Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/christian/fix-inputframework-test-race'

Browse source 
* origin/topic/christian/fix-inputframework-test-race:
  Fix race conditions in scripts.base.frameworks.input.reread
  Fix race condition in scripts.base.frameworks.input.invalid*
This commit is contained in:
Tim Wojtulewicz 2021-07-14 15:01:20 -07:00
commit 09c4908573
10 changed files with 783 additions and 1539 deletions
Download patch file Download diff file Expand all files Collapse all files

21
CHANGES
View file

@ -1,3 +1,24 @@
4.2.0-dev.14 | 2021-07-14 15:01:20 -0700
* Fix race conditions in scripts.base.frameworks.input.reread (Christian Kreibich, Corelight)
On FreeBSD, this test showed two problems: (1) reordering problems
based on writing the predicate, event, and end-of-data updates into a
single file, (2) a race condition based on printing the entirety of
the table description argument in update events. The description
contains the destination table, and its content at the time an update
event gets processed isn't deterministic: depending on the number
of updates the reader thread has sent, the table will contain a
varying number of entries.
* Fix race condition in scripts.base.frameworks.input.invalid* (Christian Kreibich, Corelight)
The invalidset and invalidtext tests loaded an input file via table
and event reads, in parallel. On FreeBSD this triggers an occasional
reordering of messages coming out of the reader thread vs the input
managers. This commit makes the table and event reads sequential,
avoiding the race.
4.2.0-dev.11 | 2021-07-14 15:00:11 -0700 4.2.0-dev.11 | 2021-07-14 15:00:11 -0700
* Reorder fields in some classes for more compact memory layout (Tim Wojtulewicz) * Reorder fields in some classes for more compact memory layout (Tim Wojtulewicz)

2
VERSION
View file

@ -1 +1 @@
4.2.0-dev.11 4.2.0-dev.14

317
testing/btest/Baseline/scripts.base.frameworks.input.reread/events.out Normal file
View file

@ -0,0 +1,317 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
destination[left = -42], [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
idx, A::Idx
val, A::Val
want_record, T
Type, Input::EVENT_NEW
Left, [i=-42]
Right, [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
destination[left = -43], [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
idx, A::Idx
val, A::Val
want_record, T
Type, Input::EVENT_NEW
Left, [i=-43]
Right, [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
destination[left = -43], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
idx, A::Idx
val, A::Val
want_record, T
Type, Input::EVENT_CHANGED
Left, [i=-43]
Right, [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
destination[left = -44], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
idx, A::Idx
val, A::Val
want_record, T
Type, Input::EVENT_NEW
Left, [i=-44]
Right, [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
destination[left = -45], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
idx, A::Idx
val, A::Val
want_record, T
Type, Input::EVENT_NEW
Left, [i=-45]
Right, [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
destination[left = -46], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
idx, A::Idx
val, A::Val
want_record, T
Type, Input::EVENT_NEW
Left, [i=-46]
Right, [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
destination[left = -47], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
idx, A::Idx
val, A::Val
want_record, T
Type, Input::EVENT_NEW
Left, [i=-47]
Right, [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
destination[left = -48], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
idx, A::Idx
val, A::Val
want_record, T
Type, Input::EVENT_NEW
Left, [i=-48]
Right, [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh
============EVENT============
Description
source, ../input.log
reader, Input::READER_ASCII
mode, Input::REREAD
name, ssh

1509
testing/btest/Baseline/scripts.base.frameworks.input.reread/out
View file

File diff suppressed because it is too large Load diff

211
testing/btest/Baseline/scripts.base.frameworks.input.reread/preds.out Normal file
View file

@ -0,0 +1,211 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
============PREDICATE============
Input::EVENT_NEW
[i=-42]
[b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_NEW
[i=-43]
[b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_CHANGED
[i=-43]
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_NEW
[i=-44]
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_NEW
[i=-45]
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_NEW
[i=-46]
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_NEW
[i=-47]
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_NEW
[i=-48]
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_REMOVED
[i=-42]
[b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_REMOVED
[i=-43]
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_REMOVED
[i=-45]
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_REMOVED
[i=-46]
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_REMOVED
[i=-44]
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
============PREDICATE============
Input::EVENT_REMOVED
[i=-47]
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]

173
testing/btest/Baseline/scripts.base.frameworks.input.reread/servers.out Normal file
View file

@ -0,0 +1,173 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
==========SERVERS============
{
[-42] = [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
}
==========SERVERS============
{
[-43] = [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]],
[-42] = [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
}
==========SERVERS============
{
[-43] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]],
[-42] = [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
}
==========SERVERS============
{
[-46] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]],
[-42] = [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]],
[-44] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]],
[-45] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]],
[-48] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]],
[-43] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]],
[-47] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
}
==========SERVERS============
{
[-48] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
4,
2,
1,
3
}, ss={
CC,
AA,
BB
}, se={
}, vc=[10, 20, 30], ve=[]]
}
done

8
testing/btest/scripts/base/frameworks/input/invalidset.zeek
View file

@ -50,13 +50,19 @@ event zeek_init()
outfile = open("../out"); outfile = open("../out");
# first read in the old stuff into the table... # first read in the old stuff into the table...
Input::add_table([$source="../input.log", $name="ssh", $error_ev=handle_our_errors, $idx=Idx, $val=Val, $destination=servers]); Input::add_table([$source="../input.log", $name="ssh", $error_ev=handle_our_errors, $idx=Idx, $val=Val, $destination=servers]);
Input::add_event([$source="../input.log", $name="sshevent", $error_ev=handle_our_errors_event, $fields=Val, $want_record=T, $ev=line]);
} }
event Input::end_of_data(name: string, source:string) event Input::end_of_data(name: string, source:string)
{ {
++endcount; ++endcount;
# ... and when we're done, move to reading via events.
# This makes the reads sequential, avoding races in the output.
if ( endcount == 1 )
{
Input::add_event([$source="../input.log", $name="sshevent", $error_ev=handle_our_errors_event, $fields=Val, $want_record=T, $ev=line]);
}
if ( endcount == 2 ) if ( endcount == 2 )
{ {
print outfile, servers; print outfile, servers;

8
testing/btest/scripts/base/frameworks/input/invalidtext.zeek
View file

@ -51,13 +51,19 @@ event zeek_init()
outfile = open("../out"); outfile = open("../out");
# first read in the old stuff into the table... # first read in the old stuff into the table...
Input::add_table([$source="../input.log", $name="ssh", $error_ev=handle_our_errors, $idx=Idx, $val=Val, $destination=servers]); Input::add_table([$source="../input.log", $name="ssh", $error_ev=handle_our_errors, $idx=Idx, $val=Val, $destination=servers]);
Input::add_event([$source="../input.log", $name="sshevent", $error_ev=handle_our_errors_event, $fields=Val, $want_record=T, $ev=line]);
} }
event Input::end_of_data(name: string, source:string) event Input::end_of_data(name: string, source:string)
{ {
++endcount; ++endcount;
# ... and when we're done, move to reading via events.
# This makes the reads sequential, avoding races in the output.
if ( endcount == 1 )
{
Input::add_event([$source="../input.log", $name="sshevent", $error_ev=handle_our_errors_event, $fields=Val, $want_record=T, $ev=line]);
}
if ( endcount == 2 ) if ( endcount == 2 )
{ {
print outfile, servers; print outfile, servers;

63
testing/btest/scripts/base/frameworks/input/reread.zeek
View file

@ -1,3 +1,6 @@
# This test verifies update events, predicates, and multiple data
# updates when using Input::REREAD mode.
# @TEST-EXEC: mv input1.log input.log # @TEST-EXEC: mv input1.log input.log
# @TEST-EXEC: btest-bg-run zeek zeek -b %INPUT # @TEST-EXEC: btest-bg-run zeek zeek -b %INPUT
# @TEST-EXEC: $SCRIPTS/wait-for-file zeek/got1 15 || (btest-bg-wait -k 1 && false) # @TEST-EXEC: $SCRIPTS/wait-for-file zeek/got1 15 || (btest-bg-wait -k 1 && false)
@ -9,7 +12,9 @@
# @TEST-EXEC: $SCRIPTS/wait-for-file zeek/got4 15 || (btest-bg-wait -k 1 && false) # @TEST-EXEC: $SCRIPTS/wait-for-file zeek/got4 15 || (btest-bg-wait -k 1 && false)
# @TEST-EXEC: mv input5.log input.log # @TEST-EXEC: mv input5.log input.log
# @TEST-EXEC: btest-bg-wait 30 # @TEST-EXEC: btest-bg-wait 30
# @TEST-EXEC: btest-diff out # @TEST-EXEC: btest-diff servers.out
# @TEST-EXEC: btest-diff events.out
# @TEST-EXEC: btest-diff preds.out
@TEST-START-FILE input1.log @TEST-START-FILE input1.log
#separator \x09 #separator \x09
@ -84,36 +89,48 @@ type Val: record {
ve: vector of int; ve: vector of int;
}; };
global servers: table[int] of Val = table(); type servers_type: table[int] of Val;
global servers: servers_type = table();
global outfile: file; global events_file = open("../events.out");
global predicates_file = open("../preds.out");
global servers_file = open("../servers.out");
global try: count; global try: count;
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: Val) event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: Val)
{ {
print outfile, "============EVENT============"; # Printing description details here avoids printing the
print outfile, "Description"; # destination table itself. Its content is not deterministic
print outfile, description; # at the time this event handler runs: it depends on how many
print outfile, "Type"; # entries the reader backend thread has sent over.
print outfile, tpe; print events_file, "============EVENT============";
print outfile, "Left"; print events_file, "Description";
print outfile, left; print events_file, " source", description$source;
print outfile, "Right"; print events_file, " reader", description$reader;
print outfile, right; print events_file, " mode", description$mode;
print events_file, " name", description$name;
print events_file, fmt(" destination[left = %s]", left$i),
(description$destination as servers_type)[left$i];
print events_file, " idx", description$idx;
print events_file, " val", description$val;
print events_file, " want_record", description$want_record;
print events_file, "Type", tpe;
print events_file, "Left", left;
print events_file, "Right", right;
} }
event zeek_init() event zeek_init()
{ {
outfile = open("../out");
try = 0; try = 0;
# first read in the old stuff into the table... # first read in the old stuff into the table...
Input::add_table([$source="../input.log", $mode=Input::REREAD, $name="ssh", $idx=Idx, $val=Val, $destination=servers, $ev=line, Input::add_table([$source="../input.log", $mode=Input::REREAD, $name="ssh",
$idx=Idx, $val=Val, $destination=servers, $ev=line,
$pred(typ: Input::Event, left: Idx, right: Val) = { $pred(typ: Input::Event, left: Idx, right: Val) = {
print outfile, "============PREDICATE============"; print predicates_file, "============PREDICATE============";
print outfile, typ; print predicates_file, typ;
print outfile, left; print predicates_file, left;
print outfile, right; print predicates_file, right;
return T; return T;
} }
]); ]);
@ -122,8 +139,8 @@ event zeek_init()
event Input::end_of_data(name: string, source: string) event Input::end_of_data(name: string, source: string)
{ {
print outfile, "==========SERVERS============"; print servers_file, "==========SERVERS============";
print outfile, servers; print servers_file, servers;
try = try + 1; try = try + 1;
@ -137,8 +154,10 @@ event Input::end_of_data(name: string, source: string)
system("touch got4"); system("touch got4");
else if ( try == 5 ) else if ( try == 5 )
{ {
print outfile, "done"; print servers_file, "done";
close(outfile); close(events_file);
close(predicates_file);
close(servers_file);
Input::remove("input"); Input::remove("input");
terminate(); terminate();
} }