Blob Blame History Raw
/**
 * @file enc_syslog.c
 * Encoder for syslog format.
 * This file contains code from all related objects that is required in
 * order to encode syslog format. The core idea of putting all of this into
 * a single file is that this makes it very straightforward to write
 * encoders for different encodings, as all is in one place.
 */
/*
 * liblognorm - a fast samples-based log normalization library
 * Copyright 2010-2016 by Rainer Gerhards and Adiscon GmbH.
 *
 * Modified by Pavel Levshin (pavel@levshin.spb.ru) in 2013
 *
 * This file is part of liblognorm.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 *
 * A copy of the LGPL v2.1 can be found in the file "COPYING" in this distribution.
 */
#include "config.h"
#include <stdlib.h>
#include <stdio.h>
#include <stdarg.h>
#include <assert.h>
#include <string.h>

#include <libestr.h>

#include "internal.h"
#include "liblognorm.h"
#include "enc.h"

static int
ln_addValue_Syslog(const char *value, es_str_t **str)
{
	int r;
	es_size_t i;

	assert(str != NULL);
	assert(*str != NULL);
	assert(value != NULL);

	for(i = 0; i < strlen(value); i++) {
		switch(value[i]) {
		case '\0':
			es_addChar(str, '\\');
			es_addChar(str, '0');
			break;
		case '\n':
			es_addChar(str, '\\');
			es_addChar(str, 'n');
			break;
		/* TODO : add rest of control characters here... */
		case ',': /* comma is CEE-reserved for lists */
			es_addChar(str, '\\');
			es_addChar(str, ',');
			break;
#if 0 /* alternative encoding for discussion */
		case '^': /* CEE-reserved for lists */
			es_addChar(str, '\\');
			es_addChar(str, '^');
			break;
#endif
		/* at this layer ... do we need to think about transport
		 * encoding at all? Or simply leave it to the transport agent?
		 */
		case '\\': /* RFC5424 reserved */
			es_addChar(str, '\\');
			es_addChar(str, '\\');
			break;
		case ']': /* RFC5424 reserved */
			es_addChar(str, '\\');
			es_addChar(str, ']');
			break;
		case '\"': /* RFC5424 reserved */
			es_addChar(str, '\\');
			es_addChar(str, '\"');
			break;
		default:
			es_addChar(str, value[i]);
			break;
		}
	}
	r = 0;

	return r;
}


static int
ln_addField_Syslog(char *name, struct json_object *field, es_str_t **str)
{
	int r;
	const char *value;
	int needComma = 0;
	struct json_object *obj;
	int i;

	assert(field != NULL);
	assert(str != NULL);
	assert(*str != NULL);

	CHKR(es_addBuf(str, name, strlen(name)));
	CHKR(es_addBuf(str, "=\"", 2));
	switch(json_object_get_type(field)) {
	case json_type_array:
		for (i = json_object_array_length(field) - 1; i >= 0; i--) {
			if(needComma)
				es_addChar(str, ',');
			else
				needComma = 1;
			CHKN(obj = json_object_array_get_idx(field, i));
			CHKN(value = json_object_get_string(obj));
			CHKR(ln_addValue_Syslog(value, str));
		}
		break;
	case json_type_string:
	case json_type_int:
		CHKN(value = json_object_get_string(field));
		CHKR(ln_addValue_Syslog(value, str));
		break;
	case json_type_null:
	case json_type_boolean:
	case json_type_double:
	case json_type_object:
		CHKR(es_addBuf(str, "***unsupported type***", sizeof("***unsupported type***")-1));
		break;
	default:
		CHKR(es_addBuf(str, "***OBJECT***", sizeof("***OBJECT***")-1));
	}
	CHKR(es_addChar(str, '\"'));
	r = 0;

done:
	return r;
}


static inline int
ln_addTags_Syslog(struct json_object *taglist, es_str_t **str)
{
	int r = 0;
	struct json_object *tagObj;
	int needComma = 0;
	const char *tagCstr;
	int i;

	assert(json_object_is_type(taglist, json_type_array));

	CHKR(es_addBuf(str, " event.tags=\"", 13));
	for (i = json_object_array_length(taglist) - 1; i >= 0; i--) {
		if(needComma)
			es_addChar(str, ',');
		else
			needComma = 1;
		CHKN(tagObj = json_object_array_get_idx(taglist, i));
		CHKN(tagCstr = json_object_get_string(tagObj));
		CHKR(es_addBuf(str, (char*)tagCstr, strlen(tagCstr)));
	}
	es_addChar(str, '"');

done:	return r;
}


int
ln_fmtEventToRFC5424(struct json_object *json, es_str_t **str)
{
	int r = -1;
	struct json_object *tags;

	assert(json != NULL);
	assert(json_object_is_type(json, json_type_object));
	if((*str = es_newStr(256)) == NULL)
		goto done;

	es_addBuf(str, "[cee@115", 8);

	if(json_object_object_get_ex(json, "event.tags", &tags)) {
		CHKR(ln_addTags_Syslog(tags, str));
	}
	struct json_object_iterator it = json_object_iter_begin(json);
	struct json_object_iterator itEnd = json_object_iter_end(json);
	while (!json_object_iter_equal(&it, &itEnd)) {
		char *const name = (char*)json_object_iter_peek_name(&it);
		if (strcmp(name, "event.tags")) {
			es_addChar(str, ' ');
			ln_addField_Syslog(name, json_object_iter_peek_value(&it), str);
		}
		json_object_iter_next(&it);
	}
	es_addChar(str, ']');

done:
	return r;
}