Automatically allow struct access by json tags

fixtures/multi_vql_queries.golden

@@ -1331,5 +1331,12 @@
       "timestamp(epoch=1723428985) \u003e \"2024-08-12T02:15:25.176Z\"": false,
       "\"2024-08-12T02:15:25.176Z\" \u003e timestamp(epoch=1723428985)": false
     }
+  ],
+  "087/000 Test struct associative: SELECT StructValue.SrcIP, StructValue.src_ip, StructValue.SrcIp FROM scope()": [
+    {
+      "StructValue.SrcIP": "127.0.0.1",
+      "StructValue.src_ip": "127.0.0.1",
+      "StructValue.SrcIp": null
+    }
   ]
 }

protocols/protocol_associative.go

@@ -226,16 +226,12 @@ func (self DefaultAssociative) Associative(scope types.Scope, a types.Any, b typ
 		}
 
 	case string:
-		if !utils.IsExported(field_name) {
-			field_name = strings.Title(field_name)
-		}
-
 		a_value := reflect.Indirect(reflect.ValueOf(a))
 		a_type := a_value.Type()
 
 		// A struct with regular exportable field.
 		if a_type.Kind() == reflect.Struct {
-			field_value := a_value.FieldByName(field_name)
+			field_value := a_value.FieldByNameFunc(FieldMatchName(a_type, field_name))
 			if field_value.IsValid() && field_value.CanInterface() {
 				if field_value.Kind() == reflect.Ptr && field_value.IsNil() {
 					return &types.Null{}, true
@@ -288,6 +284,28 @@ func (self DefaultAssociative) Associative(scope types.Scope, a types.Any, b typ
 	return &types.Null{}, false
 }
 
+func FieldMatchName(
+	struct_type reflect.Type,
+	field_name string) func(in string) bool {
+	return func(in string) bool {
+		if in == field_name {
+			return true
+		}
+
+		// If the field has a json tag of this name we also consider
+		// it a match.
+		field, pres := struct_type.FieldByName(in)
+		if pres {
+			tag := field.Tag.Get("json")
+			json_name, _, _ := strings.Cut(tag, ",")
+			if json_name == field_name {
+				return true
+			}
+		}
+		return false
+	}
+}
+
 // Get the members which are callable by VFilter.
 func (self DefaultAssociative) GetMembers(scope types.Scope, a types.Any) []string {
 	var result []string

vfilter_test.go

@@ -453,7 +453,7 @@ func TestValue(t *testing.T) {
 
 func TestEvalWhereClause(t *testing.T) {
 	scope := makeScope()
-	for _, test := range execTests {
+	for idx, test := range execTests {
 		preamble := "select * from plugin() where \n"
 		vql, err := Parse(preamble + test.clause)
 		if err != nil {
@@ -471,7 +471,7 @@ func TestEvalWhereClause(t *testing.T) {
 			utils.Debug(test.clause)
 			utils.Debug(test.result)
 			utils.Debug(value)
-			t.Fatalf("%v: Expected %v, got %v", test.clause, test.result, value)
+			t.Fatalf("%v: %v: Expected %v, got %v", idx, test.clause, test.result, value)
 		}
 	}
 }
@@ -1327,6 +1327,10 @@ SELECT timestamp(epoch=1723428985) < 1118628985,
        "2024-08-12T02:15:25.176Z" > timestamp(epoch=1723428985)
 FROM scope()
 `},
+
+	{"Test struct associative", `
+SELECT StructValue.SrcIP, StructValue.src_ip, StructValue.SrcIp
+FROM scope()`},
 }
 
 type _RangeArgs struct {
@@ -1338,6 +1342,9 @@ func makeTestScope() types.Scope {
 	result := makeScope().
 		AppendVars(ordereddict.NewDict().
 			Set("ArrayValue", [3]int{1, 2, 3}).
+			Set("StructValue", structWithJson{
+				SrcIP: "127.0.0.1",
+			}).
 			Set("VarIsObjectWithMethods", ObjectWithMethods{Value1: 1})).
 		AddProtocolImpl(protocols.NewLazyStructWrapper(
 			ObjectWithMethods{}, "Value1", "Value2", "Value3", "Counter")).
@@ -1581,3 +1588,7 @@ func TestVQLSerializaition(t *testing.T) {
 		}
 	}
 }
+
+type structWithJson struct {
+	SrcIP string `json:"src_ip,omitempty"`
+}