@ -31,12 +31,10 @@ fn log_pgsql(tx: &PgsqlTransaction, flags: u32, js: &mut JsonBuilder) -> Result<
js . set_uint ( "tx_id" , tx . tx_id ) ? ;
js . set_uint ( "tx_id" , tx . tx_id ) ? ;
if ! tx . requests . is_empty ( ) {
if ! tx . requests . is_empty ( ) {
// For now, even if 'requests' is an array, we don't need to log it as such, as
// For now, even if 'requests' is an array, we don't need to log it as such, as
// there are no duplicated messages
// there should be no duplicated messages, and there should be no more than 2 requests per tx
debug_validate_bug_on ! ( tx . requests . len ( ) > 2 ) ;
js . open_object ( "request" ) ? ;
js . open_object ( "request" ) ? ;
for request in & tx . requests {
log_request ( tx , flags , js ) ? ;
SCLogNotice ! ( "Suricata requests length: {}" , tx . requests . len ( ) ) ;
log_request ( request , flags , js ) ? ;
}
js . close ( ) ? ;
js . close ( ) ? ;
} else if tx . responses . is_empty ( ) {
} else if tx . responses . is_empty ( ) {
SCLogDebug ! ( "Suricata created an empty PGSQL transaction" ) ;
SCLogDebug ! ( "Suricata created an empty PGSQL transaction" ) ;
@ -55,7 +53,11 @@ fn log_pgsql(tx: &PgsqlTransaction, flags: u32, js: &mut JsonBuilder) -> Result<
Ok ( ( ) )
Ok ( ( ) )
}
}
fn log_request ( req : & PgsqlFEMessage , flags : u32 , js : & mut JsonBuilder ) -> Result < ( ) , JsonError > {
fn log_request ( tx : & PgsqlTransaction , flags : u32 , js : & mut JsonBuilder ) -> Result < ( ) , JsonError > {
// CopyFail, ConsolidatedCopyDataIn, CopyDone
let mut duplicated_messages : [ u8 ; 3 ] = [ 0 , 0 , 0 ] ;
for req in & tx . requests {
SCLogDebug ! ( "Suricata requests length: {}" , tx . requests . len ( ) ) ;
match req {
match req {
PgsqlFEMessage ::StartupMessage ( StartupPacket {
PgsqlFEMessage ::StartupMessage ( StartupPacket {
length : _ ,
length : _ ,
@ -102,13 +104,17 @@ fn log_request(req: &PgsqlFEMessage, flags: u32, js: &mut JsonBuilder) -> Result
identifier : _ ,
identifier : _ ,
length : _ ,
length : _ ,
payload ,
payload ,
} )
} ) = > {
| PgsqlFEMessage ::CopyFail ( RegularPacket {
js . set_string_from_bytes ( req . to_str ( ) , payload ) ? ;
}
PgsqlFEMessage ::CopyFail ( RegularPacket {
identifier : _ ,
identifier : _ ,
length : _ ,
length : _ ,
payload ,
payload ,
} ) = > {
} ) = > {
js . set_string_from_bytes ( req . to_str ( ) , payload ) ? ;
js . set_string_from_bytes ( req . to_str ( ) , payload ) ? ;
duplicated_messages [ 0 ] + = 1 ;
debug_validate_bug_on ! ( duplicated_messages [ 0 ] > 1 ) ;
}
}
PgsqlFEMessage ::CancelRequest ( CancelRequestMessage { pid , backend_key } ) = > {
PgsqlFEMessage ::CancelRequest ( CancelRequestMessage { pid , backend_key } ) = > {
js . set_string ( "message" , "cancel_request" ) ? ;
js . set_string ( "message" , "cancel_request" ) ? ;
@ -124,9 +130,15 @@ fn log_request(req: &PgsqlFEMessage, flags: u32, js: &mut JsonBuilder) -> Result
js . set_uint ( "msg_count" , * row_cnt ) ? ;
js . set_uint ( "msg_count" , * row_cnt ) ? ;
js . set_uint ( "data_size" , * data_size ) ? ;
js . set_uint ( "data_size" , * data_size ) ? ;
js . close ( ) ? ;
js . close ( ) ? ;
duplicated_messages [ 1 ] + = 1 ;
debug_validate_bug_on ! ( duplicated_messages [ 1 ] > 1 ) ;
}
PgsqlFEMessage ::CopyDone ( _ ) = > {
js . set_string ( "message" , req . to_str ( ) ) ? ;
duplicated_messages [ 2 ] + = 1 ;
debug_validate_bug_on ! ( duplicated_messages [ 2 ] > 1 ) ;
}
}
PgsqlFEMessage ::CopyDone ( _ )
PgsqlFEMessage ::Terminate ( _ ) = > {
| PgsqlFEMessage ::Terminate ( _ ) = > {
js . set_string ( "message" , req . to_str ( ) ) ? ;
js . set_string ( "message" , req . to_str ( ) ) ? ;
}
}
PgsqlFEMessage ::UnknownMessageType ( RegularPacket {
PgsqlFEMessage ::UnknownMessageType ( RegularPacket {
@ -137,6 +149,7 @@ fn log_request(req: &PgsqlFEMessage, flags: u32, js: &mut JsonBuilder) -> Result
// We don't want to log these, for now. Cf redmine: #6576
// We don't want to log these, for now. Cf redmine: #6576
}
}
}
}
}
Ok ( ( ) )
Ok ( ( ) )
}
}