Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-186: fix JSON formatting of timestamps before Unix epoch

Browse source
This commit is contained in:
Jon Siwek 2018-10-12 21:30:19 +00:00
parent f05ef0cb1e
commit 70233148be
5 changed files with 44 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,4 +1,8 @@
2.6-beta2-29 | 2018-10-12 21:30:19 +0000
* GH-186: fix JSON formatting of timestamps before Unix epoch (Jon Siwek, Corelight)
2.6-beta2-28 | 2018-10-12 12:48:33 -0400 2.6-beta2-28 | 2018-10-12 12:48:33 -0400
* Fix test baseline for plugin skeleton update (Jon Siwek, Corelight) * Fix test baseline for plugin skeleton update (Jon Siwek, Corelight)

2
VERSION
View file

@ -1 +1 @@
2.6-beta2-28 2.6-beta2-29

8
src/threading/formatters/JSON.cc
View file

@ -116,7 +116,7 @@ bool JSON::Describe(ODesc* desc, Value* val, const string& name) const
{ {
char buffer[40]; char buffer[40];
char buffer2[40]; char buffer2[40];
time_t the_time = time_t(val->val.double_val); time_t the_time = time_t(floor(val->val.double_val));
struct tm t; struct tm t;
desc->AddRaw("\"", 1); desc->AddRaw("\"", 1);
@ -133,7 +133,11 @@ bool JSON::Describe(ODesc* desc, Value* val, const string& name) const
{ {
double integ; double integ;
double frac = modf(val->val.double_val, &integ); double frac = modf(val->val.double_val, &integ);
snprintf(buffer2, sizeof(buffer2), "%s.%06.0fZ", buffer, frac * 1000000);
if ( frac < 0 )
frac += 1;
snprintf(buffer2, sizeof(buffer2), "%s.%06.0fZ", buffer, fabs(frac) * 1000000);
desc->Add(buffer2); desc->Add(buffer2);
} }

8
testing/btest/Baseline/scripts.base.frameworks.logging.ascii-json-iso-timestamps/ssh.log
View file

@ -1,2 +1,10 @@
{"t":"2008-07-09T16:13:30.005432Z"} {"t":"2008-07-09T16:13:30.005432Z"}
{"t":"1986-12-01T01:01:01.900000Z"} {"t":"1986-12-01T01:01:01.900000Z"}
{"t":"1969-12-31T23:59:59.600000Z"}
{"t":"1969-12-31T23:59:59.500000Z"}
{"t":"1969-12-31T23:59:59.400000Z"}
{"t":"1969-12-31T23:59:59.000000Z"}
{"t":"1969-12-31T23:59:58.600000Z"}
{"t":"1969-12-31T23:59:58.500000Z"}
{"t":"1969-12-31T23:59:58.400000Z"}
{"t":"1969-12-31T23:58:21.000000Z"}

25
testing/btest/scripts/base/frameworks/logging/ascii-json-iso-timestamps.bro
View file

@ -27,5 +27,30 @@ event bro_init()
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "1986-12-01T01:01:01Z") + 0.90 secs) $t=(strptime("%Y-%m-%dT%H:%M:%SZ", "1986-12-01T01:01:01Z") + 0.90 secs)
]); ]);
Log::write(SSH::LOG, [
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "1970-01-01T00:00:00Z") - 0.4 secs)
]);
Log::write(SSH::LOG, [
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "1970-01-01T00:00:00Z") - 0.5 secs)
]);
Log::write(SSH::LOG, [
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "1970-01-01T00:00:00Z") - 0.6 secs)
]);
Log::write(SSH::LOG, [
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "1970-01-01T00:00:00Z") - 1.0 secs)
]);
Log::write(SSH::LOG, [
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "1970-01-01T00:00:00Z") - 1.4 secs)
]);
Log::write(SSH::LOG, [
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "1970-01-01T00:00:00Z") - 1.5 secs)
]);
Log::write(SSH::LOG, [
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "1970-01-01T00:00:00Z") - 1.6 secs)
]);
Log::write(SSH::LOG, [
$t=(strptime("%Y-%m-%dT%H:%M:%SZ", "1970-01-01T00:00:00Z") - 99 secs)
]);
} }