From 927a06b9abd74eb01dc9fb94b405edf5ae53c4a5 Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Tue, 14 Jan 2025 10:30:44 +0100
Subject: [PATCH] logging: Fix HookLogInit() and HookLogWrite() info usage

There's two instances of WriterBackend::WriterInfo for a given
writer. One in Manager::WriterInfo that's accessible via
stream.writers and a copy within WriterFrontend.

Commit 78999d147d7a98a064d25854eea38468c1af7c5e switched to use the
address of the frontend's info instance for HookLogWrite() invocations,
breaking users using the address for identification purposes.
---
 src/logging/Manager.cc                        | 21 ++++++++++++-------
 .../logging-hooks-plugin/src/Plugin.cc        | 14 +++++++++++++
 .../plugins/logging-hooks-plugin/src/Plugin.h |  5 +++++
 3 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/src/logging/Manager.cc b/src/logging/Manager.cc
index 571b61c020..fd6072d3b5 100644
--- a/src/logging/Manager.cc
+++ b/src/logging/Manager.cc
@@ -1115,19 +1115,21 @@ bool Manager::WriteToFilters(const Manager::Stream* stream, zeek::RecordValPtr c
             path = filter->path = filter->path_val->AsString()->CheckString();
         }
 
+        WriterBackend::WriterInfo* info = nullptr;
         WriterFrontend* writer = nullptr;
 
         if ( w != stream->writers.end() ) {
             // We know this writer already.
-            writer = w->second->writer;
+            auto* wi = w->second;
+            writer = wi->writer;
+            info = wi->info;
 
-            if ( ! w->second->hook_initialized ) {
-                auto wi = w->second;
+            if ( ! wi->hook_initialized ) {
                 wi->hook_initialized = true;
                 PLUGIN_HOOK_VOID(HOOK_LOG_INIT, HookLogInit(filter->writer->GetType()->AsEnumType()->Lookup(
                                                                 filter->writer->InternalInt()),
                                                             wi->instantiating_filter, filter->local, filter->remote,
-                                                            *wi->info, filter->num_fields, filter->fields));
+                                                            *info, filter->num_fields, filter->fields));
             }
         }
 
@@ -1141,9 +1143,12 @@ bool Manager::WriteToFilters(const Manager::Stream* stream, zeek::RecordValPtr c
             // Find the newly inserted WriterInfo record.
             w = stream->writers.find(wpp);
             assert(w != stream->writers.end());
+
+            info = w->second->info;
         }
 
         assert(writer);
+        assert(info);
 
         // Alright, can do the write now.
         auto rec = RecordToLogRecord(stream, filter, columns.get());
@@ -1156,10 +1161,10 @@ bool Manager::WriteToFilters(const Manager::Stream* stream, zeek::RecordValPtr c
             for ( auto& v : rec )
                 vals.emplace_back(&v);
 
-            bool res = zeek::plugin_mgr->HookLogWrite(filter->writer->GetType()->AsEnumType()->Lookup(
-                                                          filter->writer->InternalInt()),
-                                                      filter->name, *writer->info, filter->num_fields, filter->fields,
-                                                      &vals[0]);
+            bool res =
+                zeek::plugin_mgr->HookLogWrite(filter->writer->GetType()->AsEnumType()->Lookup(
+                                                   filter->writer->InternalInt()),
+                                               filter->name, *info, filter->num_fields, filter->fields, &vals[0]);
             if ( ! res ) {
                 DBG_LOG(DBG_LOGGING, "Hook prevented writing to filter '%s' on stream '%s'", filter->name.c_str(),
                         stream->name.c_str());
diff --git a/testing/btest/plugins/logging-hooks-plugin/src/Plugin.cc b/testing/btest/plugins/logging-hooks-plugin/src/Plugin.cc
index 65f3a1a896..af151069c9 100644
--- a/testing/btest/plugins/logging-hooks-plugin/src/Plugin.cc
+++ b/testing/btest/plugins/logging-hooks-plugin/src/Plugin.cc
@@ -49,6 +49,8 @@ void Plugin::HookLogInit(const std::string& writer, const std::string& instantia
 
     fprintf(stderr, "%.6f %-15s %s %d/%d %s\n", zeek::run_state::network_time, "| HookLogInit", info.path, local,
             remote, d.Description());
+
+    info_addr_init = &info;
 }
 
 bool Plugin::HookLogWrite(const std::string& writer, const std::string& filter,
@@ -62,5 +64,17 @@ bool Plugin::HookLogWrite(const std::string& writer, const std::string& filter,
     else if ( round == 3 )
         vals[1]->present = false;
 
+    if ( ! info_addr_write )
+        info_addr_write = &info;
+    else if ( info_addr_write != &info )
+        fprintf(stderr, "FAIL: subsequent info addr %p differs from %p\n", &info, info_addr_write);
+
     return true;
 }
+
+void Plugin::Done() {
+    if ( ! info_addr_init || ! info_addr_write || info_addr_init != info_addr_write ) {
+        fprintf(stderr, "FAIL: info_addr_init=%p info_addr_write=%p\n", info_addr_init, info_addr_write);
+        exit(1);
+    }
+}
diff --git a/testing/btest/plugins/logging-hooks-plugin/src/Plugin.h b/testing/btest/plugins/logging-hooks-plugin/src/Plugin.h
index 8ada633a20..50ff4b6cdf 100644
--- a/testing/btest/plugins/logging-hooks-plugin/src/Plugin.h
+++ b/testing/btest/plugins/logging-hooks-plugin/src/Plugin.h
@@ -17,8 +17,13 @@ protected:
     // Overridden from plugin::Plugin.
     zeek::plugin::Configuration Configure() override;
 
+    // Overridden from plugin::Plugin.
+    void Done() override;
+
 private:
     int round;
+    const zeek::logging::WriterBackend::WriterInfo* info_addr_init = nullptr;
+    const zeek::logging::WriterBackend::WriterInfo* info_addr_write = nullptr;
 };
 
 extern Plugin plugin;