rsyslog/tests/diagtalker.c
Rainer Gerhards fcd5578c82
ci/tests: add QRadar JSON ingest test; fix diagtalker buf
Parsing QRadar-formatted JSON is common in real-world pipelines and
migration projects. This change adds CI coverage to ensure rsyslog
can ingest and re-emit such events without semantic drift.

Impact: CI-only; no runtime behavior change.

Add testsuites/qradar_json with two representative QRadar events. A
new Python validator compares input vs. emitted JSON after removing
the CEE cookie, ignoring whitespace and key order for semantic
equality. A shell fallback uses jq for normalized compares and a
basic field presence check when jq is unavailable. Increase the
tests/diagtalker input buffer from 2 KiB to 10 KiB so large QRadar
payloads are not truncated during test runs.

BEFORE: No semantic check for QRadar JSON; large messages could
truncate in diagtalker.
AFTER: CI asserts input/output JSON equivalence; diagtalker handles
~10 KiB lines without truncation.
2025-10-01 19:14:50 +02:00

160 lines
3.9 KiB
C

/* A yet very simple tool to talk to imdiag (this replaces the
* previous Java implementation in order to get fewer dependencies).
*
* Copyright 2010-2018 Rainer Gerhards and Adiscon GmbH.
*
* This file is part of rsyslog.
*
* Rsyslog is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Rsyslog is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with Rsyslog. If not, see <http://www.gnu.org/licenses/>.
*
* A copy of the GPL can be found in the file "COPYING" in this distribution.
*/
#include "config.h"
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <arpa/inet.h>
#include <sys/types.h>
#include <sys/socket.h>
#if defined(__FreeBSD__)
#include <netinet/in.h>
#endif
static char *targetIP = "127.0.0.1";
static int targetPort = 13500;
/* open a single tcp connection
*/
int openConn(int *fd) {
int sock;
struct sockaddr_in addr;
int port;
int retries = 0;
if ((sock = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket()");
exit(1);
}
port = targetPort;
memset((char *)&addr, 0, sizeof(addr));
addr.sin_family = AF_INET;
addr.sin_port = htons(port);
if (inet_aton(targetIP, &addr.sin_addr) == 0) {
fprintf(stderr, "inet_aton() failed\n");
exit(1);
}
while (1) { /* loop broken inside */
if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == 0) {
break;
} else {
if (retries++ == 50) {
perror("connect()");
fprintf(stderr, "[%d] connect() failed\n", port);
exit(1);
} else {
fprintf(stderr, "[%d] connect failed, retrying...\n", port);
usleep(100000); /* ms = 1000 us! */
}
}
}
if (retries > 0) {
fprintf(stderr, "[%d] connection established.\n", port);
}
*fd = sock;
return 0;
}
/* send a string
*/
static void sendCmd(int fd, char *buf, int len) {
int lenSend;
lenSend = send(fd, buf, len, 0);
if (lenSend != len) {
perror("sending string");
exit(1);
}
}
/* wait for a response from remote system
*/
static void waitRsp(int fd, char *buf, int len) {
int ret;
ret = recv(fd, buf, len - 1, 0);
if (ret < 0) {
perror("receiving response");
exit(1);
}
/* we assume the message was complete, it may be better to wait
* for a LF...
*/
buf[ret] = '\0';
}
/* do the actual processing
*/
static void doProcessing(void) {
int fd;
int len;
char line[10 * 1024];
openConn(&fd);
while (!feof(stdin)) {
if (fgets(line, sizeof(line) - 1, stdin) == NULL) break;
len = strlen(line);
sendCmd(fd, line, len);
waitRsp(fd, line, sizeof(line));
printf("imdiag[%d]: %s", targetPort, line);
if (strstr(line, "imdiag::error") != NULL) {
exit(1);
}
}
}
/* Run the test.
* rgerhards, 2009-04-03
*/
int main(int argc, char *argv[]) {
int ret = 0;
int opt;
while ((opt = getopt(argc, argv, "t:p:")) != -1) {
switch (opt) {
case 't':
targetIP = optarg;
break;
case 'p':
targetPort = atoi(optarg);
break;
default:
printf("invalid option '%c' or value missing - terminating...\n", opt);
exit(1);
break;
}
}
doProcessing();
exit(ret);
}