Ok(()) } diff --git a/src/output-json-pgsql.c b/src/output-json-pgsql.c index 623077e8ad44..d82602e351a7 100644 --- a/src/output-json-pgsql.c +++ b/src/output-json-pgsql.c @@ -76,11 +76,9 @@ static int JsonPgsqlLogger(ThreadVars *tv, void *thread_data, const Packet *p, F return TM_ECODE_FAILED; } - jb_open_object(jb, "pgsql"); if (!rs_pgsql_logger(txptr, thread->pgsqllog_ctx->flags, jb)) { goto error; } - jb_close(jb); OutputJsonBuilderBuffer(jb, thread->ctx); jb_free(jb); From 872da3ca6fc14d078da02f68909678f802a23901 Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Tue, 30 Apr 2024 16:48:27 -0300 Subject: [PATCH 2/2] pgsql: tx_id doesn't need to be adjusted When createing a new PgsqlTransaction, we first increment PgsqlState's tx_id and then pass that onto the new tx tx_id. As it is not created they're first id 0, there's no need to adjust when freeing or searching. Bug #7000 --- rust/src/pgsql/pgsql.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rust/src/pgsql/pgsql.rs b/rust/src/pgsql/pgsql.rs index eda9d484856d..611f07179651 100644 --- a/rust/src/pgsql/pgsql.rs +++ b/rust/src/pgsql/pgsql.rs @@ -175,7 +175,7 @@ impl PgsqlState { let mut index = 0; for i in 0..len { let tx = &self.transactions[i]; - if tx.tx_id == tx_id + 1 { + if tx.tx_id == tx_id { found = true; index = i; break; @@ -188,7 +188,7 @@ impl PgsqlState { } pub fn get_tx(&mut self, tx_id: u64) -> Option<&PgsqlTransaction> { - self.transactions.iter().find(|tx| tx.tx_id == tx_id + 1) + self.transactions.iter().find(|tx| tx.tx_id == tx_id) } fn new_tx(&mut self) -> PgsqlTransaction {