Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

support for uninitialized fields & empty sets and tables.

Browse source 
The only snag is... with the default output format of the log-file writer, the input reader cannot tell if a table or set is empty or uninitialized (both cases use the same character by default). In this case, by default it is assumed that the field/vector is uninitalized.
This commit is contained in:
Bernhard Amann 2011-11-16 23:51:51 -08:00
parent 4fef1e3f8c
commit 4dd95fcf3c
4 changed files with 57 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/frameworks/input/__load__.bro
View file

@ -1 +1,3 @@
@load ./main
@load ./readers/ascii

61
src/InputMgr.cc
View file

@ -505,10 +505,10 @@ void InputMgr::SendEntry(const InputReader* reader, const LogVal* const *vals) {
position++;
}
if ( val == 0 ) {
/* if ( val == 0 ) {
reporter->InternalError("conversion error");
return;
}
} */
r->Assign(j,val);
@ -871,7 +871,9 @@ int InputMgr::GetLogValLength(const LogVal* val) {
}
case TYPE_VECTOR: {
for ( int i = 0; i < val->val.vector_val.size; i++ ) {
int j = val->val.vector_val.size;
for ( int i = 0; i < j; i++ ) {
reporter->Error("size is %d", val->val.vector_val.size);
length += GetLogValLength(val->val.vector_val.vals[i]);
}
break;
@ -945,7 +947,8 @@ int InputMgr::CopyLogVal(char *data, const int startpos, const LogVal* val) {
case TYPE_VECTOR: {
int length = 0;
for ( int i = 0; i < val->val.vector_val.size; i++ ) {
int j = val->val.vector_val.size;
for ( int i = 0; i < j; i++ ) {
length += CopyLogVal(data, startpos+length, val->val.vector_val.vals[i]);
}
return length;
@ -994,6 +997,10 @@ Val* InputMgr::LogValToVal(const LogVal* val, BroType* request_type) {
reporter->InternalError("Typetags don't match: %d vs %d", request_type->Tag(), val->type);
return 0;
}
if ( !val->present ) {
return 0; // unset field
}
switch ( val->type ) {
@ -1033,38 +1040,28 @@ Val* InputMgr::LogValToVal(const LogVal* val, BroType* request_type) {
break;
case TYPE_TABLE: {
if ( val->val.set_val.size == 0 ) {
// empty table
TypeList* set_index = new TypeList(base_type(TYPE_ANY));
// iim quite sure this does not work... we probably need the internal set type for this...
reporter->InternalError("Implement me.");
return new TableVal(new SetType(set_index, 0));
} else {
// all entries have to have the same type...
BroType* type = request_type->AsTableType()->Indices()->PureType();
TypeList* set_index = new TypeList(type->Ref());
set_index->Append(type->Ref());
SetType* s = new SetType(set_index, 0);
TableVal* t = new TableVal(s);
for ( int i = 0; i < val->val.set_val.size; i++ ) {
t->Assign(LogValToVal( val->val.set_val.vals[i], type ), 0);
}
return t;
}
// all entries have to have the same type...
BroType* type = request_type->AsTableType()->Indices()->PureType();
TypeList* set_index = new TypeList(type->Ref());
set_index->Append(type->Ref());
SetType* s = new SetType(set_index, 0);
TableVal* t = new TableVal(s);
for ( int i = 0; i < val->val.set_val.size; i++ ) {
t->Assign(LogValToVal( val->val.set_val.vals[i], type ), 0);
}
return t;
break;
}
case TYPE_VECTOR: {
assert ( val->val.vector_val.size > 1 ); // implement empty vector...
// all entries have to have the same type...
BroType* type = request_type->AsVectorType()->YieldType();
VectorType* vt = new VectorType(type->Ref());
VectorVal* v = new VectorVal(vt);
for ( int i = 0; i < val->val.vector_val.size; i++ ) {
v->Assign(i, LogValToVal( val->val.set_val.vals[i], type ), 0);
}
return v;
// all entries have to have the same type...
BroType* type = request_type->AsVectorType()->YieldType();
VectorType* vt = new VectorType(type->Ref());
VectorVal* v = new VectorVal(vt);
for ( int i = 0; i < val->val.vector_val.size; i++ ) {
v->Assign(i, LogValToVal( val->val.set_val.vals[i], type ), 0);
}
return v;
}

61
src/InputReaderAscii.cc
View file

@ -34,31 +34,19 @@ InputReaderAscii::InputReaderAscii()
//keyMap = new map<string, string>();
separator_len = BifConst::LogAscii::separator->Len();
separator = new char[separator_len];
memcpy(separator, BifConst::LogAscii::separator->Bytes(),
separator_len);
if ( separator_len != 1 ) {
separator.assign( (const char*) BifConst::InputAscii::separator->Bytes(), BifConst::InputAscii::separator->Len());
if ( separator.size() != 1 ) {
Error("separator length has to be 1. Separator will be truncated.");
}
set_separator_len = BifConst::LogAscii::set_separator->Len();
set_separator = new char[set_separator_len];
memcpy(set_separator, BifConst::LogAscii::set_separator->Bytes(),
set_separator_len);
if ( set_separator_len != 1 ) {
set_separator.assign( (const char*) BifConst::InputAscii::set_separator->Bytes(), BifConst::InputAscii::set_separator->Len());
if ( set_separator.size() != 1 ) {
Error("set_separator length has to be 1. Separator will be truncated.");
}
empty_field_len = BifConst::LogAscii::empty_field->Len();
empty_field = new char[empty_field_len];
memcpy(empty_field, BifConst::LogAscii::empty_field->Bytes(),
empty_field_len);
unset_field_len = BifConst::LogAscii::unset_field->Len();
unset_field = new char[unset_field_len];
memcpy(unset_field, BifConst::LogAscii::unset_field->Bytes(),
unset_field_len);
empty_field.assign( (const char*) BifConst::InputAscii::empty_field->Bytes(), BifConst::InputAscii::empty_field->Len());
unset_field.assign( (const char*) BifConst::InputAscii::unset_field->Bytes(), BifConst::InputAscii::unset_field->Len());
}
@ -66,10 +54,6 @@ InputReaderAscii::~InputReaderAscii()
{
DoFinish();
delete [] separator;
delete [] set_separator;
delete [] empty_field;
delete [] unset_field;
}
void InputReaderAscii::DoFinish()
@ -172,7 +156,10 @@ bool InputReaderAscii::GetLine(string& str) {
LogVal* InputReaderAscii::EntryToVal(string s, FieldMapping field) {
LogVal* val = new LogVal(field.type, true);
//bzero(val, sizeof(LogVal));
if ( s.compare(unset_field) == 0 ) { // field is not set...
return new LogVal(field.type, false);
}
switch ( field.type ) {
case TYPE_ENUM:
@ -244,19 +231,13 @@ LogVal* InputReaderAscii::EntryToVal(string s, FieldMapping field) {
if ( s[i] == ',') length++;
unsigned int pos = 0;
if ( s.compare(empty_field) == 0 )
length = 0;
LogVal** lvals = new LogVal* [length];
if ( field.type == TYPE_TABLE ) {
// construct a table from entry...
// for the moment assume, that entries are split by ",".
/* Fix support for emtyp tables if ( s == "-" ) {
// empty
val->val.set_val.size = 0;
break;
} */
val->val.set_val.vals = lvals;
val->val.set_val.size = length;
} else if ( field.type == TYPE_VECTOR ) {
@ -266,18 +247,20 @@ LogVal* InputReaderAscii::EntryToVal(string s, FieldMapping field) {
assert(false);
}
if ( length == 0 )
break; //empty
istringstream splitstream(s);
while ( splitstream ) {
string element;
if ( pos >= length ) {
Error(Fmt("Internal error while parsing set. pos %d > length %d", pos, length));
break;
}
if ( !getline(splitstream, element, set_separator[0]) )
break;
if ( pos >= length ) {
Error(Fmt("Internal error while parsing set. pos %d >= length %d. Element: %s", pos, length, element.c_str()));
break;
}
LogVal* newval = EntryToVal(element, field.subType());
if ( newval == 0 ) {

12
src/InputReaderAscii.h
View file

@ -59,17 +59,13 @@ private:
//map<string, string> *keyMap;
//
// Options set from the script-level.
char* separator;
int separator_len;
string separator;
char* set_separator;
int set_separator_len;
string set_separator;
char* empty_field;
int empty_field_len;
string empty_field;
char* unset_field;
int unset_field_len;
string unset_field;
};