darktemplar/auditd-plugin-clickhouse
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Implement audit record deserialization

Browse Source
This commit is contained in:
Aleksei Nikiforov 2020-01-14 17:53:22 +03:00
parent a42ec11de1
commit e9cb80077d
2 changed files with 144 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

143
auditd-record.cpp
View File

@ -605,3 +605,146 @@ boost::property_tree::ptree AuditRecord::toPtree() const
return data;
}
AuditRecord AuditRecord::fromPtree(const boost::property_tree::ptree &data)
{
AuditRecord result;
{
auto child = data.get_child_optional("time");
if (child)
{
result.time = boost::lexical_cast<decltype(AuditRecord::time)>(child->get_value<std::string>());
}
}
{
auto child = data.get_child_optional("milliseconds");
if (child)
{
result.milliseconds = boost::lexical_cast<decltype(AuditRecord::milliseconds)>(child->get_value<std::string>());
}
}
{
auto child = data.get_child_optional("serial");
if (child)
{
result.serial = boost::lexical_cast<decltype(AuditRecord::serial)>(child->get_value<std::string>());
}
}
{
auto child = data.get_child_optional("node");
if (child)
{
result.node = boost::lexical_cast<decltype(AuditRecord::node)>(child->get_value<std::string>());
}
}
{
auto fields = data.get_child_optional("fields");
if (fields)
{
for (auto iter = fields->begin(); iter != fields->end(); ++iter)
{
auto field_type = iter->second.get_child_optional("type");
if (field_type)
{
auto field_type_value = static_cast<AbstractRecordField::Type>(boost::lexical_cast<int>(field_type->get_value<std::string>()));
switch (field_type_value)
{
case AbstractRecordField::Type::Int:
{
auto record_field = std::dynamic_pointer_cast<IntegerRecordField>(IntegerRecordField::createRecord(iter->first));
if (record_field)
{
auto int_value = iter->second.get_child_optional("value_int");
if (int_value)
{
record_field->setIntValue(boost::lexical_cast<int>(int_value->get_value<std::string>()));
}
auto str_value = iter->second.get_child_optional("value_str");
if (str_value)
{
record_field->setStringValue(str_value->get_value<std::string>());
}
result.fields[iter->first] = record_field;
}
}
break;
case AbstractRecordField::Type::String:
{
auto record_field = std::dynamic_pointer_cast<StringRecordField>(StringRecordField::createRecord(iter->first));
if (record_field)
{
auto str_value = iter->second.get_child_optional("value_str");
if (str_value)
{
record_field->setStringValue(str_value->get_value<std::string>());
}
result.fields[iter->first] = record_field;
}
}
break;
case AbstractRecordField::Type::InterpretedString:
{
auto record_field = std::dynamic_pointer_cast<InterpretedStringRecordField>(InterpretedStringRecordField::createRecord(iter->first));
if (record_field)
{
auto str_value = iter->second.get_child_optional("value_str");
if (str_value)
{
record_field->setStringValue(str_value->get_value<std::string>());
}
result.fields[iter->first] = record_field;
}
}
break;
case AbstractRecordField::Type::InterpretedStringArray:
{
auto record_field = std::dynamic_pointer_cast<InterpretedStringArrayRecordField>(InterpretedStringArrayRecordField::createRecord(iter->first));
if (record_field)
{
std::list<std::string> names, values;
auto name_child = iter->second.get_child_optional("names");
if (name_child)
{
for (auto child_iter = name_child->begin(); child_iter != name_child->end(); ++child_iter)
{
names.push_back(child_iter->second.get_value<std::string>());
}
}
auto value_child = iter->second.get_child_optional("values");
if (value_child)
{
for (auto child_iter = value_child->begin(); child_iter != value_child->end(); ++child_iter)
{
values.push_back(child_iter->second.get_value<std::string>());
}
}
record_field->setArrays(names, values);
result.fields[iter->first] = record_field;
}
}
break;
}
}
}
}
}
return result;
}

1
auditd-record.hpp
View File

@ -93,6 +93,7 @@ struct AuditRecord
std::map<std::string, std::shared_ptr<AbstractRecordField> > fields;
boost::property_tree::ptree toPtree() const;
static AuditRecord fromPtree(const boost::property_tree::ptree &data);
};
class CommonStringRecordField: public AbstractRecordField