From 3d56820f130e6c1b674560125e677be3b6a2d8f4 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Sat, 25 Aug 2012 19:21:12 +0200 Subject: add capability to configure outname for constant (inside template) also some cleanup --- grammar/grammar.y | 10 ++++------ runtime/msg.c | 4 ++-- template.c | 21 ++++++++------------- template.h | 2 +- 4 files changed, 15 insertions(+), 22 deletions(-) diff --git a/grammar/grammar.y b/grammar/grammar.y index 27d0e1d5..8371f854 100644 --- a/grammar/grammar.y +++ b/grammar/grammar.y @@ -133,18 +133,16 @@ conf: /* empty (to end recursion) */ | conf BSD_HOST_SELECTOR { cnfDoBSDHost($2); } obj: BEGINOBJ nvlst ENDOBJ { $$ = cnfobjNew($1, $2); } | BEGIN_ACTION nvlst ENDOBJ { $$ = cnfobjNew(CNFOBJ_ACTION, $2); } - | BEGIN_TPL nvlst ENDOBJ { $$ = cnfobjNew(CNFOBJ_TPL, $2); dbgprintf("processing template() without {}\n"); } + | BEGIN_TPL nvlst ENDOBJ { $$ = cnfobjNew(CNFOBJ_TPL, $2); } | BEGIN_TPL nvlst ENDOBJ '{' propconst '}' { $$ = cnfobjNew(CNFOBJ_TPL, $2); $$->subobjs = $5; - dbgprintf("processing template() WITH {}, subobj=%p\n", $5); } + } propconst: { $$ = NULL; } | propconst property { $$ = objlstAdd($1, $2); } | propconst constant { $$ = objlstAdd($1, $2); } -property: BEGIN_PROPERTY nvlst ENDOBJ { $$ = cnfobjNew(CNFOBJ_PROPERTY, $2); - dbgprintf("processed property()\n"); } -constant: BEGIN_CONSTANT nvlst ENDOBJ { $$ = cnfobjNew(CNFOBJ_CONSTANT, $2); - dbgprintf("processed constant()\n"); } +property: BEGIN_PROPERTY nvlst ENDOBJ { $$ = cnfobjNew(CNFOBJ_PROPERTY, $2); } +constant: BEGIN_CONSTANT nvlst ENDOBJ { $$ = cnfobjNew(CNFOBJ_CONSTANT, $2); } cfsysline: CFSYSLINE { $$ = $1; } nvlst: { $$ = NULL; } | nvlst nv { $2->next = $1; $$ = $2; } diff --git a/runtime/msg.c b/runtime/msg.c index da751dba..891907ec 100644 --- a/runtime/msg.c +++ b/runtime/msg.c @@ -2515,9 +2515,9 @@ jsonField(struct templateEntry *pTpe, uchar **ppRes, unsigned short *pbMustBeFre pSrc = *ppRes; buflen = (*pBufLen == -1) ? ustrlen(pSrc) : *pBufLen; /* we hope we have only few escapes... */ - dst = es_newStr(buflen+es_strlen(pTpe->data.field.fieldName)+15); + dst = es_newStr(buflen+es_strlen(pTpe->fieldName)+15); es_addChar(&dst, '"'); - es_addStr(&dst, pTpe->data.field.fieldName); + es_addStr(&dst, pTpe->fieldName); es_addBufConstcstr(&dst, "\"=\""); CHKiRet(jsonAddVal(pSrc, buflen, &dst)); es_addChar(&dst, '"'); diff --git a/template.c b/template.c index 4cad7cb7..768608f1 100644 --- a/template.c +++ b/template.c @@ -74,7 +74,6 @@ static struct cnfparamdescr cnfparamdescrProperty[] = { { "controlcharacters", eCmdHdlrString, 0 }, { "securepath", eCmdHdlrString, 0 }, { "format", eCmdHdlrString, 0 }, -// From here { "position.from", eCmdHdlrInt, 0 }, { "position.to", eCmdHdlrInt, 0 }, { "field.number", eCmdHdlrInt, 0 }, @@ -84,7 +83,6 @@ static struct cnfparamdescr cnfparamdescrProperty[] = { { "regex.nomatchmode", eCmdHdlrString, 0 }, { "regex.match", eCmdHdlrInt, 0 }, { "regex.submatch", eCmdHdlrInt, 0 }, -//-- to here { "droplastlf", eCmdHdlrBinary, 0 }, { "spifno1stsp", eCmdHdlrBinary, 0 } }; @@ -97,7 +95,6 @@ static struct cnfparamblk pblkProperty = static struct cnfparamdescr cnfparamdescrConstant[] = { { "value", eCmdHdlrString, 1 }, { "outname", eCmdHdlrString, 0 }, - { "format", eCmdHdlrString, 0 } }; static struct cnfparamblk pblkConstant = { CNFPARAMBLK_VERSION, @@ -980,12 +977,12 @@ static int do_Parameter(unsigned char **pp, struct template *pTpl) /* save field name - if none was given, use the property name instead */ if(pStrField == NULL) { - if((pTpe->data.field.fieldName = + if((pTpe->fieldName = es_newStrFromCStr((char*)cstrGetSzStrNoNULL(pStrProp), cstrLen(pStrProp))) == NULL) { return 1; } } else { - if((pTpe->data.field.fieldName = + if((pTpe->fieldName = es_newStrFromCStr((char*)cstrGetSzStrNoNULL(pStrField), cstrLen(pStrField))) == NULL) { return 1; } @@ -1193,6 +1190,7 @@ createConstantTpe(struct template *pTpl, struct cnfobj *o) es_str_t *value; int i; struct cnfparamvals *pvals; + es_str_t *outname = NULL; DEFiRet; /* pull params */ @@ -1204,12 +1202,8 @@ createConstantTpe(struct template *pTpl, struct cnfobj *o) continue; if(!strcmp(pblkConstant.descr[i].name, "value")) { value = pvals[i].val.d.estr; - } else if(!strcmp(pblkConstant.descr[i].name, "format")) { - errmsg.LogError(0, RS_RET_ERR, "paramter 'format' is currently not " - "supported for 'constant' template parts - ignored"); } else if(!strcmp(pblkConstant.descr[i].name, "outname")) { - errmsg.LogError(0, RS_RET_ERR, "paramter 'outname' is currently not " - "supported for 'constant' template parts - ignored"); + outname = es_strdup(pvals[i].val.d.estr); } else { dbgprintf("template:constantTpe: program error, non-handled " "param '%s'\n", pblkConstant.descr[i].name); @@ -1222,6 +1216,7 @@ createConstantTpe(struct template *pTpl, struct cnfobj *o) CHKmalloc(pTpe = tpeConstruct(pTpl)); es_unescapeStr(value); pTpe->eEntryType = CONSTANT; + pTpe->fieldName = outname; pTpe->data.constant.iLenConstant = es_strlen(value); pTpe->data.constant.pConstant = (uchar*)es_str2cstr(value, NULL); @@ -1466,7 +1461,7 @@ createPropertyTpe(struct template *pTpl, struct cnfobj *o) pTpe->data.field.options.bSecPathReplace = 1; break; } - pTpe->data.field.fieldName = outname; + pTpe->fieldName = outname; pTpe->data.field.eDateFormat = datefmt; if(fieldnum != -1) { pTpe->data.field.has_fields = 1; @@ -1767,8 +1762,8 @@ void tplDeleteAll(rsconf_t *conf) } if(pTpeDel->data.field.propName != NULL) es_deleteStr(pTpeDel->data.field.propName); - if(pTpeDel->data.field.fieldName != NULL) - es_deleteStr(pTpeDel->data.field.fieldName); + if(pTpeDel->fieldName != NULL) + es_deleteStr(pTpeDel->fieldName); #endif break; } diff --git a/template.h b/template.h index 65435cd8..9f6a4c33 100644 --- a/template.h +++ b/template.h @@ -68,6 +68,7 @@ enum tplRegexType { TPL_REGEX_BRE = 0, /* posix BRE */ struct templateEntry { struct templateEntry *pNext; enum EntryTypes eEntryType; + es_str_t *fieldName; /**< field name to be used for structured output */ union { struct { uchar *pConstant; /* pointer to constant value */ @@ -99,7 +100,6 @@ struct templateEntry { #endif es_str_t *propName; /**< property name (currently being used for CEE only) */ - es_str_t *fieldName; /**< field name to be used for structured output */ enum tplFormatTypes eDateFormat; enum tplFormatCaseConvTypes eCaseConv; -- cgit