alert/metadata: no pgsql object encapsulation (7.0.x backport) - v1 #11665
Conversation
Before, the JsonBuilder object for the pgsql event was being created from the C-side function that actually called the Rust logger. This resulted that if another module - such as the Json Alert called the PGSQL logger, we wouldn't have the `pgsql` key present in the log output - only its inner fields. Bug OISF#6983 (cherry picked from commit 69e26de)
Related to Bug OISF#6983
It was brought to my attention by GLongo that Pgsql parser handled eof diffrently for requests and responses, and apparently there isn't a good reason for such a difference therefore, apply same logic used for rs_pgsql_parse_request for checking for eof when parsing a response. (cherry picked from commit ce1556c)
|
Re. commit: 56dbcd6 Maybe a wording issue. But this adds pgsql metadata to alerts if available right? Maybe: |
|
Information: QA ran without warnings. Pipeline 22270 |
|
Why do we need pgsql: check for eol when parsing response ? |
As this seemed to be something that should have been there from the beginning, it made sense to me that it would be backported, once it was discovered and fixed. |
Okie, do I submit a new PR to fix the commit? |
Yup :) |
|
Properly new PR for updating commit message :P #11681 |
Trying to decouple this backport from progress (or delays) of #11635
Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/7066
Describe changes:
Provide values to any of the below to override the defaults.
SV_REPO=
SV_BRANCH=OISF/suricata-verify#2020