Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

logging/Ascii: Fix abort() for non-existing postrotation functions

Browse source 
When looking up the postprocessor function from shadow files, id::find_func()
would abort() if the function wasn't available instead of falling back
to the default postprocessor.

Fix by using id::find() and checking the type explicitly and also adding a
strict type check while at it.

This issue was tickled by loading the json-streaming-logs package,
Zeek creating shadow files containing its custom postprocessor function,
then restarting Zeek without the package loaded.

Closes #4562
This commit is contained in:
Arne Welzel 2025-06-10 20:05:17 +02:00
parent 99155f6ec6
commit 45f5a4c1b8
4 changed files with 44 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/logging/writers/ascii/Ascii.cc
View file

@ -749,10 +749,9 @@ void Ascii::RotateLeftoverLogs() {
auto ppf = default_ppf;
if ( ! ll.post_proc_func.empty() ) {
auto func = id::find_func(ll.post_proc_func.data());
if ( func )
ppf = std::move(func);
const auto& id = id::find(ll.post_proc_func.data());
if ( id && id->GetVal() && same_type(id->GetVal()->GetType(), default_ppf->GetType()) )
ppf = id->GetVal()->AsFuncVal()->AsFuncPtr();
else
reporter->Warning(
"Could not postprocess log '%s' with intended "

6
testing/btest/Baseline/scripts.base.frameworks.logging.rotate-leftover-log-rotation-shadow-files-postprocessor-errors/.stderr Normal file
View file

@ -0,0 +1,6 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
### NOTE: This file has been sorted with diff-sort.
Rotated/postprocessed leftover log '<...>/conn.log' -> 'conn.no-date.log'
Rotated/postprocessed leftover log '<...>/dns.log' -> 'dns.no-date.log'
warning: Could not postprocess log '<...>/conn.log' with intended postprocessor function 'non_existing_rotation_postprocessor', proceeding with the default function
warning: Could not postprocess log '<...>/dns.log' with intended postprocessor function 'wrongly_typed_rotation_postprocessor', proceeding with the default function

3
testing/btest/Baseline/scripts.base.frameworks.logging.rotate-leftover-log-rotation-shadow-files-postprocessor-errors/logs.cat Normal file
View file

@ -0,0 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
leftover conn log
leftover dns log

32
testing/btest/scripts/base/frameworks/logging/rotate-leftover-log-rotation-shadow-files-postprocessor-errors.zeek Normal file
View file

@ -0,0 +1,32 @@
# @TEST-DOC: Put a non-existing postprocessor function into a shadow file, ensure the default gets picked up. Regression test for #4562
#
# @TEST-EXEC: echo ".log" >> .shadow.conn.log
# @TEST-EXEC: echo "non_existing_rotation_postprocessor" >> .shadow.conn.log
# @TEST-EXEC: echo "leftover conn log" > conn.log
#
# @TEST-EXEC: echo ".log" >> .shadow.dns.log
# @TEST-EXEC: echo "wrongly_typed_rotation_postprocessor" >> .shadow.dns.log
# @TEST-EXEC: echo "leftover dns log" > dns.log
#
# @TEST-EXEC: zeek -b %INPUT
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-sort" btest-diff .stderr
#
# Ensure leftover files were removed.
# @TEST-EXEC: ! test -f .shadow.conn.log
# @TEST-EXEC: ! test -f conn.log
# @TEST-EXEC: ! test -f .shadow.dns.log
# @TEST-EXEC: ! test -f dns.log
#
# Ensure the rotated conn log ends-up in the current working directory.
# @TEST-EXEC: cat ./conn.*.log ./dns.*.log > logs.cat
# @TEST-EXEC: btest-diff logs.cat
function wrongly_typed_rotation_postprocessor(): bool
{
exit(1);
return T;
}
redef LogAscii::enable_leftover_log_rotation = T;
redef Log::default_rotation_interval = 1hr;
redef Log::default_rotation_date_format = "no-date";