diff --git a/CHANGES b/CHANGES index ae7bdf2d11..965129fa08 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,9 @@ +5.1.0-dev.373 | 2022-08-11 08:49:22 -0700 + + * Add table_keys function (AmazingPP) + + * Add table_values function (AmazingPP) + 5.1.0-dev.368 | 2022-08-11 16:01:32 +0200 * GH-1678: Introduce global disabling_analyzer() hook to veto disable_analyzer() (Arne Welzel, Corelight) diff --git a/VERSION b/VERSION index f424cf82a6..715c44c4d0 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -5.1.0-dev.368 +5.1.0-dev.373 diff --git a/src/Val.h b/src/Val.h index 6e5c28bf39..19798422c7 100644 --- a/src/Val.h +++ b/src/Val.h @@ -932,6 +932,8 @@ public: const PDict* Get() const { return table_val; } + const detail::CompositeHash* GetTableHash() const { return table_hash; } + // Returns the size of the table. int Size() const; int RecursiveSize() const; diff --git a/src/zeek.bif b/src/zeek.bif index 82b4b75a8b..9b00450766 100644 --- a/src/zeek.bif +++ b/src/zeek.bif @@ -28,6 +28,7 @@ #include "zeek/IntrusivePtr.h" #include "zeek/input.h" #include "zeek/Hash.h" +#include "zeek/CompHash.h" #include "zeek/packet_analysis/Manager.h" using namespace std; @@ -1178,6 +1179,58 @@ function clear_table%(v: any%): any return nullptr; %} +## Gets all values from a table. +## +## t: The :zeek:type:`table` +## +## Returns: A ``vector of T`` of all the values in t. +## +## .. zeek:see:: table_keys +function table_values%(t: any%): any_vec + %{ + if ( ! t->GetType()->IsTable() ) + { + zeek::emit_builtin_error("table_values() requires a table argument"); + return nullptr; + } + + auto vt = zeek::make_intrusive(t->GetType()->AsTableType()->Yield()); + auto vv = zeek::make_intrusive(std::move(vt)); + for ( const auto& iter : *t->AsTable() ) + { + vv->Append(iter.value->GetVal()); + } + + return vv; + %} + +## Gets all keys from a table. +## +## t: The :zeek:type:`table` +## +## Returns: A ``set of T`` of all the keys in t. +## +## .. zeek:see:: table_values +function table_keys%(t: any%): any + %{ + if ( ! t->GetType()->IsTable() ) + { + zeek::emit_builtin_error("table_keys() requires a table argument"); + return nullptr; + } + + auto tl = t->GetType()->AsTableType()->GetIndices(); + auto st = zeek::make_intrusive(std::move(tl), nullptr); + auto sv = zeek::make_intrusive(std::move(st)); + auto th = t->AsTableVal()->GetTableHash(); + for ( const auto& iter : *t->AsTable() ) + { + sv->Assign(th->RecoverVals(*iter.GetHashKey()), nullptr); + } + + return sv; + %} + ## Gets all subnets that contain a given subnet from a set/table[subnet]. ## ## search: the subnet to search for. diff --git a/testing/btest/Baseline/bifs.table_keys/out b/testing/btest/Baseline/bifs.table_keys/out new file mode 100644 index 0000000000..b54a0fa697 --- /dev/null +++ b/testing/btest/Baseline/bifs.table_keys/out @@ -0,0 +1,13 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +{ +http, +https +} +{ +[a=, b=7], +[a=10, b=5] +} +{ +[1/tcp, test, T] , +[2/tcp, example, F] +} diff --git a/testing/btest/Baseline/bifs.table_values/out b/testing/btest/Baseline/bifs.table_values/out new file mode 100644 index 0000000000..d89f8a0be4 --- /dev/null +++ b/testing/btest/Baseline/bifs.table_values/out @@ -0,0 +1,3 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +[example, test] +[80/tcp, http, 443/tcp, https, 21/tcp, ftp, 23/tcp, telnet] diff --git a/testing/btest/bifs/table_keys.zeek b/testing/btest/bifs/table_keys.zeek new file mode 100644 index 0000000000..d22f2d5d14 --- /dev/null +++ b/testing/btest/bifs/table_keys.zeek @@ -0,0 +1,29 @@ +# +# @TEST-EXEC: zeek -b %INPUT > out +# @TEST-EXEC: btest-diff out + +type MyRec: record { + a: count &optional; + b: count; +}; + +type MyTable: table[MyRec] of string; + +event zeek_init() + { + local t1 = table( + ["http"] = "http://www.google.com/", + ["https"] = "https://www.google.com/"); + local t2 = MyTable([[$a=10, $b=5]] = "b5", [[$b=7]] = "b7"); + local t3: table[port, string, bool] of string = table( + [1/tcp, "test", T] = "test1", + [2/tcp, "example", F] = "test2"); + + local v1: set[string] = table_keys(t1); + local v2: set[MyRec] = table_keys(t2); + local v3: set[port, string, bool] = table_keys(t3); + + print v1; + print v2; + print v3; + } diff --git a/testing/btest/bifs/table_values.zeek b/testing/btest/bifs/table_values.zeek new file mode 100644 index 0000000000..39dc1c1371 --- /dev/null +++ b/testing/btest/bifs/table_values.zeek @@ -0,0 +1,17 @@ +# +# @TEST-EXEC: zeek -b %INPUT > out +# @TEST-EXEC: btest-diff out + +event zeek_init() + { + local t1: table[count] of string = table([5] = "test", [0] = "example"); + local t2 = table( + ["web"] = { [80/tcp, "http"], [443/tcp, "https"] }, + ["login"] = { [21/tcp, "ftp"], [23/tcp, "telnet"] }); + + local v1: vector of set[string] = table_values(t1); + local v2: vector of set[port, string] = table_values(t2); + + print v1; + print v2; + }