mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
Address review comments and small updates for DNS warnings
This commit addresses review feedback for DH-4155. Furthermore it fixes test failures, and adds a new test for the is_event_handled bif.
This commit is contained in:
parent
9f72353a41
commit
13f042cc27
6 changed files with 37 additions and 8 deletions
|
@ -498,7 +498,7 @@ event dns_unknown_reply%(c: connection, msg: dns_msg, ans: dns_answer%);
|
||||||
##
|
##
|
||||||
## .. note::
|
## .. note::
|
||||||
##
|
##
|
||||||
## Note that this event will only be raised if ``dns_skip_all_addl``
|
## Note that this event will only be raised if :zeek:see:`dns_skip_all_addl`
|
||||||
## is set to false.
|
## is set to false.
|
||||||
##
|
##
|
||||||
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
|
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
|
||||||
|
@ -526,7 +526,7 @@ event dns_EDNS_addl%(c: connection, msg: dns_msg, ans: dns_edns_additional%);
|
||||||
##
|
##
|
||||||
## .. note::
|
## .. note::
|
||||||
##
|
##
|
||||||
## Note that this event will only be raised if ``dns_skip_all_addl``
|
## Note that this event will only be raised if :zeek:see:`dns_skip_all_addl`
|
||||||
## is set to false.
|
## is set to false.
|
||||||
##
|
##
|
||||||
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
|
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
|
||||||
|
@ -556,7 +556,7 @@ event dns_EDNS_ecs%(c: connection, msg: dns_msg, opt: dns_edns_ecs%);
|
||||||
##
|
##
|
||||||
## .. note::
|
## .. note::
|
||||||
##
|
##
|
||||||
## Note that this event will only be raised if ``dns_skip_all_addl``
|
## Note that this event will only be raised if :zeek:see:`dns_skip_all_addl`
|
||||||
## is set to false.
|
## is set to false.
|
||||||
##
|
##
|
||||||
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
|
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
|
||||||
|
@ -586,7 +586,7 @@ event dns_EDNS_tcp_keepalive%(c: connection, msg: dns_msg, opt: dns_edns_tcp_kee
|
||||||
##
|
##
|
||||||
## .. note::
|
## .. note::
|
||||||
##
|
##
|
||||||
## Note that this event will only be raised if ``dns_skip_all_addl``
|
## Note that this event will only be raised if :zeek:see:`dns_skip_all_addl`
|
||||||
## is set to false.
|
## is set to false.
|
||||||
##
|
##
|
||||||
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
|
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
|
||||||
|
@ -614,7 +614,7 @@ event dns_EDNS_cookie%(c: connection, msg: dns_msg, opt: dns_edns_cookie%);
|
||||||
##
|
##
|
||||||
## .. note::
|
## .. note::
|
||||||
##
|
##
|
||||||
## Note that ``ans`` will only be populated if ``dns_skip_all_addl``
|
## Note that ``ans`` will only be populated if :zeek:see:`dns_skip_all_addl`
|
||||||
## is set to false.
|
## is set to false.
|
||||||
##
|
##
|
||||||
## .. zeek:see:: dns_TSIG_addl
|
## .. zeek:see:: dns_TSIG_addl
|
||||||
|
@ -633,10 +633,10 @@ event dns_TKEY%(c: connection, msg: dns_msg, ans: dns_tkey%);
|
||||||
## msg: The parsed DNS message header.
|
## msg: The parsed DNS message header.
|
||||||
##
|
##
|
||||||
## ans: The parsed TSIG reply.
|
## ans: The parsed TSIG reply.
|
||||||
#
|
##
|
||||||
## .. note::
|
## .. note::
|
||||||
##
|
##
|
||||||
## Note that this event will only be raised if ``dns_skip_all_addl``
|
## Note that this event will only be raised if :zeek:see:`dns_skip_all_addl`
|
||||||
## is set to false.
|
## is set to false.
|
||||||
##
|
##
|
||||||
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
## .. zeek:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||||
|
|
10
src/zeek.bif
10
src/zeek.bif
|
@ -5019,13 +5019,21 @@ function generate_all_events%(%) : bool
|
||||||
## This currently is mainly used to warn when events are defined that will not be used
|
## This currently is mainly used to warn when events are defined that will not be used
|
||||||
## in certain conditions.
|
## in certain conditions.
|
||||||
##
|
##
|
||||||
|
## Raises an error if the named event does not exist.
|
||||||
|
##
|
||||||
## event_name: event name to check
|
## event_name: event name to check
|
||||||
##
|
##
|
||||||
## returns: true if the named event is handled.
|
## returns: true if the named event is handled.
|
||||||
function is_event_handled%(event_name: string%) : bool
|
function is_event_handled%(event_name: string%) : bool
|
||||||
%{
|
%{
|
||||||
auto *h = event_registry->Lookup(event_name->ToStdStringView());
|
auto *h = event_registry->Lookup(event_name->ToStdStringView());
|
||||||
if ( h && *h )
|
if ( ! h )
|
||||||
|
{
|
||||||
|
zeek::emit_builtin_error(zeek::util::fmt("is_event_handled: '%s' is not an event", event_name->CheckString()));
|
||||||
|
return zeek::val_mgr->False();
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( *h )
|
||||||
return zeek::val_mgr->True();
|
return zeek::val_mgr->True();
|
||||||
|
|
||||||
return zeek::val_mgr->False();
|
return zeek::val_mgr->False();
|
||||||
|
|
3
testing/btest/Baseline/bifs.is_event_handled/err
Normal file
3
testing/btest/Baseline/bifs.is_event_handled/err
Normal file
|
@ -0,0 +1,3 @@
|
||||||
|
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||||
|
error in <...>/is_event_handled.zeek, line 11: is_event_handled: 'myfunc1' is not an event (is_event_handled(myfunc1))
|
||||||
|
error in <...>/is_event_handled.zeek, line 12: is_event_handled: 'conn_id' is not an event (is_event_handled(conn_id))
|
5
testing/btest/Baseline/bifs.is_event_handled/out
Normal file
5
testing/btest/Baseline/bifs.is_event_handled/out
Normal file
|
@ -0,0 +1,5 @@
|
||||||
|
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||||
|
T
|
||||||
|
F
|
||||||
|
F
|
||||||
|
F
|
|
@ -385,6 +385,7 @@ scripts/base/init-default.zeek
|
||||||
scripts/base/protocols/dns/__load__.zeek
|
scripts/base/protocols/dns/__load__.zeek
|
||||||
scripts/base/protocols/dns/consts.zeek
|
scripts/base/protocols/dns/consts.zeek
|
||||||
scripts/base/protocols/dns/main.zeek
|
scripts/base/protocols/dns/main.zeek
|
||||||
|
scripts/base/protocols/dns/check-event-handlers.zeek
|
||||||
scripts/base/protocols/finger/__load__.zeek
|
scripts/base/protocols/finger/__load__.zeek
|
||||||
scripts/base/protocols/finger/spicy-events.zeek
|
scripts/base/protocols/finger/spicy-events.zeek
|
||||||
scripts/base/protocols/finger/main.zeek
|
scripts/base/protocols/finger/main.zeek
|
||||||
|
|
12
testing/btest/bifs/is_event_handled.zeek
Normal file
12
testing/btest/bifs/is_event_handled.zeek
Normal file
|
@ -0,0 +1,12 @@
|
||||||
|
# @TEST-EXEC: zeek -b %INPUT >out 2>err
|
||||||
|
# @TEST-EXEC: btest-diff out
|
||||||
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff err
|
||||||
|
|
||||||
|
function myfunc1(a: addr, b: addr): int
|
||||||
|
{
|
||||||
|
}
|
||||||
|
|
||||||
|
print is_event_handled("zeek_init"); # T
|
||||||
|
print is_event_handled("dns_EDNS_cookie"); # F
|
||||||
|
print is_event_handled("myfunc1"); # builtin error
|
||||||
|
print is_event_handled("conn_id"); # builtin error
|
Loading…
Add table
Add a link
Reference in a new issue