From a4eefd16b7776ded6a0fd680530057b8e843b7ad Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Sat, 17 Dec 2022 09:01:10 +0100
Subject: [PATCH] output: add %M format option for the log message body

If %M is not specified, it is automatically appended to the format
string, to provide backwards compatibility.
---
 src/util-debug.c | 54 ++++++++++++++++++++++++++++++------------------
 src/util-debug.h | 13 ++++++------
 2 files changed, 41 insertions(+), 26 deletions(-)

diff --git a/src/util-debug.c b/src/util-debug.c
index f6c602b083..fb91c6a4b3 100644
--- a/src/util-debug.c
+++ b/src/util-debug.c
@@ -376,8 +376,11 @@ static SCError SCLogMessageGetBuffer(struct timeval *tval, int color, SCLogOPTyp
     BUG_ON(sc_log_module_initialized != 1);
 
     /* make a copy of the format string as it will be modified below */
-    char local_format[strlen(log_format) + 1];
+    const int add_M = strstr(log_format, "%M") == NULL;
+    char local_format[strlen(log_format) + add_M * 2 + 1];
     strlcpy(local_format, log_format, sizeof(local_format));
+    if (add_M)
+        strlcat(local_format, "%M", sizeof(local_format));
     char *temp_fmt = local_format;
     char *substr = temp_fmt;
 
@@ -553,6 +556,36 @@ static SCError SCLogMessageGetBuffer(struct timeval *tval, int color, SCLogOPTyp
                 substr = temp_fmt;
                 substr++;
                 break;
+
+            case SC_LOG_FMT_MESSAGE: {
+                temp_fmt[0] = '\0';
+                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s", substr);
+                if (cw < 0) {
+                    return -1;
+                }
+                temp += cw;
+                if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) {
+                    return 0;
+                }
+                const char *hi = "";
+                if (log_level <= SC_LOG_ERROR)
+                    hi = red;
+                else if (log_level <= SC_LOG_NOTICE)
+                    hi = yellow;
+                cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s", hi, message,
+                        reset);
+                if (cw < 0) {
+                    return -1;
+                }
+                temp += cw;
+                if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) {
+                    return 0;
+                }
+                temp_fmt++;
+                substr = temp_fmt;
+                substr++;
+                break;
+            }
         }
         temp_fmt++;
 	}
@@ -563,25 +596,6 @@ static SCError SCLogMessageGetBuffer(struct timeval *tval, int color, SCLogOPTyp
     if (cw < 0) {
         return -1;
     }
-    temp += cw;
-    if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) {
-        return 0;
-    }
-
-    const char *hi = "";
-    if (log_level <= SC_LOG_ERROR)
-        hi = red;
-    else if (log_level <= SC_LOG_NOTICE)
-        hi = yellow;
-    cw = snprintf(temp, SC_LOG_MAX_LOG_MSG_LEN - (temp - buffer), "%s%s%s", hi, message, reset);
-    if (cw < 0) {
-        return -1;
-    }
-    temp += cw;
-    if ((temp - buffer) > SC_LOG_MAX_LOG_MSG_LEN) {
-        return 0;
-    }
-
     if (sc_log_config->op_filter_regex != NULL) {
         if (pcre2_match(sc_log_config->op_filter_regex, (PCRE2_SPTR8)buffer, strlen(buffer), 0, 0,
                     sc_log_config->op_filter_regex_match, NULL) < 0) {
diff --git a/src/util-debug.h b/src/util-debug.h
index d56ea61cd8..1e6e880da3 100644
--- a/src/util-debug.h
+++ b/src/util-debug.h
@@ -74,14 +74,14 @@ typedef enum {
 } SCLogOPType;
 
 /* The default log_format, if it is not supplied by the user */
-#define SC_LOG_DEF_FILE_FORMAT      "[%i - %m] %t %d: %S: "
-#define SC_LOG_DEF_LOG_FORMAT_REL   "%D: %S: "
-#define SC_LOG_DEF_LOG_FORMAT_RELV  "%d: %S: "
-#define SC_LOG_DEF_LOG_FORMAT_RELVV "[%i] %d: %S: "
+#define SC_LOG_DEF_FILE_FORMAT      "[%i - %m] %t %d: %S: %M"
+#define SC_LOG_DEF_LOG_FORMAT_REL   "%D: %S: %M"
+#define SC_LOG_DEF_LOG_FORMAT_RELV  "%d: %S: %M"
+#define SC_LOG_DEF_LOG_FORMAT_RELVV "[%i] %d: %S: %M"
 #ifdef DEBUG
-#define SC_LOG_DEF_LOG_FORMAT_DEV "[%f:%l] %d: %S: "
+#define SC_LOG_DEF_LOG_FORMAT_DEV "%d: %S: %M [%f:%l]"
 #else
-#define SC_LOG_DEF_LOG_FORMAT_DEV "[%f:%l] %d: %S: "
+#define SC_LOG_DEF_LOG_FORMAT_DEV "%d: %S: %M [%f:%l]"
 #endif
 
 /* The maximum length of the log message */
@@ -199,6 +199,7 @@ typedef struct SCLogConfig_ {
 #define SC_LOG_FMT_FUNCTION         'n' /* Function */
 #define SC_LOG_FMT_SUBSYSTEM        'S' /* Subsystem name */
 #define SC_LOG_FMT_THREAD_NAME      'T' /* thread name */
+#define SC_LOG_FMT_MESSAGE          'M' /* log message body */
 
 /* The log format prefix for the format specifiers */
 #define SC_LOG_FMT_PREFIX           '%'