From f112b51b8d6c358b87ac608112d393adb047ea0f Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 20 Dec 2011 16:39:39 +0100 Subject: bugfix: imuxsock did truncate part of received message if it did not contain a proper date. The truncation occured because we removed that part of the messages that was expected to be the date. closes: http://bugzilla.adiscon.com/show_bug.cgi?id=295 --- ChangeLog | 4 ++++ plugins/imuxsock/imuxsock.c | 7 +++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 26d6762a..3f5031ea 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,9 @@ --------------------------------------------------------------------------- Version 5.8.7 [V5-stable] 2011-??-?? +- bugfix: imuxsock did truncate part of received message if it did not + contain a proper date. The truncation occured because we removed that + part of the messages that was expected to be the date. + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=295 - bugfix: potential abort after reading invalid X.509 certificate closes: http://bugzilla.adiscon.com/show_bug.cgi?id=290 Thanks to Tomas Heinrich for the patch diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c index 2697c48a..feddb20c 100644 --- a/plugins/imuxsock/imuxsock.c +++ b/plugins/imuxsock/imuxsock.c @@ -565,8 +565,11 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred) parse++; lenMsg--; /* '>' */ if((pLstn->flags & IGNDATE)) { - parse += 16; /* just skip timestamp */ - lenMsg -= 16; + /* in this case, we still need to find out if we have a valid + * datestamp or not .. and advance the parse pointer accordingly. + */ + struct syslogTime dummy; + datetime.ParseTIMESTAMP3164(&dummy, &parse, &lenMsg); } else { if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &parse, &lenMsg) != RS_RET_OK) { DBGPRINTF("we have a problem, invalid timestamp in msg!\n"); -- cgit From 8d2f6675c47c0b7b6d7c644004507d0a85a90cb4 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 20 Dec 2011 18:17:45 +0100 Subject: bugfix: stats counter were not properly initialized on creation --- ChangeLog | 1 + runtime/statsobj.c | 2 ++ 2 files changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 26d6762a..598a9036 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,6 @@ --------------------------------------------------------------------------- Version 5.8.7 [V5-stable] 2011-??-?? +- bugfix: stats counter were not properly initialized on creation - bugfix: potential abort after reading invalid X.509 certificate closes: http://bugzilla.adiscon.com/show_bug.cgi?id=290 Thanks to Tomas Heinrich for the patch diff --git a/runtime/statsobj.c b/runtime/statsobj.c index e1a89cf4..131605e0 100644 --- a/runtime/statsobj.c +++ b/runtime/statsobj.c @@ -154,9 +154,11 @@ addCounter(statsobj_t *pThis, uchar *ctrName, statsCtrType_t ctrType, void *pCtr switch(ctrType) { case ctrType_IntCtr: ctr->val.pIntCtr = (intctr_t*) pCtr; + *(ctr->val.pIntCtr) = 0; break; case ctrType_Int: ctr->val.pInt = (int*) pCtr; + *(ctr->val.pInt) = 0; break; } addCtrToList(pThis, ctr); -- cgit From 832d6e1e2c88455be6bb0929591715499602ad56 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 20 Dec 2011 18:19:14 +0100 Subject: imtcp: added stats counters also adds counters to other users of tcpsrv.c method, but these do not work if default submit method is overwritten (currently only the case for imdiag, what we don't consider a problem) --- tcps_sess.c | 1 + tcpsrv.c | 15 ++++++++++++++- tcpsrv.h | 3 +++ 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/tcps_sess.c b/tcps_sess.c index 99af0cb8..0fd3e713 100644 --- a/tcps_sess.c +++ b/tcps_sess.c @@ -259,6 +259,7 @@ defaultDoSubmitMessage(tcps_sess_t *pThis, struct syslogTime *stTime, time_t ttG CHKiRet(MsgSetRcvFromIP(pMsg, pThis->fromHostIP)); MsgSetRuleset(pMsg, pThis->pLstnInfo->pRuleset); + STATSCOUNTER_INC(pThis->pLstnInfo->ctrSubmit, pThis->pLstnInfo->mutCtrSubmit); if(pMultiSub == NULL) { CHKiRet(submitMsg(pMsg)); } else { diff --git a/tcpsrv.c b/tcpsrv.c index 0b822511..ca9d4192 100644 --- a/tcpsrv.c +++ b/tcpsrv.c @@ -36,8 +36,8 @@ * * A copy of the GPL can be found in the file "COPYING" in this distribution. */ - #include "config.h" +#include #include #include #include @@ -90,6 +90,7 @@ DEFobjCurrIf(netstrm) DEFobjCurrIf(nssel) DEFobjCurrIf(nspoll) DEFobjCurrIf(prop) +DEFobjCurrIf(statsobj) /* add new listener port to listener port list @@ -99,6 +100,7 @@ static inline rsRetVal addNewLstnPort(tcpsrv_t *pThis, uchar *pszPort) { tcpLstnPortList_t *pEntry; + uchar statname[64]; DEFiRet; ISOBJ_TYPE_assert(pThis, tcpsrv); @@ -118,6 +120,15 @@ addNewLstnPort(tcpsrv_t *pThis, uchar *pszPort) pEntry->pNext = pThis->pLstnPorts; pThis->pLstnPorts = pEntry; + /* support statistics gathering */ + CHKiRet(statsobj.Construct(&(pEntry->stats))); + snprintf((char*)statname, sizeof(statname), "%s(%s)", pThis->pszInputName, pszPort); + statname[sizeof(statname)-1] = '\0'; /* just to be on the save side... */ + CHKiRet(statsobj.SetName(pEntry->stats, statname)); + CHKiRet(statsobj.AddCounter(pEntry->stats, UCHAR_CONSTANT("submitted"), + ctrType_IntCtr, &(pEntry->ctrSubmit))); + CHKiRet(statsobj.ConstructFinalize(pEntry->stats)); + finalize_it: RETiRet; } @@ -1068,6 +1079,7 @@ CODESTARTObjClassExit(tcpsrv) objRelease(tcps_sess, DONT_LOAD_LIB); objRelease(conf, CORE_COMPONENT); objRelease(prop, CORE_COMPONENT); + objRelease(statsobj, CORE_COMPONENT); objRelease(ruleset, CORE_COMPONENT); objRelease(glbl, CORE_COMPONENT); objRelease(errmsg, CORE_COMPONENT); @@ -1094,6 +1106,7 @@ BEGINObjClassInit(tcpsrv, 1, OBJ_IS_LOADABLE_MODULE) /* class, version - CHANGE CHKiRet(objUse(conf, CORE_COMPONENT)); CHKiRet(objUse(glbl, CORE_COMPONENT)); CHKiRet(objUse(ruleset, CORE_COMPONENT)); + CHKiRet(objUse(statsobj, CORE_COMPONENT)); CHKiRet(objUse(prop, CORE_COMPONENT)); /* set our own handlers */ diff --git a/tcpsrv.h b/tcpsrv.h index 57bdf4b1..6dc79897 100644 --- a/tcpsrv.h +++ b/tcpsrv.h @@ -25,6 +25,7 @@ #include "obj.h" #include "prop.h" #include "tcps_sess.h" +#include "statsobj.h" /* support for framing anomalies */ typedef enum ETCPsyslogFramingAnomaly { @@ -40,6 +41,8 @@ struct tcpLstnPortList_s { prop_t *pInputName; tcpsrv_t *pSrv; /**< pointer to higher-level server instance */ ruleset_t *pRuleset; /**< associated ruleset */ + statsobj_t *stats; /**< associated stats object */ + STATSCOUNTER_DEF(ctrSubmit, mutCtrSubmit) tcpLstnPortList_t *pNext; /**< next port or NULL */ }; -- cgit From 74722b23317d556e86ad7fb77913c4c864c239c4 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 20 Dec 2011 18:22:58 +0100 Subject: bugfix: stats counter were not properly initialized on creation --- ChangeLog | 1 + runtime/statsobj.c | 2 ++ 2 files changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 3f5031ea..42cfac2a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,7 @@ Version 5.8.7 [V5-stable] 2011-??-?? - bugfix: potential abort after reading invalid X.509 certificate closes: http://bugzilla.adiscon.com/show_bug.cgi?id=290 Thanks to Tomas Heinrich for the patch +- bugfix: stats counter were not properly initialized on creation --------------------------------------------------------------------------- Version 5.8.6 [V5-stable] 2011-10-21 - bugfix: missing whitespace after property-based filter was not detected diff --git a/runtime/statsobj.c b/runtime/statsobj.c index e1a89cf4..131605e0 100644 --- a/runtime/statsobj.c +++ b/runtime/statsobj.c @@ -154,9 +154,11 @@ addCounter(statsobj_t *pThis, uchar *ctrName, statsCtrType_t ctrType, void *pCtr switch(ctrType) { case ctrType_IntCtr: ctr->val.pIntCtr = (intctr_t*) pCtr; + *(ctr->val.pIntCtr) = 0; break; case ctrType_Int: ctr->val.pInt = (int*) pCtr; + *(ctr->val.pInt) = 0; break; } addCtrToList(pThis, ctr); -- cgit