fix(dnstap source): expose parsed httpProtocol field in events

changelog.d/25887_dnstap_source_http_protocol_field.fix.md

@@ -0,0 +1,3 @@
+Added missing "httpProtocol" field to dnstap source events.
+
+authors: esensar Quad9DNS

lib/vector-vrl/dnstap-parser/src/parser.rs

@@ -39,7 +39,10 @@ use dnstap_proto::{
 use vector_core::config::log_schema;
 use vector_lookup::{PathPrefix, lookup_v2::ValuePath};
 
-use crate::{internal_events::DnstapParseWarning, schema::DNSTAP_VALUE_PATHS};
+use crate::{
+    internal_events::DnstapParseWarning, parser::dnstap_proto::HttpProtocol,
+    schema::DNSTAP_VALUE_PATHS,
+};
 
 #[derive(Debug, Snafu)]
 enum DnstapParserError {
@@ -239,6 +242,15 @@ impl DnstapParser {
             )?;
         }
 
+        if let Some(http_protocol) = dnstap_message.http_protocol {
+            DnstapParser::insert(
+                event,
+                prefix.clone(),
+                &DNSTAP_VALUE_PATHS.http_protocol,
+                to_http_protocol_name(http_protocol)?.to_string(),
+            );
+        }
+
         DnstapParser::parse_dnstap_message_type(
             event,
             prefix.clone(),
@@ -1014,6 +1026,12 @@ fn to_socket_protocol_name(socket_protocol: i32) -> Result<&'static str> {
         .map(|sp| sp.as_str_name())
 }
 
+fn to_http_protocol_name(http_protocol: i32) -> Result<&'static str> {
+    HttpProtocol::try_from(http_protocol)
+        .map_err(|_| Error::from(format!("Unknown HTTP protocol: {http_protocol}")))
+        .map(|sp| sp.as_str_name())
+}
+
 fn to_dnstap_data_type(data_type_id: i32) -> Option<String> {
     match data_type_id {
         1 => Some(String::from("Message")),
@@ -1448,4 +1466,12 @@ mod tests {
         assert_eq!("DOQ", to_socket_protocol_name(7).unwrap());
         assert!(to_socket_protocol_name(8).is_err());
     }
+
+    #[test]
+    fn test_get_http_protocol_name() {
+        assert_eq!("HTTP1", to_http_protocol_name(1).unwrap());
+        assert_eq!("HTTP2", to_http_protocol_name(2).unwrap());
+        assert_eq!("HTTP3", to_http_protocol_name(3).unwrap());
+        assert!(to_http_protocol_name(4).is_err());
+    }
 }

lib/vector-vrl/dnstap-parser/src/schema.rs

@@ -184,6 +184,7 @@ impl DnstapEventSchema {
                 Kind::integer(),
                 None,
             )
+            .optional_field(&DNSTAP_VALUE_PATHS.http_protocol, Kind::bytes(), None)
     }
 
     /// The schema definition for a dns tap message.
@@ -223,6 +224,7 @@ pub struct DnstapPaths {
     pub response_message: OwnedValuePath,
     pub request_message_size: OwnedValuePath,
     pub response_message_size: OwnedValuePath,
+    pub http_protocol: OwnedValuePath,
 
     // DnsQueryMessageSchema
     pub response_code: OwnedValuePath,
@@ -325,6 +327,7 @@ pub static DNSTAP_VALUE_PATHS: LazyLock<DnstapPaths> = LazyLock::new(|| DnstapPa
     response_message: owned_value_path!("responseData"),
     request_message_size: owned_value_path!("requestMessageSize"),
     response_message_size: owned_value_path!("responseMessageSize"),
+    http_protocol: owned_value_path!("httpProtocol"),
     response_code: owned_value_path!("fullRcode"),
     response: owned_value_path!("rcodeName"),
     header: owned_value_path!("header"),