Attachment #106787 for bug #161882

View | Details | Raw Unified | Return to bug 161882
Collapse All | Expand All




-- extensions/printpkt.c

#define GET_VALUE(x)	ulogd_keyh[intr_ids[x].id].interp->result[ulogd_keyh[intr_ids[x].id].offset].value
#define GET_FLAGS(x)	ulogd_keyh[intr_ids[x].id].interp->result[ulogd_keyh[intr_ids[x].id].offset].flags

int printpkt_print(ulog_iret_t *res, char *buf, size_t buf_siz, int prefix)
{
	char *timestr;
	char *tmp;
	time_t now;

	if( buf_siz) *buf = '\0';
	size_t buf_len = 0;

#define BUF_ADD(ptr, siz, off, fmt...) \
	snprintf(((ptr)+(off)), ((siz) > (off) ? (siz)-(off) : 0), ##fmt)

	if (prefix) {
		now = (time_t) GET_VALUE(0).ui32;

			*tmp = '\0';

		/* print time and hostname */
		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "%.15s %s", timestr, hostname);
	}

	if (*(char *) GET_VALUE(1).ptr)
	{
		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, " %s", (char *) GET_VALUE(1).ptr);
	}

	buf_len = strlen(buf);
	BUF_ADD(buf,buf_siz,buf_len," IN=%s OUT=%s ", 
		 (char *) GET_VALUE(2).ptr, 
		 (char *) GET_VALUE(3).ptr);

	/* FIXME: configurable */
	buf_len = strlen(buf);
	BUF_ADD(buf,buf_siz,buf_len, "MAC=%s ", 
		 (GET_FLAGS(4) & ULOGD_RETF_VALID) ? (char *) GET_VALUE(4).ptr : "");

	buf_len = strlen(buf);
	BUF_ADD(buf,buf_siz,buf_len, "SRC=%s ", 
		 inet_ntoa((struct in_addr) {htonl(GET_VALUE(5).ui32)}));

	buf_len = strlen(buf);
	BUF_ADD(buf,buf_siz,buf_len, "DST=%s ", 
		inet_ntoa((struct in_addr) {htonl(GET_VALUE(6).ui32)}));

	buf_len = strlen(buf);
	BUF_ADD(buf,buf_siz,buf_len,
		 "LEN=%u TOS=%02X PREC=0x%02X TTL=%u ID=%u ", 
		 GET_VALUE(7).ui16, GET_VALUE(8).ui8 & IPTOS_TOS_MASK, 
		 GET_VALUE(8).ui8 & IPTOS_PREC_MASK, GET_VALUE(9).ui8,
		 GET_VALUE(10).ui16);

	if (GET_VALUE(10).ui16 & IP_RF) 
	{
		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "CE ");
	}

	if (GET_VALUE(11).ui16 & IP_DF)
	{
		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "DF ");
	}

	if (GET_VALUE(11).ui16 & IP_MF)
	{
		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "MF ");
	}

	if (GET_VALUE(11).ui16 & IP_OFFMASK)
	{
		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "FRAG:%u ", 
				GET_VALUE(11).ui16 & IP_OFFMASK);
	}

	switch (GET_VALUE(12).ui8) {

	case IPPROTO_TCP:
		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "PROTO=TCP ");
		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "SPT=%u DPT=%u ",
			 GET_VALUE(13).ui16, GET_VALUE(14).ui16);
		/* FIXME: config */
		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "SEQ=%u ACK=%u ", 
			 GET_VALUE(15).ui32, GET_VALUE(16).ui32);

		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len,
			 "WINDOW=%u ", GET_VALUE(17).ui16);

//		buf_len = strlen(buf);
//		BUF_ADD(buf,buf_siz,buf_len, "RES=0x%02x ", 
		
		if (GET_VALUE(18).b)
		{
			buf_len = strlen(buf);
			BUF_ADD(buf,buf_siz,buf_len, "URG ");
		}

		if (GET_VALUE(19).b)
		{
			buf_len = strlen(buf);
			BUF_ADD(buf,buf_siz,buf_len, "ACK ");
		}

		if (GET_VALUE(20).b)
		{
			buf_len = strlen(buf);
			BUF_ADD(buf,buf_siz,buf_len, "PSH ");
		}

		if (GET_VALUE(21).b)
		{
			buf_len = strlen(buf);
			BUF_ADD(buf,buf_siz,buf_len, "RST ");
		}

		if (GET_VALUE(22).b)
		{
			buf_len = strlen(buf);
			BUF_ADD(buf,buf_siz,buf_len, "SYN ");
		}

		if (GET_VALUE(23).b)
		{
			buf_len = strlen(buf);
			BUF_ADD(buf,buf_siz,buf_len, "FIN ");
		}

		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "URGP=%u ", GET_VALUE(24).ui16);

		break;
	case IPPROTO_UDP:

		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "PROTO=UDP ");

		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "SPT=%u DPT=%u LEN=%u ", 
				GET_VALUE(25).ui16, GET_VALUE(26).ui16, 
				GET_VALUE(27).ui16);
			break;
	case IPPROTO_ICMP:

		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "PROTO=ICMP ");

		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "TYPE=%u CODE=%u ",
				GET_VALUE(28).ui8, GET_VALUE(29).ui8);

		switch (GET_VALUE(28).ui8) {
		case ICMP_ECHO:
		case ICMP_ECHOREPLY:
			buf_len = strlen(buf);
			BUF_ADD(buf,buf_siz,buf_len, "ID=%u SEQ=%u ", 
					   GET_VALUE(30).ui16,
					   GET_VALUE(31).ui16);
			break;
		case ICMP_PARAMETERPROB:
			buf_len = strlen(buf);
			BUF_ADD(buf,buf_siz,buf_len, "PARAMETER=%u ",
					   GET_VALUE(32).ui32 >> 24);
			break;
		case ICMP_REDIRECT:
			buf_len = strlen(buf);
			BUF_ADD(buf,buf_siz,buf_len, "GATEWAY=%s ", inet_ntoa((struct in_addr) {htonl(GET_VALUE(32).ui32)}));
			break;
		case ICMP_DEST_UNREACH:
			if (GET_VALUE(29).ui8 == ICMP_FRAG_NEEDED)
			{
				buf_len = strlen(buf);
				BUF_ADD(buf,buf_siz,buf_len, "MTU=%u ", 
						   GET_VALUE(33).ui16);
			}
			break;
		}
		break;
	case IPPROTO_ESP:
	case IPPROTO_AH:
		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "PROTO=%s ", GET_VALUE(12).ui8 == IPPROTO_ESP ? "ESP" : "AH");
		/* FIXME: "INCOMPLETE [%u bytes]" in case of short pkt */
		if (intr_ids[34].id > 0) {
			buf_len = strlen(buf);
			BUF_ADD(buf,buf_siz,buf_len, "SPI=0x%x ", GET_VALUE(34).ui32);
		}
		break;
	default:

		buf_len = strlen(buf);
		BUF_ADD(buf,buf_siz,buf_len, "PROTO=%u ", GET_VALUE(11).ui8);
	}
	buf_len = strlen(buf);
	BUF_ADD(buf,buf_siz,buf_len, "\n");

#undef  BUF_ADD

	return 0;
}
-- extensions/printpkt.h

#ifndef _PRINTPKT_H
#define _PRINTPKT_H

int printpkt_print(ulog_iret_t *res, char *buf, size_t buf_siz, int prefix);
int printpkt_init(void);

#endif
-- extensions/ulogd_BASE.c

	int i;
	char *buf, *oldbuf = NULL;
	ulog_iret_t *ret = ip->result;
	size_t siz;

	if (pkt->mac_len) {
		siz = 3 * pkt->mac_len + 1;
		buf = (char *) malloc(siz);
		if (!buf) {
			ulogd_log(ULOGD_ERROR, "OOM!!!\n");
			return NULL;

		p = pkt->mac;
		oldbuf = buf;
		for (i = 0; i < pkt->mac_len; i++, p++)
			snprintf(buf, siz, "%s%02x%c", oldbuf, *p, i==pkt->mac_len-1 ? ' ':':');
		ret[0].value.ptr = buf;
		ret[0].flags |= ULOGD_RETF_VALID;
	}
-- extensions/ulogd_LOGEMU.c

{
	static char buf[4096];

	printpkt_print(res, buf, sizeof(buf), 1);

	fprintf(of, "%s", buf);

-- extensions/ulogd_PWSNIFF.c

			return NULL;
		}
		strncpy(ret[0].value.ptr, (const char *)begp, len);
		*((char *)ret[0].value.ptr + len) = '\0';
	}
	if (pw_len) {
		ret[1].value.ptr = (char *) malloc(pw_len+1);

			return NULL;
		}
		strncpy(ret[1].value.ptr, (const char *)pw_begp, pw_len);
		*((char *)ret[1].value.ptr + pw_len) = '\0';

	}
	return ret;
-- extensions/ulogd_SYSLOG.c

{
	static char buf[4096];
	
	printpkt_print(res, buf, sizeof(buf), 0);
	syslog(syslog_level|syslog_facility, buf);

	return 0;
-- mysql/ulogd_MYSQL.c

#include <ulogd/ulogd.h>
#include <ulogd/conffile.h>
#include <mysql/mysql.h>
#include <inttypes.h>

#ifdef DEBUG_MYSQL
#define DEBUGP(x, args...)	fprintf(stderr, x, ## args)

/* buffer for our insert statement */
static char *stmt;

/* size of our insert statement buffer */
static size_t stmt_siz;

/* pointer to the beginning of the "VALUES" part */
static char *stmt_val;


			
		if (!res || !IS_VALID((*res))) {
			/* no result, we have to fake something */
			snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "NULL,");
			stmt_ins = stmt + strlen(stmt);
			continue;
		}
		
		switch (res->type) {
			case ULOGD_RET_INT8:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%d,", res->value.i8);
				break;
			case ULOGD_RET_INT16:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%d,", res->value.i16);
				break;
			case ULOGD_RET_INT32:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%d,", res->value.i32);
				break;
			case ULOGD_RET_INT64:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%"PRId64",", res->value.i64);
				break;
			case ULOGD_RET_UINT8:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%u,", res->value.ui8);
				break;
			case ULOGD_RET_UINT16:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%u,", res->value.ui16);
				break;
			case ULOGD_RET_IPADDR:
#ifdef IP_AS_STRING
				memset(&addr, 0, sizeof(addr));
				addr.s_addr = ntohl(res->value.ui32);
				*stmt_ins++ = '\'';
				tmpstr = inet_ntoa(addr);
				if(stmt_siz > (stmt_ins-stmt)+(strlen(tmpstr)*2)+4)
				{
					*stmt_ins++ = '\'';
#ifdef OLD_MYSQL
					mysql_escape_string(stmt_ins, tmpstr,
							    strlen(tmpstr));
#else
					mysql_real_escape_string(dbh, stmt_ins,
								 tmpstr,
								 strlen(tmpstr));
#endif /* OLD_MYSQL */
	                                stmt_ins = stmt + strlen(stmt);
        	                        snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "',");
				}
				else
				{
					snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "'',");
				}
                                break;
#endif /* IP_AS_STRING */
				/* EVIL: fallthrough when logging IP as
				 * u_int32_t */
			case ULOGD_RET_UINT32:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%u,", res->value.ui32);
				break;
			case ULOGD_RET_UINT64:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%"PRIu64",", res->value.ui64);
				break;
			case ULOGD_RET_BOOL:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "'%d',", res->value.b);
				break;
			case ULOGD_RET_STRING:
				if(stmt_siz > (stmt_ins-stmt)+(strlen(res->value.ptr)*2)+4)
				{
					*stmt_ins++ = '\'';
#ifdef OLD_MYSQL
					mysql_escape_string(stmt_ins, res->value.ptr,
						strlen(res->value.ptr));
#else
					mysql_real_escape_string(dbh, stmt_ins,
						res->value.ptr, strlen(res->value.ptr));
#endif
					stmt_ins = stmt + strlen(stmt);
					snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "',");
				}
				else
				{
					snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "'',");
				}
				/* snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "'%s',", res->value.ptr); */
				break;
			case ULOGD_RET_RAW:
				ulogd_log(ULOGD_NOTICE,

static int mysql_createstmt(void)
{
	struct _field *f;
	size_t size;
	char buf[ULOGD_MAX_KEYLEN];
	char *underscore;


	}

	/* caclulate the size for the insert statement */
	size = strlen(MYSQL_INSERTTEMPL) + strlen(table_ce.u.string) + 1;

	for (f = fields; f; f = f->next) {
		/* we need space for the key and a comma, as well as

	ulogd_log(ULOGD_DEBUG, "allocating %u bytes for statement\n", size);

	stmt = (char *) malloc(size);

	if (!stmt) {
		ulogd_log(ULOGD_ERROR, "OOM!\n");
		return 1;
	}
	stmt_siz = size;

	snprintf(stmt, stmt_siz, "insert into %s (", table_ce.u.string);
	stmt_val = stmt + strlen(stmt);

	for (f = fields; f; f = f->next) {
		strncpy(buf, f->name, ULOGD_MAX_KEYLEN-1);	
		buf[ULOGD_MAX_KEYLEN-1] = '\0';
		while ((underscore = strchr(buf, '.')))
			*underscore = '_';
		snprintf(stmt_val, stmt_siz-(stmt_val-stmt), "%s,", buf);
		stmt_val = stmt + strlen(stmt);
	}
	*(stmt_val - 1) = ')';

	snprintf(stmt_val, stmt_siz-(stmt_val-stmt), " values (");
	stmt_val = stmt + strlen(stmt);

	ulogd_log(ULOGD_DEBUG, "stmt='%s'\n", stmt);

	while ((field = mysql_fetch_field(result))) {

		/* replace all underscores with dots */
		strncpy(buf, field->name, ULOGD_MAX_KEYLEN-1);
		buf[ULOGD_MAX_KEYLEN-1] = '\0';
		while ((underscore = strchr(buf, '_')))
			*underscore = '.';


			ulogd_log(ULOGD_ERROR, "OOM!\n");
			return 1;
		}
		strncpy(f->name, buf, ULOGD_MAX_KEYLEN-1);
		f->name[ULOGD_MAX_KEYLEN-1] = '\0';
		f->id = id;
		f->next = fields;
		fields = f;	
-- pgsql/ulogd_PGSQL.c

/* buffer for our insert statement */
static char *stmt;

/* size of our insert statement buffer */
static size_t stmt_siz;

/* pointer to the beginning of the "VALUES" part */
static char *stmt_val;



		if (!res || !IS_VALID((*res))) {
			/* no result, we have to fake something */
			snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "NULL,");
			stmt_ins = stmt + strlen(stmt);
			continue;
		}

		switch (res->type) {
			case ULOGD_RET_INT8:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%d,", res->value.i8);
				break;
			case ULOGD_RET_INT16:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%d,", res->value.i16);
				break;
			case ULOGD_RET_INT32:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%d,", res->value.i32);
				break;
			case ULOGD_RET_INT64:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%lld,", res->value.i64);
				break;
			case ULOGD_RET_UINT8:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%u,", res->value.ui8);
				break;
			case ULOGD_RET_UINT16:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%u,", res->value.ui16);
				break;
			case ULOGD_RET_IPADDR:
#ifdef IP_AS_STRING
				*stmt_ins++ = '\'';
				memset(&addr, 0, sizeof(addr));
				addr.s_addr = ntohl(res->value.ui32);
				tmpstr = (char *)inet_ntoa(addr);
				if(stmt_siz > (stmt_ins-stmt)+(strlen(tmpstr)*2)+4)
				{
					*stmt_ins++ = '\'';
					PQescapeString(stmt_ins,tmpstr,strlen(tmpstr)); 
					stmt_ins = stmt + strlen(stmt);
					snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "',");
				}
				else
				{
					ulogd_log(ULOGD_NOTICE,"%s: pgsql - no space to add escaped ip string to insert statement\n");
					snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "'',");
				}
				break;
#endif /* IP_AS_STRING */
				/* EVIL: fallthrough when logging IP as
				 * u_int32_t */

			case ULOGD_RET_UINT32:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%u,", res->value.ui32);
				break;
			case ULOGD_RET_UINT64:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "%llu,", res->value.ui64);
				break;
			case ULOGD_RET_BOOL:
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "'%d',", res->value.b);
				break;
			case ULOGD_RET_STRING:
				if(stmt_siz > (stmt_ins-stmt)+(strlen(res->value.ptr)*2)+4)
				{
					*stmt_ins++ = '\'';
					PQescapeString(stmt_ins,res->value.ptr,strlen(res->value.ptr)); 
					stmt_ins = stmt + strlen(stmt);
					snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "',");
				}
				else
				{
					ulogd_log(ULOGD_NOTICE,"%s: pgsql - no space to add escaped string to insert statement\n");
					snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "'',");
				}
				break;
			case ULOGD_RET_RAW:
				ulogd_log(ULOGD_NOTICE,"%s: pgsql doesn't support type RAW\n",res->key);
				snprintf(stmt_ins, stmt_siz-(stmt_ins-stmt), "NULL,");
				break;
			default:
				ulogd_log(ULOGD_NOTICE,

/* Determine if server support schemas */
static int pgsql_namespace(void) {
	PGresult *result;
	size_t pgbuf_siz = strlen(PGSQL_HAVE_NAMESPACE_TEMPLATE)+strlen(schema_ce.u.string)+1;
	char   pgbuf[pgbuf_siz];

	if (!dbh)
		return 1;

	snprintf(pgbuf, pgbuf_siz, PGSQL_HAVE_NAMESPACE_TEMPLATE, schema_ce.u.string);
	ulogd_log(ULOGD_DEBUG, "%s\n", pgbuf);
	
	result = PQexec(dbh, pgbuf);

		ulogd_log(ULOGD_ERROR, "OOM!\n");
		return 1;
	}
	stmt_siz = size;

	if (pgsql_have_schemas) {
		snprintf(stmt, stmt_siz, "insert into %s.%s (", schema_ce.u.string, table_ce.u.string);
	} else {
		snprintf(stmt, stmt_siz, "insert into %s (", table_ce.u.string);
	}

	stmt_val = stmt + strlen(stmt);

	for (f = fields; f; f = f->next) {
		strncpy(buf, f->name, ULOGD_MAX_KEYLEN-1);
		buf[ULOGD_MAX_KEYLEN-1] = '\0';
		while ((underscore = strchr(buf, '.')))
			*underscore = '_';
		snprintf(stmt_val, stmt_siz-(stmt_val-stmt), "%s,", buf);
		stmt_val = stmt + strlen(stmt);
	}
	*(stmt_val - 1) = ')';

	snprintf(stmt_val, stmt_siz-(stmt_val-stmt), " values (");
	stmt_val = stmt + strlen(stmt);

	ulogd_log(ULOGD_DEBUG, "stmt='%s'\n", stmt);

	for (intaux=0; intaux<PQntuples(result); intaux++) {

		/* replace all underscores with dots */
		strncpy(buf, PQgetvalue(result, intaux, 0), ULOGD_MAX_KEYLEN-1);
		buf[ULOGD_MAX_KEYLEN-1] = '\0';
		while ((underscore = strchr(buf, '_')))
			*underscore = '.';


			ulogd_log(ULOGD_ERROR, "OOM!\n");
			return 1;
		}
		strncpy(f->name, buf, ULOGD_MAX_KEYLEN-1);
		f->name[ULOGD_MAX_KEYLEN-1] = '\0';
		f->id = id;
		f->next = fields;
		fields = f;

	if (port)
		len += 20;

	connstr = (char *) malloc(len+1);
	if (!connstr)
		return 1;

	if (server) {
		strncpy(connstr, " host=", len);
		connstr[len] = '\0';
		strncat(connstr, server, len-strlen(connstr));
	}

	if (port) {
		char portbuf[20];
		snprintf(portbuf, sizeof(portbuf), " port=%u", port);
		strncat(connstr, portbuf, len-strlen(connstr));
	}

	strncat(connstr, " dbname=", len-strlen(connstr));
	strncat(connstr, db, len-strlen(connstr));
	strncat(connstr, " user=", len-strlen(connstr));
	strncat(connstr, user, len-strlen(connstr));

	if (pass) {
		strncat(connstr, " password=", len-strlen(connstr));
		strncat(connstr, pass, len-strlen(connstr));
	}
	
	dbh = PQconnectdb(connstr);
	free(connstr);
	if (PQstatus(dbh)!=CONNECTION_OK) {
		exit_nicely(dbh);
		return 1;
-- sqlite3/ulogd_SQLITE3.c

/* buffer for our insert statement */
static char *stmt;

/* size of our insert statement buffer */
static size_t stmt_siz;

/* pointer to the final prepared statement */
static sqlite3_stmt *p_stmt;


static int _sqlite3_createstmt(void)
{
	struct _field *f;
	size_t size;
	char buf[ULOGD_MAX_KEYLEN];
	char *underscore;
	char *stmt_pos;

	}

	/* caclulate the size for the insert statement */
	size = strlen(_SQLITE3_INSERTTEMPL) + strlen(table_ce.u.string) + 1;

	DEBUGP("initial size: %u\n", size);


		ulogd_log(ULOGD_ERROR, "OOM!\n");
		return 1;
	}
	stmt_siz = size;

	snprintf(stmt, stmt_siz, "insert into %s (", table_ce.u.string);
	stmt_pos = stmt + strlen(stmt);

	for (f = fields; f; f = f->next) {
		strncpy(buf, f->name, ULOGD_MAX_KEYLEN-1);	
		buf[ULOGD_MAX_KEYLEN-1] = '\0';
		while ((underscore = strchr(buf, '.')))
			*underscore = '_';
		snprintf(stmt_pos, stmt_siz-(stmt_pos-stmt), "%s,", buf);
		stmt_pos = stmt + strlen(stmt);
	}

	*(stmt_pos - 1) = ')';

	snprintf(stmt_pos, stmt_siz-(stmt_pos-stmt), " values (");
	stmt_pos = stmt + strlen(stmt);

	for (i = 0; i < col_count - 1; i++) {
		snprintf(stmt_pos, stmt_siz-(stmt_pos-stmt), "?,");
		stmt_pos += 2;
	}

	snprintf(stmt_pos, stmt_siz-(stmt_pos-stmt), "?)");
	ulogd_log(ULOGD_DEBUG, "stmt='%s'\n", stmt);

	DEBUGP("about to prepare statement.\n");

static int _sqlite3_get_columns(const char *table)
{
	char buf[ULOGD_MAX_KEYLEN];
	char query[SQLITE_SELECT_LEN + CONFIG_VAL_STRING_LEN + 1] = "select * from \0";
	char *underscore;
	struct _field *f;
	sqlite3_stmt *schema_stmt;

	if (!dbh)
		return 1;

	strncat(query,table,sizeof(query)-strlen(query)-1);

	result = sqlite3_prepare(dbh,query,-1,&schema_stmt,0);
	
	if (result != SQLITE_OK)


	for (column = 0; column < sqlite3_column_count(schema_stmt); column++) {
		/* replace all underscores with dots */
		strncpy(buf, sqlite3_column_name(schema_stmt,column), ULOGD_MAX_KEYLEN-1);
		buf[ULOGD_MAX_KEYLEN-1] = '\0';
		while ((underscore = strchr(buf, '_')))
			*underscore = '.';


			ulogd_log(ULOGD_ERROR, "OOM!\n");
			return 1;
		}
		strncpy(f->name, buf, ULOGD_MAX_KEYLEN-1);
		f->name[ULOGD_MAX_KEYLEN-1] = '\0';
		f->id = id;
		f->next = fields;
		fields = f;	

Return to bug 161882