logging/Ascii: Fix abort() for non-existing postrotation functions

When looking up the postprocessor function from shadow files, id::find_func()
would abort() if the function wasn't available instead of falling back
to the default postprocessor.

Fix by using id::find() and checking the type explicitly and also adding a
strict type check while at it.

This issue was tickled by loading the json-streaming-logs package,
Zeek creating shadow files containing its custom postprocessor function,
then restarting Zeek without the package loaded.

Closes #4562
This commit is contained in:
Arne Welzel 2025-06-10 20:05:17 +02:00
parent 99155f6ec6
commit 45f5a4c1b8
4 changed files with 44 additions and 4 deletions

View file

@ -0,0 +1,32 @@
# @TEST-DOC: Put a non-existing postprocessor function into a shadow file, ensure the default gets picked up. Regression test for #4562
#
# @TEST-EXEC: echo ".log" >> .shadow.conn.log
# @TEST-EXEC: echo "non_existing_rotation_postprocessor" >> .shadow.conn.log
# @TEST-EXEC: echo "leftover conn log" > conn.log
#
# @TEST-EXEC: echo ".log" >> .shadow.dns.log
# @TEST-EXEC: echo "wrongly_typed_rotation_postprocessor" >> .shadow.dns.log
# @TEST-EXEC: echo "leftover dns log" > dns.log
#
# @TEST-EXEC: zeek -b %INPUT
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-sort" btest-diff .stderr
#
# Ensure leftover files were removed.
# @TEST-EXEC: ! test -f .shadow.conn.log
# @TEST-EXEC: ! test -f conn.log
# @TEST-EXEC: ! test -f .shadow.dns.log
# @TEST-EXEC: ! test -f dns.log
#
# Ensure the rotated conn log ends-up in the current working directory.
# @TEST-EXEC: cat ./conn.*.log ./dns.*.log > logs.cat
# @TEST-EXEC: btest-diff logs.cat
function wrongly_typed_rotation_postprocessor(): bool
{
exit(1);
return T;
}
redef LogAscii::enable_leftover_log_rotation = T;
redef Log::default_rotation_interval = 1hr;
redef Log::default_rotation_date_format = "no-date";