mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath: Ok, this one is not really necessary for 2.1 and more of a nice-to-have another small bug found while searching for something else... Fix two little bugs: sorry. the patch for the set_separator. make set_separators different from , work for input framework. Bug found bei Keith & Seth: input framework was not handling counts and ints out of 32-bit-range correctly.
This commit is contained in:
Robin Sommer
commit
352d4bd5e2
13 changed files with 754 additions and 90 deletions
19
CHANGES
19
CHANGES
|
|
@ -1,6 +1,23 @@
|
|||
|
||||
2.1 | 2012-08-24 15:11:49 -0700
|
||||
|
||||
* Input framework fixes (Bernhard Amann), including:
|
||||
|
||||
- One of the change events got the wrong parameters.
|
||||
|
||||
- Escape commas in sets and vectors that were unescaped before
|
||||
tokenization.
|
||||
|
||||
- Handling of zero-length-strings as last element in a set was
|
||||
broken (sets ending with a ,).
|
||||
|
||||
- Hashing of lines just containing zero-length-strings was broken.
|
||||
|
||||
- Make set_separators different from , work for input framework.
|
||||
|
||||
- Input framework was not handling counts and ints out of
|
||||
32-bit-range correctly.
|
||||
|
||||
* Update documentation for builtin types. (Daniel Thayer)
|
||||
|
||||
- Add missing description of interval "msec" unit.
|
||||
|
|
@ -19,8 +36,6 @@
|
|||
* Adding an identifier to the SMTP blocklist notices for duplicate
|
||||
suppression. (Seth Hall)
|
||||
|
||||
- Slight addition and revision to inline docs.
|
||||
|
||||
2.1-beta-45 | 2012-08-22 16:11:10 -0700
|
||||
|
||||
* Add an option to the input framework that allows the user to chose
|
||||
|
|
|
|||
2
VERSION
2
VERSION
|
|
@ -1 +1 @@
|
|||
2.1
|
||||
2.1-7
|
||||
|
|
|
|||
|
|
@ -1228,7 +1228,7 @@ void Manager::EndCurrentSend(ReaderFrontend* reader)
|
|||
Ref(predidx);
|
||||
Ref(val);
|
||||
Ref(ev);
|
||||
SendEvent(stream->event, 3, ev, predidx, val);
|
||||
SendEvent(stream->event, 4, stream->description->Ref(), ev, predidx, val);
|
||||
}
|
||||
|
||||
if ( predidx ) // if we have a stream or an event...
|
||||
|
|
@ -1748,7 +1748,7 @@ int Manager::GetValueLength(const Value* val) {
|
|||
case TYPE_STRING:
|
||||
case TYPE_ENUM:
|
||||
{
|
||||
length += val->val.string_val.length;
|
||||
length += val->val.string_val.length + 1;
|
||||
break;
|
||||
}
|
||||
|
||||
|
|
@ -1848,7 +1848,10 @@ int Manager::CopyValue(char *data, const int startpos, const Value* val)
|
|||
case TYPE_ENUM:
|
||||
{
|
||||
memcpy(data+startpos, val->val.string_val.data, val->val.string_val.length);
|
||||
return val->val.string_val.length;
|
||||
// Add a \0 to the end. To be able to hash zero-length
|
||||
// strings and differentiate from !present.
|
||||
memset(data + startpos + val->val.string_val.length, 0, 1);
|
||||
return val->val.string_val.length + 1;
|
||||
}
|
||||
|
||||
case TYPE_ADDR:
|
||||
|
|
@ -1939,13 +1942,15 @@ HashKey* Manager::HashValues(const int num_elements, const Value* const *vals)
|
|||
const Value* val = vals[i];
|
||||
if ( val->present )
|
||||
length += GetValueLength(val);
|
||||
|
||||
// And in any case add 1 for the end-of-field-identifier.
|
||||
length++;
|
||||
}
|
||||
|
||||
if ( length == 0 )
|
||||
{
|
||||
reporter->Error("Input reader sent line where all elements are null values. Ignoring line");
|
||||
assert ( length >= num_elements );
|
||||
|
||||
if ( length == num_elements )
|
||||
return NULL;
|
||||
}
|
||||
|
||||
int position = 0;
|
||||
char *data = (char*) malloc(length);
|
||||
|
|
@ -1957,6 +1962,12 @@ HashKey* Manager::HashValues(const int num_elements, const Value* const *vals)
|
|||
const Value* val = vals[i];
|
||||
if ( val->present )
|
||||
position += CopyValue(data, position, val);
|
||||
|
||||
memset(data + position, 1, 1); // Add end-of-field-marker. Does not really matter which value it is,
|
||||
// it just has to be... something.
|
||||
|
||||
position++;
|
||||
|
||||
}
|
||||
|
||||
HashKey *key = new HashKey(data, length);
|
||||
|
|
|
|||
|
|
@ -220,6 +220,7 @@ Value* Ascii::EntryToVal(string s, FieldMapping field)
|
|||
switch ( field.type ) {
|
||||
case TYPE_ENUM:
|
||||
case TYPE_STRING:
|
||||
s = get_unescaped_string(s);
|
||||
val->val.string_val.length = s.size();
|
||||
val->val.string_val.data = copy_string(s.c_str());
|
||||
break;
|
||||
|
|
@ -238,7 +239,7 @@ Value* Ascii::EntryToVal(string s, FieldMapping field)
|
|||
break;
|
||||
|
||||
case TYPE_INT:
|
||||
val->val.int_val = atoi(s.c_str());
|
||||
val->val.int_val = strtoll(s.c_str(), (char**) NULL, 10);
|
||||
break;
|
||||
|
||||
case TYPE_DOUBLE:
|
||||
|
|
@ -249,7 +250,7 @@ Value* Ascii::EntryToVal(string s, FieldMapping field)
|
|||
|
||||
case TYPE_COUNT:
|
||||
case TYPE_COUNTER:
|
||||
val->val.uint_val = atoi(s.c_str());
|
||||
val->val.uint_val = strtoull(s.c_str(),(char**) NULL, 10);
|
||||
break;
|
||||
|
||||
case TYPE_PORT:
|
||||
|
|
@ -259,6 +260,7 @@ Value* Ascii::EntryToVal(string s, FieldMapping field)
|
|||
|
||||
case TYPE_SUBNET:
|
||||
{
|
||||
s = get_unescaped_string(s);
|
||||
size_t pos = s.find("/");
|
||||
if ( pos == s.npos )
|
||||
{
|
||||
|
|
@ -275,6 +277,7 @@ Value* Ascii::EntryToVal(string s, FieldMapping field)
|
|||
}
|
||||
|
||||
case TYPE_ADDR:
|
||||
s = get_unescaped_string(s);
|
||||
val->val.addr_val = StringToAddr(s);
|
||||
break;
|
||||
|
||||
|
|
@ -288,7 +291,10 @@ Value* Ascii::EntryToVal(string s, FieldMapping field)
|
|||
// how many entries do we have...
|
||||
unsigned int length = 1;
|
||||
for ( unsigned int i = 0; i < s.size(); i++ )
|
||||
if ( s[i] == ',' ) length++;
|
||||
{
|
||||
if ( s[i] == set_separator[0] )
|
||||
length++;
|
||||
}
|
||||
|
||||
unsigned int pos = 0;
|
||||
|
||||
|
|
@ -342,9 +348,23 @@ Value* Ascii::EntryToVal(string s, FieldMapping field)
|
|||
pos++;
|
||||
}
|
||||
|
||||
// Test if the string ends with a set_separator. If it does
|
||||
// we have to push an zero-length val on top of it.
|
||||
if ( *s.rbegin() == set_separator[0] )
|
||||
{
|
||||
lvals[pos] = EntryToVal("", field.subType());
|
||||
if ( lvals[pos] == 0 )
|
||||
{
|
||||
Error("Error while trying to add empty set element");
|
||||
return 0;
|
||||
}
|
||||
|
||||
pos++;
|
||||
}
|
||||
|
||||
if ( pos != length )
|
||||
{
|
||||
Error("Internal error while parsing set: did not find all elements");
|
||||
Error(Fmt("Internal error while parsing set: did not find all elements: %s", s.c_str()));
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -438,8 +458,6 @@ bool Ascii::DoUpdate()
|
|||
if ( ! getline(splitstream, s, separator[0]) )
|
||||
break;
|
||||
|
||||
s = get_unescaped_string(s);
|
||||
|
||||
stringfields[pos] = s;
|
||||
pos++;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,3 @@
|
|||
{
|
||||
[9223372036854775800] = [c=18446744073709551612]
|
||||
}
|
||||
|
|
@ -0,0 +1,155 @@
|
|||
============PREDICATE============
|
||||
Input::EVENT_NEW
|
||||
[i=1]
|
||||
[s=<uninitialized>, ss=TEST]
|
||||
============PREDICATE============
|
||||
Input::EVENT_NEW
|
||||
[i=2]
|
||||
[s=<uninitialized>, ss=<uninitialized>]
|
||||
============EVENT============
|
||||
Description
|
||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::REREAD, name=ssh, destination={
|
||||
[2] = [s=<uninitialized>, ss=<uninitialized>],
|
||||
[1] = [s=<uninitialized>, ss=TEST]
|
||||
}, idx=<no value description>, val=<no value description>, want_record=T, ev=line
|
||||
{
|
||||
print A::outfile, ============EVENT============;
|
||||
print A::outfile, Description;
|
||||
print A::outfile, A::description;
|
||||
print A::outfile, Type;
|
||||
print A::outfile, A::tpe;
|
||||
print A::outfile, Left;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, Right;
|
||||
print A::outfile, A::right;
|
||||
}, pred=anonymous-function
|
||||
{
|
||||
print A::outfile, ============PREDICATE============;
|
||||
print A::outfile, A::typ;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, A::right;
|
||||
return (T);
|
||||
}, config={
|
||||
|
||||
}]
|
||||
Type
|
||||
Input::EVENT_NEW
|
||||
Left
|
||||
[i=1]
|
||||
Right
|
||||
[s=<uninitialized>, ss=TEST]
|
||||
============EVENT============
|
||||
Description
|
||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::REREAD, name=ssh, destination={
|
||||
[2] = [s=<uninitialized>, ss=<uninitialized>],
|
||||
[1] = [s=<uninitialized>, ss=TEST]
|
||||
}, idx=<no value description>, val=<no value description>, want_record=T, ev=line
|
||||
{
|
||||
print A::outfile, ============EVENT============;
|
||||
print A::outfile, Description;
|
||||
print A::outfile, A::description;
|
||||
print A::outfile, Type;
|
||||
print A::outfile, A::tpe;
|
||||
print A::outfile, Left;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, Right;
|
||||
print A::outfile, A::right;
|
||||
}, pred=anonymous-function
|
||||
{
|
||||
print A::outfile, ============PREDICATE============;
|
||||
print A::outfile, A::typ;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, A::right;
|
||||
return (T);
|
||||
}, config={
|
||||
|
||||
}]
|
||||
Type
|
||||
Input::EVENT_NEW
|
||||
Left
|
||||
[i=2]
|
||||
Right
|
||||
[s=<uninitialized>, ss=<uninitialized>]
|
||||
==========SERVERS============
|
||||
{
|
||||
[2] = [s=<uninitialized>, ss=<uninitialized>],
|
||||
[1] = [s=<uninitialized>, ss=TEST]
|
||||
}
|
||||
============PREDICATE============
|
||||
Input::EVENT_CHANGED
|
||||
[i=1]
|
||||
[s=TEST, ss=<uninitialized>]
|
||||
============PREDICATE============
|
||||
Input::EVENT_CHANGED
|
||||
[i=2]
|
||||
[s=TEST, ss=TEST]
|
||||
============EVENT============
|
||||
Description
|
||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::REREAD, name=ssh, destination={
|
||||
[2] = [s=TEST, ss=TEST],
|
||||
[1] = [s=TEST, ss=<uninitialized>]
|
||||
}, idx=<no value description>, val=<no value description>, want_record=T, ev=line
|
||||
{
|
||||
print A::outfile, ============EVENT============;
|
||||
print A::outfile, Description;
|
||||
print A::outfile, A::description;
|
||||
print A::outfile, Type;
|
||||
print A::outfile, A::tpe;
|
||||
print A::outfile, Left;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, Right;
|
||||
print A::outfile, A::right;
|
||||
}, pred=anonymous-function
|
||||
{
|
||||
print A::outfile, ============PREDICATE============;
|
||||
print A::outfile, A::typ;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, A::right;
|
||||
return (T);
|
||||
}, config={
|
||||
|
||||
}]
|
||||
Type
|
||||
Input::EVENT_CHANGED
|
||||
Left
|
||||
[i=1]
|
||||
Right
|
||||
[s=<uninitialized>, ss=TEST]
|
||||
============EVENT============
|
||||
Description
|
||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::REREAD, name=ssh, destination={
|
||||
[2] = [s=TEST, ss=TEST],
|
||||
[1] = [s=TEST, ss=<uninitialized>]
|
||||
}, idx=<no value description>, val=<no value description>, want_record=T, ev=line
|
||||
{
|
||||
print A::outfile, ============EVENT============;
|
||||
print A::outfile, Description;
|
||||
print A::outfile, A::description;
|
||||
print A::outfile, Type;
|
||||
print A::outfile, A::tpe;
|
||||
print A::outfile, Left;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, Right;
|
||||
print A::outfile, A::right;
|
||||
}, pred=anonymous-function
|
||||
{
|
||||
print A::outfile, ============PREDICATE============;
|
||||
print A::outfile, A::typ;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, A::right;
|
||||
return (T);
|
||||
}, config={
|
||||
|
||||
}]
|
||||
Type
|
||||
Input::EVENT_CHANGED
|
||||
Left
|
||||
[i=2]
|
||||
Right
|
||||
[s=<uninitialized>, ss=<uninitialized>]
|
||||
==========SERVERS============
|
||||
{
|
||||
[2] = [s=TEST, ss=TEST],
|
||||
[1] = [s=TEST, ss=<uninitialized>]
|
||||
}
|
||||
done
|
||||
|
|
@ -1084,7 +1084,7 @@ BB
|
|||
}
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
[i=-43]
|
||||
[i=-44]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
|
|
@ -1096,6 +1096,21 @@ AA,
|
|||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
[i=-42]
|
||||
[b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
|
|
@ -1111,21 +1126,6 @@ AA,
|
|||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
[i=-44]
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
|
|
@ -1159,25 +1159,7 @@ BB
|
|||
}, vc=[10, 20, 30], ve=[]]
|
||||
============PREDICATE============
|
||||
Input::EVENT_REMOVED
|
||||
[i=-42]
|
||||
[b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
Input::EVENT_REMOVED
|
||||
Type
|
||||
[i=-43]
|
||||
Left
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
|
|
@ -1190,14 +1172,10 @@ BB
|
|||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
Right
|
||||
============EVENT============
|
||||
Description
|
||||
Input::EVENT_REMOVED
|
||||
Type
|
||||
[i=-46]
|
||||
Left
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::REREAD, name=ssh, destination={
|
||||
[-48] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
|
|
@ -1209,13 +1187,32 @@ BB
|
|||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
Right
|
||||
============EVENT============
|
||||
Description
|
||||
Input::EVENT_REMOVED
|
||||
}, idx=<no value description>, val=<no value description>, want_record=T, ev=line
|
||||
{
|
||||
print A::outfile, ============EVENT============;
|
||||
print A::outfile, Description;
|
||||
print A::outfile, A::description;
|
||||
print A::outfile, Type;
|
||||
print A::outfile, A::tpe;
|
||||
print A::outfile, Left;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, Right;
|
||||
print A::outfile, A::right;
|
||||
}, pred=anonymous-function
|
||||
{
|
||||
print A::outfile, ============PREDICATE============;
|
||||
print A::outfile, A::typ;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, A::right;
|
||||
return (T);
|
||||
}, config={
|
||||
|
||||
}]
|
||||
Type
|
||||
Input::EVENT_REMOVED
|
||||
Left
|
||||
[i=-44]
|
||||
Left
|
||||
Right
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
|
|
@ -1228,14 +1225,10 @@ BB
|
|||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
Right
|
||||
============EVENT============
|
||||
Description
|
||||
Input::EVENT_REMOVED
|
||||
Type
|
||||
[i=-47]
|
||||
Left
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::REREAD, name=ssh, destination={
|
||||
[-48] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
|
|
@ -1247,32 +1240,32 @@ BB
|
|||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
Right
|
||||
============EVENT============
|
||||
Description
|
||||
Input::EVENT_REMOVED
|
||||
Type
|
||||
[i=-45]
|
||||
Left
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
}, idx=<no value description>, val=<no value description>, want_record=T, ev=line
|
||||
{
|
||||
print A::outfile, ============EVENT============;
|
||||
print A::outfile, Description;
|
||||
print A::outfile, A::description;
|
||||
print A::outfile, Type;
|
||||
print A::outfile, A::tpe;
|
||||
print A::outfile, Left;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, Right;
|
||||
print A::outfile, A::right;
|
||||
}, pred=anonymous-function
|
||||
{
|
||||
print A::outfile, ============PREDICATE============;
|
||||
print A::outfile, A::typ;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, A::right;
|
||||
return (T);
|
||||
}, config={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
Right
|
||||
============EVENT============
|
||||
Description
|
||||
Input::EVENT_REMOVED
|
||||
}]
|
||||
Type
|
||||
Input::EVENT_REMOVED
|
||||
Left
|
||||
[i=-42]
|
||||
Left
|
||||
Right
|
||||
[b=T, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
|
|
@ -1285,7 +1278,218 @@ BB
|
|||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::REREAD, name=ssh, destination={
|
||||
[-48] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
}, idx=<no value description>, val=<no value description>, want_record=T, ev=line
|
||||
{
|
||||
print A::outfile, ============EVENT============;
|
||||
print A::outfile, Description;
|
||||
print A::outfile, A::description;
|
||||
print A::outfile, Type;
|
||||
print A::outfile, A::tpe;
|
||||
print A::outfile, Left;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, Right;
|
||||
print A::outfile, A::right;
|
||||
}, pred=anonymous-function
|
||||
{
|
||||
print A::outfile, ============PREDICATE============;
|
||||
print A::outfile, A::typ;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, A::right;
|
||||
return (T);
|
||||
}, config={
|
||||
|
||||
}]
|
||||
Type
|
||||
Input::EVENT_REMOVED
|
||||
Left
|
||||
[i=-46]
|
||||
Right
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::REREAD, name=ssh, destination={
|
||||
[-48] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
}, idx=<no value description>, val=<no value description>, want_record=T, ev=line
|
||||
{
|
||||
print A::outfile, ============EVENT============;
|
||||
print A::outfile, Description;
|
||||
print A::outfile, A::description;
|
||||
print A::outfile, Type;
|
||||
print A::outfile, A::tpe;
|
||||
print A::outfile, Left;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, Right;
|
||||
print A::outfile, A::right;
|
||||
}, pred=anonymous-function
|
||||
{
|
||||
print A::outfile, ============PREDICATE============;
|
||||
print A::outfile, A::typ;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, A::right;
|
||||
return (T);
|
||||
}, config={
|
||||
|
||||
}]
|
||||
Type
|
||||
Input::EVENT_REMOVED
|
||||
Left
|
||||
[i=-47]
|
||||
Right
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::REREAD, name=ssh, destination={
|
||||
[-48] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
}, idx=<no value description>, val=<no value description>, want_record=T, ev=line
|
||||
{
|
||||
print A::outfile, ============EVENT============;
|
||||
print A::outfile, Description;
|
||||
print A::outfile, A::description;
|
||||
print A::outfile, Type;
|
||||
print A::outfile, A::tpe;
|
||||
print A::outfile, Left;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, Right;
|
||||
print A::outfile, A::right;
|
||||
}, pred=anonymous-function
|
||||
{
|
||||
print A::outfile, ============PREDICATE============;
|
||||
print A::outfile, A::typ;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, A::right;
|
||||
return (T);
|
||||
}, config={
|
||||
|
||||
}]
|
||||
Type
|
||||
Input::EVENT_REMOVED
|
||||
Left
|
||||
[i=-45]
|
||||
Right
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
============EVENT============
|
||||
Description
|
||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::REREAD, name=ssh, destination={
|
||||
[-48] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
}, idx=<no value description>, val=<no value description>, want_record=T, ev=line
|
||||
{
|
||||
print A::outfile, ============EVENT============;
|
||||
print A::outfile, Description;
|
||||
print A::outfile, A::description;
|
||||
print A::outfile, Type;
|
||||
print A::outfile, A::tpe;
|
||||
print A::outfile, Left;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, Right;
|
||||
print A::outfile, A::right;
|
||||
}, pred=anonymous-function
|
||||
{
|
||||
print A::outfile, ============PREDICATE============;
|
||||
print A::outfile, A::typ;
|
||||
print A::outfile, A::left;
|
||||
print A::outfile, A::right;
|
||||
return (T);
|
||||
}, config={
|
||||
|
||||
}]
|
||||
Type
|
||||
Input::EVENT_REMOVED
|
||||
Left
|
||||
[i=-43]
|
||||
Right
|
||||
[b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
2,
|
||||
4,
|
||||
1,
|
||||
3
|
||||
}, ss={
|
||||
CC,
|
||||
AA,
|
||||
BB
|
||||
}, se={
|
||||
|
||||
}, vc=[10, 20, 30], ve=[]]
|
||||
==========SERVERS============
|
||||
{
|
||||
[-48] = [b=F, e=SSH::LOG, c=21, p=123/unknown, sn=10.0.0.0/24, a=1.2.3.4, d=3.14, t=1315801931.273616, iv=100.0, s=hurz, sc={
|
||||
|
|
|
|||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
[1] = [s={
|
||||
b,
|
||||
e,
|
||||
d,
|
||||
c,
|
||||
f,
|
||||
a
|
||||
}, ss=[1, 2, 3, 4, 5, 6]]
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
{
|
||||
[2] = [s={
|
||||
,
|
||||
testing
|
||||
}, s=[testing, , testing]],
|
||||
[4] = [s={
|
||||
,
|
||||
testing
|
||||
}, s=[testing, ]],
|
||||
[1] = [s={
|
||||
testing,testing,testing,
|
||||
}, s=[testing,testing,testing,]],
|
||||
[5] = [s={
|
||||
|
||||
}, s=[, , , ]],
|
||||
[3] = [s={
|
||||
,
|
||||
testing
|
||||
}, s=[, testing]]
|
||||
}
|
||||
44
testing/btest/scripts/base/frameworks/input/bignumber.bro
Normal file
44
testing/btest/scripts/base/frameworks/input/bignumber.bro
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
#separator \x09
|
||||
#fields i c
|
||||
#types int count
|
||||
9223372036854775800 18446744073709551612
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
module A;
|
||||
|
||||
type Idx: record {
|
||||
i: int;
|
||||
};
|
||||
|
||||
type Val: record {
|
||||
c: count;
|
||||
};
|
||||
|
||||
global servers: table[int] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
outfile = open("../out");
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="../input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
|
||||
Input::remove("ssh");
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source:string)
|
||||
{
|
||||
print outfile, servers;
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
|
|
@ -0,0 +1,89 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: cp input1.log input.log
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: sleep 2
|
||||
# @TEST-EXEC: cp input2.log input.log
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: btest-diff out
|
||||
|
||||
@TEST-START-FILE input1.log
|
||||
#separator \x09
|
||||
#fields i s ss
|
||||
#types int sting string
|
||||
1 - TEST
|
||||
2 - -
|
||||
@TEST-END-FILE
|
||||
@TEST-START-FILE input2.log
|
||||
#separator \x09
|
||||
#fields i s ss
|
||||
#types int sting string
|
||||
1 TEST -
|
||||
2 TEST TEST
|
||||
@TEST-END-FILE
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
|
||||
module A;
|
||||
|
||||
type Idx: record {
|
||||
i: int;
|
||||
};
|
||||
|
||||
type Val: record {
|
||||
s: string;
|
||||
ss: string;
|
||||
};
|
||||
|
||||
global servers: table[int] of Val = table();
|
||||
|
||||
global outfile: file;
|
||||
|
||||
global try: count;
|
||||
|
||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: Val)
|
||||
{
|
||||
print outfile, "============EVENT============";
|
||||
print outfile, "Description";
|
||||
print outfile, description;
|
||||
print outfile, "Type";
|
||||
print outfile, tpe;
|
||||
print outfile, "Left";
|
||||
print outfile, left;
|
||||
print outfile, "Right";
|
||||
print outfile, right;
|
||||
}
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
outfile = open("../out");
|
||||
try = 0;
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="../input.log", $mode=Input::REREAD, $name="ssh", $idx=Idx, $val=Val, $destination=servers, $ev=line,
|
||||
$pred(typ: Input::Event, left: Idx, right: Val) = {
|
||||
print outfile, "============PREDICATE============";
|
||||
print outfile, typ;
|
||||
print outfile, left;
|
||||
print outfile, right;
|
||||
return T;
|
||||
}
|
||||
]);
|
||||
}
|
||||
|
||||
|
||||
event Input::update_finished(name: string, source: string)
|
||||
{
|
||||
print outfile, "==========SERVERS============";
|
||||
print outfile, servers;
|
||||
|
||||
try = try + 1;
|
||||
if ( try == 2 )
|
||||
{
|
||||
print outfile, "done";
|
||||
close(outfile);
|
||||
Input::remove("input");
|
||||
terminate();
|
||||
}
|
||||
}
|
||||
46
testing/btest/scripts/base/frameworks/input/setseparator.bro
Normal file
46
testing/btest/scripts/base/frameworks/input/setseparator.bro
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
#separator \x09
|
||||
#fields i s ss
|
||||
1 a|b|c|d|e|f 1|2|3|4|5|6
|
||||
@TEST-END-FILE
|
||||
|
||||
redef InputAscii::set_separator = "|";
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
module A;
|
||||
|
||||
type Idx: record {
|
||||
i: int;
|
||||
};
|
||||
|
||||
type Val: record {
|
||||
s: set[string];
|
||||
ss:vector of count;
|
||||
};
|
||||
|
||||
global servers: table[int] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
outfile = open("../out");
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="../input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
|
||||
Input::remove("ssh");
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source:string)
|
||||
{
|
||||
print outfile, servers;
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
# (uses listen.bro just to ensure input sources are more reliably fully-read).
|
||||
# @TEST-SERIALIZE: comm
|
||||
#
|
||||
# @TEST-EXEC: btest-bg-run bro bro -b %INPUT
|
||||
# @TEST-EXEC: btest-bg-wait -k 5
|
||||
# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-sort btest-diff out
|
||||
|
||||
@TEST-START-FILE input.log
|
||||
#separator \x09
|
||||
#fields i s ss
|
||||
1 testing\x2ctesting\x2ctesting\x2c testing\x2ctesting\x2ctesting\x2c
|
||||
2 testing,,testing testing,,testing
|
||||
3 ,testing ,testing
|
||||
4 testing, testing,
|
||||
5 ,,, ,,,
|
||||
@TEST-END-FILE
|
||||
|
||||
|
||||
@load frameworks/communication/listen
|
||||
|
||||
global outfile: file;
|
||||
|
||||
module A;
|
||||
|
||||
type Idx: record {
|
||||
i: int;
|
||||
};
|
||||
|
||||
type Val: record {
|
||||
s: set[string];
|
||||
s: vector of string;
|
||||
};
|
||||
|
||||
global servers: table[int] of Val = table();
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
outfile = open("../out");
|
||||
# first read in the old stuff into the table...
|
||||
Input::add_table([$source="../input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
|
||||
Input::remove("ssh");
|
||||
}
|
||||
|
||||
event Input::update_finished(name: string, source:string)
|
||||
{
|
||||
print outfile, servers;
|
||||
close(outfile);
|
||||
terminate();
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue