Skip to content

Commit 396dcf1

Browse files
kodjo-anipahkodjo-anipah
committed
add timzone config to FortiGateSyslogEvent
1 parent 74247ce commit 396dcf1

File tree

5 files changed

+80
-26
lines changed

5 files changed

+80
-26
lines changed

‎src/main/java/org/graylog2/syslog4j/server/impl/event/CiscoSyslogServerEvent.java‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ public class CiscoSyslogServerEvent extends SyslogServerEvent {
2929
public CiscoSyslogServerEvent(final byte[] message, int length, InetAddress inetAddress) {
3030
super();
3131

32-
initialize(message, length, inetAddress);
32+
initialize(message, length, inetAddress, null);
3333
parse();
3434
}
3535
public CiscoSyslogServerEvent(final byte[] message, int length, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
@@ -42,7 +42,7 @@ public CiscoSyslogServerEvent(final byte[] message, int length, InetAddress inet
4242
public CiscoSyslogServerEvent(final String message, InetAddress inetAddress) {
4343
super();
4444

45-
initialize(message, inetAddress);
45+
initialize(message, inetAddress, null);
4646
parse();
4747
}
4848

@@ -171,7 +171,4 @@ public int getSequenceNumber() {
171171
return sequenceNumber;
172172
}
173173

174-
private ZoneId getDefaultServerZoneId() {
175-
return Objects.isNull(sysLogServerTimeZone) ? ZoneOffset.UTC : sysLogServerTimeZone.toTimeZone().toZoneId();
176-
}
177174
}

‎src/main/java/org/graylog2/syslog4j/server/impl/event/FortiGateSyslogEvent.java‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,21 @@
11
package org.graylog2.syslog4j.server.impl.event;
22

33
import org.graylog2.syslog4j.server.SyslogServerEventIF;
4+
import org.joda.time.DateTimeZone;
45

56
import java.nio.charset.Charset;
67
import java.nio.charset.StandardCharsets;
78
import java.time.LocalDate;
89
import java.time.LocalTime;
10+
import java.time.ZoneId;
911
import java.time.ZoneOffset;
1012
import java.time.ZonedDateTime;
1113
import java.time.format.DateTimeFormatter;
1214
import java.util.Collections;
1315
import java.util.Date;
1416
import java.util.HashMap;
1517
import java.util.Map;
18+
import java.util.Objects;
1619
import java.util.regex.Matcher;
1720
import java.util.regex.Pattern;
1821

@@ -30,7 +33,8 @@ public class FortiGateSyslogEvent implements SyslogServerEventIF {
3033
private static final Pattern KV_PATTERN = Pattern.compile("(\\w+)=([^\\s\"]*)");
3134
private static final Pattern QUOTED_KV_PATTERN = Pattern.compile("(\\w+)=\"([^\"]*)\"");
3235

33-
private final String rawEvent;
36+
private String rawEvent;
37+
private ZoneId defaultZoneId;
3438
private Date date;
3539
private int facility;
3640
private int level;
@@ -40,7 +44,16 @@ public class FortiGateSyslogEvent implements SyslogServerEventIF {
4044
private Map<String, String> fields = Collections.emptyMap();
4145

4246
public FortiGateSyslogEvent(final String rawEvent) {
47+
initialize(rawEvent, null);
48+
}
49+
50+
public FortiGateSyslogEvent(final String rawEvent, DateTimeZone sysLogServerTimeZone) {
51+
initialize(rawEvent, sysLogServerTimeZone);
52+
}
53+
54+
private void initialize(final String rawEvent, DateTimeZone sysLogServerTimeZone) {
4355
this.rawEvent = requireNonNull(rawEvent, "rawEvent");
56+
this.defaultZoneId = Objects.isNull(sysLogServerTimeZone) ? ZoneOffset.UTC : sysLogServerTimeZone.toTimeZone().toZoneId();
4457
parse(rawEvent);
4558
}
4659

@@ -55,7 +68,7 @@ private void parse(String event) {
5568
parsePriority(priority);
5669
setMessage(message);
5770
parseFields(message);
58-
parseDate(fields.get("date"), fields.get("time"));
71+
parseDate(fields.get("date"), fields.get("time"), fields.get("tz"));
5972
setHost(fields.get("devname"));
6073
}
6174
}
@@ -83,12 +96,18 @@ private void parseFields(String event) {
8396
setFields(fields);
8497
}
8598

86-
private void parseDate(String date, String time) {
99+
private void parseDate(String date, String time, String timeZone) {
87100
if (date != null && time != null) {
101+
ZoneId zone = defaultZoneId;
102+
103+
if (timeZone != null) {
104+
zone = ZoneOffset.of(timeZone);
105+
}
106+
88107
final ZonedDateTime dateTime = ZonedDateTime.of(
89-
LocalDate.parse(date, DateTimeFormatter.ISO_LOCAL_DATE.withZone(ZoneOffset.UTC)),
90-
LocalTime.parse(time, DateTimeFormatter.ISO_LOCAL_TIME.withZone(ZoneOffset.UTC)),
91-
ZoneOffset.UTC);
108+
LocalDate.parse(date, DateTimeFormatter.ISO_LOCAL_DATE.withZone(zone)),
109+
LocalTime.parse(time, DateTimeFormatter.ISO_LOCAL_TIME.withZone(zone)),
110+
zone);
92111
setDate(Date.from(dateTime.toInstant()));
93112

94113
} else {

‎src/main/java/org/graylog2/syslog4j/server/impl/event/SyslogServerEvent.java‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111
import java.text.DateFormat;
1212
import java.text.ParseException;
1313
import java.text.SimpleDateFormat;
14+
import java.time.ZoneId;
15+
import java.time.ZoneOffset;
1416
import java.util.Calendar;
1517
import java.util.Date;
1618
import java.util.Locale;
@@ -61,7 +63,7 @@ public SyslogServerEvent(final String message, InetAddress inetAddress, DateTime
6163
}
6264

6365
public SyslogServerEvent(final byte[] message, int length, InetAddress inetAddress) {
64-
initialize(message, length, inetAddress);
66+
initialize(message, length, inetAddress, null);
6567

6668
parse();
6769
}
@@ -72,28 +74,20 @@ public SyslogServerEvent(final byte[] message, int length, InetAddress inetAddre
7274
parse();
7375
}
7476

75-
protected void initialize(final String message, InetAddress inetAddress) {
77+
protected void initialize(final String message, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
7678
this.rawString = message;
7779
this.rawLength = message.length();
7880
this.inetAddress = inetAddress;
79-
8081
this.message = message;
81-
}
82-
83-
protected void initialize(final String message, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
8482
this.sysLogServerTimeZone = sysLogServerTimeZone;
85-
initialize(message, inetAddress);
8683
}
8784

88-
protected void initialize(final byte[] message, int length, InetAddress inetAddress) {
85+
86+
protected void initialize(final byte[] message, int length, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
8987
this.rawBytes = message;
9088
this.rawLength = length;
9189
this.inetAddress = inetAddress;
92-
}
93-
94-
protected void initialize(final byte[] message, int length, InetAddress inetAddress, DateTimeZone sysLogServerTimeZone) {
9590
this.sysLogServerTimeZone = sysLogServerTimeZone;
96-
initialize(message, length, inetAddress);
9791
}
9892

9993
protected void parseHost() {
@@ -222,6 +216,10 @@ public byte[] getRaw() {
222216
}
223217
}
224218

219+
protected ZoneId getDefaultServerZoneId() {
220+
return Objects.isNull(sysLogServerTimeZone) ? ZoneOffset.UTC : sysLogServerTimeZone.toTimeZone().toZoneId();
221+
}
222+
225223
public int getRawLength() {
226224
return this.rawLength;
227225
}

‎src/main/java/org/graylog2/syslog4j/server/impl/event/structured/StructuredSyslogServerEvent.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,14 +39,14 @@ public class StructuredSyslogServerEvent extends SyslogServerEvent {
3939
public StructuredSyslogServerEvent(final byte[] message, int length, InetAddress inetAddress) {
4040
super();
4141

42-
initialize(message, length, inetAddress);
42+
initialize(message, length, inetAddress, null);
4343
parse();
4444
}
4545

4646
public StructuredSyslogServerEvent(final String message, InetAddress inetAddress) {
4747
super();
4848

49-
initialize(message, inetAddress);
49+
initialize(message, inetAddress, null);
5050
parse();
5151
}
5252

‎src/test/java/org/graylog2/syslog4j/server/impl/event/FortiGateSyslogEventTest.java‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,20 @@
11
package org.graylog2.syslog4j.server.impl.event;
22

3+
import org.joda.time.DateTimeZone;
34
import org.junit.Test;
45

56
import java.nio.charset.StandardCharsets;
7+
import java.time.ZoneId;
68
import java.time.ZoneOffset;
79
import java.time.ZonedDateTime;
810

911
import static org.assertj.core.api.Assertions.assertThat;
1012

1113
public class FortiGateSyslogEventTest {
14+
15+
public static final DateTimeZone MST_TIMEZONE = DateTimeZone.forID("MST");
16+
public static final ZoneId MST = MST_TIMEZONE.toTimeZone().toZoneId();
17+
1218
@Test
1319
public void testFortiGateMessage() {
1420
final String rawMessage = "<45>date=2017-03-06 time=12:53:10 devname=DEVICENAME devid=DEVICEID logid=0000000013 type=traffic subtype=forward level=notice vd=ALIAS srcip=IP srcport=45748 srcintf=\"IF\" dstip=IP dstport=443 dstintf=\"IF\" sessionid=1122686199 status=close policyid=77 dstcountry=\"COUNTRY\" srccountry=\"COUNTRY\" trandisp=dnat tranip=IP tranport=443 service=HTTPS proto=6 appid=41540 app=\"SSL_TLSv1.2\" appcat=\"Network.Service\" applist=\"ACLNAME\" appact=detected duration=1 sentbyte=2313 rcvdbyte=14883 sentpkt=19 rcvdpkt=19 utmaction=passthrough utmevent=app-ctrl attack=\"SSL\" hostname=\"HOSTNAME\" custom=\"white space\"";
@@ -31,4 +37,38 @@ public void testFortiGateMessage() {
3137
.containsEntry("custom", "white space");
3238
}
3339

34-
}
40+
@Test
41+
public void testDefaultTimezoneDetected() {
42+
final String rawMessage = "<45>date=2017-03-06 time=12:53:10 tz=-0700 devname=DEVICENAME devid=DEVICEID logid=0000000013 type=traffic subtype=forward level=notice vd=ALIAS srcip=IP srcport=45748 srcintf=\"IF\" dstip=IP dstport=443 dstintf=\"IF\" sessionid=1122686199 status=close policyid=77 dstcountry=\"COUNTRY\" srccountry=\"COUNTRY\" trandisp=dnat tranip=IP tranport=443 service=HTTPS proto=6 appid=41540 app=\"SSL_TLSv1.2\" appcat=\"Network.Service\" applist=\"ACLNAME\" appact=detected duration=1 sentbyte=2313 rcvdbyte=14883 sentpkt=19 rcvdpkt=19 utmaction=passthrough utmevent=app-ctrl attack=\"SSL\" hostname=\"HOSTNAME\" custom=\"white space\"";
43+
final FortiGateSyslogEvent event = new FortiGateSyslogEvent(rawMessage);
44+
45+
ZonedDateTime of = ZonedDateTime.of(2017, 3, 6, 12, 53, 10, 0, MST);
46+
47+
assertThat(ZonedDateTime.ofInstant(event.getDate().toInstant(), MST))
48+
.isEqualTo(of);
49+
}
50+
51+
52+
@Test
53+
public void testDefaultTimezoneConfigIgnored() {
54+
final String rawMessage = "<45>date=2017-03-06 time=12:53:10 tz=+0000 devname=DEVICENAME devid=DEVICEID logid=0000000013 type=traffic subtype=forward level=notice vd=ALIAS srcip=IP srcport=45748 srcintf=\"IF\" dstip=IP dstport=443 dstintf=\"IF\" sessionid=1122686199 status=close policyid=77 dstcountry=\"COUNTRY\" srccountry=\"COUNTRY\" trandisp=dnat tranip=IP tranport=443 service=HTTPS proto=6 appid=41540 app=\"SSL_TLSv1.2\" appcat=\"Network.Service\" applist=\"ACLNAME\" appact=detected duration=1 sentbyte=2313 rcvdbyte=14883 sentpkt=19 rcvdpkt=19 utmaction=passthrough utmevent=app-ctrl attack=\"SSL\" hostname=\"HOSTNAME\" custom=\"white space\"";
55+
final FortiGateSyslogEvent event = new FortiGateSyslogEvent(rawMessage, MST_TIMEZONE);
56+
57+
ZonedDateTime of = ZonedDateTime.of(2017, 3, 6, 12, 53, 10, 0, ZoneOffset.UTC);
58+
59+
assertThat(ZonedDateTime.ofInstant(event.getDate().toInstant(), ZoneOffset.UTC))
60+
.isEqualTo(of);
61+
}
62+
63+
@Test
64+
public void testDefaultTimezoneConfigured() {
65+
final String rawMessage = "<45>date=2017-03-06 time=12:53:10 devname=DEVICENAME devid=DEVICEID logid=0000000013 type=traffic subtype=forward level=notice vd=ALIAS srcip=IP srcport=45748 srcintf=\"IF\" dstip=IP dstport=443 dstintf=\"IF\" sessionid=1122686199 status=close policyid=77 dstcountry=\"COUNTRY\" srccountry=\"COUNTRY\" trandisp=dnat tranip=IP tranport=443 service=HTTPS proto=6 appid=41540 app=\"SSL_TLSv1.2\" appcat=\"Network.Service\" applist=\"ACLNAME\" appact=detected duration=1 sentbyte=2313 rcvdbyte=14883 sentpkt=19 rcvdpkt=19 utmaction=passthrough utmevent=app-ctrl attack=\"SSL\" hostname=\"HOSTNAME\" custom=\"white space\"";
66+
final FortiGateSyslogEvent event = new FortiGateSyslogEvent(rawMessage, MST_TIMEZONE);
67+
68+
ZoneId mst = MST_TIMEZONE.toTimeZone().toZoneId();
69+
ZonedDateTime of = ZonedDateTime.of(2017, 3, 6, 12, 53, 10, 0, mst);
70+
71+
assertThat(ZonedDateTime.ofInstant(event.getDate().toInstant(), mst))
72+
.isEqualTo(of);
73+
}
74+
}

0 commit comments

Comments
 (0)