Pull request #4656: extractor: add tenant id as common field

Merge in SNORT/snort3 from ~ANOROKH/snort3:extr_add_tenant_field to master

Squashed commit of the following:

commit 2a414abe67d6ffd4bc4d94171a595031a3fa1a89
Author: anorokh <anorokh@cisco.com>
Date:   Tue Mar 4 14:21:32 2025 +0200

    extractor: add tenant id as common field

diff --git a/doc/user/extractor.txt b/doc/user/extractor.txt
index 1686ff9d94cd951bfaba498a5cbf1779dd06285a..1dd5566b2ee161531a053649861aacace0f9aa08 100644 (file)
--- a/doc/user/extractor.txt
+++ b/doc/user/extractor.txt
@@ -71,6 +71,7 @@ Common fields available for every service:
 * `id.resp_h` - server IP address
 * `id.resp_p` - server TCP port
 * `pkt_num` - packet number
+* `tenant_id` - tenant identifier
 
 Fields supported for HTTP:
 

diff --git a/src/network_inspectors/extractor/extractor_service.cc b/src/network_inspectors/extractor/extractor_service.cc
index ffdbe2506844abba38110bfc585550e361bda680..c4e9b2a4c0023c6137f2f0950e7b8875554b19d9 100644 (file)
--- a/src/network_inspectors/extractor/extractor_service.cc
+++ b/src/network_inspectors/extractor/extractor_service.cc
@@ -45,7 +45,8 @@ std::vector<std::string> ExtractorService::common_fields =
     "id.orig_p",
     "id.resp_h",
     "id.resp_p",
-    "pkt_num"
+    "pkt_num",
+    "tenant_id"
 };
 
 THREAD_LOCAL ExtractorLogger* ExtractorService::logger = nullptr;

diff --git a/src/network_inspectors/extractor/extractors.cc b/src/network_inspectors/extractor/extractors.cc
index 7603e160638d17079f84123af33577a9f289fcd4..000a747633e8e437ac023c35846b7093a9161251 100644 (file)
--- a/src/network_inspectors/extractor/extractors.cc
+++ b/src/network_inspectors/extractor/extractors.cc
@@ -72,5 +72,6 @@ const std::map<std::string, ExtractorEvent::NumGetFn> ExtractorEvent::num_getter
     {"id.orig_p", ExtractorEvent::get_ip_src_port},
     {"id.resp_p", ExtractorEvent::get_ip_dst_port},
     {"uid", ExtractorEvent::get_uid},
-    {"pkt_num", ExtractorEvent::get_pkt_num}
+    {"pkt_num", ExtractorEvent::get_pkt_num},
+    {"tenant_id", ExtractorEvent::get_tenant_id}
 };

diff --git a/src/network_inspectors/extractor/extractors.h b/src/network_inspectors/extractor/extractors.h
index 0a76641b2d0d713bc4a111178ad7000423a41e39..773a63b17498a2c3b65bcee4c059c1e55141f28d 100644 (file)
--- a/src/network_inspectors/extractor/extractors.h
+++ b/src/network_inspectors/extractor/extractors.h
@@ -115,6 +115,15 @@ protected:
     static uint64_t get_ip_dst_port(const DataEvent*, const Flow* flow)
     { return flow->server_port; }
 
+    static uint64_t get_tenant_id(const DataEvent*, const Flow* flow)
+    {
+#ifdef DISABLE_TENANT_ID
+        return 0;
+#else
+        return flow->key->tenant_id;
+#endif
+    }
+
     static uint64_t get_pkt_num(const DataEvent*, const Flow*)
     {
         const Packet* p = ExtractorEvent::get_packet();