Skip to content

pgsql: low hanging fruits - v2 #10853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jufajardini wants to merge 2 commits into from
Closed

pgsql: low hanging fruits - v2 #10853

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bbdc104
eve/alert: add missing pgsql metadata
jufajardini Apr 13, 2024
a0fac7f
pgsql: check for eol when parsing response
jufajardini Apr 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions rust/src/pgsql/pgsql.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/* Copyright (C) 2022 Open Information Security Foundation
/* Copyright (C) 2022-2024 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
Expand Down Expand Up @@ -661,7 +661,13 @@ pub unsafe extern "C" fn rs_pgsql_parse_response(
flow: *const Flow, state: *mut std::os::raw::c_void, pstate: *mut std::os::raw::c_void,
stream_slice: StreamSlice, _data: *const std::os::raw::c_void,
) -> AppLayerResult {
let _eof = AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC) > 0;
if stream_slice.is_empty() {
if AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC) > 0 {
return AppLayerResult::ok();
} else {
return AppLayerResult::err();
}
}

let state_safe: &mut PgsqlState = cast_pointer!(state, PgsqlState);

Expand Down
8 changes: 7 additions & 1 deletion src/output-json-pgsql.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/* Copyright (C) 2022 Open Information Security Foundation
/* Copyright (C) 2022-2024 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
Expand Down Expand Up @@ -47,6 +47,7 @@
#include "rust.h"

#define PGSQL_LOG_PASSWORDS BIT_U32(0)
#define PGSQL_DEFAULTS (PGSQL_LOG_PASSWORDS)

typedef struct OutputPgsqlCtx_ {
uint32_t flags;
Expand All @@ -58,6 +59,11 @@ typedef struct LogPgsqlLogThread_ {
OutputJsonThreadCtx *ctx;
} LogPgsqlLogThread;

bool JsonPgsqlAddMetadata(void *vtx, JsonBuilder *jb)
{
return rs_pgsql_logger(vtx, PGSQL_DEFAULTS, jb);
}

static int JsonPgsqlLogger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state,
void *txptr, uint64_t tx_id)
{
Expand Down
3 changes: 2 additions & 1 deletion src/output-json-pgsql.h
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/* Copyright (C) 2022 Open Information Security Foundation
/* Copyright (C) 2022-2024 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
Expand All @@ -25,5 +25,6 @@
#define SURICATA_OUTPUT_JSON_PGSQL_H

void JsonPgsqlLogRegister(void);
bool JsonPgsqlAddMetadata(void *vtx, JsonBuilder *jb);

#endif /* SURICATA_OUTPUT_JSON_PGSQL_H */
2 changes: 1 addition & 1 deletion src/output.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1133,7 +1133,7 @@ static EveJsonSimpleAppLayerLogger simple_json_applayer_loggers[ALPROTO_MAX] = {
{ ALPROTO_SIP, (EveJsonSimpleTxLogFunc)rs_sip_log_json },
{ ALPROTO_RFB, rs_rfb_logger_log },
{ ALPROTO_MQTT, JsonMQTTAddMetadata },
{ ALPROTO_PGSQL, NULL }, // TODO missing
{ ALPROTO_PGSQL, JsonPgsqlAddMetadata },
{ ALPROTO_TELNET, NULL }, // no logging
{ ALPROTO_TEMPLATE, rs_template_logger_log },
{ ALPROTO_RDP, (EveJsonSimpleTxLogFunc)rs_rdp_to_json },
Expand Down