Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/timw/deprecation-cleanup'

Browse source 
Merge adjustments:
- Removed some stale str_split() references from docs
- Renumbered TypeTag enum comments
- Simplified test-case for @unload (don't need .bro files anymore)

* origin/topic/timw/deprecation-cleanup:
  Doc updates
  Fix language.init-in-anon-function btest due to changes to log filter predicates
  Remove deprecated log filter predicates for 4.1
  Remove Plugin::HookCallFunction and fix tests related to it
  Remove support for .bro script extension and BRO_ environment variables
  Remove deprecated ICMP events
  Remove some deprected methods/events from bif files
  Remove TYPE_COUNTER
  Remove all of the random single-file deprecations
  Remove all fully-deprecated files
  Update bifcl submodule to remove deprecations from generated code
This commit is contained in:
Jon Siwek 2021-01-29 16:37:56 -08:00
commit 1ca85f0221
322 changed files with 500 additions and 5697 deletions
Download patch file Download diff file Expand all files Collapse all files

18
testing/btest/scripts/base/frameworks/logging/pred.zeek
View file

@ -14,26 +14,32 @@ export {
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
status: string &optional;
status: string;
country: string &default="unknown";
} &log;
}
function fail(rec: Log): bool
hook success(rec: Log, id: Log::ID, filter: Log::Filter)
{
return rec$status != "success";
if ( rec$status != "success" )
break;
}
hook fail(rec: Log, id: Log::ID, filter: Log::Filter)
{
if ( rec$status == "success" )
break;
}
event zeek_init()
{
Log::create_stream(Test::LOG, [$columns=Log]);
Log::remove_default_filter(Test::LOG);
Log::add_filter(Test::LOG, [$name="f1", $path="test.success", $pred=function(rec: Log): bool { return rec$status == "success"; }]);
Log::add_filter(Test::LOG, [$name="f2", $path="test.failure", $pred=fail]);
Log::add_filter(Test::LOG, [$name="f1", $path="test.success", $policy=success]);
Log::add_filter(Test::LOG, [$name="f2", $path="test.failure", $policy=fail]);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];
local r: Log = [$t=network_time(), $id=cid, $status="success"];
Log::write(Test::LOG, r);
Log::write(Test::LOG, [$t=network_time(), $id=cid, $status="failure", $country="US"]);
}

10
testing/btest/scripts/base/frameworks/logging/remove.zeek
View file

@ -15,15 +15,21 @@ export {
type Log: record {
t: time;
id: conn_id; # Will be rolled out into individual columns.
status: string &optional;
status: string;
country: string &default="unknown";
} &log;
}
hook fail_only(rec: Log, id: Log::ID, filter: Log::Filter)
{
if ( rec$status != "failure" )
break;
}
event zeek_init()
{
Log::create_stream(SSH::LOG, [$columns=Log]);
Log::add_filter(SSH::LOG, [$name="f1", $path="ssh.failure", $pred=function(rec: Log): bool { return rec$status == "failure"; }]);
Log::add_filter(SSH::LOG, [$name="f1", $path="ssh.failure", $policy=fail_only]);
local cid = [$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=2.3.4.5, $resp_p=80/tcp];