Merge branch 'master' into topic/jsiwek/file-analysis

testing/btest/Baseline/bifs.reverse/out

@@ -0,0 +1,7 @@
+!dlrow olleh
+hello world!
+risetovotesir
+ff00
+00ff
+3039
+A

testing/btest/Baseline/core.q-in-q/conn.log

@@ -0,0 +1,11 @@
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	conn
+#open	2013-03-22-16-36-54
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	service	duration	orig_bytes	resp_bytes	conn_state	local_orig	missed_bytes	history	orig_pkts	orig_ip_bytes	resp_pkts	resp_ip_bytes	tunnel_parents
+#types	time	string	addr	port	addr	port	enum	string	interval	count	count	string	bool	count	string	count	count	count	count	table[string]
+1363900699.548138	UWkUyAuUGXf	172.19.51.37	47808	172.19.51.63	47808	udp	-	0.000100	36	0	S0	-	0	D	2	92	0	0	(empty)
+1363900699.549647	arKYeMETxOg	193.1.186.60	9875	224.2.127.254	9875	udp	-	0.000139	552	0	S0	-	0	D	2	608	0	0	(empty)
+#close	2013-03-22-16-36-54

testing/btest/Baseline/language.table-init-record-idx-2/output

@@ -0,0 +1,25 @@
+following should all be true...
+T
+T
+T
+T
+T
+T
+T
+T
+1
+1
+1
+following should all be false...
+F
+F
+F
+now here's the foo table...
+{
+[[a=foo, b=2], 2] = 2,
+[[a=baz, b=6], 6] = 6,
+[[a=bar, b=4], 4] = 4,
+[[a=baz, b=5], 5] = 5,
+[[a=bar, b=3], 3] = 3,
+[[a=foo, b=1], 1] = 1
+}

testing/btest/Baseline/language.table-init-record-idx-3/output

@@ -0,0 +1,25 @@
+following should all be true...
+T
+T
+T
+T
+T
+T
+T
+T
+1
+1
+1
+following should all be false...
+F
+F
+F
+now here's the foo table...
+{
+[[a=baz, b=5]] = 5,
+[[a=foo, b=2]] = 2,
+[[a=baz, b=6]] = 6,
+[[a=foo, b=1]] = 1,
+[[a=bar, b=4]] = 4,
+[[a=bar, b=3]] = 3
+}

testing/btest/Baseline/language.table-init-record-idx-4/language.table-init-record-idx-2/output

@@ -0,0 +1,25 @@
+following should all be true...
+T
+T
+T
+T
+T
+T
+T
+T
+1
+1
+1
+following should all be false...
+F
+F
+F
+now here's the foo table...
+{
+[[a=foo, b=2], 2] = 2,
+[[a=baz, b=6], 6] = 6,
+[[a=bar, b=4], 4] = 4,
+[[a=baz, b=5], 5] = 5,
+[[a=bar, b=3], 3] = 3,
+[[a=foo, b=1], 1] = 1
+}

testing/btest/Baseline/language.table-init-record-idx-4/output

@@ -0,0 +1,25 @@
+following should all be true...
+T
+T
+T
+T
+T
+T
+T
+T
+1
+1
+1
+following should all be false...
+F
+F
+F
+now here's the foo table...
+{
+[[a=foo, b=2], 2] = 2,
+[[a=baz, b=6], 6] = 6,
+[[a=bar, b=4], 4] = 4,
+[[a=baz, b=5], 5] = 5,
+[[a=bar, b=3], 3] = 3,
+[[a=foo, b=1], 1] = 1
+}

testing/btest/Baseline/language.table-init-record-idx/output

@@ -0,0 +1,25 @@
+following should all be true...
+T
+T
+T
+T
+T
+T
+T
+T
+1
+1
+1
+following should all be false...
+F
+F
+F
+now here's the foo table...
+{
+[[a=baz, b=5]] = 5,
+[[a=foo, b=2]] = 2,
+[[a=baz, b=6]] = 6,
+[[a=foo, b=1]] = 1,
+[[a=bar, b=4]] = 4,
+[[a=bar, b=3]] = 3
+}

testing/btest/bifs/reverse.bro

@@ -0,0 +1,19 @@
+#
+# @TEST-EXEC: bro -b %INPUT >out
+# @TEST-EXEC: btest-diff out
+
+event bro_init()
+	{
+	local s1 = "hello world!";
+	local s2 = "rise to vote sir";
+	local s3 = "\xff\x00";
+	local s4 = "\xff\x39\x30\xff";
+
+	print reverse(s1);
+	print reverse(reverse(s1));
+	print subst_string(reverse(s2), " ", "");
+	print bytestring_to_hexstr(s3);
+	print bytestring_to_hexstr(reverse(s3));
+	print bytestring_to_hexstr(reverse(sub_bytes(s4, 2, 2)));
+	print reverse("A");
+	}

testing/btest/core/q-in-q.bro

@@ -0,0 +1,2 @@
+# @TEST-EXEC: bro -r $TRACES/q-in-q.trace
+# @TEST-EXEC: btest-diff conn.log

testing/btest/language/table-init-container-ctors.bro

@@ -2,7 +2,7 @@
 # @TEST-EXEC: btest-diff output
 
 # The various container constructor expressions should work in table
-# initialization lists.
+# initialization lists (as yields).
 
 type set_yield: set[string, count];
 type vector_yield: vector of count;

testing/btest/language/table-init-record-idx.bro

@@ -0,0 +1,216 @@
+# @TEST-EXEC: bro -b %INPUT >output
+# @TEST-EXEC: btest-diff output
+
+# Record constructors should work in table initializers
+
+type r: record  {
+	a: string;
+	b: count;
+};  
+
+global a: r = [$a="foo", $b=1];
+global b: r = [$a="foo", $b=2];
+global c: r = [$a="bar", $b=3];
+global d: r = [$a="bar", $b=4];
+global e: r = [$a="baz", $b=5];
+global f: r = [$a="baz", $b=6];
+
+global foo: table[r] of count = {
+	[a] = 1,
+	[record($a="foo", $b=2)] = 2,
+	[[$a="bar", $b=3]] = 3,
+};
+
+foo[d] = 4;
+foo[[$a="baz", $b=5]] = 5;
+foo[record($a="baz", $b=6)] = 6;
+
+print "following should all be true...";
+
+print a in foo;
+print b in foo;
+print c in foo;
+print d in foo;
+print e in foo;
+print f in foo;
+
+print [$a="foo", $b=1] in foo;
+print record($a="foo", $b=1) in foo;
+
+print foo[a];
+print foo[[$a="foo", $b=1]];
+print foo[record($a="foo", $b=1)];
+
+print "following should all be false...";
+
+local bah: r = [$a="bah", $b=0];
+
+print bah in foo;
+print [$a="bah", $b=0] in foo;
+print record($a="bah", $b=0) in foo;
+
+print "now here's the foo table...";
+
+print foo;
+
+# @TEST-START-NEXT
+
+# They can be part of a compound index type, too...
+
+type r: record  {
+	a: string;
+	b: count;
+};
+
+global a: r = [$a="foo", $b=1];
+global b: r = [$a="foo", $b=2];
+global c: r = [$a="bar", $b=3];
+global d: r = [$a="bar", $b=4];
+global e: r = [$a="baz", $b=5];
+global f: r = [$a="baz", $b=6];
+
+global foo: table[r, count] of count = {
+	[a, 1] = 1,
+	[record($a="foo", $b=2), 2] = 2,
+	[[$a="bar", $b=3], 3] = 3,
+};
+
+foo[d, 4] = 4;
+foo[[$a="baz", $b=5], 5] = 5;
+foo[record($a="baz", $b=6), 6] = 6;
+
+print "following should all be true...";
+
+print [a, 1] in foo;
+print [b, 2] in foo;
+print [c, 3] in foo;
+print [d, 4] in foo;
+print [e, 5] in foo;
+print [f, 6] in foo;
+
+print [[$a="foo", $b=1], 1] in foo;
+print [record($a="foo", $b=1), 1] in foo;
+
+print foo[a, 1];
+print foo[[$a="foo", $b=1], 1];
+print foo[record($a="foo", $b=1), 1];
+
+print "following should all be false...";
+
+local bah: r = [$a="bah", $b=0];
+
+print [bah, 0] in foo;
+print [[$a="bah", $b=0], 0] in foo;
+print [record($a="bah", $b=0), 0] in foo;
+
+print "now here's the foo table...";
+
+print foo;
+
+# @TEST-START-NEXT
+
+# Now checking table() ctor versus { } initializer
+
+type r: record  {
+	a: string;
+	b: count;
+};  
+
+global a: r = [$a="foo", $b=1];
+global b: r = [$a="foo", $b=2];
+global c: r = [$a="bar", $b=3];
+global d: r = [$a="bar", $b=4];
+global e: r = [$a="baz", $b=5];
+global f: r = [$a="baz", $b=6];
+
+global foo: table[r] of count = table(
+	[a] = 1,
+	[record($a="foo", $b=2)] = 2,
+	[[$a="bar", $b=3]] = 3
+);
+
+foo[d] = 4;
+foo[[$a="baz", $b=5]] = 5;
+foo[record($a="baz", $b=6)] = 6;
+
+print "following should all be true...";
+
+print a in foo;
+print b in foo;
+print c in foo;
+print d in foo;
+print e in foo;
+print f in foo;
+
+print [$a="foo", $b=1] in foo;
+print record($a="foo", $b=1) in foo;
+
+print foo[a];
+print foo[[$a="foo", $b=1]];
+print foo[record($a="foo", $b=1)];
+
+print "following should all be false...";
+
+local bah: r = [$a="bah", $b=0];
+
+print bah in foo;
+print [$a="bah", $b=0] in foo;
+print record($a="bah", $b=0) in foo;
+
+print "now here's the foo table...";
+
+print foo;
+
+# @TEST-START-NEXT
+
+# Now checking table() ctor versus { } initializer for compound index
+
+type r: record  {
+	a: string;
+	b: count;
+};
+
+global a: r = [$a="foo", $b=1];
+global b: r = [$a="foo", $b=2];
+global c: r = [$a="bar", $b=3];
+global d: r = [$a="bar", $b=4];
+global e: r = [$a="baz", $b=5];
+global f: r = [$a="baz", $b=6];
+
+global foo: table[r, count] of count = table(
+	[a, 1] = 1,
+	[record($a="foo", $b=2), 2] = 2,
+	[[$a="bar", $b=3], 3] = 3
+);
+
+foo[d, 4] = 4;
+foo[[$a="baz", $b=5], 5] = 5;
+foo[record($a="baz", $b=6), 6] = 6;
+
+print "following should all be true...";
+
+print [a, 1] in foo;
+print [b, 2] in foo;
+print [c, 3] in foo;
+print [d, 4] in foo;
+print [e, 5] in foo;
+print [f, 6] in foo;
+
+print [[$a="foo", $b=1], 1] in foo;
+print [record($a="foo", $b=1), 1] in foo;
+
+print foo[a, 1];
+print foo[[$a="foo", $b=1], 1];
+print foo[record($a="foo", $b=1), 1];
+
+print "following should all be false...";
+
+local bah: r = [$a="bah", $b=0];
+
+print [bah, 0] in foo;
+print [[$a="bah", $b=0], 0] in foo;
+print [record($a="bah", $b=0), 0] in foo;
+
+print "now here's the foo table...";
+
+print foo;