Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 10:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'amazing-pp/topic/fupeng/from_json_bif'

Browse source 
* amazing-pp/topic/fupeng/from_json_bif:
  Implement from_json bif

Minor updates during merge: Moved ValFromJSON into zeek::detail for the
time being, removed gotos, normalized some error messages to lower case,
minimal test extension and added a raw reader input framework test reading
"json lines" as a demo, adding notes about the implicit type
conversions.
This commit is contained in:
Arne Welzel 2023-05-09 09:26:14 +02:00
commit 264284150b
34 changed files with 695 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

71
testing/btest/scripts/base/frameworks/input/from_json.zeek Normal file
View file

@ -0,0 +1,71 @@
# @TEST-DOC: Reading a jsonl file using the raw input reader and parsing via from_json()
# @TEST-EXEC: zeek -b %INPUT >out
# @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff out
@TEST-START-FILE denylist.jsonl
{"ip": "192.168.0.1", "source": "local", "timestamp": "1990-09-22T12:13:14"}
{"ip": "192.168.0.1", "source": "local", "timestamp": "1990-09-23T13:14:15"}
{"ip": "192.168.0.2", "source": "local"}
{"source": "local"}
{... ]
{"ip": "8.8.4.4", "source": "remote"}
@TEST-END-FILE
redef exit_only_after_terminate = T;
module A;
type Line: record {
l: string;
};
type Deny: record {
ip: addr;
source: string;
timestamp: string &optional;
timestamp_parsed: time &optional;
};
event line(description: Input::EventDescription, tpe: Input::Event, line: string)
{
local r = from_json(line, Deny);
if ( r$valid )
{
local deny = r$v as Deny;
if ( deny?$timestamp )
deny$timestamp_parsed = strptime("%Y-%m-%dT%H:%M:%S", deny$timestamp);
print fmt("Valid: %s (%s)", deny, line);
}
else
print fmt("Invalid: '%s'", line);
}
event die()
{
if ( zeek_is_terminating() )
return;
print "error: test timeout";
exit(1);
}
event zeek_init()
{
Input::add_event([
$source="denylist.jsonl",
$name="denylist",
$reader=Input::READER_RAW,
$fields=Line,
$ev=line,
$want_record=F
]);
schedule 5sec { die() };
}
event Input::end_of_data(name: string, source:string)
{
Input::remove("deny");
terminate();
}