mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
add testcase for subrecords and events
add missing binary testcase (Baseline is in master, testcase is missing for some reason) make error output for nonmatching event types much more verbose
This commit is contained in:
parent
84399c5d7d
commit
1a49363bbe
4 changed files with 150 additions and 1 deletions
|
@ -443,7 +443,11 @@ bool Manager::CreateEventStream(RecordVal* fval)
|
|||
|
||||
if ( !same_type((*args)[2], fields ) )
|
||||
{
|
||||
reporter->Error("Incompatible type for event");
|
||||
ODesc desc1;
|
||||
ODesc desc2;
|
||||
(*args)[2]->Describe(&desc1);
|
||||
fields->Describe(&desc2);
|
||||
reporter->Error("Incompatible type '%s':%s for event which needs type '%s':%s\n", type_name((*args)[2]->Tag()), desc1.Bytes(), type_name(fields->Tag()), desc2.Bytes());
|
||||
return false;
|
||||
}
|
||||
|
||||
|
|
|
@ -0,0 +1,12 @@
|
|||
[sub=[b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, two=[a=1.2.3.4, d=3.14]], t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
56
testing/btest/scripts/base/frameworks/input/binary.bro
Normal file
56
testing/btest/scripts/base/frameworks/input/binary.bro
Normal file
|
@ -0,0 +1,56 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
redef InputAscii::separator = "|";
|
||||
redef InputAscii::set_separator = ",";
|
||||
redef InputAscii::empty_field = "(empty)";
|
||||
redef InputAscii::unset_field = "-";
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
#separator |
|
||||
#set_separator|,
|
||||
#empty_field|(empty)
|
||||
#unset_field|-
|
||||
#path|ssh
|
||||
#start|2012-07-20-01-49-19
|
||||
#fields|data|data2
|
||||
#types|string|string
|
||||
abc\x0a\xffdef|DATA2
|
||||
abc\x7c\xffdef|DATA2
|
||||
abc\xff\x7cdef|DATA2
|
||||
#end|2012-07-20-01-49-19
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
global try: count;
|
||||
|
||||
type Val: record {
|
||||
data: string;
|
||||
data2: string;
|
||||
};
|
||||
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, a: string, b: string)
|
||||
{
|
||||
print outfile, a;
|
||||
print outfile, b;
|
||||
try = try + 1;
|
||||
if ( try == 3 )
|
||||
{
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
try = 0;
|
||||
outfile = open("../out");
|
||||
Input::add_event([$source="../input.log", $name="input", $fields=Val, $ev=line]);
|
||||
Input::remove("input");
|
||||
}
|
|
@ -0,0 +1,77 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
#separator \x09
|
||||
#path ssh
|
||||
#fields sub.b i sub.e sub.c sub.p sub.sn sub.two.a sub.two.d t iv s sc ss se vc ve f
|
||||
#types bool int enum count port subnet addr double time interval string table table table vector vector func
|
||||
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY SSH::foo\x0a{ \x0aif (0 < SSH::i) \x0a\x09return (Foo);\x0aelse\x0a\x09return (Bar);\x0a\x0a}
|
||||
@TEST-END-FILE
|
||||
|
||||
@load base/protocols/ssh
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
global try: count;
|
||||
|
||||
redef InputAscii::empty_field = "EMPTY";
|
||||
|
||||
module A;
|
||||
|
||||
type Idx: record {
|
||||
i: int;
|
||||
};
|
||||
|
||||
type SubVal2: record {
|
||||
a: addr;
|
||||
d: double;
|
||||
};
|
||||
|
||||
type SubVal: record {
|
||||
b: bool;
|
||||
e: Log::ID;
|
||||
c: count;
|
||||
p: port;
|
||||
sn: subnet;
|
||||
two: SubVal2;
|
||||
};
|
||||
|
||||
type Val: record {
|
||||
sub: SubVal;
|
||||
t: time;
|
||||
iv: interval;
|
||||
s: string;
|
||||
sc: set[count];
|
||||
ss: set[string];
|
||||
se: set[string];
|
||||
vc: vector of int;
|
||||
ve: vector of int;
|
||||
};
|
||||
|
||||
|
||||
|
||||
event line(description: Input::EventDescription, tpe: Input::Event, value: Val)
|
||||
{
|
||||
print outfile, value;
|
||||
try = try + 1;
|
||||
if ( try == 7 )
|
||||
{
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
try = 0;
|
||||
outfile = open("../out");
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_event([$source="../input.log", $name="ssh", $fields=Val, $ev=line, $want_record=T]);
|
||||
Input::remove("ssh");
|
||||
print "Hi";
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue