mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 05:58:20 +00:00
Fix race conditions in scripts.base.frameworks.input.reread
On FreeBSD, this test showed two problems: (1) reordering problems based on writing the predicate, event, and end-of-data updates into a single file, (2) a race condition based on printing the entirety of the table description argument in update events. The description contains the destination table, and its content at the time an update event gets processed isn't deterministic: depending on the number of updates the reader thread has sent, the table will contain a varying number of entries.
This commit is contained in:
Christian Kreibich
parent
4e75662963
commit
136a9baa42
6 changed files with 747 additions and 1536 deletions
|
|
@ -0,0 +1,317 @@
|
|||
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
destination[left = -42], [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
idx, A::Idx
|
||||
val, A::Val
|
||||
want_record, T
|
||||
Type, Input::EVENT_NEW
|
||||
Left, [i=-42]
|
||||
Right, [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
destination[left = -43], [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
idx, A::Idx
|
||||
val, A::Val
|
||||
want_record, T
|
||||
Type, Input::EVENT_NEW
|
||||
Left, [i=-43]
|
||||
Right, [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
destination[left = -43], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
idx, A::Idx
|
||||
val, A::Val
|
||||
want_record, T
|
||||
Type, Input::EVENT_CHANGED
|
||||
Left, [i=-43]
|
||||
Right, [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
destination[left = -44], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
idx, A::Idx
|
||||
val, A::Val
|
||||
want_record, T
|
||||
Type, Input::EVENT_NEW
|
||||
Left, [i=-44]
|
||||
Right, [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
destination[left = -45], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
idx, A::Idx
|
||||
val, A::Val
|
||||
want_record, T
|
||||
Type, Input::EVENT_NEW
|
||||
Left, [i=-45]
|
||||
Right, [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
destination[left = -46], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
idx, A::Idx
|
||||
val, A::Val
|
||||
want_record, T
|
||||
Type, Input::EVENT_NEW
|
||||
Left, [i=-46]
|
||||
Right, [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
destination[left = -47], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
idx, A::Idx
|
||||
val, A::Val
|
||||
want_record, T
|
||||
Type, Input::EVENT_NEW
|
||||
Left, [i=-47]
|
||||
Right, [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
destination[left = -48], [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
idx, A::Idx
|
||||
val, A::Val
|
||||
want_record, T
|
||||
Type, Input::EVENT_NEW
|
||||
Left, [i=-48]
|
||||
Right, [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
============EVENT============
|
||||
Description
|
||||
source, ../input.log
|
||||
reader, Input::READER_ASCII
|
||||
mode, Input::REREAD
|
||||
name, ssh
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,211 @@
|
|||
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||
============PREDICATE============
|
||||
Input::EVENT_NEW
|
||||
[i=-42]
|
||||
[b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_NEW
|
||||
[i=-43]
|
||||
[b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_CHANGED
|
||||
[i=-43]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_NEW
|
||||
[i=-44]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_NEW
|
||||
[i=-45]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_NEW
|
||||
[i=-46]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_NEW
|
||||
[i=-47]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_NEW
|
||||
[i=-48]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
[i=-42]
|
||||
[b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
[i=-43]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
[i=-45]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
[i=-46]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
[i=-44]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
[i=-47]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
|
|
@ -0,0 +1,173 @@
|
|||
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||
==========SERVERS============
|
||||
{
|
||||
[-42] = [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
}
|
||||
==========SERVERS============
|
||||
{
|
||||
[-43] = [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]],
|
||||
[-42] = [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
}
|
||||
==========SERVERS============
|
||||
{
|
||||
[-43] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]],
|
||||
[-42] = [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
}
|
||||
==========SERVERS============
|
||||
{
|
||||
[-46] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]],
|
||||
[-42] = [b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]],
|
||||
[-44] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]],
|
||||
[-45] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]],
|
||||
[-48] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]],
|
||||
[-43] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]],
|
||||
[-47] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
}
|
||||
==========SERVERS============
|
||||
{
|
||||
[-48] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=XXXXXXXXXX.XXXXXX, iv=1.0 min 40.0 secs, s=hurz, sc={
|
||||
4,
|
||||
2,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
}
|
||||
done
|
||||
|
|
@ -1,3 +1,6 @@
|
|||
# This test verifies update events, predicates, and multiple data
|
||||
# updates when using Input::REREAD mode.
|
||||
|
||||
# @TEST-EXEC: mv input1.log input.log
|
||||
# @TEST-EXEC: btest-bg-run zeek zeek -b %INPUT
|
||||
# @TEST-EXEC: $SCRIPTS/wait-for-file zeek/got1 15 || (btest-bg-wait -k 1 && false)
|
||||
|
|
@ -9,7 +12,9 @@
|
|||
# @TEST-EXEC: $SCRIPTS/wait-for-file zeek/got4 15 || (btest-bg-wait -k 1 && false)
|
||||
# @TEST-EXEC: mv input5.log input.log
|
||||
# @TEST-EXEC: btest-bg-wait 30
|
||||
# @TEST-EXEC: btest-diff out
|
||||
# @TEST-EXEC: btest-diff servers.out
|
||||
# @TEST-EXEC: btest-diff events.out
|
||||
# @TEST-EXEC: btest-diff preds.out
|
||||
|
||||
@TEST-START-FILE input1.log
|
||||
#separator \x09
|
||||
|
|
@ -84,36 +89,48 @@ type Val: record {
|
|||
ve: vector of int;
|
||||
};
|
||||
|
||||
global servers: table[int] of Val = table();
|
||||
type servers_type: table[int] of Val;
|
||||
global servers: servers_type = table();
|
||||
|
||||
global outfile: file;
|
||||
global events_file = open("../events.out");
|
||||
global predicates_file = open("../preds.out");
|
||||
global servers_file = open("../servers.out");
|
||||
|
||||
global try: count;
|
||||
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: Val)
|
||||
{
|
||||
print outfile, "============EVENT============";
|
||||
print outfile, "Description";
|
||||
print outfile, description;
|
||||
print outfile, "Type";
|
||||
print outfile, tpe;
|
||||
print outfile, "Left";
|
||||
print outfile, left;
|
||||
print outfile, "Right";
|
||||
print outfile, right;
|
||||
# Printing description details here avoids printing the
|
||||
# destination table itself. Its content is not deterministic
|
||||
# at the time this event handler runs: it depends on how many
|
||||
# entries the reader backend thread has sent over.
|
||||
print events_file, "============EVENT============";
|
||||
print events_file, "Description";
|
||||
print events_file, " source", description$source;
|
||||
print events_file, " reader", description$reader;
|
||||
print events_file, " mode", description$mode;
|
||||
print events_file, " name", description$name;
|
||||
print events_file, fmt(" destination[left = %s]", left$i),
|
||||
(description$destination as servers_type)[left$i];
|
||||
print events_file, " idx", description$idx;
|
||||
print events_file, " val", description$val;
|
||||
print events_file, " want_record", description$want_record;
|
||||
print events_file, "Type", tpe;
|
||||
print events_file, "Left", left;
|
||||
print events_file, "Right", right;
|
||||
}
|
||||
|
||||
event zeek_init()
|
||||
{
|
||||
outfile = open("../out");
|
||||
try = 0;
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="../input.log", $mode=Input::REREAD, $name="ssh", $idx=Idx, $val=Val, $destination=servers, $ev=line,
|
||||
Input::add_table([$source="../input.log", $mode=Input::REREAD, $name="ssh",
|
||||
$idx=Idx, $val=Val, $destination=servers, $ev=line,
|
||||
$pred(typ: Input::Event, left: Idx, right: Val) = {
|
||||
print outfile, "============PREDICATE============";
|
||||
print outfile, typ;
|
||||
print outfile, left;
|
||||
print outfile, right;
|
||||
print predicates_file, "============PREDICATE============";
|
||||
print predicates_file, typ;
|
||||
print predicates_file, left;
|
||||
print predicates_file, right;
|
||||
return T;
|
||||
}
|
||||
]);
|
||||
|
|
@ -122,8 +139,8 @@ event zeek_init()
|
|||
|
||||
event Input::end_of_data(name: string, source: string)
|
||||
{
|
||||
print outfile, "==========SERVERS============";
|
||||
print outfile, servers;
|
||||
print servers_file, "==========SERVERS============";
|
||||
print servers_file, servers;
|
||||
|
||||
try = try + 1;
|
||||
|
||||
|
|
@ -137,8 +154,10 @@ event Input::end_of_data(name: string, source: string)
|
|||
system("touch got4");
|
||||
else if ( try == 5 )
|
||||
{
|
||||
print outfile, "done";
|
||||
close(outfile);
|
||||
print servers_file, "done";
|
||||
close(events_file);
|
||||
close(predicates_file);
|
||||
close(servers_file);
|
||||
Input::remove("input");
|
||||
terminate();
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue