summaryrefslogtreecommitdiffstats
path: root/output/ulogd_output_JSON.c
Commit message (Collapse)AuthorAgeFilesLines
* output: add missing support for int64_t valuesJeremy Sowden2022-12-081-0/+3
| | | | | | | Some of the output plug-ins don't handle 64-bit signed values. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: remove incorrect config value checkJeremy Sowden2022-12-081-5/+3
| | | | | | | | The `u.string` member of a config entry is an array, and so never `NULL`. Output the device string unconditionally. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: remove bogus check for host and portPablo Neira Ayuso2022-01-041-5/+0
| | | | | | | struct config_entry already provides storage for the host and port strings, .u.string is never NULL. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: fix possible truncation of socket pathPablo Neira Ayuso2022-01-041-9/+39
| | | | | | Verify that the path is shorter than 108 bytes (maximum unix socket path). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: optimize appending of newline to outputJeremy Sowden2022-01-031-2/+2
| | | | | | | | | | | | We have `buflen` available. We can remove `strncat` and assign the characters directly, without traversing the whole buffer. Fixes a compiler warning: logd_output_JSON.c:407:9: warning: `strncat` specified bound 1 equals source length Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: fix possible leak in error-handling.Jeremy Sowden2022-01-031-7/+6
| | | | | | | | | | | | The `realloc` extending the buffer containing the JSON to allow us to insert a final new-line may fail. Therefore, we need to assign the return-value to a temporary variable or we will not able to free the existing buffer on error. Use the correct type for `buflen`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: increase time-stamp buffer sizeJeremy Sowden2022-01-031-1/+1
| | | | | | | | | | | | | | | The output buffer for date-times is of sufficient size provided that we don't get oversized integer values for any of the fields, which is a reasonable assumption. However, the compiler complains about possible truncation, e.g.: ulogd_output_JSON.c:314:65: warning: `%06u` directive output may be truncated writing between 6 and 10 bytes into a region of size between 0 and 18 ulogd_output_JSON.c:313:25: note: `snprintf` output between 27 and 88 bytes into a destination of size 38 Fix the warnings by increasing the buffer size. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: fix output of GMT offsetJeremy Sowden2022-01-031-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | The compiler has two sets of complaints. Firstly, `t->tm_gmtoffset` is a `long int`, but it is being passed to `abs`, which leads to warnings such as: ulogd_output_JSON.c:308:34: warning: absolute value function `abs` given an argument of type `long int` but has parameter of type `int` which may cause truncation of value Secondly, it can't verify that the hour value derived from the offset will in fact fit into `%02d`, thus: ulogd_output_JSON.c:306:37: warning: `%02d` directive output may be truncated writing between 2 and 6 bytes into a region of size 5 To remedy these, we now mod the offset by 86,400 and assign it to an `int` before deriving the hour and minute values. We also change the format-specifier for the hour value to `%+03d` which causes a sign to be printed even if the value is positive, thus allowing us not to specify the sign explicitly and to drop the `abs` call for the hour value. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd: json: send messages to a remote host / unix socketAndreas Jaggi2018-06-011-21/+270
| | | | | | | | Extend the JSON output plugin so that the generated JSON stream can be sent to a remote host via TCP/UDP or to a local unix socket. Signed-off-by: Andreas Jaggi <andreas.jaggi@waterwave.ch> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: append timezone information to ISO 8601 dateVincent Bernat2015-10-021-5/+20
| | | | | | | | | | | | | | | | | | While this is not strictly needed for ISO 8601, this is helpful since otherwise, the receiver can't assume anything about the timezone. This uses a GNU extension but as ulogd is quite Linux-specific, this shouldn't be a problem. The POSIX variables (tzname and daylight) are quite difficult to use because daylight handling is incomplete (daylight don't say if DST is now in effect, it just says it is sometimes in effect). A timezone offset is used instead of a timezone since it is usually easier to parse (strptime in glibc is not able to parse a timezone name) and don't require an up-to-date TZ database. Signed-off-by: Vincent Bernat <Vincent.Bernat@exoscale.ch>
* json: output messages in JSONv1 formatVincent Bernat2015-10-021-1/+14
| | | | | | | | | | | | | | | | | | While Logstash is quite flexible in the JSON messages received, the canonical format it "expects" is the JSON Event v1 format. The timestamp should be keyed by `@timestamp` and there should be a `@version` key whose value is 1. All other keys are free. There is no formal specification of this format. It is however described here: https://github.com/elastic/logstash/blob/1.5/lib/logstash/event.rb#L26-L47 It's useful to respect this format as it allows a user to use a less capable receiver. The new format is enabled only when `eventv1=1` is set in plugin configuration. Signed-off-by: Vincent Bernat <Vincent.Bernat@exoscale.ch>
* Fix JSON output on big endian systemsJimmy Jones2014-08-111-0/+11
| | | | Signed-off-by: Jimmy Jones <jimmyjones2@gmx.co.uk>
* json: use packet timestamp if availableEric Leblond2014-03-071-5/+43
| | | | | | | | | This patch updates the JSON output plugin to have it use the timestamp of the packet if available. The date format used for the timestamp is now using ISO 8601 to have an easy import in most software (tested with logstash and splunk). Signed-off-by: Eric Leblond <eric@regit.org>
* json: introduce new JSON output pluginEric Leblond2014-01-281-0/+254
This patch introduces a new JSON output plugin. This patch displays CIM field name instead of ulogd key valu if this CIM field is available. The module does not display binary address but uses the string version of them. So a complete stack is for example: stack=log2:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,mac2str1:HWHDR,json1:JSON If boolean_label is set to 1, then the numeric_label put on packet by the input plugin is coding the decision on packet. If 0, then packet has been blocked and if non null it has been accepted.