Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add is_used attribute to an ID if used in a signature eval statement

Browse source
This commit is contained in:
Tim Wojtulewicz 2022-08-31 10:00:30 -07:00
parent a726418d38
commit 0a0dd7143b
4 changed files with 37 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/RuleCondition.cc
View file

@ -180,6 +180,10 @@ RuleConditionEval::RuleConditionEval(const char* func)
rules_error("eval function parameters must be a 'signature_state' "
"and a 'string' type",
func);
std::vector<AttrPtr> attrv{make_intrusive<Attr>(ATTR_IS_USED, nullptr)};
id->AddAttrs(
make_intrusive<Attributes>(std::move(attrv), id->GetType(), false, id->IsGlobal()));
}
}

1
testing/btest/Baseline/signatures.signature-cond-used/.stderr Normal file
View file

@ -0,0 +1 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.

3
testing/btest/Baseline/signatures.signature-cond-used/.stdout Normal file
View file

@ -0,0 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
signature_cond, GET /download/CHANGES.bro-aux.txt HTTP/1.1\x0d\x0aUser-Agent: Wget/1.14 (darwin12.2.0)\x0d\x0aAccept: */*\x0d\x0aHost: bro.org\x0d\x0aConnection: Keep-Alive\x0d\x0a\x0d\x0a
signature_match, GET, GET /download/CHANGES.bro-aux.txt HTTP/1.1\x0d\x0aUser-Agent: Wget/1.14 (darwin12.2.0)\x0d\x0aAccept: */*\x0d\x0aHost: bro.org\x0d\x0aConnection: Keep-Alive\x0d\x0a\x0d\x0a

29
testing/btest/signatures/signature-cond-used.zeek Normal file
View file

@ -0,0 +1,29 @@
# @TEST-DOC: The function signature_cond used for eval in test.sig should not be reported as unused
# @TEST-EXEC: zeek -b %INPUT -r $TRACES/http/get.trace
# @TEST-EXEC: btest-diff .stderr
# @TEST-EXEC: btest-diff .stdout
module SignatureEvalTest;
@load-sigs ./test.sig
event signature_match(state: signature_state, msg: string, data: string)
{
print "signature_match", msg, data;
}
function signature_cond(state: signature_state, data: string): bool
{
print "signature_cond", data;
return T;
}
@TEST-START-FILE test.sig
signature my-first-sig {
ip-proto == tcp
dst-port == 80
payload /GET/
event "GET"
eval SignatureEvalTest::signature_cond
}
@TEST-END-FILE