Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 11:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Tag truncated values with a flag, plus pack threading::Value better

Browse source
This commit is contained in:
Tim Wojtulewicz 2025-08-11 16:47:11 -07:00
parent c8818d76bd
commit 39814816af
2 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/logging/Manager.cc
View file

@ -1506,6 +1506,7 @@ threading::Value Manager::ValToLogVal(WriterInfo* info, const Stream* stream, st
stream->max_total_string_bytes, total_string_bytes);
if ( allowed_bytes < static_cast<size_t>(s->Len()) ) {
lval.truncated = true;
reporter->Weird("log_string_field_truncated", util::fmt("%s", stream->name.c_str()));
info->total_truncated_string_fields->Inc();
}
@ -1563,6 +1564,7 @@ threading::Value Manager::ValToLogVal(WriterInfo* info, const Stream* stream, st
stream->max_total_container_elements, total_container_elements);
if ( allowed_elements < static_cast<size_t>(set->Length()) ) {
lval.truncated = true;
reporter->Weird("log_container_field_truncated", util::fmt("%s", stream->name.c_str()));
info->total_truncated_containers->Inc();
}
@ -1593,6 +1595,7 @@ threading::Value Manager::ValToLogVal(WriterInfo* info, const Stream* stream, st
stream->max_total_container_elements, total_container_elements);
if ( allowed_elements < static_cast<size_t>(vec->Size()) ) {
lval.truncated = true;
reporter->Weird("log_container_field_truncated", util::fmt("%s", stream->name.c_str()));
info->total_truncated_containers->Inc();
}

19
src/threading/SerialTypes.h
View file

@ -126,8 +126,14 @@ struct Field {
* those Vals supported).
*/
struct Value {
TypeTag type; //! The type of the value.
TypeTag subtype; //! Inner type for sets and vectors.
TypeTag type; //! The type of the value.
TypeTag subtype; //! Inner type for sets and vectors.
bool present = false; //! False for optional record fields that are not set.
bool truncated = false; //! True if the string or container field was truncated.
// For values read by the input framework, this can represent the line number
// containing this value. Used by the Ascii reader primarily.
int32_t line_number = -1;
struct set_t {
zeek_int_t size;
@ -186,8 +192,6 @@ struct Value {
_val() { memset(this, 0, sizeof(_val)); }
} val;
bool present = false; //! False for optional record fields that are not set.
/**
* Constructor.
*
@ -275,13 +279,6 @@ struct Value {
void SetFileLineNumber(int line) { line_number = line; }
int GetFileLineNumber() const { return line_number; }
private:
friend class IPAddr;
// For values read by the input framework, this can represent the line number
// containing this value. Used by the Ascii reader primarily.
int line_number = -1;
};
} // namespace zeek::threading