Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Address review comments and small updates for DNS warnings

Browse source 
This commit addresses review feedback for DH-4155. Furthermore it fixes
test failures, and adds a new test for the is_event_handled bif.
This commit is contained in:
Johanna Amann 2025-01-08 15:01:30 +00:00
parent 9f72353a41
commit 13f042cc27
6 changed files with 37 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/analyzer/protocol/dns/events.bif
View file

@ -498,7 +498,7 @@ event dns_unknown_reply%(c: connection, msg: dns_msg, ans: dns_answer%);
##
## .. note::
##
## Note that this event will only be raised if ``dns_skip_all_addl``
## Note that this event will only be raised if :zeek:see:`dns_skip_all_addl`
## is set to false.
##
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
@ -526,7 +526,7 @@ event dns_EDNS_addl%(c: connection, msg: dns_msg, ans: dns_edns_additional%);
##
## .. note::
##
## Note that this event will only be raised if ``dns_skip_all_addl``
## Note that this event will only be raised if :zeek:see:`dns_skip_all_addl`
## is set to false.
##
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
@ -556,7 +556,7 @@ event dns_EDNS_ecs%(c: connection, msg: dns_msg, opt: dns_edns_ecs%);
##
## .. note::
##
## Note that this event will only be raised if ``dns_skip_all_addl``
## Note that this event will only be raised if :zeek:see:`dns_skip_all_addl`
## is set to false.
##
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
@ -586,7 +586,7 @@ event dns_EDNS_tcp_keepalive%(c: connection, msg: dns_msg, opt: dns_edns_tcp_kee
##
## .. note::
##
## Note that this event will only be raised if ``dns_skip_all_addl``
## Note that this event will only be raised if :zeek:see:`dns_skip_all_addl`
## is set to false.
##
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
@ -614,7 +614,7 @@ event dns_EDNS_cookie%(c: connection, msg: dns_msg, opt: dns_edns_cookie%);
##
## .. note::
##
## Note that ``ans`` will only be populated if ``dns_skip_all_addl``
## Note that ``ans`` will only be populated if :zeek:see:`dns_skip_all_addl`
## is set to false.
##
## .. zeek:see:: dns_TSIG_addl
@ -633,10 +633,10 @@ event dns_TKEY%(c: connection, msg: dns_msg, ans: dns_tkey%);
## msg: The parsed DNS message header.
##
## ans: The parsed TSIG reply.
#
##
## .. note::
##
## Note that this event will only be raised if ``dns_skip_all_addl``
## Note that this event will only be raised if :zeek:see:`dns_skip_all_addl`
## is set to false.
##
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl

10
src/zeek.bif
View file

@ -5019,13 +5019,21 @@ function generate_all_events%(%) : bool
## This currently is mainly used to warn when events are defined that will not be used
## in certain conditions.
##
## Raises an error if the named event does not exist.
##
## event_name: event name to check
##
## returns: true if the named event is handled.
function is_event_handled%(event_name: string%) : bool
%{
auto *h = event_registry->Lookup(event_name->ToStdStringView());
if ( h && *h )
if ( ! h )
{
zeek::emit_builtin_error(zeek::util::fmt("is_event_handled: '%s' is not an event", event_name->CheckString()));
return zeek::val_mgr->False();
}
if ( *h )
return zeek::val_mgr->True();
return zeek::val_mgr->False();

3
testing/btest/Baseline/bifs.is_event_handled/err Normal file
View file

@ -0,0 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
error in <...>/is_event_handled.zeek, line 11: is_event_handled: 'myfunc1' is not an event (is_event_handled(myfunc1))
error in <...>/is_event_handled.zeek, line 12: is_event_handled: 'conn_id' is not an event (is_event_handled(conn_id))

5
testing/btest/Baseline/bifs.is_event_handled/out Normal file
View file

@ -0,0 +1,5 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
T
F
F
F

1
testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
View file

@ -385,6 +385,7 @@ scripts/base/init-default.zeek
scripts/base/protocols/dns/__load__.zeek
scripts/base/protocols/dns/consts.zeek
scripts/base/protocols/dns/main.zeek
scripts/base/protocols/dns/check-event-handlers.zeek
scripts/base/protocols/finger/__load__.zeek
scripts/base/protocols/finger/spicy-events.zeek
scripts/base/protocols/finger/main.zeek

12
testing/btest/bifs/is_event_handled.zeek Normal file
View file

@ -0,0 +1,12 @@
# @TEST-EXEC: zeek -b %INPUT >out 2>err
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff err
function myfunc1(a: addr, b: addr): int
{
}
print is_event_handled("zeek_init"); # T
print is_event_handled("dns_EDNS_cookie"); # F
print is_event_handled("myfunc1"); # builtin error
print is_event_handled("conn_id"); # builtin error