From 09b956562e90a459f77d66388f21930e6f4164ea Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Wed, 17 May 2023 21:20:34 +0200
Subject: [PATCH] btest/input/raw: Fix reread test

This seems to have relied on the reading file twice behavior simply
testing that 16 lines are observed. Switch to using two separate
files and doing a system("mv ...") to trigger the REREAD logic, there's
not force_update() needed and it wouldn't do anything if the file
hadn't changed anyway.
---
 .../out                                       | 300 +-----------------
 .../base/frameworks/input/raw/rereadraw.zeek  |  38 ++-
 2 files changed, 40 insertions(+), 298 deletions(-)

diff --git a/testing/btest/Baseline/scripts.base.frameworks.input.raw.rereadraw/out b/testing/btest/Baseline/scripts.base.frameworks.input.raw.rereadraw/out
index e09e95e053..8c75626e45 100644
--- a/testing/btest/Baseline/scripts.base.frameworks.input.raw.rereadraw/out
+++ b/testing/btest/Baseline/scripts.base.frameworks.input.raw.rereadraw/out
@@ -1,289 +1,13 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-DSF"DFKJ"SDFKLh304yrsdkfj@#(*U$34jfDJup3UF
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-q3r3057fdf
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-sdfs\d
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-dfsdf
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-sdf
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-3rw43wRRERLlL#RWERERERE.
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-DSF"DFKJ"SDFKLh304yrsdkfj@#(*U$34jfDJup3UF
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-q3r3057fdf
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-sdfs\d
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-dfsdf
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-sdf
-[source=../input.log, reader=Input::READER_RAW, mode=Input::REREAD, name=input, fields=A::Val, want_record=F, ev=line
-{ 
-print outfile, A::description;
-print outfile, A::tpe;
-print outfile, A::s;
-try = try + 1;
-if (16 == try) 
-{ 
-Input::remove(input);
-close(outfile);
-terminate();
-}
-
-}, error_ev=<uninitialized>, config={
-
-}]
-Input::EVENT_NEW
-3rw43wRRERLlL#RWERERERE.
+1, Input::EVENT_NEW, sdfkh:KH;fdkncv;ISEUp34:Fkdj;YVpIODhfDF, 39
+2, Input::EVENT_NEW, DSF"DFKJ"SDFKLh304yrsdkfj@#(*U$34jfDJup3UF, 42
+3, Input::EVENT_NEW, q3r3057fdf, 10
+4, Input::EVENT_NEW, sdfs\d, 6
+5, Input::EVENT_NEW, , 0
+6, Input::EVENT_NEW, dfsdf, 5
+7, Input::EVENT_NEW, sdf, 3
+8, Input::EVENT_NEW, 3rw43wRRERLlL#RWERERERE., 24
+end_of_data, updating input.log
+9, Input::EVENT_NEW, Beginning of input2.log, 23
+10, Input::EVENT_NEW, 3rw43wRRERLlL#RWERERERE., 24
+11, Input::EVENT_NEW, game over, 9
diff --git a/testing/btest/scripts/base/frameworks/input/raw/rereadraw.zeek b/testing/btest/scripts/base/frameworks/input/raw/rereadraw.zeek
index f187187f68..138c83d299 100644
--- a/testing/btest/scripts/base/frameworks/input/raw/rereadraw.zeek
+++ b/testing/btest/scripts/base/frameworks/input/raw/rereadraw.zeek
@@ -13,10 +13,16 @@ sdf
 3rw43wRRERLlL#RWERERERE.
 @TEST-END-FILE
 
+@TEST-START-FILE input2.log
+Beginning of input2.log
+3rw43wRRERLlL#RWERERERE.
+game over
+@TEST-END-FILE
+
+redef Threading::heartbeat_interval = 100msec;
 redef exit_only_after_terminate = T;
 
 global outfile: file;
-global try: count;
 
 module A;
 
@@ -24,13 +30,27 @@ type Val: record {
 	s: string;
 };
 
-event line(description: Input::EventDescription, tpe: Input::Event, s: string)
+global end_of_datas = 0;
+
+event Input::end_of_data(name: string, source: string)
 	{
-	print outfile, description;
-	print outfile, tpe;
-	print outfile, s;
-	try = try + 1;
-	if ( try == 16 )
+	++end_of_datas;
+	if ( end_of_datas > 1 )
+		return;
+
+	print outfile, "end_of_data, updating input.log";
+	# This should be recognized by the raw reader as file update (inode change)
+	# and the new file is reread.
+	system("mv ../input2.log ../input.log");
+	}
+
+global lines = 0;
+
+event A::line(description: Input::EventDescription, tpe: Input::Event, s: string)
+	{
+	++lines;
+	print outfile, lines, tpe, s, |s|;
+	if ( s == "game over" )
 		{
 		Input::remove("input");
 		close(outfile);
@@ -40,8 +60,6 @@ event line(description: Input::EventDescription, tpe: Input::Event, s: string)
 
 event zeek_init()
 	{
-	try = 0;
 	outfile = open("../out");
-	Input::add_event([$source="../input.log", $reader=Input::READER_RAW, $mode=Input::REREAD, $name="input", $fields=Val, $ev=line, $want_record=F]);
-	Input::force_update("input");
+	Input::add_event([$source="../input.log", $reader=Input::READER_RAW, $mode=Input::REREAD, $name="input", $fields=Val, $ev=A::line, $want_record=F]);
 	}